health-control
Health control system for Kodachi that includes network connectivity checks and system health monitoring
File Information
| Property | Value |
|---|---|
| Binary Name | health-control |
| Version | 10.0.3 |
| Build Date | Not disclosed |
| Rust Version | 1.82.0 |
| File Size | 22.2MB |
| Author | Warith Al Maawali |
| License | Proprietary |
| Category | Kodachi Binary |
| Description | Health control system for Kodachi that includes network connectivity checks and system health monitoring |
| Git Commit | unknown |
| Metadata Generated | 2026-11-13T16:19:56Z |
| Binary Timestamp | Unknown |
| JSON Data | View Raw JSON |
SHA256 Checksum
66eb3da93c3c1a6e68b8e3b6f9b8a1c3e56bebff85b3910e622baf42fbfcd3c0
Features
| # | Feature |
|---|---|
| 1 | Network connectivity monitoring |
| 2 | Internet traffic control |
| 3 | Security hardening |
| 4 | System integrity checking |
| 5 | Offline system management |
Security Features
| Feature | Description |
|---|---|
| Authentication | Not provided by cli-core (see online-auth) |
| Encryption | Not provided by cli-core |
| Input Validation | Argument parsing via clap; per-command validation is the consumer's responsibility |
| Rate Limiting | Not provided by cli-core |
System Requirements
| Requirement | Value |
|---|---|
| OS | Linux (Debian-based) |
| Privileges | root/sudo for system operations |
| Dependencies | OpenSSL, libcurl |
Global Options
| Flag | Description |
|---|---|
-h, --help |
Print help information |
-v, --version |
Print version information |
-n, --info |
Display detailed information |
-e, --examples |
Show usage examples |
--json |
Output in JSON format |
-o, --output-format <FORMAT> |
Force output format (text|json) |
--json-pretty |
Pretty-print JSON output with indentation |
--json-human |
Enhanced JSON output with improved formatting (like jq) |
--json-filter <FIELD1,FIELD2> |
Return only specified JSON fields (comma-separated) |
--fields <FIELD_LIST> |
Select specific fields to include in output (comma-separated) |
--limit <NUMBER> |
Limit number of results returned |
--offset <NUMBER> |
Skip first N results (for pagination) |
-d, --work-dir <PATH> |
Working directory (defaults to auto-detected base directory) |
--port <PORT> |
Set custom port number (1024-65535) |
--log-level <LEVEL> |
Set log level (error|warn|info|debug) |
--verbose |
Enable verbose output |
--quiet |
Suppress non-essential output |
--no-color |
Disable colored output |
--config <FILE> |
Use custom configuration file |
--timeout <SECS> |
Set operation timeout in seconds (optional; no default applied) |
Commands
Data Destruction
wipe-file
Securely wipe a file with multiple passes
Usage:
health-control wipe-file [OPTIONS]
Options:
--file <PATH>: Path to file to wipe--passes <NUM>: Number of wipe passes
Examples:
sudo health-control wipe-file --file /path/to/file.txt
sudo health-control wipe-file --file /path/to/file.txt --passes 7 --json
wipe-directory
Securely wipe an entire directory and its contents
Usage:
health-control wipe-directory [OPTIONS]
Options:
--path <PATH>: Directory path to wipe--passes <N>: Number of wipe passes
Examples:
sudo health-control wipe-directory --path /tmp/sensitive_dir
sudo health-control wipe-directory --path /path/to/directory --passes 7 --json
wipe-user-dir
Securely wipe a common user directory (downloads, desktop, documents)
Usage:
health-control wipe-user-dir [OPTIONS]
Options:
--target <TARGET>: Directory target to wipe
Examples:
sudo health-control wipe-user-dir --target downloads
sudo health-control wipe-user-dir --target desktop
sudo health-control wipe-user-dir --target documents --json
wipe-logs
Securely wipe system logs (journal, syslog, auth.log, kern.log), user history (bash, zsh, python), and application cache logs
Usage:
health-control wipe-logs [OPTIONS]
Options:
--type <TYPE>: Log type: system, user, all
Examples:
sudo health-control wipe-logs # Wipe all logs (system + user)
sudo health-control wipe-logs --type system # Wipe only system logs (/var/log/*, journal)
sudo health-control wipe-logs --type user # Wipe only user logs (history, cache)
sudo health-control wipe-logs --type all --json # Show detailed JSON output
wipe-batch
Batch wipe multiple files
Usage:
health-control wipe-batch [OPTIONS]
Options:
--paths <PATHS>: Comma-separated paths to wipe (alternative to positional arguments)<FILES>: Files to wipe (can specify multiple)-p, --passes <PASSES>: Number of wipe passes
Examples:
# Multiple file paths as arguments:
sudo health-control wipe-batch file1.png file2.png --passes 7
sudo health-control wipe-batch /tmp/sensitive.doc /home/user/data.txt
# Alternative comma-separated format:
sudo health-control wipe-batch --paths "file1.png,file2.png" --passes 7
sudo health-control wipe-batch --paths "/tmp/file1,/tmp/file2" --json
⚠ Security Note: Using actual paths may expose system directory structure
wipe-browser-data
Wipe browser data and history
Usage:
health-control wipe-browser-data [OPTIONS]
Options:
--browser <BROWSER>: Browser: firefox, chrome, chromium, brave, edge, opera, vivaldi, tor, librewolf, waterfox, falkon, epiphany, konqueror, midori, palemoon, seamonkey, qutebrowser, min, nyxt, or 'all' (default)
Examples:
sudo health-control wipe-browser-data # Wipe all browsers
sudo health-control wipe-browser-data --browser firefox # Firefox only
sudo health-control wipe-browser-data --browser brave # Brave only
sudo health-control wipe-browser-data --browser tor # Tor Browser only
sudo health-control wipe-browser-data --browser all --json
wipe-free-space
Securely wipe free space on a mounted filesystem (use mount points like '/', '/home' or device paths)
Usage:
health-control wipe-free-space [OPTIONS]
Options:
--device <PATH>: Mount point (e.g., '/', '/home', '/tmp') or device (e.g., '/dev/DEVICE')
Examples:
sudo health-control wipe-free-space --device /
sudo health-control wipe-free-space --device /home
sudo health-control wipe-free-space --device /dev/DEVICE --json
sudo health-control wipe-free-space --device /tmp
wipe-pattern
Wipe files matching pattern (use --pattern flag or positional argument)
Usage:
health-control wipe-pattern [OPTIONS]
Options:
<PATTERN>: File pattern to match (e.g., '*.tmp', '*.log') - use quotes for shell patterns--pattern <PATTERN>: File pattern to match (e.g., '*.tmp', '*.log') - use quotes for shell patterns--directory <DIR>: Directory to search in
Examples:
sudo health-control wipe-pattern --pattern '*.tmp'
sudo health-control wipe-pattern '*.tmp'
sudo health-control wipe-pattern --pattern '*.log' --directory /var/log
sudo health-control wipe-pattern '*.log' --directory /var/log
sudo health-control wipe-pattern --pattern 'backup*' --json
sudo health-control wipe-pattern 'backup*' --json
sudo health-control wipe-pattern --pattern '*.cache' --directory ~/.cache
sudo health-control wipe-pattern '*.cache' --directory ~/.cache
wipe-schedule
Schedule automatic data wiping
Usage:
health-control wipe-schedule [OPTIONS]
Options:
<TARGET>: Target: temp, logs, cache, browser--frequency <FREQ>: Frequency: daily, weekly, monthly
Examples:
sudo health-control wipe-schedule temp --frequency daily
sudo health-control wipe-schedule logs --frequency weekly
sudo health-control wipe-schedule browser --json
wipe-verify
Verify that a file was wiped properly
Usage:
health-control wipe-verify [OPTIONS]
Options:
--path <PATH>: Path to verify
Examples:
sudo health-control wipe-verify --path /tmp/sensitive.txt
sudo health-control wipe-verify --path /home/user/data.bin --json
Display & Power
conky-enable
Start Conky widget
Usage:
health-control conky-enable [OPTIONS]
Examples:
health-control conky-enable
health-control conky-enable --json
conky-disable
Stop Conky widget
Usage:
health-control conky-disable [OPTIONS]
Examples:
health-control conky-disable
health-control conky-disable --json
conky-status
Check Conky running/installed/boot state
Usage:
health-control conky-status [OPTIONS]
Examples:
health-control conky-status
health-control conky-status --json
conky-boot-enable
Enable Conky on boot (autostart/systemd)
Usage:
health-control conky-boot-enable [OPTIONS]
Examples:
health-control conky-boot-enable
health-control conky-boot-enable --json
conky-boot-disable
Disable Conky on boot
Usage:
health-control conky-boot-disable [OPTIONS]
Examples:
health-control conky-boot-disable
health-control conky-boot-disable --json
screensaver-disable
Disable XFCE screensaver
Usage:
health-control screensaver-disable [OPTIONS]
Examples:
health-control screensaver-disable
health-control screensaver-disable --json
screensaver-enable
Enable XFCE screensaver
Usage:
health-control screensaver-enable [OPTIONS]
Examples:
health-control screensaver-enable
health-control screensaver-enable --json
screensaver-status
Check screensaver status
Usage:
health-control screensaver-status [OPTIONS]
Examples:
health-control screensaver-status
health-control screensaver-status --json
dpms-disable
Disable display power management
Usage:
health-control dpms-disable [OPTIONS]
Examples:
health-control dpms-disable
health-control dpms-disable --json
dpms-enable
Enable display power management
Usage:
health-control dpms-enable [OPTIONS]
Examples:
health-control dpms-enable
health-control dpms-enable --json
dpms-status
Check DPMS and timeout settings
Usage:
health-control dpms-status [OPTIONS]
Examples:
health-control dpms-status
health-control dpms-status --json
lock-screen
Lock the screen
Usage:
health-control lock-screen [OPTIONS]
Examples:
health-control lock-screen
health-control lock-screen --json
session-logout
End XFCE session
Usage:
health-control session-logout [OPTIONS]
Examples:
health-control session-logout
health-control session-logout --json
suspend
Suspend to RAM
Usage:
health-control suspend [OPTIONS]
Examples:
health-control suspend
health-control suspend --json
conky-mask-enable
Mask sensitive info in Conky panels
Usage:
health-control conky-mask-enable [OPTIONS]
Examples:
health-control conky-mask-enable
health-control conky-mask-enable --json
conky-mask-disable
Unmask Conky panels
Usage:
health-control conky-mask-disable [OPTIONS]
Examples:
health-control conky-mask-disable
health-control conky-mask-disable --json
conky-mask-status
Check if Conky privacy masking is active
Usage:
health-control conky-mask-status [OPTIONS]
Examples:
health-control conky-mask-status
health-control conky-mask-status --json
Emergency Operations
kill-switch-arm
Arm the emergency kill switch - sets system to high-alert state for manual activation. NOTE: This prepares the system for rapid response but does NOT actively monitor for threats. It's a preparedness state that allows quick manual activation via kill-switch-activate command.
Usage:
health-control kill-switch-arm [OPTIONS]
Examples:
sudo health-control kill-switch-arm
sudo health-control kill-switch-arm --json
kill-switch-disarm
Disarm the emergency kill switch
Usage:
health-control kill-switch-disarm [OPTIONS]
Examples:
sudo health-control kill-switch-disarm
sudo health-control kill-switch-disarm --json
kill-switch-status
Check whether the kill switch high-alert flag is armed/disarmed. Shows armed time and trigger count. Arming is a state flag, not a monitor: nothing is watching and nothing auto-fires. Also reports what the firewall enforces: enforced (an egress deny covering IPv4 is in place; an IPv6-only deny does not count), traffic_blocked (true only when ALL outbound traffic is blocked, IPv6 included or disabled in the kernel), egress_allowlist (tor, tunnel, public_address, other: what the deny still lets through, e.g. Tor under torrify; other means an exception that can let any traffic out) and egress_deny_scope (all, except_allowlist, ipv4_only, ipv6_only, none). Does NOT activate anything - just displays current status.
Usage:
health-control kill-switch-status [OPTIONS]
Examples:
health-control kill-switch-status
health-control kill-switch-status --json
kill-switch-activate
IMMEDIATELY activate emergency procedures. Unlike 'arm' (which only raises a high-alert flag and monitors nothing), this executes panic mode NOW. Choose level: soft (network+lock), medium (default: +kill processes), hard (+forced power-off, then a RAM wipe until the power goes)
Usage:
health-control kill-switch-activate [OPTIONS]
Options:
--level <LEVEL>: Panic level: soft, medium, hard--force: Force activation without confirmation--dry-run: Test mode - shows what actions would be taken without executing
Examples:
sudo health-control kill-switch-activate
sudo health-control kill-switch-activate --level hard --force
sudo health-control kill-switch-activate --level soft --json
sudo health-control kill-switch-activate --dry-run --json
panic-soft
IMMEDIATE soft panic mode. Actions: Kill all network connections, clear clipboard, lock screen. NO CONFIRMATION. The firewall, service and interface state is saved first: run 'sudo health-control panic-recover' to restore it. Restarting the network does NOT undo this (the firewall stays set to drop everything), and 'unblock-internet' only reverses its own block-internet, never the panic.
Usage:
health-control panic-soft [OPTIONS]
Options:
--dry-run: Test mode - shows what actions would be taken without executing--clear-traces: After the network is cut and the screen is locked, also clear your shell histories, the recently-used list and the thumbnail cache (cannot be undone)
Examples:
sudo health-control panic-soft
sudo health-control panic-soft --json
sudo health-control panic-soft --dry-run
sudo health-control panic-soft --clear-traces
sudo health-control panic-soft --clear-traces --dry-run --json
panic-hard
IMMEDIATE hard panic mode with CONFIRMATION. CRITICAL: Kill network, clear clipboard, terminate non-essential processes, clear memory caches, unmount devices, force the power off, then start a fast RAM wipe that runs only until the power goes. The forced power-off skips the shutdown steps, so the installed shutdown wipe does not run. Does not lock the screen. IRREVERSIBLE - system will shutdown!
Usage:
health-control panic-hard [OPTIONS]
Options:
--dry-run: Test mode - shows what actions would be taken without executing
Examples:
sudo health-control panic-hard
sudo health-control panic-hard --json
sudo health-control panic-hard --dry-run
destroy-kodachi
IRREVERSIBLE: wipe every LUKS device and its header backups, then hard panic + shutdown. Use --dry-run to preview or --force to execute.
Usage:
health-control destroy-kodachi [--dry-run] [--force] [--include-external-usb]
Options:
--dry-run: Preview the exact devices, backup files and steps without destroying anything--force: Skip confirmation and execute (DANGEROUS, IRREVERSIBLE)--include-external-usb: Also wipe LUKS on removable/USB drives, not only internal and boot/live media
Examples:
sudo health-control destroy-kodachi --dry-run
sudo health-control destroy-kodachi --dry-run --include-external-usb --json
sudo health-control destroy-kodachi --force
destroy-schedule-arm
Arm a root systemd timer to run Destroy at a chosen time, even if the dashboard is closed. --in uses a monotonic timer; --at needs a synced clock. Cleared on reboot.
Usage:
health-control destroy-schedule-arm (--in <DURATION> | --at <EPOCH>) [--include-external-usb]
Options:
--in <DURATION>: Fire after a relative delay WITH A UNIT, e.g. 20m, 1h, 6h, 10h, 24h--at <EPOCH>: Fire at an absolute time (epoch seconds); needs a synced clock--include-external-usb: Also wipe LUKS on removable/USB drives when it fires
Examples:
sudo health-control destroy-schedule-arm --in 1h
sudo health-control destroy-schedule-arm --in 20m --include-external-usb --json
destroy-schedule-cancel
Cancel a pending scheduled destroy (stops the timer, removes the armed state). Never requires authentication. If the wipe is already firing, it is not interrupted.
Usage:
health-control destroy-schedule-cancel
Examples:
sudo health-control destroy-schedule-cancel
destroy-schedule-status
Report whether a scheduled destroy is armed, its deadline and remaining time. Read-only.
Usage:
health-control destroy-schedule-status
Examples:
sudo health-control destroy-schedule-status --json
panic-medium
IMMEDIATE medium panic mode with CONFIRMATION. Actions: Kill network, clear clipboard, terminate non-essential processes, clear memory caches, unmount devices, lock screen. Run 'sudo health-control panic-recover' to restore the saved firewall, services and interfaces; ended processes, cleared memory and unmounted devices are not brought back.
Usage:
health-control panic-medium [OPTIONS]
Options:
--dry-run: Test mode - shows what actions would be taken without executing--clear-traces: After the network is cut and the screen is locked, also clear your shell histories, the recently-used list and the thumbnail cache (cannot be undone)
Examples:
sudo health-control panic-medium
sudo health-control panic-medium --json
sudo health-control panic-medium --dry-run
sudo health-control panic-medium --clear-traces
sudo health-control panic-medium --clear-traces --dry-run --json
clear-user-traces
Clear your shell and tool histories (bash, zsh, fish, python, less, node, sqlite, mysql, psql, wget, vim), the recently-used files list and the thumbnail cache, yours and root's. Only files owned by each account inside its own home are touched; a link is left in place, never followed. Cannot be undone. Also available as --clear-traces on panic-soft and panic-medium. Needs a login (the dashboard's login, or sudo online-auth authenticate).
Usage:
health-control clear-user-traces [OPTIONS]
Options:
--dry-run: Show which files would be cleared, change nothing
Examples:
sudo health-control clear-user-traces --dry-run
sudo health-control clear-user-traces --dry-run --json
sudo health-control clear-user-traces
panic-profile
Configure automated emergency response profile that defines system actions during panic mode activation
Usage:
health-control panic-profile [OPTIONS]
Options:
--profile <PROFILE>: Emergency response profile to configure: stealth - Light security response: minimal network blocking, clear cache, lock screen paranoid - Maximum security response: full network isolation, memory wipe, system lockdown recovery - Safe restoration mode: create recovery point, restart essential services
Examples:
# Configure light security response (recommended for public wifi):
sudo health-control panic-profile --profile stealth
# Configure maximum security lockdown (for high-risk situations):
sudo health-control panic-profile --profile paranoid
# Configure recovery mode (to restore system to safe state):
sudo health-control panic-profile --profile recovery
# Get JSON output with profile configuration details:
sudo health-control panic-profile --profile paranoid --json
panic-recover
Activate panic recovery mode
Usage:
health-control panic-recover [OPTIONS]
Examples:
sudo health-control panic-recover
sudo health-control panic-recover --json
create-recovery-point
Create system recovery checkpoint
Usage:
health-control create-recovery-point [OPTIONS]
Options:
--name <NAME>: Recovery point name
Examples:
sudo health-control create-recovery-point
sudo health-control create-recovery-point --name pre-update
sudo health-control create-recovery-point --json
nuke-execute
Execute emergency data destruction sequence (DANGEROUS - use --dry-run for testing)
Usage:
health-control nuke-execute [--method fast|secure|paranoid] [--dry-run] [--force]
Options:
--method, -m <METHOD>: Wipe method: fast, secure (default), paranoid--dry-run: Test mode - shows actions without executing--force, -f: Skip confirmation prompt (DANGEROUS)
Examples:
health-control nuke-execute --dry-run
health-control nuke-execute --method fast --dry-run
health-control nuke-execute --method paranoid --dry-run --json
nuke-progress
Get current nuke mode execution progress
Usage:
health-control nuke-progress
Examples:
health-control nuke-progress
health-control nuke-progress --json
nuke-storage-detect
Detect storage type (SSD/HDD/NVMe) for a device
Usage:
health-control nuke-storage-detect --device /dev/DEVICE
Options:
--device <DEVICE>: Device path (e.g., /dev/DEVICE)
Examples:
health-control nuke-storage-detect --device /dev/DEVICE
health-control nuke-storage-detect --device /dev/DEVICE --json
Emergency Shortcuts
emergency-trigger
Execute an emergency plan (dashboard, luks, both). Requires local session token from kodachi-session-helper daemon. Use --dry-run for testing.
Usage:
health-control emergency-trigger --plan <dashboard|luks|both> [--device <dev>] [--silent] [--force] [--dry-run]
Options:
--plan <PLAN>: Emergency plan: dashboard, luks, both--device <DEVICE>: LUKS device path (required for luks/both plans)--dry-run: Log planned actions without executing--silent: Suppress stdout output--force: Skip readiness checks
Examples:
sudo health-control emergency-trigger --plan dashboard --dry-run
sudo health-control emergency-trigger --plan luks --device /dev/DEVICE --dry-run
sudo health-control emergency-trigger --plan both --device /dev/DEVICE --dry-run --json
emergency-lockdown
Start a delayed countdown that triggers an emergency plan when the timer expires. Persists state for crash recovery. Requires local session token.
