SécurixOS: Base OS for a secure workstation

[!NOTE] This project is in alpha, no support is provided at this time.

Objectives

SécurixOS is a NixOS distribution developed by DINUM to equip secure computers for system administration, office work, and development in order to handle Unprotected information initially and possibly Restricted Distribution information later on.

It constitutes a secure PC template designed to enable access to production and other critical uses while guaranteeing a variable level of security depending on the configuration used.

Thanks to NixOS, this secure PC template can be re-instantiated for varying use cases: multi-agent workstation, multi-level workstation, intranet-only workstation, etc. with different teams, different VPN roots.

Built according to ANSSI recommendations: https://cyber.gouv.fr/publications/recommandations-relatives-ladministration-securisee-des-si.

Technical architecture target

Operating system

Sécurix is based on NixOS with a customized Linux kernel in accordance with ANSSI hardening rules, some of which can be disabled as needed.

Built-in security modules

• Systematic configuration according to ANSSI recommendations for GNU/Linux systems: https://cyber.gouv.fr/publications/recommandations-de-securite-relatives-un-systeme-gnulinux.
• Advanced TPM2 and Yubikey support for authentication key management.
• Data encryption using age or a Vault server.
• Centralized enrollment for Secure Boot with PK/KEK management.
• Workstation login via FIDO2, with the password serving only as a fallback mode.
• Workstation decryption using a FIDO2 key (a backup key is generated at installation).

Features under development (by priority)

• Security hardening

  • Application of ANSSI recommendations for additional hardening: https://cyber.gouv.fr/publications/recommandations-de-securite-relatives-un-systeme-gnulinux.
  • Addition of a log sink configuration for sending activity from a Sécurix system.

• Fast onboarding and centralized management

  • Implementation of a "phone home" server allowing automatic addition of:
    • The system's TPM2 SSH key to the infrastructure repository.
    • Authorization to decrypt secrets via age (or future integration with Vault).
    • This piece of infrastructure could fit into a business process aimed at setting up a new Sécurix for an agent.

• Advanced security key support

  • Management and rotation of Secure Boot keys with TPM2 to strengthen Secure Boot.

Contributing

Contributions are open to the project; expertise in NixOS is recommended to facilitate integration. Consult the open issues and the contribution guide to participate. You can open issues to propose features and discuss the architecture. AI-generated PRs without review or testing will be closed, and contributions by the same author may subsequently be blocked.

This README is in French, but the rest of the code, issues, and PRs are in English.

Running tests

The tests are based on the NixOS test framework. They allow Sécurix to be launched in a VM and then tests to be run on the behavior of that VM.

nix-build -A tests

Licenses

Sécurix is distributed under the MIT license. See the LICENSES folder for more details.