Skip Navigation

Secure Desktop Project

For this project option, you will create a fully encrypted, secure desktop environment. This environment must run directly on a physical computer (or a Raspberry Pi) by the end of the project. While a virtual machine can be used for testing and development purposes, the ultimate objective of this environment is to be usable as a replacement operating system for real hardware.

Page Contents

Background

Alpine Linux is a security-oriented Linux distribution that is primarily designed for use with containers and servers. However, I have found it to be usable as a desktop operating system, where its security hardening features have some advantages over other desktop systems. In fact, I am running the exact setup for this project (Alpine Linux on a fully encrypted system) as my laptop operating system.

One nice property of Alpine Linux is that it will install and run quite happily from a removable USB drive, which can be helpful if you only have access to one physical system and are not yet ready to change your desktop OS. Alpine Linux is also available for the Raspberry Pi single-board computer, which would be an option for this project if you already own one. At this time, supply chain disruptions are resulting in significant price scalping for Raspberry Pi boards, resulting in prices well in excess of $150 for a board that has a base price starting at $35. Therefore, I do not recommend purchasing one of these devices for this project – just use your laptop and an external USB drive instead.

The objective of this project is to have a fully-working desktop environment that you can use for day-to-day activities. In fact, you might find that you can replace your existing operating system with Alpine Linux and still be able to do everything you’re used to doing with your computer.

Additional Reading

While the final installation must run directly on the metal, you might find it useful to do some testing in a virtual machine. Any virtualization software will work for this purpose, but my suggestion is to use QEMU:

Project Requirements

A successful implementation of this project:

  1. Boots directly on a laptop, desktop, or Raspberry Pi device. On a laptop or desktop computer, the system boots using UEFI and not legacy BIOS (also known as the Compatibility Support Module, or CSM).
  2. Is fully encrypted, with the exception of the EFI System Partition (on a laptop or desktop) or boot partition (on a Raspberry Pi).
  3. Uses two partitions: the EFI or Raspberry Pi-specific partition required to hold the bootloader, and a second partition fully encrypted with LUKS version 1.
  4. Uses LVM within the encrypted container to support segmentation of the root, home, and (except on Raspberry Pi) boot file systems.
  5. Has a working graphical user interface (GUI). This can be a desktop environment (e.g. KDE Plasma, Xfce, MATE, Gnome, etc.) or a lightweight window manager.
  6. Has a working LibreOffice suite (Flatpak version recommended on x86_64).
  7. Can play at least basic video games. Open source games are fine for satisfying this requirement, although installing Steam and running at least one game from your Steam Library is also acceptable. Your hardware will determine what games will run (e.g. a Raspberry Pi can’t run Steam, and a laptop that can run Steam might not have the graphics card required to play certain titles).

Milestones

Milestone 1

For Milestone 1, prepare a video presentation that covers the following items:

  1. Using either a virtual or physical machine, show that you have performed a basic installation of Alpine Linux with the GRUB bootloader. The installation does not have to be encrypted yet.
  2. Identify which tool you used to partition the disk used for the installation.
  3. Explain your thought process and progress toward selecting a desktop environment or window manager.

Each person in the group should present for approximately equal time. Be sure to include the URLs to each person’s portfolio in your presentation.

Add the following items to your portfolio:

  1. Your current resume.
  2. A photograph of the system, Raspberry Pi, or external USB drive onto which you plan to install Alpine Linux. Caption this photograph to indicate that you used this device to run Alpine Linux.

Milestone 2

For Milestone 2, prepare a video presentation that covers the following items:

  1. Using a physical machine (not a VM), demonstrate that you have successfully installed Alpine Linux on a fully encrypted system using LVM to separate /boot, /, and /home (or, on Raspberry Pi only, / and /home). You may need to record video or take screenshots with your cell phone, since your machine probably isn’t yet to a point where it can do screen recording. You can demonstrate the presence of LVM and your partition layout easily by installing the correct software to be able to run the lsblk command.
  2. Demonstrate that you have correctly set up iptables and ip6tables by running the following commands as root and showing the output:
iptables -S
ip6tables -S

Each person in the group should present for approximately equal time. Be sure to include the URLs to each person’s portfolio in your presentation.

