Using Porteus for Secure Administrative Management (Expatriation)

[Girow]

Hello. I’m setting up my business abroad (in Dubai) and I’m looking to secure my access. I plan to use a clean version of Porteus on a USB drive exclusively for my sensitive administrative tasks: accounting, local VAT filings, and access to my future company’s bank accounts. Do any of you use Porteus (perhaps the Kiosk edition?) for this kind of professional need? I’m not sure if it’s stable enough to handle browsers with a lot of security certificates, or if I should create a specific module for my management tools.

[spa_time]

A better protection is including opensnitch firewall module .. to control apps access to internet..you can
extract module from this iso.. http://www.mediafire.com/file/2s55w9q4c ... 1.iso/file

[fu11m00n]

@ Girow... salutations.

If you don't need to login remotely... try this.

Boot Porteus... go to /etc/ssh then edit ssh_config.
Only change these two things... 1) "port" number 2) login "permission".

Change the port number (to something other than 22... preferably 4 digits)
try the last 4 digits of your Social Security or bank card. Or use a birthday.
Something you can remember.

Change PermitRootLogin to: PermitRootLogin prohibit-password

Create a folder called cfg4etc containig the following directory... /etc/ssh.
Place ssh_config into /etc/ssh.

Make the folder into a module .

Then remaster the .iso using Isomaster.
Using Isomaster place the module into /porteus/modules.

I have found doing this stops 90% of online exploits.
I have had internet uptimes of > a week (or more) without system instability.

I must note... there are numerous tactics to secure a system. This is but one.

[Girow]

fu11m00n, your SSH setup makes a lot of sense. Changing the default port and disabling root password logins is pretty much where I'd start too.
One thing I'm curious about though: when you mention running for a week without any stability issues, what kind of host machine are you using?
That's the part I'm still unsure about. I'm planning to run Porteus on an older ThinkPad from around 2015–2016, nothing particularly powerful. My concern is whether long sessions from a live USB start causing issues over time, especially when I'm juggling multiple admin tabs, online banking, and various VAT filing forms.
Last week I was going through a UAE VAT rate guide and ended up with five or six fairly heavy tabs open at once, which got me wondering how well this kind of setup holds up on modest hardware.
Have you noticed any freezes, slowdowns, or other quirks on older machines, or has it been consistently stable regardless of the hardware?

[fu11m00n]

@ Girow... thanks.

My host? (I got it in 2024 on eBay for $250/USD)

It's a 6 core... 12 thread... 8gb ram...
HP Elite (Bang & Olfusen) Model c645 (OEM release 2022)
AMD x86_64 Chromebook (running a "Mr. Chromebook" Debian container)
The iso runs in a 5gb Aqemu VM so it's not bare metal.

That amounts to 2 software abstraction levels.
Before the iso is mounted that's already a lot of overhead.

It runs my custom Porteus based OS (fu11m00n/OS) @ https://oreivd96v420wee4.umso.co/
The minimal system requirement for my OS is... 4 cores (and/or threads) 4gb ram (8gb ram for VM).
@ boot the system uses < 15% memory. With Firefox (using a 50mb cache) < 25% memory using 1 tab.

I develope my entire project in this convoluted environment.
I have network uptimes of > 1 week with no identifiable instability.
I rarely turn off my rig (except for rebooting Chromebook's update's).
It's been running pretty much 24/7 for the last 2 years.

Like I said... there are numerous tactics to secure a system.
My OS uses numerous tactics (some are noted on my project page).

For example this is my "demilitarized zone" tactic...


This tactic allows me to connect multiple internet facing Beowulf supercomputer clusters
while keeping (redirected) port 22 open for clustering but closed for unsolicited traffic.

see... The "Captain Howdy" Project (Post by fu11m00n #105431)

My tactics might fall a bit short if dealing with nation state actors (like the NSA) but they will severly punish "script kiddies" (> 90% of online exploits).