Usage:
health-control emergency-lockdown --delay <seconds> [--plan <dashboard|luks|both>] [--device <dev>] [--dry-run]
Options:
--delay <SECONDS>: Countdown delay in seconds--plan <PLAN>: Emergency plan: dashboard (default), luks, both--device <DEVICE>: LUKS device path (required for luks/both plans)--dry-run: Log planned actions without starting timer
Examples:
sudo health-control emergency-lockdown --delay 300 --dry-run
sudo health-control emergency-lockdown --delay 60 --plan luks --device /dev/DEVICE
sudo health-control emergency-lockdown --delay 120 --plan both --device /dev/DEVICE --json
emergency-lockdown-status
Show current emergency lockdown state: active/inactive, remaining seconds, plan. No authentication required (read-only).
Usage:
health-control emergency-lockdown-status [--json]
Examples:
health-control emergency-lockdown-status
health-control emergency-lockdown-status --json
emergency-lockdown-cancel
Cancel an active emergency lockdown countdown. Requires local session token.
Usage:
health-control emergency-lockdown-cancel
Examples:
sudo health-control emergency-lockdown-cancel
sudo health-control emergency-lockdown-cancel --json
Hardware Security
hardware-rng-verify
Verify hardware random number generator status
Usage:
health-control hardware-rng-verify [OPTIONS]
Examples:
sudo health-control hardware-rng-verify
sudo health-control hardware-rng-verify --json
entropy-status
Check system entropy pool status and quality
Usage:
health-control entropy-status [OPTIONS]
Examples:
sudo health-control entropy-status
sudo health-control entropy-status --json
coldboot-defense-enable
Enable cold boot defense mechanisms
Usage:
health-control coldboot-defense-enable [OPTIONS]
Examples:
sudo health-control coldboot-defense-enable
sudo health-control coldboot-defense-enable --json
coldboot-defense-disable
Disable cold boot defense mechanisms
Usage:
health-control coldboot-defense-disable [OPTIONS]
Examples:
sudo health-control coldboot-defense-disable
sudo health-control coldboot-defense-disable --json
sudo health-control coldboot-defense-disable --json-human
coldboot-defense-status
Check cold boot defense mechanisms status
Usage:
health-control coldboot-defense-status [OPTIONS]
Examples:
sudo health-control coldboot-defense-status
sudo health-control coldboot-defense-status --json
boot-integrity-check
Report boot security settings (UEFI, Secure Boot, MOK, lockdown, module signing)
Usage:
health-control boot-integrity-check [OPTIONS]
Examples:
sudo health-control boot-integrity-check
sudo health-control boot-integrity-check --json
system-doctor
Read-only health report: previous boots, boot readiness, failed services, the Tor firewall guard and disk space, each problem with its fix
Usage:
health-control system-doctor [OPTIONS]
Options:
-e, --examples: Show usage examples
Examples:
sudo health-control system-doctor
sudo health-control system-doctor --json
boot-readiness
Check that every kernel can boot: initramfs present, encrypted disk unlockable, GRUB menu and free space on /boot
Usage:
health-control boot-readiness [OPTIONS]
Options:
--quiet: Print nothing; the exit code is the answer (0 ready, 2 warnings, 1 failures)--record: Also keep the result for the login line and the dashboard (used by the boot hooks)-e, --examples: Show usage examples
Examples:
sudo health-control boot-readiness
sudo health-control boot-readiness --json
sudo health-control boot-readiness --quiet
firmware-security-check
Check firmware and platform security (fwupd HSI, UEFI, Secure Boot, SPI, TPM)
Usage:
health-control firmware-security-check [OPTIONS]
Examples:
sudo health-control firmware-security-check
sudo health-control firmware-security-check --json
Hostname Management
set-default-hostname
Set the default hostname
Usage:
health-control set-default-hostname [OPTIONS]
Examples:
sudo health-control set-default-hostname
sudo health-control set-default-hostname --json
set-random-hostname
Set a random hostname
Usage:
health-control set-random-hostname [OPTIONS]
Examples:
sudo health-control set-random-hostname
sudo health-control set-random-hostname --json
set-custom-hostname
Set a custom hostname
Usage:
health-control set-custom-hostname [OPTIONS]
Options:
--name <HOSTNAME>: Custom hostname to set
Examples:
sudo health-control set-custom-hostname --name MyHost
sudo health-control set-custom-hostname --name secure-host --json
Internet Traffic Control
block-internet
Block all internet traffic
Usage:
health-control block-internet [OPTIONS]
Options:
--method <METHOD>: Block method: firewall (nftables and iptables, ufw is an alias), iptables, nftables, interfaces, auto, all--allow-local: Allow local network traffic (LAN)
Examples:
sudo health-control block-internet
sudo health-control block-internet --method firewall
sudo health-control block-internet --method ufw
sudo health-control block-internet --method iptables
sudo health-control block-internet --method nftables
sudo health-control block-internet --method interfaces
sudo health-control block-internet --method all
sudo health-control block-internet --allow-local
sudo health-control block-internet --method iptables --allow-local
sudo health-control block-internet --method all --allow-local
sudo health-control block-internet --json
unblock-internet
Unblock internet traffic
Usage:
health-control unblock-internet [OPTIONS]
Options:
--method <METHOD>: Unblock method: firewall (nftables and iptables, ufw is an alias), iptables, nftables, interfaces, auto, all
Examples:
sudo health-control unblock-internet
sudo health-control unblock-internet --method firewall
sudo health-control unblock-internet --method ufw
sudo health-control unblock-internet --method iptables
sudo health-control unblock-internet --method nftables
sudo health-control unblock-internet --method interfaces
sudo health-control unblock-internet --method all
sudo health-control unblock-internet --json
block-ping
Block outbound ICMP echo-requests (ping) via iptables and ip6tables
Usage:
health-control block-ping [OPTIONS]
Options:
--family <FAMILY>: Address family to act on: all (default), ipv4, ipv6
Examples:
sudo health-control block-ping
sudo health-control block-ping --family ipv4
sudo health-control block-ping --family ipv6
sudo health-control block-ping --json
unblock-ping
Unblock outbound ICMP echo-requests (ping), remove the DROP rules
Usage:
health-control unblock-ping [OPTIONS]
Options:
--family <FAMILY>: Address family to act on: all (default), ipv4, ipv6
Examples:
sudo health-control unblock-ping
sudo health-control unblock-ping --family ipv4
sudo health-control unblock-ping --family ipv6
sudo health-control unblock-ping --json
internet-status
Check internet blocking status
Usage:
health-control internet-status [OPTIONS]
Options:
--force: Force quick recovery even if connectivity appears healthy--silent: Disable terminal and desktop notifications
Examples:
sudo health-control internet-status
sudo health-control internet-status --silent
sudo health-control internet-status --json
recover-internet
Recover internet connectivity
Usage:
health-control recover-internet [OPTIONS]
Options:
--check-dns: Check DNS resolution after recovery--force: Force recovery even if connectivity appears working--silent: Disable terminal and desktop notifications
Examples:
sudo health-control recover-internet
sudo health-control recover-internet --check-dns
sudo health-control recover-internet --force
sudo health-control recover-internet --check-dns --force
sudo health-control recover-internet --silent
sudo health-control recover-internet --json
fast-recover-internet
Fast internet recovery - bounce interface, restart NetworkManager, renew DHCP
Usage:
health-control fast-recover-internet [OPTIONS]
Options:
--force: Force quick recovery even when connectivity appears healthy--silent: Disable terminal and desktop notifications
Examples:
sudo health-control fast-recover-internet
sudo health-control fast-recover-internet --force
sudo health-control fast-recover-internet --force --silent
sudo health-control fast-recover-internet --silent
sudo health-control fast-recover-internet --json
network-manager-restart
Restart NetworkManager and verify it is active; refuses (exit 1) when Kodachi's Disable network management has masked it, and never unmasks
Usage:
health-control network-manager-restart [OPTIONS]
Examples:
sudo health-control network-manager-restart
sudo health-control network-manager-restart --json
kill-network
Emergency network kill switch
Usage:
health-control kill-network [OPTIONS]
Examples:
sudo health-control kill-network
sudo health-control kill-network --json
kill-network-interface
Kill specific network interface
Usage:
health-control kill-network-interface [OPTIONS]
Options:
--interface <INTERFACE>: Network interface to kill
Examples:
sudo health-control kill-network-interface --interface wlan0
sudo health-control kill-network-interface --interface eth0 --json
kill-process
Kill specific process by name or PID
Usage:
health-control kill-process [OPTIONS]
Options:
--process <PROCESS>: Process name or PID
Examples:
sudo health-control kill-process --process firefox
sudo health-control kill-process --process 1234 --json
enable
Enable a watch-guard to monitor system changes and block internet on triggers
Usage:
health-control enable --type watch-guard --watch <TYPE> --method <METHOD>
Options:
--type: Type of watch-guard to enable--watch: What to watch for changes (vpn, dns, ip, mac, hostname, timezone, interfaces, process, firewall-rules). vpn = cut the internet on any change of VPN state, a drop or a new connection, so enable it while the VPN is connected. firewall-rules = when the Tor firewall rules are flushed or deleted, ask tor-switch to check and restore them; it never blocks and only accepts the log_event action--target: Process name to watch (required for process watch)--method: Blocking method to use when triggered--daemon: No-op, accepted for compatibility: watch-guards ALWAYS run as a persistent daemon (see daemon_mode in execute())--interval: Custom check interval in seconds (1-300)--actions: Comma-separated actions to execute when triggered
Examples:
sudo health-control enable --type watch-guard --watch ip --method nftables
sudo health-control enable --type watch-guard --watch timezone --method iptables
sudo health-control enable --type watch-guard --watch timezone --method iptables --daemon
sudo health-control enable --type watch-guard --watch interfaces --method firewall
sudo health-control enable --type watch-guard --watch process --target tor --method all
sudo health-control enable --type watch-guard --watch process --target firefox --method auto
sudo health-control enable --type watch-guard --watch mac --method nftables --interval 5
sudo health-control enable --type watch-guard --watch hostname --method iptables
sudo health-control enable --type watch-guard --watch vpn --method nftables --interval 3
sudo health-control enable --type watch-guard --watch dns --method firewall
sudo health-control enable --type watch-guard --watch firewall-rules --method auto
sudo health-control enable --type watch-guard --watch mac --method nftables --actions log_event,randomize_hostname
sudo health-control enable --type watch-guard --watch vpn --method nftables --actions log_event,show_alert,block_network
disable
Disable an active watch-guard and optionally unblock internet
Usage:
health-control disable --type watch-guard <IDENTIFIER>
Options:
--type: Type of command to disable<IDENTIFIER>: Which watch-guard to disable: a watch type (vpn, dns, ip, mac, hostname, timezone, interfaces, process, firewall-rules), a guard id, a process name such as tor, or all--no-unblock: Do not unblock internet after disabling watch-guard
Examples:
sudo health-control disable --type watch-guard vpn
sudo health-control disable --type watch-guard ip
sudo health-control disable --type watch-guard timezone
sudo health-control disable --type watch-guard interfaces
sudo health-control disable --type watch-guard tor
sudo health-control disable --type watch-guard all
sudo health-control disable --type watch-guard all --no-unblock
watch-guard
Show status of active watch-guards
Usage:
health-control watch-guard status
Examples:
sudo health-control watch-guard status
sudo health-control watch-guard status --json
daemon
Run watch-guard monitoring as a persistent daemon process
Usage:
health-control daemon --config-id <ID>
Options:
--config-id: Configuration ID to monitor
Examples:
sudo health-control daemon --config-id <watchguard-config-id>
MAC Address Management
mac-change-all
Change the MAC address of every interface except the one carrying the default route (--include-active or --force include it)
Usage:
health-control mac-change-all [OPTIONS]
Options:
--force: Safely tear down active routing/Tor protection, then also change the active default-route interface MAC--anyway: Compatibility spelling for --force; never bypasses teardown or verification--include-active: Also change the active default-route interface MAC, but only while VPN routing and Tor are verified off; the link drops for a few seconds and nothing is torn down
Examples:
sudo health-control mac-change-all
sudo health-control mac-change-all --json
sudo health-control mac-change-all --include-active
sudo health-control mac-change-all --force
sudo health-control mac-change-all --anyway
mac-force-change
Force change all MAC addresses (disable interfaces first)
Usage:
health-control mac-force-change [OPTIONS]
Options:
--anyway: Compatibility spelling; never bypasses teardown or verification
Examples:
sudo health-control mac-force-change
sudo health-control mac-force-change --json
sudo health-control mac-force-change --anyway
mac-change-specific
Change specific interface MAC address
Usage:
health-control mac-change-specific [OPTIONS]
Options:
--interface <INTERFACE>: Target interface name--force: Safely tear down active routing/Tor protection, then allow targeting the active default-route interface--anyway: Compatibility spelling for --force; never bypasses teardown or verification
Examples:
sudo health-control mac-change-specific --interface eth0
sudo health-control mac-change-specific --interface wlan0 --json
sudo health-control mac-change-specific --interface eth0 --force
sudo health-control mac-change-specific --interface eth0 --anyway
mac-show-interfaces
Show available network interfaces
Usage:
health-control mac-show-interfaces [OPTIONS]
Examples:
sudo health-control mac-show-interfaces
sudo health-control mac-show-interfaces --json
wifi-hidden-audit
List saved Wi-Fi profiles marked as hidden networks, which make this machine broadcast their names, with the command that turns the flag off. Changes nothing.
Usage:
health-control wifi-hidden-audit [OPTIONS]
Examples:
health-control wifi-hidden-audit
health-control wifi-hidden-audit --json
mac-rotation
Turn timed MAC address rotation on or off, or show it. Off by default. Each rotation skips the active interface while VPN routing or Tor is on, so a protected connection is never dropped. The interface you are connected through is changed only while VPN and Tor are off, and then the connection drops for a few seconds and can get a new address.
Usage:
health-control mac-rotation [OPTIONS]
Options:
--enable: Turn timed rotation on--disable: Turn timed rotation off and remove its timer--status: Show whether timed rotation is on and how often it runs--interval-minutes <MINUTES>: Minutes between rotations, 15 to 1440 (with --enable)
Examples:
health-control mac-rotation --status
sudo health-control mac-rotation --enable --interval-minutes 120
sudo health-control mac-rotation --disable --json
mac-show-macs
Show current MAC addresses
Usage:
health-control mac-show-macs [OPTIONS]
Examples:
sudo health-control mac-show-macs
sudo health-control mac-show-macs --json
mac-reset-all
Reset all MAC addresses to default
Usage:
health-control mac-reset-all [OPTIONS]
Examples:
sudo health-control mac-reset-all
sudo health-control mac-reset-all --json
mac-active-interface
Show active network interface
Usage:
health-control mac-active-interface [OPTIONS]
Examples:
sudo health-control mac-active-interface
sudo health-control mac-active-interface --json
Memory Management
memory-clean
Clean memory caches and buffers
Usage:
health-control memory-clean [OPTIONS]
Examples:
sudo health-control memory-clean
sudo health-control memory-clean --json
memory-force-clean
Force clean memory by killing top process
Usage:
health-control memory-force-clean [OPTIONS]
Examples:
sudo health-control memory-force-clean
sudo health-control memory-force-clean --json
memory-wipe
Secure RAM wipe (sdmem)
Usage:
health-control memory-wipe [OPTIONS]
Examples:
sudo health-control memory-wipe
sudo health-control memory-wipe --json
memory-wipe-process
Close a program, then overwrite free memory: its memory is only free once it has ended
Usage:
health-control memory-wipe-process [OPTIONS]
Options:
--value <PROCESS>: Process name or PID
Examples:
sudo health-control memory-wipe-process --value firefox
sudo health-control memory-wipe-process --value 1234 --json
memory-limits
Manage process memory limits
Usage:
health-control memory-limits [OPTIONS]
Options:
--value <PROCESS>: Process name to set limit for--limit-mb <LIMIT_MB>: Memory limit in MB
Examples:
sudo health-control memory-limits
sudo health-control memory-limits --value firefox --limit-mb 1024
sudo health-control memory-limits --value chrome --limit-mb 2048
sudo health-control memory-limits --value brave --limit-mb 1536
sudo health-control memory-limits --json
memory-stats
Display memory statistics and history
Usage:
health-control memory-stats [OPTIONS]
Options:
--history: Include memory usage history
Examples:
sudo health-control memory-stats
sudo health-control memory-stats --history --json
swap-configure
Configure swap settings
Usage:
health-control swap-configure [OPTIONS]
Options:
--swappiness <VALUE>: Swappiness value (0-100)--cache-pressure <VALUE>: Cache pressure value
Examples:
sudo health-control swap-configure --swappiness 10 --cache-pressure 50
sudo health-control swap-configure --swappiness 0 --json
disable-swap
Disable swap memory
Usage:
health-control disable-swap [OPTIONS]
Examples:
sudo health-control disable-swap
sudo health-control disable-swap --json
enable-swap
Enable swap memory
Usage:
health-control enable-swap [OPTIONS]
Options:
--size <SIZE>: Swap size in MB
Examples:
sudo health-control enable-swap
sudo health-control enable-swap --size 2048
sudo health-control enable-swap --size 4096
sudo health-control enable-swap --json
Network Connectivity
net-check
Check network connectivity (IP ping, DNS, and HTTP probe)
Usage:
health-control net-check [--timeout <SECONDS>] [--http] [--ip-only|--domain-only|--http-only] [--dns-server <ADDRESS:PORT>]
Options:
--timeout <SECONDS>: Timeout in seconds for each connectivity check--http: Run the extended HTTP-focused check path (IP ping + DNS + HTTP, verbose per-target reporting)--ip-only: Check IP ping only, skip DNS lookups and HTTP probe--domain-only: Check DNS resolution only, skip IP ping and HTTP probe--http-only: Check HTTP reachability only, skip IP ping and DNS lookups (returns HTTP_ONLY_CONNECTIVITY/5 on success)--dns-server <ADDRESS:PORT>: Custom DNS server address (e.g., 127.0.0.1:5353 for Tor DNS)
Examples:
sudo health-control net-check
sudo health-control net-check --json
sudo health-control net-check --timeout 15
sudo health-control net-check --http
sudo health-control net-check --http --json
sudo health-control net-check --ip-only
sudo health-control net-check --domain-only
sudo health-control net-check --http-only
sudo health-control net-check --http-only --json
sudo health-control net-check --domain-only --dns-server 127.0.0.1:5353
net-check-http
Check network connectivity including HTTP
Usage:
health-control net-check-http [OPTIONS]
Options:
--timeout <TIMEOUT>: Timeout in seconds
Examples:
sudo health-control net-check-http
sudo health-control net-check-http --timeout 15
sudo health-control net-check-http --json
list-ips
List IPs used for connectivity testing
Usage:
health-control list-ips [OPTIONS]
Examples:
sudo health-control list-ips
sudo health-control list-ips --json
list-domains
List domains used for connectivity testing
Usage:
health-control list-domains [OPTIONS]
Examples:
sudo health-control list-domains
sudo health-control list-domains --json
Offline Actions
offline-postgresql
Manage PostgreSQL database service
Usage:
health-control offline-postgresql [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-postgresql --action disable
sudo health-control offline-postgresql --action enable
health-control offline-postgresql --action check --json
Password Generation
genpass
Generate secure passwords using multiple methods (pass, pwgen, xkcdpass)
Usage:
health-control genpass [OPTIONS]
Options:
--method <METHOD>: Password generation method: pass, pwgen, or xkcdpass-c, --count <NUM>: Number of passwords to generate (default: 1, max: 1000)-l, --length <NUM>: Password length (default: 25)--uppercase: Include uppercase letters--no-uppercase: Explicitly exclude uppercase letters--lowercase: Include lowercase letters--no-lowercase: Explicitly exclude lowercase letters--digits: Include digits--no-digits: Explicitly exclude digits--symbols <CHARS>: Symbols to include (default: "@-#")--force-native: Force use of native Rust implementations (skip package check)
Examples:
sudo health-control genpass
sudo health-control genpass --method pwgen
sudo health-control genpass --count 10
sudo health-control genpass --method pwgen --count 50
sudo health-control genpass --method xkcdpass --count 20 --json
sudo health-control genpass --length 32 --symbols "@-_!#$"
Phone Companion
companion-status
Show the phone companion: whether it is installed and running, whether its onion is published, the paired phones and the PIN lockout. Never shows a key.