Add the following items to your portfolio:

  1. Brief documentation of the syntax for the pvcreate, vgcreate, lvcreate, vgchange, and vgs commands. Do not simply copy and paste the official documentation or anyone else’s content. Instead, concisely show in your own words how to create a physical volume, create a volume group from that physical volume, add logical volumes to the volume group, start and stop a volume group, and see how much unallocated space (not belonging to a logical volume) you have left in a volume group.
  2. A brief description of your iptables and ip6tables setup. You can reproduce the rules if you would like.

Milestone 3

For Milestone 3, prepare a video presentation that covers the following items:

  1. Using physical hardware (not a virtual machine), demonstrate that you have added a graphical desktop environment (or window manager) to your installation.
  2. Demonstrate that you have added LibreOffice and Firefox to your installation. I recommend the Flatpak version if your system is x86_64 (not available on Raspberry Pi).

Each person in the group should present for approximately equal time. Be sure to include the URLs to each person’s portfolio in your presentation.

Add the following items to your portfolio:

  1. A screenshot showing the desktop environment you installed. The names of all team members should be visible in the screenshot. (You could echo your names in a terminal window on the screen, or type them into a LibreOffice window. Just be sure the terminal or LibreOffice doesn’t hide which desktop environment or window manager you’re using. If you want to be more creative, make a custom desktop background with your names in it.)

Milestone 4

For Milestone 4, prepare a video presentation that covers the following items:

  1. Using OBS Studio, record your presentation from the Alpine Linux installation you created. This might not be possible if you used a Raspberry Pi or a limited system with an old or weak CPU, in which case you can use your phone instead.
  2. Demonstrate that you can play a video game using your installed system.

Each person in the group should present for approximately equal time. Be sure to include the URLs to each person’s portfolio in your presentation.

Add the following items to your portfolio:

  1. A brief description of the project and how you went about implementing it. Include some potential uses for your secure desktop environment in the description.
  2. A statement about teamwork. Think about answers to questions that you might get asked in an interview. For example, how well did you work as part of a team? How did you divide your responsibilities between team members? How did you communicate with your teammates? How did you resolve any conflicts?

Tips

GRUB

Note that this section does not apply if you’re installing on a Raspberry Pi.

You must use the GRUB bootloader. None of the other bootloaders are capable of booting a fully encrypted system. While it is technically possible to use an unencrypted /boot partition with another bootloader, this isn’t secure for several reasons. First, it gives away the presence of a working Linux distribution, where a fully encrypted system maintains some plausible deniability that anything is actually installed on the drive. Second, a malicious actor could replace the kernel on an unencrypted /boot partition with one that captures and transmits the encryption key (or otherwise lets them bypass encryption), permitting access to your data.

As of Alpine Linux v3.16, the setup-alpine script hasn’t been reliable for installing the bootloader correctly. This is especially true on fully encrypted systems. See the GRUB Installation Notes section of the Alpine Linux Notes document for some general steps. You need to do a couple other things inside the chroot environment before running the grub-install step.

Following the “LVM on LUKS” Alpine Wiki entry, be sure to do the extra steps in the “Installing Alpine Linux” section. In particular, you will need both the cryptsetup and cryptkey features in mkinitfs.conf.

After configuring the initfs, follow the “GRUB with EFI” section under “Installing a bootloader” in the same wiki document. To get the UUID for the filesystem, use the blkid command and pass it the device node of the encrypted partition. Be sure to use the partition’s device node, NOT anything in /dev/mapper. For example, if your USB drive is /dev/sda, then the partition is probably /dev/sda2.

Before leaving the chroot environment, re-generate the initramfs one more time. We need to embed the crypto_keyfile.bin into it, so as to avoid a second password prompt when booting the system:

mkinitfs $(ls /lib/modules/)

Desktop Environment

After rebooting into your new installation, you will need to pick a desktop environment. Several choices are available. I use KDE Plasma, but Xfce, Gnome, and MATE are also available in the standard repositories in Alpine. I recommend using the following Wiki pages to get your environment configured:

Flatpak vs. apk

Several packages are available both from Flatpak and via the apk command. You will need to do some trial and error to determine which version works better for your use case. In my daily use of Alpine Linux as a desktop system, I’ve observed the following:

Firewall

Even though a default installation of Alpine Linux as a desktop doesn’t expose any running services, a firewall must still be deployed on the system for security purposes. See my “iptables Notes” link from the Background section above.

Laptop Touchpad Issues

If you’re using a laptop, and you find that touchpad scrolling or tapping stops working randomly, create (as root) a file at /etc/modprobe.d/psmouse.conf with the following contents:

blacklist psmouse

Then reboot and check touchpad operation.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.