SedirOS Files

Which file do I need?

Everything else is used by the CLI, the apt repository or for verification. Easier: sediros.github.io/sediros lists only the ISOs, with their checksums.

Hardening (sediros-hardening 0.5.5)

• Multipath TCP is turned off (net.mptcp.enabled = 0), the second workaround advised for CVE-2026-98432 next to tcp_migrate_req = 0; MPTCP clients fall back to plain TCP. SedirOS already dropped IPv4 TCP packets with IP options, the part of that bug reachable from the network, and Debian's fixed kernel (6.12.113 and later) is in the 1.0 images. Installed systems get the setting through apt without a reboot, and sediros-audit checks it.

Daily audit (sediros-audit 0.3.0)

• sediros-audit.timer runs the audit every day (sediros-audit --record): the result is shown at login and kept in /var/lib/sediros/audit/ (last.json, last-summary).
• When a check got worse than the previous run, it is reported by e-mail (MAILTO) or webhook (WEBHOOK, plain text or Slack format), set in /etc/sediros/audit.conf; nothing is sent until one is set. Editing that file is not reported as drift.
• Prometheus metrics for node_exporter's textfile collector: sediros_audit_check, sediros_audit_findings, sediros_audit_last_run_timestamp_seconds.
• The audit checks that its own timer is enabled: turning it off would silence the reports.
• The results in /var/lib/sediros/audit are readable by root and the sudo group only; the Prometheus file stays readable for node_exporter.

Tools (sediros CLI 0.7.0)

• sediros fleet <hosts-file> shows the hardening state of many servers in one table, over SSH: the last daily audit by default (no sudo needed), the audit run now with --live. Unreachable servers, failures and results older than two days count as needing attention (exit status 1). -F uses another ssh config.
• sediros unlock <host> unlocks an encrypted SedirOS server over SSH at boot: it waits until the boot-time SSH server answers, sends the passphrase on ssh's stdin, and can keep it in the macOS Keychain or the Linux Secret Service (--save, --forget). Tested against an installed disk booting in QEMU.
• sediros pull keeps working when GitHub does not: image files come from the SourceForge mirror, the checksums from the download page on GitHub Pages (never from the mirror, so a tampered mirror cannot pass the check), and the newest release's name from the download page when GitHub's API does not answer. It says which source it used.

Login greeting (sediros-base-files 1.1)

• At every login (console and SSH) SedirOS greets with its logo (the cedar in a shield, as text), the release, the hostname and build, and the hardening state; until the daily audit (#2) records a result it points to sudo sediros-audit. Off with chmod -x /etc/update-motd.d/20-sediros.

Cloud images (sediros-firstboot 0.1.0)

• sediros-firstboot sets up a cloud or VPS instance on its first boot, from a NoCloud seed (label cidata) or the EC2-style metadata service at 169.254.169.254 (Vultr, Hetzner, AWS, OpenStack): new SSH host keys, hostname, the admin user's SSH keys, root file system grown to the disk. A new instance id (a cloned disk) runs it again; a known one changes nothing.
• User-data scripts are never run. From #cloud-config only hostname and ssh_authorized_keys are used; anything else is reported at login (/etc/motd.d/50-sediros-firstboot).
• Built and published as a package; no image contains it yet (cloud images follow). No Rust dependencies, like sediros-audit.

Verifying downloads

:::bash
sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify <file> --repo sediros/sediros