Usage:
health-control companion-status [OPTIONS]
Examples:
sudo health-control companion-status
sudo health-control companion-status --json
companion-enable
Install and start the phone companion: its own Tor (no proxy port) and serve. Nothing is published until a phone is paired. Running it again clears the lock after 5 wrong PINs. Needs a login (the dashboard's login, or sudo online-auth authenticate).
Usage:
health-control companion-enable [OPTIONS]
Examples:
sudo health-control companion-enable
sudo health-control companion-enable --json
companion-disable
Stop the phone companion and remove its units and torrc where Kodachi wrote them. The onion goes away at once; the paired phones are kept for a later companion-enable.
Usage:
health-control companion-disable [OPTIONS]
Examples:
sudo health-control companion-disable
sudo health-control companion-disable --json
companion-pair
Pair a phone with the companion: choose the PIN, then import the line shown once on this terminal into Tor Browser or Orbot. Needs a terminal; the key is never stored or logged. Needs a login (the dashboard's login, or sudo online-auth authenticate).
Usage:
health-control companion-pair [OPTIONS]
Options:
--name <NAME>: A name for this phone (1 to 32 letters, digits, spaces, '-' or '_'); default 'phone'
Examples:
sudo health-control companion-pair --name pixel
sudo health-control companion-pair --name pixel --json
companion-unpair
Unpair one phone by name, or every phone with --all, which also forgets the onion key so the next pairing gets a new address.
Usage:
health-control companion-unpair [OPTIONS]
Options:
--name <NAME>: The phone to unpair--all: Unpair every phone and forget the onion key and address
Examples:
sudo health-control companion-unpair --name pixel
sudo health-control companion-unpair --all
sudo health-control companion-unpair --all --json
companion-serve
Run the phone companion's answer behind its onion (started by the kodachi-companion unit, not by hand). Root only.
Usage:
health-control companion-serve [OPTIONS]
Examples:
sudo systemctl status kodachi-companion
Security
security-status
Show comprehensive security status
Usage:
health-control security-status [OPTIONS]
Options:
<CATEGORY>: Specific category: network, kernel, memory, filesystem, monitoring, sandboxing, all--category <CATEGORY_FLAG>: Specific category (alternative to positional)
Examples:
sudo health-control security-status
sudo health-control security-status --category network
sudo health-control security-status --category all --json
sudo health-control security-status all
sudo health-control security-status network --json
Security Assessment
security-score
Calculate security score and get recommendations
Usage:
health-control security-score [OPTIONS]
Examples:
health-control security-score
health-control security-score --json
security-report
Generate comprehensive security report
Usage:
health-control security-report [OPTIONS]
Options:
--format <FORMAT>: Report format: summary, detailed, compliance
Examples:
sudo health-control security-report
sudo health-control security-report --format detailed
sudo health-control security-report --format compliance --json
security-profile
Set security profile and thresholds
Usage:
health-control security-profile [OPTIONS]
Options:
--value <PROFILE>: Security profile: minimal, balanced, paranoid
Examples:
sudo health-control security-profile --value minimal
sudo health-control security-profile --value balanced
sudo health-control security-profile --value paranoid
sudo health-control security-profile --value balanced --json
security-history
View security configuration history
Usage:
health-control security-history [OPTIONS]
Options:
--days <DAYS>: Number of days to show
Examples:
sudo health-control security-history
sudo health-control security-history --days 30
sudo health-control security-history --json
security-remediate
Auto-remediate security issues
Usage:
health-control security-remediate [OPTIONS]
Options:
--bool <BOOL>: Apply fixes automatically without confirmation
Examples:
sudo health-control security-remediate
sudo health-control security-remediate --bool true
sudo health-control security-remediate --bool false --json
security-schedule
Schedule security scans (hourly, daily, weekly, monthly, disable)
Usage:
health-control security-schedule [OPTIONS]
Options:
--value <SCHEDULE>: Schedule: hourly, daily, weekly, monthly, disable
Examples:
sudo health-control security-schedule --value daily
sudo health-control security-schedule --value weekly
sudo health-control security-schedule --value disable --json
rootkit-scan-enhanced
Enhanced rootkit scanning with multiple tools
Usage:
health-control rootkit-scan-enhanced [OPTIONS]
Options:
--deep: Perform deep scan
Examples:
sudo health-control rootkit-scan-enhanced
sudo health-control rootkit-scan-enhanced --deep
sudo health-control rootkit-scan-enhanced --json
lynis-audit
Run Lynis security audit
Usage:
health-control lynis-audit [OPTIONS]
Options:
--value <PROFILE>: Audit profile: quick, full, pentest
Examples:
sudo health-control lynis-audit
sudo health-control lynis-audit --value quick
sudo health-control lynis-audit --value pentest --json
lynis-status
Check Lynis installation status
Usage:
health-control lynis-status [OPTIONS]
Examples:
health-control lynis-status
health-control lynis-status --json
clamav-scan
Scan system with ClamAV antivirus
Usage:
health-control clamav-scan [OPTIONS]
Options:
--path <PATH>: Path to scan (default: health-control execution directory)--recursive: Scan recursively--quarantine: Quarantine infected files--timeout-seconds <SECONDS>: Maximum scanner runtime in seconds (10-3600)
Examples:
sudo health-control clamav-scan
sudo health-control clamav-scan --path . --recursive
sudo health-control clamav-scan --quarantine --json
Security Hardening
security-harden
Apply comprehensive security hardening
Usage:
health-control security-harden [OPTIONS]
Options:
--profile <PROFILE>: Security profile: 'standard' (soft, nothing breaks), 'medium' (moderate, browsers+internet OK), 'paranoid' (maximum, WILL break browsers+internet, and disables user namespaces so oniux/browser sandboxes/bwrap stop working)--break-monitoring: Force paranoid hardening and make /sys/class/net root-only (breaks btop/conky/dashboard monitoring)--modules <MODULES>: Apply only specific security modules (comma-separated): kernel (sysctl hardening), process (isolation/namespaces), filesystem (secure mounts), network (firewall rules), memory (ASLR/protection), monitoring (auditd), sandboxing (AppArmor/seccomp)
Examples:
sudo health-control security-harden
sudo health-control security-harden --profile standard
# STANDARD PROFILE (soft), Nothing breaks, score 5/7
# Applies: Safe kernel sysctls, secure filesystem mounts,
# ASLR=2, symlink/hardlink protection, SYN flood protection,
# auditd monitoring, AppArmor/Firejail detection
# Also normalizes: Reverts any stricter settings left from medium/paranoid
# Safe for: All systems, all browsers, VPN/Tor routing
sudo health-control security-harden --profile medium
# MEDIUM PROFILE (moderate), Browsers+internet still work, score 6/7
# Includes Standard, PLUS: hidepid=2 on /proc, hardened_malloc,
# vm.dirty_ratio tuning, file integrity monitoring
# Also normalizes: Reverts paranoid-only settings (namespaces, IP forwarding)
# May affect: LUKS systems (higher memory from hardened_malloc)
sudo health-control security-harden --profile paranoid
# PARANOID PROFILE (maximum), Full lockdown, score 7/7
# Includes Medium, PLUS: disable user namespaces, disable IP forwarding,
# MAC spoofing, DNS firewall, LKRG, Tirdad, SMT off, RAM wipe
# WILL BREAK: Browsers, Internet, VPN/Tor routing
# Disabling user namespaces also breaks oniux Tor process
# isolation, browser sandboxes, and bubblewrap (bwrap)
# Recover: health-control security-recover
# (recover-internet restores networking only, it
# does NOT re-enable user namespaces)
sudo health-control security-harden --break-monitoring
# Alias for --profile paranoid + makes /sys/class/net root-only
sudo health-control security-harden --modules kernel,filesystem --json
# Apply only specific modules with JSON output
# LUKS encryption notice:
# On LUKS systems, medium/paranoid profiles increase memory usage.
# If OOM or browser crashes occur: health-control security-recover
security-verify
Verify if security hardening is properly applied (checks all 7 modules and reports their status)
Usage:
health-control security-verify [OPTIONS]
Options:
--profile <PROFILE>: Security profile to verify against. Defaults to the profile used during hardening, or 'standard' if no hardening has been applied.
Examples:
sudo health-control security-verify
# Check status of all 7 security modules against current profile
# Also checks for forbidden leftover settings from higher profiles
# Standard expects: 5/7 modules, no medium/paranoid leftovers
# Medium expects: 6/7 modules, no paranoid leftovers
# Paranoid expects: 7/7 modules configured
sudo health-control security-verify --profile medium
# Verify against medium profile expectations
sudo health-control security-verify --profile paranoid
# Verify against paranoid profile expectations
sudo health-control security-verify --json
# Get detailed JSON output with all verification data + leftover warnings
security-recover
Temporarily revert security hardening (keeps framework enabled for quick re-hardening)
Usage:
health-control security-recover [OPTIONS]
Options:
--modules <MODULES>: Specific modules to recover: kernel,process,filesystem,network,memory,monitoring,sandboxing
Examples:
# Temporarily revert security hardening (keeps framework ready for re-hardening)
sudo health-control security-recover
# After recovery, modules show 'ENABLED (needs configuration)', except checks stock Debian already passes, such as ASLR
# This means: Framework is ready but no restrictions are enforced
# Use this when: Troubleshooting issues, planning to re-harden later
# Recover only specific modules
sudo health-control security-recover --modules network,kernel
# LUKS systems: If hardening caused OOM kills or browser crashes,
# recovery restores vm.dirty_ratio=20 (default) and re-enables
# user namespaces for browser sandbox compatibility.
# To re-apply hardening after recovery:
sudo health-control security-harden
security-reset
Revert all hardening and clear the saved security state
Usage:
health-control security-reset [OPTIONS]
Options:
--force: Accepted for backward compatibility and IGNORED. This command does not prompt: it resets immediately with or without this flag
Examples:
# Completely disable all security modules and framework
# NOTE: there is NO confirmation prompt. This runs immediately.
sudo health-control security-reset
# After reset, security-verify shows modules as NOT HARDENED, except checks stock Debian already passes, such as ASLR
# This means: All applied security hardening has been reverted
# Use this when: You want to permanently remove security hardening
# --force is accepted for backward compatibility and changes nothing
sudo health-control security-reset --force
# Warning: After reset, security-harden will need to rebuild framework
monitoring-enable
Enable system monitoring features
Usage:
health-control monitoring-enable [OPTIONS]
Options:
--modules <MODULES>: Specific monitoring modules: auditd,lkrg,file-integrity,auth-events,process,network
Examples:
sudo health-control monitoring-enable
sudo health-control monitoring-enable --modules auditd,lkrg,file-integrity
sudo health-control monitoring-enable --json
monitoring-disable
Disable system monitoring features
Usage:
health-control monitoring-disable [OPTIONS]
Options:
--modules <MODULES>: Specific monitoring modules: auditd,lkrg,file-integrity,auth-events,process,network
Examples:
sudo health-control monitoring-disable
sudo health-control monitoring-disable --modules auditd,lkrg
sudo health-control monitoring-disable --json
monitoring-status
Check system security monitoring status
Usage:
health-control monitoring-status [OPTIONS]
Examples:
sudo health-control monitoring-status
sudo health-control monitoring-status --json
ipv6-disable
Disable IPv6 system-wide
Usage:
health-control ipv6-disable [OPTIONS]
Examples:
sudo health-control ipv6-disable
sudo health-control ipv6-disable --json
ipv6-enable
Enable IPv6 system-wide
Usage:
health-control ipv6-enable [OPTIONS]
Examples:
sudo health-control ipv6-enable
sudo health-control ipv6-enable --json
tirdad-enable
Enable Tirdad TCP ISN randomization
Usage:
health-control tirdad-enable [OPTIONS]
Examples:
sudo health-control tirdad-enable
sudo health-control tirdad-enable --json
tirdad-disable
Disable Tirdad TCP ISN randomization
Usage:
health-control tirdad-disable [OPTIONS]
Examples:
sudo health-control tirdad-disable
sudo health-control tirdad-disable --json
tirdad-status
Check Tirdad TCP ISN randomization status
Usage:
health-control tirdad-status [OPTIONS]
Examples:
health-control tirdad-status
health-control tirdad-status --json
ipv6-status
Check IPv6 status
Usage:
health-control ipv6-status [OPTIONS]
Examples:
health-control ipv6-status
health-control ipv6-status --json
ram-wipe
Run a secure RAM wipe immediately (does NOT install the shutdown hook)
Usage:
health-control ram-wipe [OPTIONS]
Examples:
sudo health-control ram-wipe
sudo health-control ram-wipe --json
wipe-ram-install
Install RAM wipe system (hooks + configuration), keeping any saved setting you do not name. Run this first if not already installed
Usage:
health-control wipe-ram-install [OPTIONS]
Options:
--force: Force installation even if Kicksecure/Whonix RAM wipe detected. WARNING: May conflict with existing systems--policy <MODE>: Initial wipe policy: kodachi-wiper (fast, recommended)|sdmem (runs sdmem -f once per pass)|both (hybrid)|auto (runs kodachi-wiper)--time <SECS>: Time budget for shutdown RAM wiping (default: 60s). Recommended: 60 for desktops and laptops. The shutdown hook stops at 80 seconds whatever is set here, because systemd ends a shutdown hook at 90. A longer budget counts only for a manual wipe-ram--passes <NUM>: Number of sdmem overwrite passes 1-9 (default: 3). More passes = more secure but slower. Recommended: 3 balanced, 7+ high-security
Examples:
sudo health-control wipe-ram-install
sudo health-control wipe-ram-install --policy kodachi-wiper
sudo health-control wipe-ram-install --policy sdmem --passes 3
sudo health-control wipe-ram-install --time 80
sudo health-control wipe-ram-install --policy sdmem --passes 5
sudo health-control wipe-ram-install --policy both --time 80 --passes 3
sudo health-control wipe-ram-install --force
sudo health-control wipe-ram-install --json
ram-wipe-status
Show RAM wipe system status - Check this first before installing or configuring
Usage:
health-control ram-wipe-status [OPTIONS]
Examples:
sudo health-control ram-wipe-status
sudo health-control ram-wipe-status --json
wipe-ram-config
Update RAM wipe configuration - Use this to modify settings after installation
Usage:
health-control wipe-ram-config [OPTIONS]
Options:
--policy <MODE>: Set policy: kodachi-wiper (fast native wiper)|sdmem (secure multi-pass)|both (balanced hybrid)|auto (runs kodachi-wiper)--time <SECS>: Set time budget for shutdown RAM wiping. Recommended: 60 for desktops and laptops. The shutdown hook stops at 80 seconds whatever is set here, because systemd ends a shutdown hook at 90. A longer budget counts only for a manual wipe-ram--passes <NUM>: Set number of sdmem passes (1-9). More = secure but slower. Recommended: 3 balanced, 7+ high-security--split <PCT>: Set time split for 'both' mode (10-90). Example: 70 = 70% kodachi-wiper, 30% sdmem. Higher = faster but less secure
Examples:
sudo health-control wipe-ram-config --policy auto
sudo health-control wipe-ram-config --policy kodachi-wiper
sudo health-control wipe-ram-config --time 80
sudo health-control wipe-ram-config --passes 5
sudo health-control wipe-ram-config --split 70
sudo health-control wipe-ram-config --policy both --time 80
sudo health-control wipe-ram-config --policy both --time 80 --passes 3 --split 60
sudo health-control wipe-ram-config --json
ram-wipe-enable
Enable automatic RAM wiping on shutdown
Usage:
health-control ram-wipe-enable [OPTIONS]
Options:
--schedule: When the wipe runs. ONLY 'shutdown' is implemented (executed by the systemd shutdown hook). 'immediate' and 'delay' are accepted but IGNORED: for an immediate wipe use `health-control wipe-ram`--passes: Number of overwrite passes (this IS honoured)
Examples:
sudo health-control ram-wipe-enable
sudo health-control ram-wipe-enable --passes 5
sudo health-control ram-wipe-enable --schedule shutdown --passes 3
sudo health-control ram-wipe-enable --json
sudo health-control wipe-ram # wipe RAM NOW (this is the real 'immediate')
ram-wipe-disable
Disable automatic RAM wiping
Usage:
health-control ram-wipe-disable [OPTIONS]
Options:
--preserve-config: Accepted for older scripts and changes nothing: the hooks are removed and the settings are kept either way
Examples:
sudo health-control ram-wipe-disable
sudo health-control ram-wipe-disable --preserve-config
sudo health-control ram-wipe-disable --json
wipe-ram-test
Check the RAM wipe setup with a dry run: reports the policy, time budget and tools a real wipe would use, and overwrites nothing. Run this to verify installation before relying on automatic wipes
Usage:
health-control wipe-ram-test [OPTIONS]
Options:
--policy <MODE>: Test specific wipe policy: kodachi-wiper (fast)|sdmem (runs sdmem -f once per pass)|both (hybrid)|auto (runs kodachi-wiper)--time <SECS>: Time budget to report in seconds (default: 10). Nothing runs for this long; the shutdown wipe uses the budget from wipe-ram-config
Examples:
sudo health-control wipe-ram-test
sudo health-control wipe-ram-test --policy kodachi-wiper
sudo health-control wipe-ram-test --policy sdmem
sudo health-control wipe-ram-test --policy both --time 60
sudo health-control wipe-ram-test --time 30
sudo health-control wipe-ram-test --policy kodachi-wiper --time 20
sudo health-control wipe-ram-test --json
wipe-ram
Execute RAM wipe operation (primarily used by systemd/init shutdown hooks, but can be run manually for testing)
Usage:
health-control wipe-ram [OPTIONS]
Options:
--shutdown-mode: INTERNAL USE - Shutdown-optimized mode for systemd/init hooks. Users should use 'wipe-ram' without this flag--no-console: Disable console output for silent operation (useful in scripts and background tasks)--policy <MODE>: Override wipe policy: kodachi-wiper (fast native wiper for quick shutdowns)|sdmem (runs sdmem -f once per pass)|both (hybrid approach: fast+secure)|auto (runs kodachi-wiper)--time <SECS>: Override time budget in seconds (how long to spend wiping RAM). Higher values = more memory wiped but longer shutdown time
Examples:
sudo health-control wipe-ram
sudo health-control wipe-ram --policy kodachi-wiper
sudo health-control wipe-ram --policy sdmem
sudo health-control wipe-ram --policy both --time 120
sudo health-control wipe-ram --time 120
sudo health-control wipe-ram --no-console
sudo health-control wipe-ram --json
sudo health-control wipe-ram --shutdown-mode
ram-wipe-detect-kicksecure
Detect Kicksecure/Whonix RAM wipe installation
Usage:
health-control ram-wipe-detect-kicksecure
Examples:
sudo health-control ram-wipe-detect-kicksecure
sudo health-control ram-wipe-detect-kicksecure --json
sudo health-control ram-wipe-detect-kicksecure --json-human
ram-wipe-update
Update RAM wipe configuration (alias for wipe-ram-config)
Usage:
health-control ram-wipe-update [OPTIONS]
Options:
--policy <MODE>: Set policy: kodachi-wiper (fast native wiper)|sdmem (secure multi-pass)|both (balanced hybrid)|auto (runs kodachi-wiper)--time <SECS>: Set time budget in seconds--passes <NUM>: Set sdmem passes (1-9)--split <PCT>: Set custom/sdmem split for 'both' mode (10-90)
Examples:
sudo health-control ram-wipe-update --policy auto
sudo health-control ram-wipe-update --policy both --time 80
sudo health-control ram-wipe-update --policy kodachi-wiper
sudo health-control ram-wipe-update --time 80
sudo health-control ram-wipe-update --passes 5
sudo health-control ram-wipe-update --json
disk-encryption-status
Check disk encryption status and security
Usage:
health-control disk-encryption-status [OPTIONS]
Examples:
sudo health-control disk-encryption-status
sudo health-control disk-encryption-status --json
swap-enable
Enable swap partition/file
Usage:
health-control swap-enable [OPTIONS]
Examples:
sudo health-control swap-enable
sudo health-control swap-enable --json
swap-activate-configured
Activate only swap already configured on this system
Usage:
health-control swap-activate-configured [OPTIONS]
Examples:
sudo health-control swap-activate-configured
sudo health-control swap-activate-configured --json
swap-deactivate-configured
Deactivate configured swap without removing encrypted mappings
Usage:
health-control swap-deactivate-configured [OPTIONS]
Examples:
sudo health-control swap-deactivate-configured
sudo health-control swap-deactivate-configured --json
swap-disable
Disable swap partition/file
Usage:
health-control swap-disable [OPTIONS]
Examples:
sudo health-control swap-disable
sudo health-control swap-disable --json
swap-encrypt
Encrypt swap partition/file
Usage:
health-control swap-encrypt [OPTIONS]
Examples:
sudo health-control swap-encrypt
sudo health-control swap-encrypt --json
swap-status
Check swap status and configuration
Usage:
health-control swap-status [OPTIONS]
Examples:
sudo health-control swap-status
sudo health-control swap-status --json
swap-decrypt
Decrypt encrypted swap partition/file
Usage:
health-control swap-decrypt [OPTIONS]
Options:
--device <DEVICE>: Swap device to decrypt
Examples:
sudo health-control swap-decrypt
sudo health-control swap-decrypt --device /dev/DEVICE
sudo health-control swap-decrypt --json
swap-encrypt-status
Check swap encryption status
Usage:
health-control swap-encrypt-status [OPTIONS]
Examples:
sudo health-control swap-encrypt-status
sudo health-control swap-encrypt-status --json
usb-list
List all USB devices
Usage:
health-control usb-list [OPTIONS]
Examples:
sudo health-control usb-list
sudo health-control usb-list --json
luks-nuke
Manage LUKS nuke passwords
Usage:
health-control luks-nuke [OPTIONS]
Options:
--action <ACTION>: Action: configure, remove, status, execute, list-backups, restore-backup, delete-backup--device <DEVICE>: LUKS device path (block device or file-based LUKS container)--password <PASSWORD>: Nuke password (for configure action)--gpg-password <PASSWORD>: GPG password for header-backup encryption (configure action)--luks-password <PASSWORD>: Current LUKS password (configure/remove actions)--backup-file <PATH>: Backup file path or file name (restore-backup/delete-backup actions)--force-overwrite: Force overwrite when a nuke password is already configured (configure action)--force-remove: Skip interactive confirmation for remove action--force-execute: Skip interactive confirmation for execute action--stdin-passwords: Read passwords from stdin as JSON instead of CLI args (avoids /proc exposure)
Examples:
# AUTOMATED HEADER BACKUP + Nuke Configuration
# Check nuke password status
sudo health-control luks-nuke --action status
→ Shows all LUKS devices and nuke password status
# Check specific device
sudo health-control luks-nuke --action status --device /dev/DEVICE
→ Shows nuke password status for /dev/DEVICE only
# Configure nuke password (FULLY AUTOMATED)
sudo health-control luks-nuke --action configure --device /dev/DEVICE
→ Backs up LUKS header AUTOMATICALLY to <hooks>/backups/
→ Encrypts backup with GPG automatically
→ Configures nuke password via cryptsetup-nuke-password
→ Verifies everything works
→ NO manual cryptsetup commands needed!
