Features / Watch on incoming access

Working today

Nothing from outside gets in uninvited, and every attempt is counted.

ZENOS refuses every new connection from outside by default. A root service counts what was refused and who failed to sign in, raises plain alerts, and puts the firewall back if anyone removes it.

All new

inbound connections from any network are dropped by default

Every 2 s

the Security graph in the System Monitor is updated

Fixed rules

alerts follow fixed thresholds, written down below

How it works

Refuse, count, repair

1

Refuse

Only connections that start on the PC itself, and replies to connections it opened, are let in. Whatever address a service listens on.

2

Count

Blocked attempts with their source and port, outbound destinations that were cut, and wrong passwords at sudo, the login screen, the lock screen and ssh.

  • Nothing leaves the machine
  • Shown in the System Monitor
3

Repair

If the firewall is removed, it is applied again. Security fixes from Debian and ZENOS are watched and flagged when not installed.

Alerts

What raises an alert

One source touches 10 or more ports within 60 secondsPort scan
50 or more blocked attempts within 60 secondsInbound burst
5 or more failed sign-ins within 5 minutesFailed sign-ins
The firewall is missingFirewall missing
A security fix is still not installed after 24 hoursRed

The same alert is not repeated for 10 minutes, so a real one is not buried.

And the trust behind every HTTPS connection

A trust agent checks every root certificate store on the disk every 15 minutes, reads Mozilla's list of distrusted certificates every 6 hours (accepted only with a valid signature), enforces it at once in the browser and every Node program, and installs TLS fixes as soon as they are published.

Proven, and what is not

What is proved here, and what is tested

Proved in Lean 4

The outbound cut

  • An outbound destination is cut exactly when it is not approved and the bytes sent to it reach the line
  • A cut destination stays cut
Trusted, not proved

Tested and listed openly

  • The inbound firewall rules themselves (tested, not proved)
  • The kernel log and the system journal the counts come from
  • The network sentinel has not yet had an outside review

Try it in the preview

Try it yourself

1

Install the preview

Boot the image and install it on a PC on your network.

2

Scan it from another machine

Run a port scan against the PC from a second computer.

3

Watch the System Monitor

The Security graph shows the blocked attempts and a port-scan alert.

Download the previewRead the sourceThreat model
← All featuresNext: Where content may go →