Skip Navigation

Secure Desktop Project

For this project option, you will create a fully encrypted, secure desktop environment. This environment must run directly on a physical computer (or a Raspberry Pi) by the end of the project. While a virtual machine can be used for testing and development purposes, the ultimate objective of this environment is to be usable as a replacement operating system for real hardware.

Page Contents

Background

Alpine Linux is a security-oriented Linux distribution that is primarily designed for use with containers and servers. However, I have found it to be usable as a desktop operating system, where its security hardening features have some advantages over other desktop systems. In fact, I am running the exact setup for this project (Alpine Linux on a fully encrypted system) as my laptop operating system.

One nice property of Alpine Linux is that it will install and run quite happily from a removable USB drive, which can be helpful if you only have access to one physical system and are not yet ready to change your desktop OS. Alpine Linux is also available for the Raspberry Pi single-board computer, which would be an option for this project if you already own one. At this time, supply chain disruptions are resulting in significant price scalping for Raspberry Pi boards, resulting in prices well in excess of $150 for a board that has a base price starting at $35. Therefore, I do not recommend purchasing one of these devices for this project – just use your laptop and an external USB drive instead.

The objective of this project is to have a fully-working desktop environment that you can use for day-to-day activities. In fact, you might find that you can replace your existing operating system with Alpine Linux and still be able to do everything you’re used to doing with your computer.

Additional Reading

While the final installation must run directly on the metal, you might find it useful to do some testing in a virtual machine.

Project Requirements

A successful implementation of this project:

  1. Boots directly on a laptop, desktop, or Raspberry Pi device. On a laptop or desktop computer, the system boots using UEFI and not legacy BIOS (also known as the Compatibility Support Module, or CSM). (An exception to the UEFI requirement can be made if you’re using a really old laptop or desktop computer for this project.)
  2. Is fully encrypted, with the exception of the EFI System Partition (on a laptop or desktop) or boot partition (on a Raspberry Pi).
  3. Uses two partitions: the EFI or Raspberry Pi-specific partition required to hold the bootloader, and a second partition fully encrypted with LUKS version 1.
  4. Uses LVM within the encrypted container to support segmentation of the root, home, and (except on Raspberry Pi) boot file systems.
  5. Has a working firewall that blocks access to all incoming ports, except for related and established traffic and for the ICMP packets required for IPv6.
  6. Has a working graphical user interface (GUI). This can be a desktop environment (e.g. KDE Plasma, Xfce, MATE, Gnome, etc.) or a lightweight window manager.
  7. Has a working LibreOffice suite (Flatpak version recommended on x86_64).
  8. Has a working Firefox browser.
  9. Can play at least basic video games. Open source games are fine for satisfying this requirement, although installing Steam and running at least one game from your Steam Library is also acceptable. Your hardware will determine what games will run (e.g. a Raspberry Pi can’t run Steam, and a laptop that can run Steam might not have the graphics card required to play certain titles).

To calculate the Project Outcome grade at the end of the semester, the Secure Desktop Project Rubric will be used.

Milestones

Milestone 1

For Milestone 1, prepare a video presentation that covers the following items:

  1. Using either a virtual or physical machine, show that you have performed a basic installation of Alpine Linux with the GRUB bootloader. The installation does not have to be encrypted yet.
  2. Identify which tool you used to partition the disk used for the installation.
  3. Explain your thought process and progress toward selecting a desktop environment or window manager.
  4. Identify and show the hardware device that you will use for the bare metal (non-VM) installation. This device can be a laptop or desktop computer, a USB stick or external SSD, or a Raspberry Pi.

Each person in the group should present for approximately equal time.

Before submitting, review the Grading Rubric for Milestone 1.