# Configure with CLI password (INSECURE - visible in history)
sudo health-control luks-nuke --action configure --device /dev/DEVICE --password '<REPLACE_WITH_STRONG_PASSWORD>'
⚠️ WARNING: Password visible in shell history!
→ Still backs up header automatically
# Header backup location
# Saved to: <hooks>/backups/header-{device-name}-{timestamp}.img.gpg
# Keep this file SAFE - it's your ONLY recovery option!
# Remove nuke password
sudo health-control luks-nuke --action remove --device /dev/DEVICE
→ Removes nuke password via cryptsetup-nuke-password
# MANUAL EMERGENCY EXECUTE (IRREVERSIBLE)
sudo health-control luks-nuke --action execute --device /dev/DEVICE --force-execute
→ Immediately destroys LUKS key material on selected device.
→ Data becomes permanently unrecoverable.
# ℹ️ FILE-BASED LUKS CONTAINERS SUPPORTED
# Works with both block devices (/dev/*) AND file-based containers
# Configure nuke for live-boot persistence image (AUTOMATED)
sudo health-control luks-nuke --action configure --device /tmp/persistence
→ Backs up header automatically
→ Supports file-based LUKS containers created by create-persistence
# Check nuke status on encrypted persistence file
sudo health-control luks-nuke --action status --device /media/kodachi/persistence
→ File must exist and be a valid LUKS container
# Remove nuke from file-based container
sudo health-control luks-nuke --action remove --device /tmp/encrypted-container.img
→ Works identically with files and block devices
# COMPLETE AUTOMATED WORKFLOW
# Create encrypted persistence with nuke password - ZERO manual steps
# Step 1: List devices to find USB
sudo health-control list-storage-devices
# Step 2: Check device safety
sudo health-control usb-safety-check --device /dev/DEVICE
# Step 3: Create encrypted persistence (AUTOMATED)
sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali --encrypted
→ Confirms device selection
→ Formats automatically
→ Creates persistence.conf automatically
→ Done!
# Step 4: Configure nuke password (AUTOMATED)
sudo health-control luks-nuke --action configure --device /dev/DEVICE
→ Backs up header automatically to <hooks>/backups/
→ Configures nuke password automatically
→ Verifies everything works
→ Done!
# ✅ ZERO MANUAL COMMANDS!
# ✅ NO manual mounting/unmounting!
# ✅ NO manual backup commands!
# ✅ Everything automated with safety confirmations!
# EMERGENCY: Restore header if nuke password used accidentally
sudo gpg -d <hooks>/backups/header-DEVICE-*.img.gpg | sudo cryptsetup luksHeaderRestore /dev/DEVICE
# List available encrypted header backups
sudo health-control luks-nuke --action list-backups --device /dev/DEVICE
# Restore from encrypted backup
sudo health-control luks-nuke --action restore-backup --device /dev/DEVICE --backup-file header-DEVICE-20260304-014630.img.gpg
# Delete old backup
sudo health-control luks-nuke --action delete-backup --backup-file header-sda1-20260304-014630.img.gpg
⚠️ USE ONLY IF nuke password was accidentally entered!
# JSON output for monitoring
sudo health-control luks-nuke --action status --json
luks-detect
Detect valid LUKS devices on the system
Usage:
health-control luks-detect [OPTIONS]
Options:
--all-devices: Check all block devices including loop devices
Examples:
sudo health-control luks-detect
sudo health-control luks-detect --all-devices
sudo health-control luks-detect --json
luks-manage
Manage LUKS encrypted devices
Usage:
health-control luks-manage [OPTIONS]
Options:
--action <ACTION>: Action: add, remove, unlock, lock, list--device <PATH>: Device path
Examples:
sudo health-control luks-manage --action list
sudo health-control luks-manage --action unlock --device /dev/DEVICE
sudo health-control luks-manage --action lock --device /dev/DEVICE
luks-nuke-advanced
Advanced LUKS nuke configuration (emergency wipe)
Usage:
health-control luks-nuke-advanced [OPTIONS]
Options:
--device <DEVICE>: Device to configure nuke for--password <PASSWORD>: Nuke password (WARNING: will destroy data)
Examples:
sudo health-control luks-nuke-advanced --device /dev/DEVICE --password '<REPLACE_WITH_STRONG_PASSWORD>'
sudo health-control luks-nuke-advanced --device /dev/DEVICE --json
luks-remove
Erase every LUKS keyslot and the LUKS signature on a device: its data can never be decrypted again
Usage:
health-control luks-remove [OPTIONS]
Options:
<DEVICE>: Device to remove LUKS from--force: Required: erase every keyslot and the LUKS signature. Without it, nothing is changed
Examples:
sudo health-control luks-remove "$LUKS_DEVICE" --force
sudo health-control luks-remove "$LUKS_DEVICE" --force --json
luks-manage-advanced
Advanced LUKS device management
Usage:
health-control luks-manage-advanced [OPTIONS]
Options:
--action <ACTION>: Action: backup-header, restore-header (perform the operation); add-key, remove-key, change-key (advisory only: print the cryptsetup command and exit non-zero)--device <PATH>: Device path--key-file <PATH>: Key file path--backup-file <PATH>: Backup file path
Examples:
sudo health-control luks-manage-advanced --action backup-header --device /dev/DEVICE --backup-file /tmp/header.backup
sudo health-control luks-manage-advanced --action restore-header --device /dev/DEVICE --backup-file /tmp/header.backup
sudo health-control luks-manage-advanced --action backup-header --device /dev/DEVICE --backup-file /tmp/header.backup --json
create-persistence
Create Debian live-boot persistence media
Usage:
health-control create-persistence [OPTIONS]
Options:
--size <GB>: Size in GB--encrypted: Enable encryption--output <PATH>: Output file path or directory (live-boot defaults to a file named 'persistence')--password <PASSWORD>: LUKS encryption password (INSECURE: visible in shell history! Use interactive mode instead)--stdin-password: Read the LUKS password from stdin (one line, 8 to 4096 bytes); implies --encrypted and keeps the password out of argv and shell history
Examples:
sudo health-control create-persistence
sudo health-control create-persistence --size 8
sudo health-control create-persistence --encrypted
sudo health-control create-persistence --encrypted --size 8
printf '%s\n' '<STRONG_PASSWORD>' | sudo health-control create-persistence --stdin-password --size 8 --json
sudo health-control create-persistence --encrypted --password '<REPLACE_WITH_STRONG_PASSWORD>'
sudo health-control create-persistence --size 4 --output /tmp/persistence --json
create-persistence-other-os
Create persistence for other Linux distributions (Kali, Parrot, Tails)
Usage:
health-control create-persistence-other-os [OPTIONS]
Options:
--device <PATH>: Target partition device (e.g., /dev/DEVICE)--os-type <TYPE>: Operating system type: kali, parrot, or tails--encrypted: Enable LUKS encryption--password <PASSWORD>: LUKS encryption password (INSECURE: visible in shell history! Use interactive mode instead)--force: Skip the interactive device confirmation - required for non-interactive use (dashboard, scripts, --json)
Examples:
# FULLY AUTOMATED - No manual mounting needed!
# RECOMMENDED: List devices first to see what's safe
sudo health-control list-storage-devices
→ Shows which devices are SAFE vs DANGEROUS
# Check if your device is safe
sudo health-control usb-safety-check --device /dev/DEVICE
→ Verifies device before formatting
# Unencrypted persistence for Kali Linux (AUTOMATED)
sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali
→ Confirms device selection
→ Formats partition automatically
→ Creates persistence.conf automatically
→ Ready to use - NO manual mounting!
# Encrypted persistence for Parrot OS (FULLY AUTOMATED)
sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type parrot --encrypted
→ Password prompted securely (not visible in history)
→ Confirms device selection
→ Encrypts partition automatically
→ Mounts, configures, unmounts automatically
→ Everything automated with safety confirmations!
# Encrypted persistence for Tails with CLI password (INSECURE)
sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type tails --encrypted --password '<REPLACE_WITH_STRONG_PASSWORD>'
⚠️ WARNING: Password visible in shell history!
# Complete safe workflow (AUTOMATED)
sudo health-control list-storage-devices && \
sudo health-control usb-safety-check --device /dev/DEVICE && \
sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali --encrypted
→ Entire workflow automated - just type YES when prompted!
# With JSON output
sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali --encrypted --json
encryption-status
Check storage encryption status
Usage:
health-control encryption-status [OPTIONS]
Examples:
# Check overall system encryption status
sudo health-control encryption-status
→ Shows: LUKS devices, encrypted filesystems, swap encryption
→ Shows: Home directory encryption, full disk encryption status
→ Reports: Encryption count summary (X/Y devices encrypted)
→ Lists: Active encrypted containers and their mount points
# Typical output includes:
# - LUKS devices: /dev/DEVICE (/, 120 GB), /dev/OTHER_DEVICE (backup, 500 GB)
# - Encrypted swap: Yes (dm-crypt)
# - Home encryption: Yes (LUKS)
# - Full disk encryption: Yes (all partitions encrypted)
# - Encryption strength: AES-256-XTS
# JSON output for monitoring/scripting
sudo health-control encryption-status --json
→ Structured data: luks_devices[], encrypted_filesystems[]
→ Boolean flags: home_encryption, swap_encrypted, full_disk_encryption
→ Device details: cipher, key_size, device_path, mount_point, size
→ Use in monitoring scripts for encryption compliance
container-create
Create a file of random data of the chosen size. It is NOT encrypted: run cryptsetup luksFormat on it yourself before you store anything in it.
Usage:
health-control container-create [OPTIONS]
Options:
--path <PATH>: Container file path--size <MB>: Size in MB--fs-type <TYPE>: Which next commands to print: ext4, luks, veracrypt. The file is the same random data for all three
Examples:
# Make a file of random data (default: 1 GB). It is NOT encrypted
sudo health-control container-create --path $HOME/secure.img
→ Size: 1024 MB (default), written in full straight away
→ Prints the commands that put a filesystem on it
# Make a 5 GB file and print the LUKS commands for it
sudo health-control container-create --path $HOME/data.img --size 5000 --fs-type luks
→ Size: 5000 MB (5 GB)
→ Sets no password: cryptsetup asks for one when you run the printed commands
# Make a 2 GB file and print the VeraCrypt command for it
sudo health-control container-create --path $HOME/portable.img --size 2048 --fs-type veracrypt
→ Formatting it is the job of VeraCrypt, which is not part of this command
# --fs-type only chooses which next commands are printed:
# ext4: a plain file with a filesystem and no encryption
# luks: cryptsetup luksFormat, open, mkfs and mount
# veracrypt: the VeraCrypt command that formats a volume
# Size guidelines:
# Small (100-500 MB): Documents, passwords, keys
# Medium (500-2000 MB): Photos, code projects
# Large (2000-10000 MB): Videos, backups, archives
# Very Large (10000+ MB): Full system backups
container-mount
Mount encrypted container
Usage:
health-control container-mount [OPTIONS]
Options:
--container <PATH>: Container file path--mount-point <PATH>: Mount point directory
Examples:
# Mount encrypted container (password prompted securely)
sudo health-control container-mount --container $HOME/secure.img --mount-point $HOME/secure
→ Prompts for LUKS password (not visible, not logged)
→ Creates $HOME/secure automatically if it doesn't exist
→ Opens LUKS device with cryptsetup
→ Mounts to $HOME/secure/ - ready to use
# Complete workflow: create → mount → use → unmount
# Step 1: Make the file of random data, then run the cryptsetup commands it prints
sudo health-control container-create --path $HOME/data.img --size 500 --fs-type luks
# Step 2: Mount container
sudo health-control container-mount --container $HOME/data.img --mount-point $HOME/data
# Enter password when prompted
# Step 3: Use the container (copy files, edit, etc.)
sudo cp -r /sensitive/documents $HOME/data/
echo 'secret data' | sudo tee $HOME/data/confidential.txt
# Step 4: Unmount when done
sudo health-control container-unmount --mount-point $HOME/data
# ✅ Complete encrypted container lifecycle!
# ✅ Data encrypted at rest, decrypted only when mounted
# ✅ Mount point automatically created and cleaned up
container-unmount
Unmount encrypted container
Usage:
health-control container-unmount [OPTIONS]
Options:
--mount-point <PATH>: Mount point directory
Examples:
# Safely unmount encrypted container
sudo health-control container-unmount --mount-point $HOME/secure
→ Unmounts filesystem from $HOME/secure
→ Closes LUKS mapper device automatically
→ Leaves the mount point folder in place
→ Refuses anything container-mount did not mount
→ ⚠️ Close all files in $HOME/secure BEFORE unmounting!
# Check if anything is using the mount before unmounting
sudo lsof +D $HOME/secure # List open files in mount point
# If files are open, close them first, then:
sudo health-control container-unmount --mount-point $HOME/secure
# Error handling: If unmount fails due to busy device
# 1. Check for open files:
sudo lsof +D $HOME/secure
# 2. Kill processes using the mount:
sudo fuser -km $HOME/secure # Kill processes (use with caution!)
# 3. Try unmounting again:
sudo health-control container-unmount --mount-point $HOME/secure
# Safe workflow: Always unmount before system shutdown
# 1. Copy files out of container
# 2. Close all applications accessing the mount
# 3. Unmount container
# 4. Container is now encrypted and safe to store/transport
Security Tools
rootkit-scan
Quick rootkit scan (fast, essential checks)
Usage:
health-control rootkit-scan [OPTIONS]
Examples:
sudo health-control rootkit-scan
sudo health-control rootkit-scan --json
kloak-status
Check Kloak keyboard anonymization status
Usage:
health-control kloak-status [OPTIONS]
Examples:
health-control kloak-status
health-control kloak-status --json
kloak-enable
Enable Kloak keyboard anonymization
Usage:
health-control kloak-enable [OPTIONS]
Examples:
sudo health-control kloak-enable
sudo health-control kloak-enable --json
kloak-disable
Disable Kloak keyboard anonymization
Usage:
health-control kloak-disable [OPTIONS]
Examples:
sudo health-control kloak-disable
sudo health-control kloak-disable --json
kloak-configure
Configure Kloak keystroke anonymization settings
Usage:
health-control kloak-configure [OPTIONS]
Options:
--rescue-delay <MS>: Kloak rescue delay in milliseconds--startup-delay <MS>: Kloak startup delay in milliseconds--max-delay <MS>: Kloak maximum keystroke delay in milliseconds--verbose: Enable Kloak verbose logging--device <PATH>: Keyboard input device passed to Kloak
Examples:
sudo health-control kloak-configure --max-delay 100
sudo health-control kloak-configure --rescue-delay 20 --startup-delay 100
sudo health-control kloak-configure --max-delay 100 --verbose --json
kloak-event-mode
Set Kloak event processing mode
Usage:
health-control kloak-event-mode [OPTIONS]
Options:
--mode <MODE>: Event mode: raw or normal
Examples:
sudo health-control kloak-event-mode --mode raw
sudo health-control kloak-event-mode --mode normal
sudo health-control kloak-event-mode --mode raw --json
kloak-stats
Show Kloak keystroke anonymization statistics
Usage:
health-control kloak-stats [OPTIONS]
Examples:
health-control kloak-stats
health-control kloak-stats --json
aide-update
Update AIDE database after legitimate changes
Usage:
health-control aide-update [OPTIONS]
Options:
--accept-changes: Accept all detected changes and update baseline
Examples:
sudo health-control aide-update
sudo health-control aide-update --accept-changes
sudo health-control aide-update --json
aide-check
Check file integrity with AIDE
Usage:
health-control aide-check [OPTIONS]
Examples:
sudo health-control aide-check
sudo health-control aide-check --json
aide-init
Initialize AIDE database for file integrity monitoring
Usage:
health-control aide-init [OPTIONS]
Options:
--config <PATH>: Path to AIDE configuration file--timeout <SECONDS>: Timeout in seconds (default: 3600 - 1 hour)--background: Run AIDE initialization in background and return immediately
Examples:
sudo health-control aide-init
sudo health-control aide-init --config ./aide.conf
sudo health-control aide-init --timeout 7200
sudo health-control aide-init --background
sudo health-control aide-init --json
aide-reinit
Reinitialize AIDE database (reset baseline)
Usage:
health-control aide-reinit [OPTIONS]
Options:
--force: Force reinitialization without confirmation--timeout <SECONDS>: Timeout in seconds for AIDE initialization (default: 3600)--background: Run AIDE reinitialization in background and return immediately
Examples:
sudo health-control aide-reinit
sudo health-control aide-reinit --force
sudo health-control aide-reinit --background --timeout 7200 --json
sudo health-control aide-reinit --json
aide-scan-dir
Scan specific directory with AIDE
Usage:
health-control aide-scan-dir [OPTIONS]
Options:
<PATH>: Directory path to scan-r, --recursive: Scan recursively
Examples:
sudo health-control aide-scan-dir ./config
sudo health-control aide-scan-dir /usr/bin --recursive
sudo health-control aide-scan-dir /home --json
Storage & USB Security
list-storage-devices
List all storage devices with safety information for persistence operations
Usage:
health-control list-storage-devices [OPTIONS]
Options:
--all: Include all devices (loop, ram, etc)
Examples:
# List all storage devices with safety indicators
sudo health-control list-storage-devices
→ Shows which devices are safe (USB) vs dangerous (system)
# Include all devices (loop, ram, etc)
sudo health-control list-storage-devices --all
# JSON output for scripting
sudo health-control list-storage-devices --json
# Before creating persistence (recommended workflow)
sudo health-control list-storage-devices && \
sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali
usb-safety-check
Check if a device is safe for persistence/formatting operations
Usage:
health-control usb-safety-check [OPTIONS]
Options:
--device <PATH>: Device to check (e.g., /dev/DEVICE)
Examples:
# Check if device is safe for persistence
sudo health-control usb-safety-check --device /dev/DEVICE
→ Returns: SAFE, CAUTION, or DANGER with details
# Check system drive (will warn)
sudo health-control usb-safety-check --device /dev/DEVICE
→ Shows why device is dangerous (system drive)
# JSON output for scripting
sudo health-control usb-safety-check --device /dev/DEVICE --json
Storage Security
storage-wipe
Securely wipe storage devices and free space
Usage:
health-control storage-wipe [OPTIONS]
Options:
--device <DEVICE>: Storage device to wipe--passes <N>: Number of overwrite passes for a device (default: 3). Ignored with --free-space--free-space: Wipe free space on all mounted filesystems--allow-root-device: Allow wiping the block device that backs the running root filesystem. WITHOUT this flag the wipe is refused when the target is (or contains) the active root device, preventing accidental destruction of the live system.
