SécurixOS: Secure OS Workstation Base

[!NOTE] This project is in alpha, no support is offered at this time.

Objectives

SécurixOS is a NixOS distribution developed by DINUM to equip secure computers for system administration, office work and development in order to handle Unprotected information initially and eventually Restricted Distribution information.

It constitutes a secure PC model designed to allow access to production and other critical uses while guaranteeing a variable level of security depending on the configuration used.

Thanks to NixOS, this secure PC model is re-instantiable for various use cases: multi-agent workstation, multi-level workstation, intranet-only workstation, etc., with different teams and different VPN strains.

Built according to ANSSI recommendations: https://cyber.gouv.fr/publications/recommandations-relatives-ladministration-securisee-des-si.

Target Technical Architecture

Operating System

Sécurix is based on NixOS with a custom Linux kernel hardened in accordance with ANSSI rules, some of which can be disabled depending on the need.

Integrated Security Modules

• Systematic configuration according to ANSSI recommendations for GNU/Linux systems: https://cyber.gouv.fr/publications/recommandations-de-securite-relatives-un-systeme-gnulinux.
• Advanced TPM2 and Yubikey support for authentication key management.
• Data encryption using age or a Vault server.
• Centralized enrollment for Secure Boot with PK/KEK management.
• Connection to the workstation via FIDO2 and the password is only a fallback mode.
• Decryption of the workstation using a FIDO2 key (a backup key is generated during installation).

Features Under Development (by priority)

• Security reinforcement

  • Application of ANSSI recommendations for additional hardening: https://cyber.gouv.fr/publications/recommandations-de-securite-relatives-un-systeme-gnulinux.
  • Adding a trace sink configuration for sending activities of a Sécurix system.

• Quick onboarding and centralized management

  • Setting up a "phone home" server to automatically add:
    • The system's TPM2 SSH key to the infrastructure repository.
    • Authorization to decrypt secrets via age (or future integration with Vault).
    • This piece of infrastructure can be inserted into a business process aimed at deploying a new Sécurix for an agent.

• Advanced security key support

  • Secure Boot key management and rotation with TPM2 to strengthen Secure Boot.

Contributing

Contributions are open to the project; it is recommended to have NixOS expertise to facilitate integration. Check the open tickets and the contribution guide to participate. You can open tickets to propose features and discuss the architecture. AI-generated PRs without review or testing will be closed; contributions by the same author may be blocked later.

This README is in French but the rest of the code, issues and PRs are in English.

Running Tests

Tests are based on the NixOS test framework. They allow launching Sécurix in a VM and then running tests on the behavior of this VM.

nix-build -A tests

Licenses

Sécurix is distributed under the MIT license. See the LICENSES folder for more details.