Milestone 2

For Milestone 2, prepare a video presentation that covers the following items:

  1. Using a physical machine (not a VM), demonstrate that you have successfully installed Alpine Linux on a fully encrypted system using LVM to separate /boot, /, and /home (or, on Raspberry Pi only, / and /home). You may need to record video or take screenshots with your cell phone, since your machine probably isn’t yet to a point where it can do screen recording. You can demonstrate the presence of LVM and your partition layout easily by installing the correct software to be able to run the lsblk command.
  2. Demonstrate that you have correctly set up iptables and ip6tables by running the following commands as root and showing the output:
iptables -S
ip6tables -S

Each person in the group should present for approximately equal time.

Before submitting, review the Grading Rubric for Milestone 2.

Milestone 3

For Milestone 3, prepare a video presentation that covers the following items:

  1. Using physical hardware (not a virtual machine), demonstrate that you have added a graphical desktop environment (or window manager) to your installation.
  2. Demonstrate that you have added LibreOffice and Firefox to your installation. I recommend the Flatpak version if your system is x86_64 (not available on Raspberry Pi).

Each person in the group should present for approximately equal time.

Before submitting, review the Grading Rubric for Milestone 3.

Milestone 4

For Milestone 4, prepare a video presentation that covers the following items:

  1. Using OBS Studio, record your presentation from the Alpine Linux installation you created. This might not be possible if you used a Raspberry Pi or a limited system with an old or weak CPU, in which case you can use your phone instead.
  2. Demonstrate that you can play a video game using your installed system.
  3. Reflect on the project. What did you learn about the technologies you used? What did you learn about teamwork?

Each person in the group should present for approximately equal time.

Before submitting, review the Grading Rubric for Milestone 4.

Tips

GRUB

Note that this section does not apply if you’re installing on a Raspberry Pi.

You must use the GRUB bootloader. None of the other bootloaders are capable of booting a fully encrypted system. While it is technically possible to use an unencrypted /boot partition with another bootloader, this isn’t secure for several reasons. First, it gives away the presence of a working Linux distribution, where a fully encrypted system maintains some plausible deniability that anything is actually installed on the drive. Second, a malicious actor could replace the kernel on an unencrypted /boot partition with one that captures and transmits the encryption key (or otherwise lets them bypass encryption), permitting access to your data.

As of Alpine Linux v3.16, the setup-alpine script hasn’t been reliable for installing the bootloader correctly. This is especially true on fully encrypted systems. See the GRUB Installation Notes section of the Alpine Linux Notes document for some general steps. You need to do a couple other things inside the chroot environment before running the grub-install step.

Following the “LVM on LUKS” Alpine Wiki entry, be sure to do the extra steps in the “Installing Alpine Linux” section. In particular, you will need both the cryptsetup and cryptkey features in mkinitfs.conf.

After configuring the initfs, follow the “GRUB with EFI” section under “Installing a bootloader” in the same wiki document. To get the UUID for the filesystem, use the blkid command and pass it the device node of the encrypted partition. Be sure to use the partition’s device node, NOT anything in /dev/mapper. For example, if your USB drive is /dev/sda, then the partition is probably /dev/sda2.

Before leaving the chroot environment, re-generate the initramfs one more time. We need to embed the crypto_keyfile.bin into it, so as to avoid a second password prompt when booting the system:

mkinitfs $(ls /lib/modules/)

Desktop Environment

After rebooting into your new installation, you will need to pick a desktop environment. Several choices are available. I use KDE Plasma, but Xfce, Gnome, and MATE are also available in the standard repositories in Alpine. I recommend using the following Wiki pages to get your environment configured:

Flatpak vs. apk

Several packages are available both from Flatpak and via the apk command. You will need to do some trial and error to determine which version works better for your use case. In my daily use of Alpine Linux as a desktop system, I’ve observed the following:

Firewall

Even though a default installation of Alpine Linux as a desktop doesn’t expose any running services, a firewall must still be deployed on the system for security purposes. See my iptables page for information about the firewall configuration.

Laptop Touchpad Issues

If you’re using a laptop, and you find that touchpad scrolling or tapping stops working randomly, create (as root) a file at /etc/modprobe.d/psmouse.conf with the following contents:

blacklist psmouse

Then reboot and check touchpad operation.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.