Examples:
sudo health-control storage-wipe --free-space
sudo health-control storage-wipe --device /dev/DEVICE --json
sudo health-control storage-wipe --device /dev/DEVICE --allow-root-device --json
storage-encrypt
Format a device as a new encrypted volume: everything on it is lost
Usage:
health-control storage-encrypt [OPTIONS]
Options:
--device <DEVICE>: Device to encrypt--stdin-password: Read the new LUKS password from stdin instead of prompting
Examples:
sudo health-control storage-encrypt --device /dev/DEVICE
sudo health-control storage-encrypt --device /dev/DEVICE --json
encryption-tune
Optimize encryption performance and security settings
Usage:
health-control encryption-tune [OPTIONS]
Options:
--profile <PROFILE>: Optimization profile: performance, security, balanced--device <PATH>: Target device or container path--apply: Apply tuning recommendations (dry-run by default)
Examples:
# Understanding encryption performance profiles
# Preview performance tuning without changing the system
sudo health-control encryption-tune --profile performance
→ Shows the kernel and device settings that --apply would write
→ Makes no changes
# Apply performance optimizations
sudo health-control encryption-tune --profile performance --apply
→ Applies the performance profile's I/O scheduler and queue depth
→ Enables hardware crypto acceleration
→ May require reboot for full effect
# Security-focused tuning (paranoid mode)
sudo health-control encryption-tune --profile security --apply
→ Applies the security profile's lower swappiness and cache pressure
→ Recommended for high-security environments
# Balanced profile (default)
sudo health-control encryption-tune --profile balanced
→ Good balance between performance and security
→ Shows recommendations without applying (add --apply to write them)
# Preview device-specific tuning for an external drive
sudo health-control encryption-tune --device /dev/DEVICE --profile balanced
→ Shows device I/O settings without applying them
# Check current tuning status
sudo health-control encryption-tune
→ Shows the balanced tuning plan
→ No changes made (preview is the default)
# JSON output for scripting
sudo health-control encryption-tune --json
→ Structured output with recommendations
→ Structured preview of the selected tuning profile
System Control
get-hostname
Get the current hostname
Usage:
health-control get-hostname
Examples:
health-control get-hostname
health-control get-hostname --json
change-hostname
Change hostname (prompts for new hostname)
Usage:
health-control change-hostname [OPTIONS]
Options:
<HOSTNAME>: New hostname to set
Examples:
sudo health-control change-hostname
sudo health-control change-hostname new-hostname
sudo health-control change-hostname --json
list-hostnames
List available hostnames by category
Usage:
health-control list-hostnames [OPTIONS]
Options:
-c, --category <CATEGORY>: Category to list (all, windows, linux, apple, network, mobile, iot, gaming, fiction, business)
Examples:
health-control list-hostnames
health-control list-hostnames --category all
health-control list-hostnames --category windows
health-control list-hostnames --category linux
health-control list-hostnames --category apple
health-control list-hostnames --category network
health-control list-hostnames --category mobile
health-control list-hostnames --category iot
health-control list-hostnames --category gaming
health-control list-hostnames --category fiction
health-control list-hostnames --json
set-random-hostname-category
Set a random hostname from a specific category
Usage:
health-control set-random-hostname-category [OPTIONS]
Options:
-c, --category <CATEGORY>: Category to select from (all, windows, linux, apple, network, mobile, iot, gaming, fiction, business)
Examples:
sudo health-control set-random-hostname-category
sudo health-control set-random-hostname-category --category windows
sudo health-control set-random-hostname-category --category linux
sudo health-control set-random-hostname-category --category apple
sudo health-control set-random-hostname-category --category network
sudo health-control set-random-hostname-category --category fiction --json
get-logged-user
Get the actual logged-in user (handles sudo correctly)
Usage:
health-control get-logged-user [OPTIONS]
Examples:
health-control get-logged-user
health-control get-logged-user --json
sudo health-control get-logged-user
sudo health-control get-logged-user --json-pretty
show-timezone
Show current system timezone
Usage:
health-control show-timezone [OPTIONS]
Examples:
health-control show-timezone
health-control show-timezone --json
sync-timezone
Sync timezone based on IP geolocation
Usage:
health-control sync-timezone [OPTIONS]
Examples:
sudo health-control sync-timezone
sudo health-control sync-timezone --json
sync-system-time
Synchronize the system clock through bounded direct NTP fallbacks
Usage:
health-control sync-system-time [OPTIONS]
Examples:
sudo health-control sync-system-time
sudo health-control sync-system-time --json
show-remote-timezone
Show timezone based on current IP location
Usage:
health-control show-remote-timezone [OPTIONS]
Examples:
health-control show-remote-timezone
health-control show-remote-timezone --json
set-timezone
Set system timezone
Usage:
health-control set-timezone [OPTIONS]
Options:
--timezone <TIMEZONE>: Timezone to set (e.g., America/New_York)
Examples:
sudo health-control set-timezone --timezone America/New_York
sudo health-control set-timezone --timezone Europe/London
sudo health-control set-timezone --timezone Asia/Tokyo --json
list-timezones
List available timezones by category
Usage:
health-control list-timezones [OPTIONS]
Options:
-c, --category <CATEGORY>: Category to list (all, africa, americas, asia, europe, australia, pacific, utc)
Examples:
health-control list-timezones
health-control list-timezones --category all
health-control list-timezones --category africa
health-control list-timezones --category americas
health-control list-timezones --category asia
health-control list-timezones --category europe
health-control list-timezones --category australia
health-control list-timezones --category pacific
health-control list-timezones --category utc
health-control list-timezones --json
set-random-timezone
Set a random timezone from a specific category
Usage:
health-control set-random-timezone [OPTIONS]
Options:
-c, --category <CATEGORY>: Category/region to select from (all, africa, americas, asia, europe, australia, pacific, utc)
Examples:
sudo health-control set-random-timezone
sudo health-control set-random-timezone --category americas
sudo health-control set-random-timezone --category europe
sudo health-control set-random-timezone --category asia
sudo health-control set-random-timezone --category africa
sudo health-control set-random-timezone --category pacific --json
play-sound
Play notification sound
Usage:
health-control play-sound [OPTIONS]
Options:
<SOUND>: Sound type to play: alert, success, warning, notification--sound <SOUND_FLAG>: Sound type (alternative to positional)-m, --format <FORMAT>: Sound format (mp3, wav, etc.)--debug: Enable debug output
Examples:
sudo health-control play-sound
sudo health-control play-sound --sound alert
sudo health-control play-sound success
sudo health-control play-sound warning -m mp3
sudo health-control play-sound alert --debug
notify
Send desktop notification
Usage:
health-control notify [OPTIONS]
Options:
--message <TITLE>: Notification title, the bold first line--body <TEXT>: Notification body, the smaller second line--duration <SECONDS>: How long the notification stays on screen--urgency <LEVEL>: Urgency level: low, normal or critical--notify-icon <PATH>: Path to the icon shown next to the notification
Examples:
health-control notify --message "Security check complete"
health-control notify --message "Hello from Kodachi"
health-control notify --message "Alert" --body "VPN connected"
health-control notify --message "Warning" --urgency critical --duration 30
health-control notify --message "Update" --notify-icon "/path/to/icon.png"
System Information
offline-info-system
Display comprehensive system information
Usage:
health-control offline-info-system [OPTIONS]
Examples:
sudo health-control offline-info-system
sudo health-control offline-info-system --json
offline-info-hardware
Display hardware information
Usage:
health-control offline-info-hardware [OPTIONS]
Examples:
sudo health-control offline-info-hardware
sudo health-control offline-info-hardware --json
offline-info-process
Display process information
Usage:
health-control offline-info-process [OPTIONS]
Examples:
sudo health-control offline-info-process
sudo health-control offline-info-process --json
offline-info-security
Display security and encryption status
Usage:
health-control offline-info-security [OPTIONS]
Examples:
sudo health-control offline-info-security
sudo health-control offline-info-security --json
offline-info-network
Display network information
Usage:
health-control offline-info-network [OPTIONS]
Examples:
sudo health-control offline-info-network
sudo health-control offline-info-network --json
offline-info-user
Display user information
Usage:
health-control offline-info-user [OPTIONS]
Examples:
sudo health-control offline-info-user
sudo health-control offline-info-user --json
offline-info-storage
Display storage information
Usage:
health-control offline-info-storage [OPTIONS]
Examples:
sudo health-control offline-info-storage
sudo health-control offline-info-storage --json
offline-info-services
Display system services information
Usage:
health-control offline-info-services [OPTIONS]
Examples:
sudo health-control offline-info-services
sudo health-control offline-info-services --json
offline-info-all
Display all system information (--json emits a TOP-LEVEL ARRAY of categories)
Usage:
health-control offline-info-all [OPTIONS]
Examples:
sudo health-control offline-info-all
sudo health-control offline-info-all --json
# --json emits a TOP-LEVEL ARRAY, not an object: iterate it
sudo health-control offline-info-all --json | jq '.[] | .category'
ping
Ping a random privacy-respecting target and return latency
Usage:
health-control ping [OPTIONS]
Examples:
health-control ping
health-control ping --json
process-age
Get process uptime for VPN or Tor
Usage:
health-control process-age [OPTIONS]
Options:
--process <NAME>: Process name: 'vpn' or 'tor'
Examples:
health-control process-age --process vpn
health-control process-age --process tor
health-control process-age --process vpn --json
health-control process-age --process tor --json
System Information & Offline Actions
offline-bluetooth
Enable/disable/check Bluetooth service
Usage:
health-control offline-bluetooth [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-bluetooth --action disable
sudo health-control offline-bluetooth --action enable
health-control offline-bluetooth --action check --json
offline-wifi
Manage WiFi connectivity
Usage:
health-control offline-wifi [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-wifi --action disable
sudo health-control offline-wifi --action enable
health-control offline-wifi --action check --json
offline-usb-storage
Manage USB storage devices
Usage:
health-control offline-usb-storage [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-usb-storage --action disable
sudo health-control offline-usb-storage --action enable
health-control offline-usb-storage --action check --json
offline-webcam
Manage webcam device
Usage:
health-control offline-webcam [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-webcam --action disable
sudo health-control offline-webcam --action enable
health-control offline-webcam --action check --json
offline-microphone
Manage microphone device. disable mutes ALSA capture and every current non-monitor desktop-session source, writes the mute again to any source that reads back unmuted, succeeds only after two consecutive all-muted reads, then installs the persistent guard. enable reverses it. check reports the policy state. refresh-guard (run by the package upgrade) rewrites only the guard files an earlier release wrote, while the guard is installed and verifies, and changes nothing else
Usage:
health-control offline-microphone [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check, refresh-guard
Examples:
sudo health-control offline-microphone --action disable
sudo health-control offline-microphone --action enable
health-control offline-microphone --action check --json
sudo health-control offline-microphone --action refresh-guard --json
offline-systemlogs
Manage system logging. disable sets the systemd manager log target to null and DefaultStandardOutput=null (persisted in /etc/systemd/system.conf.d/90-kodachi-logs-disabled.conf) and gives the Kodachi units that log to the journal explicitly, scheduled wipe units included (existing ones, and new ones as they are scheduled), a StandardOutput=null and StandardError=null drop-in (/etc/systemd/system/<unit>.d/90-kodachi-logs-disabled.conf), so the manager and those units do not fall back to the kernel log (a third-party unit that sets journal output itself can still log one line per start); restarts dnscrypt-proxy and ai-monitor while journald still runs when their output is a journal stream, so they never write to a dead one; then stops and masks syslog.socket (so rsyslog cannot be socket-activated again), rsyslog and systemd-journald and reads every unit back before reporting success. enable removes every logs drop-in it finds under /etc/systemd/system/*.d/ (also ones an older version wrote), restores the journal-or-kmsg log target, starts everything again and reconnects those two daemons; other services started while logs were disabled resume logging when they next restart, and enable lists the running ones still detached. check reports disabled while any drop-in is in place
Usage:
health-control offline-systemlogs [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-systemlogs --action disable
sudo health-control offline-systemlogs --action enable
health-control offline-systemlogs --action check --json
offline-cups
Manage CUPS printing service
Usage:
health-control offline-cups [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-cups --action disable # Disable printer service (CUPS)
sudo health-control offline-cups --action enable # Enable printer service (CUPS)
health-control offline-cups --action check --json
offline-networkmanager
Manage NetworkManager service
Usage:
health-control offline-networkmanager [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-networkmanager --action disable
sudo health-control offline-networkmanager --action enable
health-control offline-networkmanager --action check --json
offline-numlock
Manage NumLock configuration
Usage:
health-control offline-numlock [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-numlock --action enable
sudo health-control offline-numlock --action disable
health-control offline-numlock --action check --json
offline-cmdhistory
Manage command history
Usage:
health-control offline-cmdhistory [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-cmdhistory --action disable
sudo health-control offline-cmdhistory --action enable
health-control offline-cmdhistory --action check --json
offline-autologin
Enable/disable/check auto-login functionality
Usage:
health-control offline-autologin [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-autologin --action disable
sudo health-control offline-autologin --action enable
health-control offline-autologin --action check --json
offline-screen-lock
Manage screen locking
Usage:
health-control offline-screen-lock [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-screen-lock --action enable
sudo health-control offline-screen-lock --action disable
health-control offline-screen-lock --action check --json
offline-fdlimit
Enable/disable/check file descriptor limits
Usage:
health-control offline-fdlimit [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check--soft-limit <LIMIT>: Soft limit value--hard-limit <LIMIT>: Hard limit value
Examples:
sudo health-control offline-fdlimit --action enable --soft-limit 1024 --hard-limit 4096
sudo health-control offline-fdlimit --action disable
health-control offline-fdlimit --action check --json
offline-netoptimize
Enable/disable/check network optimization
Usage:
health-control offline-netoptimize [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-netoptimize --action enable
sudo health-control offline-netoptimize --action disable
health-control offline-netoptimize --action check --json
offline-bbr
Enable/disable/check BBR congestion control
Usage:
health-control offline-bbr [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-bbr --action enable
sudo health-control offline-bbr --action disable
health-control offline-bbr --action check --json
offline-ifspeed
Enable/disable/check interface speed optimization
Usage:
health-control offline-ifspeed [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check--interface <INTERFACE>: Network interface to configure (e.g., eth0, wlan0)--speed <SPEED>: Interface speed in Mbps (e.g., 1000 for gigabit)--force: Allow enable/disable to touch the active default-route (management/SSH) interface
Examples:
sudo health-control offline-ifspeed --action enable --interface eth0 --speed 1000
sudo health-control offline-ifspeed --action disable
health-control offline-ifspeed --action check --json
sudo health-control offline-ifspeed --action enable --interface wlan0
sudo health-control offline-ifspeed --action disable --interface eth0 --force
offline-avahi
Manage Avahi daemon service
Usage:
health-control offline-avahi [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-avahi --action disable
sudo health-control offline-avahi --action enable
health-control offline-avahi --action check --json
offline-modem-manager
Manage ModemManager service
Usage:
health-control offline-modem-manager [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-modem-manager --action disable
sudo health-control offline-modem-manager --action enable
health-control offline-modem-manager --action check --json
offline-ssh
Manage SSH daemon service
Usage:
health-control offline-ssh [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-ssh --action disable
sudo health-control offline-ssh --action enable
health-control offline-ssh --action check --json
offline-apache
Manage Apache web server service
Usage:
health-control offline-apache [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-apache --action disable
sudo health-control offline-apache --action enable
health-control offline-apache --action check --json
offline-nginx
Manage Nginx web server service
Usage:
health-control offline-nginx [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-nginx --action disable
sudo health-control offline-nginx --action enable
health-control offline-nginx --action check --json
offline-docker
Manage Docker container service
Usage:
health-control offline-docker [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-docker --action disable
sudo health-control offline-docker --action enable
health-control offline-docker --action check --json
offline-mysql
Manage MySQL database service
Usage:
health-control offline-mysql [OPTIONS]
Options:
--action <ACTION>: Action to perform: enable, disable, check
Examples:
sudo health-control offline-mysql --action disable
sudo health-control offline-mysql --action enable
health-control offline-mysql --action check --json
System Maintenance
auto-updates-enable
Enable automatic security updates
Usage:
health-control auto-updates-enable [OPTIONS]
Examples:
sudo health-control auto-updates-enable
sudo health-control auto-updates-enable --json
auto-updates-disable
Disable automatic security updates
Usage:
health-control auto-updates-disable [OPTIONS]
Examples:
sudo health-control auto-updates-disable
sudo health-control auto-updates-disable --json
auto-updates-status
Check automatic updates status
Usage:
health-control auto-updates-status [OPTIONS]
Examples:
sudo health-control auto-updates-status
sudo health-control auto-updates-status --json
system-maintenance-enable
Enable system maintenance settings
Usage:
health-control system-maintenance-enable [OPTIONS]
Examples:
sudo health-control system-maintenance-enable
sudo health-control system-maintenance-enable --json
system-maintenance-disable
Disable system maintenance settings
Usage:
health-control system-maintenance-disable [OPTIONS]
Examples:
sudo health-control system-maintenance-disable
sudo health-control system-maintenance-disable --json
system-maintenance-status
Check system maintenance status
Usage:
health-control system-maintenance-status [OPTIONS]
Examples:
health-control system-maintenance-status
health-control system-maintenance-status --json
password-policy-enable
Enable password policy enforcement
Usage:
health-control password-policy-enable [OPTIONS]
Examples:
sudo health-control password-policy-enable
sudo health-control password-policy-enable --json
password-policy-disable
Disable password policy enforcement
Usage:
health-control password-policy-disable [OPTIONS]
Examples:
sudo health-control password-policy-disable
sudo health-control password-policy-disable --json
password-policy-status
Check password policy status
Usage:
health-control password-policy-status [OPTIONS]
Examples:
sudo health-control password-policy-status
sudo health-control password-policy-status --json
user-security-enable
Enable user security hardening
Usage:
health-control user-security-enable [OPTIONS]
Examples:
sudo health-control user-security-enable
sudo health-control user-security-enable --json
user-security-disable
Disable user security hardening
Usage:
health-control user-security-disable [OPTIONS]
Examples:
sudo health-control user-security-disable
sudo health-control user-security-disable --json
user-security-status
Check user security status
Usage:
health-control user-security-status [OPTIONS]
Examples:
sudo health-control user-security-status
sudo health-control user-security-status --json
2fa-enable
Enable two-factor authentication
Usage:
health-control 2fa-enable [OPTIONS]
Options:
--value <USERNAME>: Target user (optional, defaults to all users)
Examples:
# WARNING: 2FA has known bugs with XFCE/LightDM login.
# Works reliably for SSH and sudo. Unreliable for XFCE login and the lock screen.
sudo health-control 2fa-enable
sudo health-control 2fa-enable --value $(id -un) --json
# Note: $(id -un) writes the current username into shell history.
2fa-disable
Disable two-factor authentication
Usage:
health-control 2fa-disable [OPTIONS]
Examples:
# Use this to recover if 2FA locked you out of the XFCE/LightDM login.
sudo health-control 2fa-disable
sudo health-control 2fa-disable --json
2fa-status
Check two-factor authentication status
Usage:
health-control 2fa-status [OPTIONS]
Examples:
# ⚠️ WARNING: 2FA has known bugs with XFCE/LightDM login!
# Works reliably for: SSH, sudo | Unreliable for: XFCE login, lock screen
health-control 2fa-status
health-control 2fa-status --json
check-and-install
Check and install required packages
Usage:
health-control check-and-install [OPTIONS]
Options:
<PACKAGES>: Packages to check and install
Examples:
sudo health-control check-and-install tor openvpn
sudo health-control check-and-install rkhunter chkrootkit --json
check-and-install-do
Execute installation after checking dependencies
Usage:
health-control check-and-install-do [OPTIONS]
Examples:
sudo health-control check-and-install-do
sudo health-control check-and-install-do --json
package-cleanup
Clean up unnecessary packages
Usage:
health-control package-cleanup [OPTIONS]
Examples:
sudo health-control package-cleanup
sudo health-control package-cleanup --json
clear-cache
Clear system memory caches
Usage:
health-control clear-cache [OPTIONS]
Options:
--level <LEVEL>: Cache level to clear (1, 2, or 3)
Examples:
sudo health-control clear-cache
sudo health-control clear-cache --level 1
sudo health-control clear-cache --level 2
sudo health-control clear-cache --level 3
sudo health-control clear-cache --json
System Recovery
fix-sudo
Fix broken sudo permissions (uses pkexec/su, no sudo required)
Usage:
health-control fix-sudo [OPTIONS]
Examples:
sudo health-control fix-sudo
sudo health-control fix-sudo --json
# This command tries pkexec first, then su -c, to fix sudo without sudo
check-sudo
Check sudo installation status and permissions
Usage:
health-control check-sudo [OPTIONS]
Examples:
sudo health-control check-sudo
sudo health-control check-sudo --json
USB Security
usb-status
Check USB Guard protection status
Usage:
health-control usb-status [OPTIONS]
Examples:
sudo health-control usb-status
sudo health-control usb-status --json
usb-guard-enable
Enable USB Guard protection
Usage:
health-control usb-guard-enable [OPTIONS]
Examples:
sudo health-control usb-guard-enable
sudo health-control usb-guard-enable --json
usb-guard-disable
Disable USB Guard protection
Usage:
health-control usb-guard-disable [OPTIONS]
Examples:
sudo health-control usb-guard-disable
sudo health-control usb-guard-disable --json
usb-policy
Manage USB device policies
Usage:
health-control usb-policy [OPTIONS]
Options:
--action <ACTION>: Action: add, remove, list--device-id <ID>: Device ID (vendor:product)--allow: Allow device
Examples:
sudo health-control usb-policy --action list
sudo health-control usb-policy --action add --device-id 1234:5678 --allow
sudo health-control usb-policy --action remove --device-id 1234:5678
usb-monitor
Watch USB connection changes for a bounded duration
Usage:
health-control usb-monitor [OPTIONS]
Options:
--duration <SECONDS>: Watch duration in seconds
Examples:
sudo health-control usb-monitor
sudo health-control usb-monitor --duration 30
sudo health-control usb-monitor --duration 30 --json
usb-history
View USB device connection history
Usage:
health-control usb-history [OPTIONS]
Options:
--days <DAYS>: Number of days of history to show--device-id <ID>: Filter by specific device ID
Examples:
sudo health-control usb-history
sudo health-control usb-history --days 30
sudo health-control usb-history --device-id 1234:5678
sudo health-control usb-history --json
usb-whitelist
Manage USB device whitelist
Usage:
health-control usb-whitelist [OPTIONS]
Options:
--action <ACTION>: Action: add, remove, list, import, export, clear, repair-policy, upgrade-policy--device-id <ID>: Device ID (vendor:product)--file <PATH>: File path for import/export
Examples:
# Find device IDs first (use lsusb)
lsusb # Shows vendor:product IDs (e.g., 1234:5678)
→ Bus 003 Device 002: ID 1234:5678 Vendor Name Product Name
# List current whitelist
sudo health-control usb-whitelist --action list
→ Shows all whitelisted device IDs
# Add device to whitelist
sudo health-control usb-whitelist --action add --device-id 1234:5678
→ Device allowed to connect automatically
# Remove device from whitelist
sudo health-control usb-whitelist --action remove --device-id 1234:5678
→ Device will be blocked on next connection
# Export whitelist (backup configuration)
sudo health-control usb-whitelist --action export --file ~/usb-whitelist-backup.json
→ Saves whitelist to JSON file for backup/transfer
# Import whitelist (restore configuration)
sudo health-control usb-whitelist --action import --file ~/usb-whitelist-backup.json
→ Restores whitelist from JSON backup file
# Clear all whitelisted devices
sudo health-control usb-whitelist --action clear
⚠️ WARNING: Removes ALL whitelisted devices - use with caution!
# Repair the base policy (composite mice/mics getting blocked?)
sudo health-control usb-whitelist --action repair-policy
→ Installs the canonical block-first policy if the on-disk one is
missing/empty or the legacy 'equals' policy; keeps your whitelist
and backs up the old file. Safe no-op if already current.
# Upgrade an unmodified older Kodachi policy (what an apt upgrade runs)
sudo health-control usb-whitelist --action upgrade-policy
→ Writes the current policy (built-in Bluetooth allowed) ONLY when the
on-disk one is an unmodified earlier Kodachi policy; never restarts
USB Guard, so it takes effect at the next boot.
# JSON output for scripting
sudo health-control usb-whitelist --action list --json
Operational Scenarios
Scenario-oriented workflows generated from the binary's built-in -e --json examples.
Scenario 1: Network Connectivity
Test network connectivity and configuration
Step 1: Full connectivity check: IP ping + DNS + HTTP probe
sudo health-control net-check
Step 2: Full check via the extended HTTP path with per-target verbose reporting
sudo health-control net-check --http
Step 3: Full connectivity check with JSON output for automation
sudo health-control net-check --json
Step 4: Extended HTTP check path with JSON output
sudo health-control net-check --http --json
Step 5: Check IP ping only, skip DNS lookups and HTTP probe
sudo health-control net-check --ip-only
Note
Mutually exclusive with --domain-only and --http-only.
Step 6: Check DNS resolution only, skip IP ping and HTTP probe
sudo health-control net-check --domain-only
Note
Mutually exclusive with --ip-only and --http-only.
Step 7: Check HTTP reachability only, skip IP ping and DNS lookups
sudo health-control net-check --http-only
Note
Mutually exclusive with --ip-only and --domain-only.
Step 8: HTTP-only reachability check with JSON output
sudo health-control net-check --http-only --json
Step 9: Full connectivity check with a custom 15 second timeout
sudo health-control net-check --timeout 15
Step 10: IP-only ping check with JSON output
sudo health-control net-check --ip-only --json
Step 11: Domain-only DNS check with a custom 20 second timeout
sudo health-control net-check --domain-only --timeout 20
Step 12: Show IPs used for connectivity testing
sudo health-control list-ips
Step 13: Show domains used for connectivity testing
sudo health-control list-domains
Step 14: Dedicated HTTP connectivity probe with a custom timeout in seconds
sudo health-control net-check-http --timeout 10
Note
--timeout defaults to 10 seconds when omitted.
Scenario 2: Internet Traffic Control
Block and unblock internet traffic
Step 1: Block internet using auto-detected method (tries nftables, then iptables, then UFW, then interfaces)
sudo health-control block-internet
Note
Without --method specified, health-control automatically selects the best available method
Step 2: Block using iptables firewall rules
sudo health-control block-internet --method iptables
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 3: Block using nftables firewall rules (preferred modern firewall)
sudo health-control block-internet --method nftables
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 4: Block using UFW (Uncomplicated Firewall)
sudo health-control block-internet --method firewall
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 5: Block by disabling network interfaces
sudo health-control block-internet --method interfaces
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 6: Block using ALL methods (UFW, nftables, iptables, and interfaces)
sudo health-control block-internet --method all
Note
Applies all available blocking methods for maximum security
Step 7: Block internet but allow local network traffic
sudo health-control block-internet --allow-local
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 8: Block internet with JSON output
sudo health-control block-internet --json
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 9: Block internet with iptables, allow local, JSON output
sudo health-control block-internet --method iptables --allow-local --json
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 10: Block using ALL methods but allow local network traffic
sudo health-control block-internet --method all --allow-local
Note
DESTRUCTIVE TO CONNECTIVITY: this severs internet access for the whole machine, including whatever is running in the background (downloads, Tor circuits, VPN). Restore it with 'sudo health-control unblock-internet' or 'sudo health-control recover-internet'. --allow-local keeps LAN/loopback reachable so you do not lock yourself out of an SSH session.
Step 11: Unblock internet traffic
sudo health-control unblock-internet
Step 12: Unblock using nftables specifically
sudo health-control unblock-internet --method nftables
Step 13: Unblock using iptables specifically
sudo health-control unblock-internet --method iptables
Step 14: Unblock using UFW specifically
sudo health-control unblock-internet --method firewall
Step 15: Unblock ALL methods (clears UFW, nftables, iptables, and re-enables interfaces)
sudo health-control unblock-internet --method all
Note
Ensures complete restoration by clearing all possible blocks
Step 16: Unblock internet with JSON output
sudo health-control unblock-internet --json
Step 17: Block OUTBOUND ICMP echo-requests (ping) for both IPv4 and IPv6. Inserts a DROP rule in the iptables/ip6tables OUTPUT chain so this host can no longer ping out, while all normal TCP/UDP traffic (web, DNS, apps) keeps working
sudo health-control block-ping
Note
Equivalent to: sudo iptables -I OUTPUT -p icmp --icmp-type echo-request -j DROP AND sudo ip6tables -I OUTPUT -p ipv6-icmp --icmpv6-type echo-request -j DROP. Idempotent, running it twice does not add duplicate rules. Use this to reduce the host's network fingerprint (stealth) without killing connectivity.
Step 18: Block ping for IPv4 only (iptables), leave IPv6 ICMP untouched
sudo health-control block-ping --family ipv4
Note
Equivalent to: sudo iptables -I OUTPUT -p icmp --icmp-type echo-request -j DROP
Step 19: Block ping for IPv6 only (ip6tables)
sudo health-control block-ping --family ipv6
Note
Equivalent to: sudo ip6tables -I OUTPUT -p ipv6-icmp --icmpv6-type echo-request -j DROP. Reports 'unavailable' if ip6tables is absent (IPv6 disabled).
Step 20: Block ping with JSON output (per-family result envelope)
sudo health-control block-ping --json
Step 21: Unblock OUTBOUND ICMP echo-requests (ping), removes the DROP rule(s) for both IPv4 and IPv6 so this host can ping out again
sudo health-control unblock-ping
Note
Equivalent to: sudo iptables -D OUTPUT -p icmp --icmp-type echo-request -j DROP AND sudo ip6tables -D OUTPUT -p ipv6-icmp --icmpv6-type echo-request -j DROP. Removes every duplicate copy of the rule; safe to run when no rule exists (reports 'already-unblocked').
Step 22: Unblock ping for IPv4 only
sudo health-control unblock-ping --family ipv4
Note
Equivalent to: sudo iptables -D OUTPUT -p icmp --icmp-type echo-request -j DROP
Step 23: Unblock ping for IPv6 only with JSON output
sudo health-control unblock-ping --family ipv6 --json
Step 24: Check current internet blocking status
sudo health-control internet-status
Step 25: Check if internet traffic is blocked with JSON output
sudo health-control internet-status --json
Step 26: ARM the emergency kill switch - raise the high-alert state flag (does not monitor; use a watch-guard for automatic response)
sudo health-control kill-switch-arm
Note
HIGH-ALERT STATE FLAG. Arming does NOT monitor anything: it starts no watcher and no daemon, and nothing activates panic mode on its own. Firing the kill switch stays manual (kill-switch-activate). What arming actually does: • Records the high-alert state so other components can see it • While armed, tor-switch will not force firewall policies back to ACCEPT during detorrify, so an existing protective DROP policy is not silently torn down. Arming does not itself block any traffic • Is read by security scoring, but the comprehensive scorer credits it ONLY when egress is actually denied by the firewall. Armed without an enforced default-deny scores zero For an automatic kill switch that reacts on its own, enable a watch-guard instead. It runs a daemon and blocks the network when the trigger fires. A VPN watch fires on any change of VPN state, a drop or a new connection, so enable it while the VPN is connected: sudo health-control enable --type watch-guard --watch vpn --method nftables
Step 27: DISARM the kill switch (clear the high-alert flag)
sudo health-control kill-switch-disarm
Note
Clears the high-alert state flag (no monitoring was running). Use after the threat has passed or on a false alarm.
Step 28: Check whether the kill switch high-alert flag is armed or disarmed
health-control kill-switch-status
Note
READ-ONLY: Just displays current state, takes no action
Step 29: IMMEDIATELY activate kill switch (default: medium panic)
sudo health-control kill-switch-activate
Note
IMMEDIATE ACTION: Unlike 'arm', this executes panic NOW. Prompts for confirmation. Use --level soft/medium/hard
Step 30: IMMEDIATE soft panic (NO confirmation)
sudo health-control panic-soft
Note
Actions: Kill network, clear clipboard (adaptive: wl-copy/xclip/xsel for Wayland/X11), lock screen. Reversible.
Step 31: IMMEDIATE medium panic (WITH confirmation)
sudo health-control panic-medium
Note
Actions: Kill network, clear clipboard, terminate non-essential processes, clear memory caches, unmount devices, lock screen. panic-recover restores the saved firewall, services and interfaces; ended processes and unmounted devices are not brought back.
Step 32: IMMEDIATE hard panic with SHUTDOWN (WITH confirmation)
sudo health-control panic-hard
Note
CRITICAL: Kill network, clear clipboard and memory caches, unmount external devices, force the power off, then start a fast RAM wipe that runs only until the power goes, and end the non-essential processes. The forced power-off skips the shutdown steps, so the installed shutdown wipe does not run. No screen lock. IRREVERSIBLE!
Step 33: Recover from panic mode
sudo health-control panic-recover
Note
Restores the firewall, services and interfaces a Soft or Medium panic saved; refuses when no recovery journal exists. Unmounted volumes are not remounted.
Step 34: ⚠️ Immediately kill ALL network connectivity (emergency cut-off)
sudo health-control kill-network
Note
⚠️ DANGEROUS: Severs all networking instantly. Takes no arguments. Use recover-internet to restore connectivity (panic-recover only restores what a Soft or Medium panic saved).
Scenario 3: Watch-Guard Management
The auto kill switch: watch one thing, cut the internet when it changes. A watch-guard always runs as a persistent daemon. --watch accepts 9 types: ip, timezone, interfaces, process (needs --target), mac, hostname, vpn, dns, firewall-rules (off unless you enable it: when the Tor firewall rules are flushed or deleted it asks tor-switch to check and restore them, and never blocks). --method chooses how the block is applied: nftables, iptables, firewall, interfaces, auto or all. All watch-guard commands need root.
Step 1: Automatic kill switch: cut the internet on any change of VPN state, such as a drop. Enable it while the VPN is connected
sudo health-control enable --type watch-guard --watch vpn --method nftables
Note
This is the auto kill switch. A daemon polls the tunnel every 5s and blocks the network on any change of VPN state, then verifies the block actually took effect. Watch-guards always run as a persistent daemon, so no extra flag is needed.
Step 2: Block internet if the external IP changes
sudo health-control enable --type watch-guard --watch ip --method nftables
Note
Blocks internet using nftables if external IP changes. For tunnel-drop protection use --watch vpn instead.
Step 3: Enable watch-guard for timezone changes
sudo health-control enable --type watch-guard --watch timezone --method iptables
Note
Polls the timezone setting every 10 seconds and blocks when it changes. The clock itself is not watched
Step 4: Monitor network interfaces for changes
sudo health-control enable --type watch-guard --watch interfaces --method firewall
Note
Blocks if new interfaces appear or existing ones change
Step 5: Monitor Tor process and block if it dies
sudo health-control enable --type watch-guard --watch process --target tor --method interfaces
Note
Polls every 5 seconds, so traffic can leave outside Tor for up to about 5 seconds after a crash
Step 6: Monitor Firefox and use all block methods if it stops
sudo health-control enable --type watch-guard --watch process --target firefox --method all
Note
Maximum blocking using all available methods
Step 7: Block internet if the DNS resolver configuration changes under you
sudo health-control enable --type watch-guard --watch dns --method nftables
Note
Leak guard: a resolver swap (rogue DHCP, a VPN client rewriting resolv.conf) is a DNS-leak precursor. Blocks the network when it happens.
Step 8: Block internet if a network interface MAC address changes
sudo health-control enable --type watch-guard --watch mac --method auto
Note
Anonymity guard: catches an unexpected MAC change (for example a re-randomisation you did not ask for) that would re-identify you on the local network.
Step 9: Block internet if the system hostname changes
sudo health-control enable --type watch-guard --watch hostname --method auto
Note
Anonymity guard: the hostname leaks into DHCP and mDNS. Valid --watch values are ip, timezone, interfaces, process, mac, hostname, vpn, dns and firewall-rules.
Step 10: Put the Tor firewall back if something flushes or deletes its rules
sudo health-control enable --type watch-guard --watch firewall-rules --method auto
Note
Off by default and never blocks: when the Tor rules are removed it logs the event and asks tor-switch firewall-guard to re-apply the torrify recorded in this boot. --method is required by enable but not used by this watch.
Step 11: Show all active watch-guards, their trigger counts and their config ids
sudo health-control watch-guard status
Note
This is where you read the config id that 'health-control daemon --config-id <ID>' needs.
Step 12: Disable IP watch-guard and unblock internet
sudo health-control disable --type watch-guard ip
Note
Automatically unblocks internet unless --no-unblock used
Step 13: Disable all watch-guards but keep internet blocked
sudo health-control disable --type watch-guard all --no-unblock
Note
Use when you want manual control over unblocking
Step 14: Run watch-guard monitoring as a persistent daemon process
sudo health-control daemon --config-id "$WATCHGUARD_CONFIG_ID"
Note
--config-id is required and comes from the 'watch-guard status' output. Add --json for machine-readable output. Long-running foreground process intended for service supervision.
Step 15: Same thing with the id pasted in literally, after reading it from watch-guard status
sudo health-control daemon --config-id <ID>
Note
Run 'sudo health-control watch-guard status' first to get <ID>. This command does not return: run it under a service unit or in a background shell.
Scenario 4: Network Recovery
Diagnose and fix connectivity issues
Step 1: Automatically diagnose and fix connectivity issues
sudo health-control recover-internet
Step 2: Include DNS resolution testing and fixes
sudo health-control recover-internet --check-dns
Step 3: Force recovery even if connectivity appears working
sudo health-control recover-internet --force
Step 4: Run full internet recovery without desktop/terminal notifications
sudo health-control recover-internet --silent
Note
Also supports --skipnotification, --skip-notification, and typo-compatible --skipnotifcation
Step 5: Fast recovery: bounce interface + restart NetworkManager + DHCP renew
sudo health-control fast-recover-internet
Note
Lightweight alternative to recover-internet: tries a quick fix, then runs the full 10-method recovery if still offline
Step 6: Run fast recovery without desktop/terminal notifications
sudo health-control fast-recover-internet --silent
Note
Also supports --skipnotification, --skip-notification, and typo-compatible --skipnotifcation
Step 7: Fast recovery with JSON output
sudo health-control fast-recover-internet --json
Step 8: Restart NetworkManager and verify it is active
sudo health-control network-manager-restart
Note
Refuses with exit 1 when Disable network management (offline-networkmanager) has masked NetworkManager; it never unmasks
Step 9: NetworkManager restart with JSON output
sudo health-control network-manager-restart --json
Scenario 5: Timezone Management
Manage system timezone settings
Step 1: Sync timezone based on IP geolocation
sudo health-control sync-timezone
Step 2: Show current system timezone
health-control show-timezone
Step 3: Set specific timezone
sudo health-control set-timezone --timezone "America/New_York"
Step 4: Show timezone based on current IP location
health-control show-remote-timezone
Step 5: List all timezone categories
health-control list-timezones
Step 6: List all available timezones
health-control list-timezones --category all
Step 7: List African timezones
health-control list-timezones --category africa
Step 8: List American timezones
health-control list-timezones --category americas
Step 9: List Asian timezones
health-control list-timezones --category asia
Step 10: List European timezones
health-control list-timezones --category europe
Step 11: List Australian timezones
health-control list-timezones --category australia
Step 12: List Pacific timezones
health-control list-timezones --category pacific
Step 13: List UTC timezones
health-control list-timezones --category utc
Step 14: List timezone categories in JSON format
health-control list-timezones --json
Step 15: Set a random timezone from all available
sudo health-control set-random-timezone
Note
Requires sudo privileges
Step 16: Set random American timezone
sudo health-control set-random-timezone --category americas
Note
Requires sudo privileges
Step 17: Set random European timezone
sudo health-control set-random-timezone --category europe
Note
Requires sudo privileges
Step 18: Set random Asian timezone
sudo health-control set-random-timezone --category asia
Note
Requires sudo privileges
Step 19: Set random African timezone
sudo health-control set-random-timezone --category africa
Note
Requires sudo privileges
Step 20: Set random Pacific timezone with JSON output
sudo health-control set-random-timezone --category pacific --json
Note
Requires sudo privileges
Scenario 6: MAC Address Management
Change and manage MAC addresses
Step 1: Change MAC addresses for every interface except the one carrying the default route
sudo health-control mac-change-all
Note
The interface carrying your traffic keeps its MAC so the connection stays up. On a laptop with only Wi-Fi this changes nothing; use --include-active. Undo with 'sudo health-control mac-reset-all'.
Step 2: Change MAC addresses for every interface, including the active one while VPN and Tor are off
sudo health-control mac-change-all --include-active
Note
The active link drops for a few seconds and reconnects. Nothing is torn down: with VPN or Tor on, the active interface is kept and the output names --force as the remedy.
Step 3: Change every MAC address, tearing down VPN and Tor protection first
sudo health-control mac-change-all --force
Note
Disconnects VPN routing and Tor before changing the active interface, and restores nothing: reconnect afterwards.
Step 4: Change MAC addresses on a timer, every 120 minutes, until disabled
sudo health-control mac-rotation --enable --interval-minutes 120
Note
Off by default. Each rotation changes the interface carrying your traffic only while VPN and Tor are off. When that happens, the connection drops for a few seconds and can get a new address. Stop it with 'sudo health-control mac-rotation --disable'.
Step 5: Show whether timed MAC rotation is on, and its interval
health-control mac-rotation --status
Step 6: List saved Wi-Fi profiles marked as hidden networks
health-control wifi-hidden-audit
Note
A hidden-network profile makes this machine call out that network's name wherever it is. The audit changes nothing itself.
Step 7: Force change MAC addresses
sudo health-control mac-force-change
Note
Use when regular change fails
Step 8: Change MAC for specific interface
sudo health-control mac-change-specific --interface eth0
Step 9: Show all network interfaces
sudo health-control mac-show-interfaces
Step 10: Show current MAC addresses
sudo health-control mac-show-macs
Step 11: Reset all MACs to original values
sudo health-control mac-reset-all
Note
Restores the hardware (permanent) MAC on every interface, which de-anonymises you on the local network again. Interfaces bounce, so live connections drop.
Step 12: Show active network interface
sudo health-control mac-active-interface
Scenario 7: Hostname Management
Get and set system hostname
Step 1: Get current system hostname
sudo health-control get-hostname
Step 2: Get hostname in JSON format
sudo health-control get-hostname --json
Step 3: Get the actual logged-in user (handles sudo correctly)
health-control get-logged-user
Note
Returns actual user even when run with sudo
Step 4: Get logged user with additional info in JSON format
health-control get-logged-user --json
Step 5: Set default system hostname
sudo health-control set-default-hostname
Step 6: Set random hostname for privacy
sudo health-control set-random-hostname
Step 7: Set random hostname with JSON output
sudo health-control set-random-hostname --json
Step 8: Set custom hostname
sudo health-control set-custom-hostname --name MyHost
Step 9: Set descriptive custom hostname
sudo health-control set-custom-hostname --name privacy-machine
Step 10: Set custom hostname with JSON output
sudo health-control set-custom-hostname --name secure-workstation --json
Step 11: List all hostname categories
health-control list-hostnames
Step 12: List all available hostnames
health-control list-hostnames --category all
Step 13: List Windows hostnames
health-control list-hostnames --category windows
Step 14: List Linux hostnames
health-control list-hostnames --category linux
Step 15: List Apple/Mac hostnames
health-control list-hostnames --category apple
Step 16: List hostname categories in JSON format
health-control list-hostnames --json
Step 17: Set random hostname from all categories
sudo health-control set-random-hostname-category
Step 18: Set random Windows hostname
sudo health-control set-random-hostname-category --category windows
Step 19: Set random Linux hostname
sudo health-control set-random-hostname-category --category linux
Step 20: Set random fictional hostname with JSON output
sudo health-control set-random-hostname-category --category fiction --json
Step 21: Set the system hostname to a specific value
sudo health-control change-hostname mylaptop
Note
HOSTNAME positional argument is optional; when omitted a hostname is generated/applied per default behavior.
Scenario 8: IPv6 Management
Control and monitor IPv6 protocol settings
Step 1: Check current IPv6 configuration status
health-control ipv6-status
Note
Shows runtime status, boot config, and active interfaces
Step 2: Disable IPv6 system-wide (sysctl and GRUB)
sudo health-control ipv6-disable
Note
Reboot recommended for full effect
Step 3: Enable IPv6 system-wide
sudo health-control ipv6-enable
Note
Reboot recommended for full effect
Step 4: Get detailed IPv6 status in JSON format
health-control ipv6-status --json
Scenario 9: Security Hardening
Apply and verify comprehensive security settings (7 modules: kernel, process, filesystem, network, memory, monitoring, sandboxing)
Step 1: Apply standard security hardening (network-safe): kernel hardening, process isolation, filesystem security, memory protection, monitoring, sandboxing - PRESERVES internet connectivity
sudo health-control security-harden
Note
Standard profile maintains system usability and network connectivity
Step 2: Apply MEDIUM profile - Enhanced security with hidepid, hardened_malloc, file integrity monitoring. Browsers and internet still work
sudo health-control security-harden --profile medium
Note
Medium profile adds hidepid=2, hardened_malloc, dirty_ratio tuning, file integrity. May increase memory on LUKS systems
Step 3: Apply PARANOID profile - WARNING: WILL BREAK browsers and internet: disables user namespaces, IP forwarding, DNS firewall, MAC spoofing
sudo health-control security-harden --profile paranoid
Note
⚠️ BROWSERS AND INTERNET DISABLED - Disabling user namespaces also breaks oniux Tor process isolation, browser sandboxes and bubblewrap (bwrap). To recover: sudo health-control security-recover (recover-internet restores networking only, NOT user namespaces)
Step 4: Apply paranoid profile plus break-monitoring mode: forces /sys/class/net to root-only and breaks non-root monitoring tools (btop/conky/dashboard)
sudo health-control security-harden --break-monitoring
Note
⚠️ ALSO BREAKS NON-ROOT MONITORING - Use only when this behavior is explicitly required
Step 5: Check if all 7 security modules are enabled and properly configured
sudo health-control security-verify
Note
Use after security-harden to verify settings are applied
Step 6: Apply only specific modules (kernel sysctl and filesystem)
sudo health-control security-harden --modules kernel,filesystem
Note
Modules: kernel, process, filesystem, network, memory, monitoring, sandboxing
Step 7: Temporarily revert security hardening (keeps framework ready for quick re-hardening)
sudo health-control security-recover
Note
Use for troubleshooting. Framework remains enabled for easy re-hardening with security-harden.
Step 8: Recover only specific security modules
sudo health-control security-recover --modules network,kernel
Note
Available modules: kernel, filesystem, network, memory, monitoring, smt
Step 9: Revert all hardening and clear the saved security state
sudo health-control security-reset
Note
Unlike security-recover, this also clears the saved state. Run security-harden to turn it back on; there is no prompt.
Step 10: The same as security-reset: there is no confirmation prompt
sudo health-control security-reset --force
Note
--force is kept for old scripts and changes nothing
Step 11: Enable system security monitoring (auditd, LKRG, file integrity, auth events)
sudo health-control monitoring-enable
Note
Starts auditd and loads LKRG when they are installed, runs aide --init once, starts the hourly file integrity timer and writes an rsyslog rule for auth events. It installs no package
Step 12: Disable system security monitoring services
sudo health-control monitoring-disable
Note
Stops all security monitoring services - reduces system overhead but decreases security visibility
Step 13: Check current system security monitoring status
sudo health-control monitoring-status
Note
Shows LKRG, the file integrity timer and the auditd service (listed as auth_monitoring)
Step 14: Enable Tirdad kernel module for TCP ISN randomization
sudo health-control tirdad-enable
Note
Randomizes TCP Initial Sequence Numbers through a kernel module. Refused under kernel lockdown or signature enforcement
Step 15: Disable Tirdad TCP ISN randomization module
sudo health-control tirdad-disable
Note
Restores default TCP ISN generation
Step 16: Check Tirdad TCP ISN randomization module status
health-control tirdad-status
Note
Shows if kernel module is loaded and TCP ISN randomization is active
Step 17: Check disk encryption status
sudo health-control disk-encryption-status
Note
Lists crypttab entries, active dm-crypt mappings, LUKS headers with their version, encrypted mounts and swap state
Step 18: List all USB devices
sudo health-control usb-list
Note
Shows all connected USB devices with vendor/product IDs for security auditing
Step 19: Create unencrypted live-boot persistence media
sudo health-control create-persistence
Note
Creates a 4GB unencrypted ext4 persistence image named 'persistence' with a root persistence.conf of '/ union' so /opt, /etc, and other system paths survive reboots on Kodachi live USBs. Use --encrypted for LUKS encryption or --size to change size.
Step 20: Create encrypted persistence (interactive)
sudo health-control create-persistence --encrypted
Note
Creates LUKS2-encrypted Debian live-boot persistence media named 'persistence' and writes '/ union' to persistence.conf. Secure method - password not visible in history.
Step 21: Create encrypted persistence with a hidden interactive password prompt
read -rsp 'Persistence password: ' PERSISTENCE_PASSWORD && printf '\n' && sudo health-control create-persistence --encrypted --password "$PERSISTENCE_PASSWORD" && unset PERSISTENCE_PASSWORD
Note
The password is read without terminal echo and is never embedded in the catalog or shell history. The variable is cleared after a successful command.
Step 22: Show overall encryption status
sudo health-control encryption-status
Note
Counts LUKS containers and says whether the root filesystem is on one
Scenario 10: System Health & Security Tools
Monitor system health and run security audits
Step 1: Compute the overall security score from real read-only checks
sudo health-control security-score --json
Note
Aggregates the individual read-only checks (entropy, boot-integrity, lynis-status, etc.)
Step 2: Scan system for rootkits
sudo health-control rootkit-scan
Step 3: Check system security status
sudo health-control security-status --json
Step 4: Run comprehensive Lynis security audit
sudo health-control lynis-audit
Note
Comprehensive security assessment
Step 5: Check Lynis installation and status
health-control lynis-status
Step 6: Initialize AIDE database
sudo health-control aide-init
Note
First time setup required
Step 7: Check file integrity with AIDE
sudo health-control aide-check
Step 8: Check kloak keystroke anonymization status
health-control kloak-status
Step 9: Enable kloak keystroke anonymization
sudo health-control kloak-enable
Step 10: Disable kloak keystroke anonymization
sudo health-control kloak-disable
Step 11: Configure kloak keystroke delay, jitter and operating mode
sudo health-control kloak-configure --rescue-delay 20 --max-delay 100
Note
--mode accepts normal, aggressive, or minimal. All flags are optional.
Step 12: Set the kloak event-processing mode
sudo health-control kloak-event-mode --mode normal
Note
--mode is required: raw, filtered, or adaptive.
Step 13: Show kloak keystroke anonymization statistics
health-control kloak-stats
Note
Add --reset to clear the statistics counters.
Step 14: Update the AIDE baseline database after reviewing changes
sudo health-control aide-update
Note
Add --accept-changes to accept all detected changes and update the baseline.
Step 15: Start AIDE database reinitialization in the background
sudo health-control aide-reinit --background --timeout 7200 --json
Note
Use --force only when intentionally replacing an existing baseline.
Step 16: Rebuild the AIDE baseline from the current filesystem, in the foreground
sudo health-control aide-reinit --force
Note
DESTROYS THE OLD BASELINE. Every tampering signal AIDE was holding is replaced by "whatever the disk looks like right now", so if the machine is already compromised you are baselining the compromise. Only reinit on a system you trust. Flags: --force (no confirmation), --timeout <SECONDS> (default 3600), --background. It can take a long time: --background returns immediately.
Step 17: Run an AIDE integrity scan against a specific directory
sudo health-control aide-scan-dir /etc --recursive
Note
PATH positional argument is required. -r/--recursive scans subdirectories.
Scenario 11: LUKS Nuke & Data Destruction
LUKS nuke passwords for emergency data destruction
Step 1: List all LUKS devices and nuke password status
sudo health-control luks-nuke --action status
Note
Shows which devices have nuke passwords configured
Step 2: ⚠️ STEP 1: Check current nuke status for target device
sudo health-control luks-nuke --action status --device "$LUKS_DEVICE"
Note
⚠️ ALWAYS backup header BEFORE configuring nuke password. This status check helps confirm current device state before changes.
Step 3: ⚠️ STEP 2: Configure nuke password (DATA DESTRUCTION FEATURE)
sudo health-control luks-nuke --action configure --device "$LUKS_DEVICE" --password "$LUKS_NUKE_PASSWORD"
Note
⚠️ CRITICAL WARNING: This creates a password that will PERMANENTLY DESTROY all data on the selected LUKS device when entered! Use only if you understand the consequences. Requires header backup from STEP 1. Password must be strong (12+ chars, mixed case, numbers, symbols). Avoid obvious words like 'nuke', 'destroy', 'emergency'.
Step 4: Remove nuke password from device
sudo health-control luks-nuke --action remove --device "$LUKS_DEVICE"
Note
Removes the data destruction feature from the device. You will be prompted to confirm which keyslot to remove (usually keyslot 7). Requires current LUKS password.
Step 5: ⚠️ EMERGENCY: Restore LUKS header after nuke password was used
gpg -d "$LUKS_HEADER_BACKUP" | sudo cryptsetup luksHeaderRestore "$LUKS_DEVICE"
Note
⚠️ USE ONLY IF nuke password was accidentally used! This restores the LUKS header from your encrypted backup. You MUST have created a header backup BEFORE the nuke password was triggered. After restoration, you can unlock the device with your original LUKS password. Without a backup, data is PERMANENTLY LOST.
Step 6: Detect LUKS-encrypted devices on the system
sudo health-control luks-detect
Note
Add --all-devices to also scan loop and other block devices.
Step 7: Manage LUKS devices (add, remove, unlock, lock, list)
sudo health-control luks-manage --action list
Note
--action defaults to list. Use --device to target a specific device path for add/remove/unlock/lock.
Step 8: Advanced LUKS header operations and key management
sudo health-control luks-manage-advanced --action backup-header --device "$LUKS_DEVICE" --backup-file "$LUKS_HEADER_BACKUP"
Note
--action is required: create, format, backup-header, restore-header, change-key, add-key, remove-key. Provide --device / --key-file / --backup-file as the action requires.
Step 9: ⚠️ Configure an advanced LUKS nuke password (DATA DESTRUCTION)
sudo health-control luks-nuke-advanced --device "$LUKS_DEVICE" --password "$LUKS_NUKE_PASSWORD"
Note
⚠️ CRITICAL: --device is required; entering the nuke --password later PERMANENTLY DESTROYS all data on the device. Always back up the LUKS header first.
Step 10: ⚠️ Erase every LUKS keyslot and the LUKS signature: the data on the device can never be decrypted again
sudo health-control luks-remove "$LUKS_DEVICE" --force
Note
⚠️ DESTRUCTIVE: DEVICE positional argument is required. Without --force nothing is changed.
Scenario 12: Emergency Nuke Operations
Full system data destruction for emergency situations. IRREVERSIBLE - use with extreme caution.
Step 1: ⚠️ TEST MODE: Preview what would be destroyed without actually wiping
health-control nuke-execute --dry-run
Note
ALWAYS test with --dry-run first! Lists the folders and the commands a real run would use: SSH keys, GPG keys, crypto wallets, browser data, messaging apps, email, documents and system logs.
Step 2: Fast wipe mode (1 pass) - the quickest
health-control nuke-execute --method fast --dry-run
Note
One pseudo-random pass and a zero pass on a hard disk. On an SSD or NVMe root, personal folders are deleted without overwriting.
Step 3: Secure wipe mode (3 passes) - balanced
health-control nuke-execute --method secure --dry-run
Note
DEFAULT mode. 3 pseudo-random passes and a zero pass on a hard disk. This is not the DoD 5220.22-M sequence. On an SSD or NVMe root, personal folders are deleted without overwriting.
Step 4: Paranoid wipe mode (7 passes) - the most passes
health-control nuke-execute --method paranoid --dry-run
Note
7 pseudo-random passes and a zero pass on a hard disk. On an SSD or NVMe root, personal folders are deleted without overwriting. Every method also destroys the boot sector, GRUB, kernels, initrd and MBR, so the system will not boot.
Step 5: ⚠️ DANGER: Execute REAL fast wipe - DESTROYS ALL DATA
health-control nuke-execute --method fast --force
Note
⚠️ IRREVERSIBLE! This PERMANENTLY DESTROYS: ~/.ssh, ~/.gnupg, crypto wallets (Bitcoin/Monero/Electrum), all browsers, Signal/Telegram/Discord, Thunderbird, Documents/Downloads/Desktop, AWS/Docker/Kube credentials, bash history, system logs. System forces reboot after completion.
Step 6: Check current nuke operation progress
health-control nuke-progress
Note
Monitor ongoing destruction progress. Shows current phase, completion status, and any errors.
Step 7: Detect storage type for optimal wipe method
health-control nuke-storage-detect --device "${TARGET_DEVICE:?Set TARGET_DEVICE after reviewing lsblk output}"
Note
Reports whether the device is NVMe, SSD or HDD. It wipes nothing.
Scenario 13: USB & Device Security
Complete USB security management: device listing, USBGuard policies, storage control, and monitoring. UNDERSTANDING USB SECURITY LAYERS. USB security has TWO independent control systems: 1. USBGuard (usb-guard-* commands): - Controls WHICH devices are allowed or blocked - Device authorization policy management - Works at the USBGuard daemon level 2. USB Storage Modules (offline-usb-storage): - Controls IF USB storage drivers are loaded at all - Manages kernel modules (usb_storage, uas) - Manages device authorization at kernel level - Integrates with USBGuard automatically CRITICAL: for USB drives to work you need all of: - USB storage modules enabled (offline-usb-storage --action enable) - USBGuard allowing the device (or USBGuard disabled) - The device authorized at kernel level (handled by offline-usb-storage) TIP: 'sudo health-control offline-usb-storage --action enable' gives complete USB storage access. It handles all 4 layers automatically.
Step 1: List all connected USB devices
sudo health-control usb-list
Step 2: Check USB storage module status (all 4 layers)
health-control offline-usb-storage --action check
Note
Shows complete status of all USB storage control layers
Step 3: Enable USB storage completely (recommended)
sudo health-control offline-usb-storage --action enable
Note
Handles ALL 4 layers: Removes blacklist, loads modules, authorizes devices, integrates with USBGuard. Your USB drives should appear immediately in 'lsblk' after this command.
Step 4: Enable USB storage with detailed layer-by-layer output
sudo health-control offline-usb-storage --action enable --verbose
Note
Use verbose mode to see exactly what happens at each layer
Step 5: Disable USB storage completely (security lockdown)
sudo health-control offline-usb-storage --action disable
Note
Blocks USB storage at all 4 layers: deauthorizes devices, blocks in USBGuard, unloads modules, creates blacklist
Step 6: Enable USB Guard protection service
sudo health-control usb-guard-enable
Note
⚠️ This only enables USBGuard service - does NOT enable USB storage modules! If USB storage modules are blocked, your drives won't appear even with USBGuard enabled. Use 'offline-usb-storage --action enable' for complete access.
Step 7: Disable USB Guard protection service
sudo health-control usb-guard-disable
Note
Disables USBGuard service but does NOT affect USB storage modules. Storage modules may still be blocked separately.
Step 8: Add USB device to USBGuard allow policy
sudo health-control usb-policy --action add --device-id 1234:5678 --allow
Note
Use lsusb to find device IDs. This manages USBGuard policy only. Device must also be authorized at kernel level (handled by offline-usb-storage).
Step 9: List all USB policies in USBGuard
sudo health-control usb-policy --action list
Step 10: Check USB security policies
sudo health-control usb-policy --action status
Step 11: Watch USB connection changes for 30 seconds
sudo health-control usb-monitor --duration 30
Step 12: View USB device history for last 7 days
sudo health-control usb-history --days 7
Step 13: Show overall USB security status
sudo health-control usb-status
Step 14: Manage the USB device whitelist (add, remove, list, import, export)
sudo health-control usb-whitelist --action add --device-id 1234:5678
Note
--action defaults to list. Use --device-id (vendor:product) for add/remove, or --file for import/export.
Scenario 14: Data Destruction & Secure Wiping
Secure data wiping procedures
Step 1: List the shell and tool histories, recent files list and thumbnails that would be cleared
sudo health-control clear-user-traces --dry-run
Note
Run it without --dry-run to clear them; that cannot be undone. Only files owned by that account inside its own home are touched, and a history path that is a link is left in place and named. Needs a login (the dashboard's login, or sudo online-auth authenticate).
Step 2: Clear the shell and tool histories, the recently used files list and the thumbnail cache, yours and root's
sudo health-control clear-user-traces --json
Note
Cannot be undone. A panic runs the same step only with --clear-traces on panic-soft or panic-medium.
Step 3: Securely wipe file with 7 passes
sudo health-control wipe-file --file /path/to/file --passes 7
Note
Each pass is pseudo-random, then one zero pass. On an SSD, overwriting may not reach the old data
Step 4: Securely wipe entire directory
sudo health-control wipe-directory --path /path/to/directory --passes 3
Note
All files in directory will be destroyed
Step 5: Wipe free space on device
sudo health-control wipe-free-space --device "$TARGET_BLOCK_DEVICE"
Note
Fills free space with sfill, or with one zero pass from dd if sfill is missing. The target must be mounted
Step 6: Wipe system and application logs
sudo health-control wipe-logs
Note
Removes log file traces
Step 7: Wipe browser history and data
sudo health-control wipe-browser-data
Note
Force-closes every browser, then deletes its whole profile and cache folders, so bookmarks and saved passwords go too. Files are deleted, not overwritten
Step 8: Schedule automatic temporary file wiping daily
sudo health-control wipe-schedule temp --frequency daily
Note
Automatically wipes temp files based on frequency
Step 9: Wipe all temporary files matching pattern
sudo health-control wipe-pattern "*.tmp"
Note
Uses glob patterns to match files for wiping
Step 10: Verify file has been securely wiped
sudo health-control wipe-verify --path /path/to/file
Note
Read-only check of the whole file, block by block. It reports blocks of one byte value, blocks that look random and blocks with readable data, with the first offset of any data. Random-looking blocks are also what compressed or encrypted data looks like. A file or last block under 512 bytes reads undecided and not verified, because so few bytes cannot be told from random data. It cannot recover a wiped file.
Step 11: Batch wipe multiple files with 7 passes
sudo health-control wipe-batch /path1 /path2 /path3 --passes 7
Note
Space-separated file paths
Step 12: ⚠️ Securely wipe a standard user directory
sudo health-control wipe-user-dir --target downloads
Note
⚠️ DESTRUCTIVE: --target is required and must be one of downloads, desktop, documents. All contents are permanently destroyed.
Scenario 15: System Maintenance & Updates
Automated updates, password policies, and system maintenance
Step 1: Enable automatic security updates
sudo health-control auto-updates-enable
Step 2: Disable automatic updates
sudo health-control auto-updates-disable
Step 3: Check automatic updates status
sudo health-control auto-updates-status
Step 4: Enable strong password policy
sudo health-control password-policy-enable
Step 5: Disable strong password policy
sudo health-control password-policy-disable
Step 6: Enable user security checks
sudo health-control user-security-enable
Step 7: Enable 2FA for specific user
sudo health-control 2fa-enable --value username
Note
Configures PAM. WARNING: 2FA is known to be unreliable with the XFCE/LightDM graphical login and the lock screen (it works for SSH and sudo). Keep a root shell open while you test it, and know that 'sudo health-control 2fa-disable' is the way out.
Step 8: Disable 2FA for user
sudo health-control 2fa-disable
Note
Recovery path if 2FA locked you out of the desktop login. Removes the PAM requirement, so the account drops back to password-only.
Step 9: Enable automatic system maintenance
sudo health-control system-maintenance-enable
Step 10: Clean up unnecessary packages
sudo health-control package-cleanup
Step 11: Check password policy status
sudo health-control password-policy-status
Step 12: Disable user security checks
sudo health-control user-security-disable
Step 13: Check user security status
sudo health-control user-security-status
Step 14: Check 2FA status for users
health-control 2fa-status
Step 15: Disable automatic system maintenance
sudo health-control system-maintenance-disable
Step 16: Check system maintenance status
health-control system-maintenance-status
Step 17: Check whether packages are installed and install the missing ones
sudo health-control check-and-install curl wget
Note
PACKAGES is a required, space-separated list of one or more package names.
Step 18: Run the predefined check-and-install routine for required packages
sudo health-control check-and-install-do
Note
Takes no arguments; installs the built-in required package set.
Step 19: Clear system caches at the specified level
sudo health-control clear-cache --level 3
Note
--level accepts 1, 2 or 3 (defaults to 3, the most thorough).
Step 20: Diagnose whether sudo is working correctly
sudo health-control check-sudo
Note
Read-only check; takes no arguments. Use fix-sudo to repair a broken sudo configuration.
Step 21: Repair a broken sudo configuration without requiring sudo
sudo health-control fix-sudo
Note
Takes no arguments. Designed to recover from a misconfigured/broken sudoers state.
Scenario 16: System Control & Notifications
System configuration and control operations
Step 1: Play system alert sound
sudo health-control play-sound --sound alert
Step 2: Play success notification sound
sudo health-control play-sound success
Step 3: Play warning sound in MP3 format
sudo health-control play-sound warning -m mp3
Step 4: Play alert sound with debug output
sudo health-control play-sound alert --debug
Step 5: Send system notification
health-control notify --message "Security check complete"
Step 6: Send basic notification message
health-control notify --message "Hello from Kodachi"
Step 7: Send notification with message body
health-control notify --message "Alert" --body "VPN connected"
Step 8: Send critical notification with 30 second duration
health-control notify --message "Warning" --urgency critical --duration 30
Step 9: Send notification with custom icon
health-control notify --message "Update" --notify-icon "/path/to/icon.png"
Scenario 17: Emergency Operations - Kill Switch & Panic Modes
Emergency security measures with two modes: PREPARATION (arm/disarm) raises a high-alert flag, IMMEDIATE (panic/activate) executes emergency procedures. Neither monitors: for automatic response use a watch-guard
Step 1: ARM the kill switch (preparation mode: a high-alert flag, not a monitor)
sudo health-control kill-switch-arm
Note
HIGH-ALERT STATE FLAG. Arming does NOT monitor anything: it starts no watcher and no daemon, and nothing activates panic mode on its own. Firing the kill switch stays manual (kill-switch-activate). What arming actually does: • Records the high-alert state so other components can see it • While armed, tor-switch will not force firewall policies back to ACCEPT during detorrify, so an existing protective DROP policy is not silently torn down. Arming does not itself block any traffic • Is read by security scoring, but the comprehensive scorer credits it ONLY when egress is actually denied by the firewall. Armed without an enforced default-deny scores zero For an automatic kill switch that reacts on its own, enable a watch-guard instead. It runs a daemon and blocks the network when the trigger fires. A VPN watch fires on any change of VPN state, a drop or a new connection, so enable it while the VPN is connected: sudo health-control enable --type watch-guard --watch vpn --method nftables
Step 2: DISARM the kill switch (clear the high-alert flag)
sudo health-control kill-switch-disarm
Note
Clears the high-alert state flag (no monitoring was running). Use after the threat has passed or on a false alarm.
Step 3: Check whether the kill switch high-alert flag is armed or disarmed
sudo health-control kill-switch-status
Note
READ-ONLY: Just displays current state, takes no action
Step 4: IMMEDIATELY activate kill switch (default: medium panic)
sudo health-control kill-switch-activate
Note
IMMEDIATE ACTION: Unlike 'arm', this executes panic NOW. Prompts for confirmation. Use --level soft/medium/hard
Step 5: IMMEDIATE soft panic (NO confirmation)
sudo health-control panic-soft
Note
INSTANT: Kill network + clear clipboard (wl-copy/xclip/xsel) + lock screen. Reversible. Good for quick privacy.
Step 6: Preview a soft panic that also clears your traces, changing nothing
sudo health-control panic-soft --clear-traces --dry-run
Note
--clear-traces is opt-in on panic-soft and panic-medium: after the network is cut and the screen is locked, it clears the shell and tool histories, the recently used files list and the thumbnail cache, yours and root's. Without --dry-run that cannot be undone.
Step 7: IMMEDIATE medium panic (requires confirmation)
sudo health-control panic-medium
Note
WITH CONFIRMATION: Kill network + clear clipboard (adaptive: wl-copy/xclip/xsel) + terminate processes + clear memory caches + unmount devices + lock screen (6 actions). panic-recover restores the saved firewall, services and interfaces; ended processes and unmounted devices are not brought back.
Step 8: IMMEDIATE hard panic (double confirmation)
sudo health-control panic-hard
Note
CRITICAL - DOUBLE CONFIRM: Kill network + clear clipboard + clear memory caches + unmount devices + forced power-off + a fast RAM wipe that runs only until the power goes + terminate non-essential processes (7 actions, no screen lock). The forced power-off skips the shutdown steps, so the installed shutdown wipe does not run. IRREVERSIBLE! System powers off NOW!
Step 9: Create recovery checkpoint BEFORE panic
sudo health-control create-recovery-point
Note
Create BEFORE activating panic modes. Allows restoration of configs after emergency.
Step 10: Restore system after panic activation
sudo health-control panic-recover
Note
Use AFTER a Soft or Medium panic: restores the saved firewall, services and interfaces.
Step 11: Configure panic response to paranoid security level
sudo health-control panic-profile --profile paranoid
Note
Records a profile name for this run only. Nothing reads it: no panic and no kill-switch-activate uses a profile, and the name is lost when this command ends. The panic levels are panic-soft, panic-medium and panic-hard.
Step 12: Kill specific network interface
sudo health-control kill-network-interface --interface eth0
Note
Selective network isolation
Step 13: Terminate specific process immediately
sudo health-control kill-process --process firefox
Note
Sends SIGKILL at once to that PID, or to every process with that name. It refuses nothing, so a system or session process can be named
Scenario 18: Phone Companion - Status and Panic From Your Phone
A paired phone reaches this machine through its own onion service with client authorization: it can read a minimal status and start a soft or medium panic with the PIN, nothing else. Off by default
Step 1: Install and start the companion: its own Tor (no proxy port) and serve
sudo health-control companion-enable
Note
Nothing is published until a phone is paired. Running it again clears the lock after 5 wrong PINs. Needs a login (the dashboard's login, or sudo online-auth authenticate).
Step 2: Pair a phone: choose the PIN twice, then import the line shown once on this terminal into Tor Browser or Orbot
sudo health-control companion-pair --name pixel
Note
Needs a terminal. The phone's key is never stored, logged or put in --json; clear the terminal when the phone has it. A new pairing replaces the PIN for every phone. Needs a login (the dashboard's login, or sudo online-auth authenticate).
Step 3: Show whether the companion runs, whether its onion is published, the paired phones and the PIN lockout
sudo health-control companion-status --json
Note
Without sudo the paired phones, PIN and lockout cannot be read and show as null.
Step 4: Unpair one phone
sudo health-control companion-unpair --name pixel
Note
That phone can no longer reach the onion once serve re-adds it, which happens at once.
Step 5: Unpair every phone and forget the onion key
sudo health-control companion-unpair --all
Note
Use it when a phone is lost: the old address stops working for every phone.
Step 6: Stop the companion and remove its units and torrc where Kodachi wrote them
sudo health-control companion-disable
Note
The onion goes away at once. The paired phones are kept for a later companion-enable; unpair --all forgets them.
Scenario 19: Storage Encryption & Secure Containers
Storage device encryption, secure wiping, LUKS encrypted containers, and volume management
Step 1: List all storage devices with safety indicators (SAFE/CAUTION/DANGER)
sudo health-control list-storage-devices
Note
Use BEFORE creating persistence to identify safe devices. Protects against accidental system drive formatting.
Step 2: List all storage devices including loop and ram devices
sudo health-control list-storage-devices --all
Step 3: Check if specific device is safe for persistence operations
sudo health-control usb-safety-check --device "${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}"
Note
Validates device before destructive operations. Prevents accidental system drive formatting.
Step 4: Format a device as a new encrypted volume: everything on it is lost
sudo health-control storage-encrypt --device "${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}"
Note
DESTRUCTIVE: back up first, the format replaces what is on the device
Step 5: Securely wipe storage device
sudo health-control storage-wipe --device "${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}" --passes 3
Note
Data will be permanently destroyed
Step 6: Create a 500MB file of random data. It is NOT encrypted
sudo health-control container-create --path $HOME/data.img --size 500
Note
Nothing is encrypted and no password is set: run the printed commands. The file path is supplied with the required --path option.
Step 7: Create a small file of random data (100MB). It is NOT encrypted
sudo health-control container-create --path $HOME/secure.img --size 100
Note
Smaller size for testing. Nothing asks for a password.
Step 8: Mount encrypted container
sudo health-control container-mount --container $HOME/data.img --mount-point $HOME/secure
Note
You'll be prompted for the container password. Mount point will be created automatically if it doesn't exist.
Step 9: Unmount encrypted container
sudo health-control container-unmount --mount-point $HOME/secure
Note
Automatically closes the LUKS mapper device.
Step 10: Recommend or apply LUKS encryption tuning settings
sudo health-control encryption-tune --profile balanced
Note
--profile defaults to balanced (also performance, security). Optional --cipher, --key-size, --iter-time, --device, --benchmark. Runs as a dry-run unless --apply is given.
Step 11: Create persistence storage for another live OS (Kali, Parrot, or Tails)
sudo health-control create-persistence-other-os --device "${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}" --os-type kali --force
Note
⚠️ --device and --os-type are required; targets/formats the given partition. --force is required for non-interactive use (dashboard/scripts/--json). Add --encrypted (optionally with --password) for LUKS. Needs a Kodachi login.
Scenario 20: Security Assessment & Scoring
Security scoring and reporting
Step 1: Calculate overall security score
health-control security-score
Step 2: Get security score in JSON format
health-control security-score --json
Step 3: Generate comprehensive security report
sudo health-control security-report
Step 4: Generate security report in JSON format
sudo health-control security-report --json
Step 5: View security score history for last 30 days
sudo health-control security-history --days 30
Note
Lists security lines from the health-control log and SSH login lines from the journal. No score history is kept
Step 6: View last 7 days security history in JSON
sudo health-control security-history --days 7 --json
Step 7: Review security fixes before applying
sudo health-control security-remediate
Note
Manual review mode for security fixes
Step 8: Run the enhanced rootkit scanner
sudo health-control rootkit-scan-enhanced --deep
Note
Add --deep to perform a thorough deep scan.
Step 9: Scan the filesystem for malware with ClamAV
sudo health-control clamav-scan --path / --recursive
Note
Needs ClamAV, which Kodachi does not install: install it once with sudo apt install clamav clamav-freshclam; its clamav-freshclam service then downloads the virus list in the background (a few minutes the first time) and keeps it current. --path defaults to the health-control folder; give --path / for the whole filesystem. Add --recursive to descend into subdirectories and --quarantine to isolate infected files.
Step 10: Set the security profile and scoring thresholds
sudo health-control security-profile --value balanced
Note
--value is required: minimal, balanced, or paranoid.
Step 11: Schedule automated security assessments
sudo health-control security-schedule --value daily
Note
--value is required: hourly, daily, weekly, monthly, or disable.
Scenario 21: Hardware Security
Hardware-level security features
Step 1: Verify hardware random number generator
sudo health-control hardware-rng-verify
Note
Checks if hardware RNG is available and functioning properly for cryptographic operations
Step 2: Check system entropy status
sudo health-control entropy-status
Note
Monitors available entropy for secure random number generation, critical for encryption
Step 3: Report boot security settings
sudo health-control boot-integrity-check
Note
Reports UEFI, Secure Boot, MOK, lockdown, module signing and grub.cfg permissions. It compares no hashes, so it cannot detect tampering
Scenario 22: System Information & Offline Actions
System information, diagnostics, and hardware/service management
Step 1: Run the read-only system doctor
sudo health-control system-doctor
Note
Never changes anything. Exit code 0 clean, 2 warnings, 1 failures. The text pastes into a support chat as it is
Step 2: System doctor report as JSON
sudo health-control system-doctor --json
Note
Used by the dashboard; the exit code is the same as the text report
Step 3: Check that every installed kernel can boot
sudo health-control boot-readiness
Note
Read-only. Exit code 0 ready, 2 warnings or not checkable, 1 a kernel would not boot. A live session is skipped
Step 4: Boot readiness as an exit code only
sudo health-control boot-readiness --quiet
Note
For scripts; the kernel hook and the daily timer use --record to keep the result for the login line
Step 5: Display comprehensive system information
sudo health-control offline-info-system
Step 6: Display hardware information
sudo health-control offline-info-hardware
Step 7: Display hardware information in JSON
sudo health-control offline-info-hardware --json
Step 8: Display process information
sudo health-control offline-info-process
Step 9: Display security configuration
sudo health-control offline-info-security
Step 10: Display network configuration
sudo health-control offline-info-network
Step 11: Display user information
sudo health-control offline-info-user
Step 12: Display storage information
sudo health-control offline-info-storage
Step 13: Display services information
sudo health-control offline-info-services
Step 14: Display all system information
sudo health-control offline-info-all
Step 15: Check Bluetooth status
health-control offline-bluetooth --action check
Step 16: Enable Bluetooth service
sudo health-control offline-bluetooth --action enable
Step 17: Disable Bluetooth service
sudo health-control offline-bluetooth --action disable
Step 18: Check WiFi status
health-control offline-wifi --action check
Step 19: Enable WiFi service
sudo health-control offline-wifi --action enable
Step 20: Disable WiFi with persistent blacklisting
sudo health-control offline-wifi --action disable
Step 21: Check webcam status
health-control offline-webcam --action check
Step 22: Enable webcam devices
sudo health-control offline-webcam --action enable
Step 23: Disable webcam devices
sudo health-control offline-webcam --action disable
Step 24: Check microphone status
health-control offline-microphone --action check
Step 25: Enable microphone devices
sudo health-control offline-microphone --action enable
Step 26: Disable microphone devices
sudo health-control offline-microphone --action disable
Step 27: Check automatic screen lock status
health-control offline-screen-lock --action check
Step 28: Enable automatic screen lock
sudo health-control offline-screen-lock --action enable
Step 29: Disable automatic screen lock
sudo health-control offline-screen-lock --action disable
Step 30: Check system logging status
health-control offline-systemlogs --action check
Step 31: Enable system logging
sudo health-control offline-systemlogs --action enable
Step 32: Disable system logging
sudo health-control offline-systemlogs --action disable
Step 33: Check CUPS printing service status
health-control offline-cups --action check
Step 34: Enable CUPS printing service
sudo health-control offline-cups --action enable
Step 35: Disable CUPS printing service
sudo health-control offline-cups --action disable
Step 36: Check NetworkManager status
health-control offline-networkmanager --action check
Step 37: Enable NetworkManager
sudo health-control offline-networkmanager --action enable
Step 38: Disable NetworkManager
sudo health-control offline-networkmanager --action disable
Step 39: Check NumLock-on-boot status
health-control offline-numlock --action check
Step 40: Enable NumLock on boot
sudo health-control offline-numlock --action enable
Step 41: Disable NumLock on boot
sudo health-control offline-numlock --action disable
Step 42: Check command history logging status
health-control offline-cmdhistory --action check
Step 43: Enable command history logging
sudo health-control offline-cmdhistory --action enable
Step 44: Disable command history logging
sudo health-control offline-cmdhistory --action disable
Step 45: Check automatic login status
health-control offline-autologin --action check
Step 46: Enable automatic login
sudo health-control offline-autologin --action enable
Step 47: Disable automatic login
sudo health-control offline-autologin --action disable
Step 48: Check current file descriptor limits
health-control offline-fdlimit --action check
Step 49: Set file descriptor limits
sudo health-control offline-fdlimit --action enable --soft-limit 1024 --hard-limit 4096
Step 50: Revert file descriptor limits to defaults
sudo health-control offline-fdlimit --action disable
Step 51: Check network optimization status
health-control offline-netoptimize --action check
Step 52: Enable network optimizations
sudo health-control offline-netoptimize --action enable
Step 53: Disable network optimizations
sudo health-control offline-netoptimize --action disable
Step 54: Check BBR congestion control status
health-control offline-bbr --action check
Step 55: Enable BBR congestion control
sudo health-control offline-bbr --action enable
Step 56: Disable BBR congestion control
sudo health-control offline-bbr --action disable
Step 57: Check current interface speed configuration
health-control offline-ifspeed --action check
Step 58: Configure interface speed
sudo health-control offline-ifspeed --action enable --interface eth0 --speed 1000
Step 59: Revert interface speed to auto-negotiation
sudo health-control offline-ifspeed --action disable --interface eth0
Step 60: Check Avahi service discovery status
health-control offline-avahi --action check
Note
Supported services: avahi, modem-manager, ssh, apache, nginx, docker, mysql, postgresql
Step 61: Enable Avahi service discovery
sudo health-control offline-avahi --action enable
Step 62: Disable Avahi service discovery
sudo health-control offline-avahi --action disable
Step 63: Check ModemManager service status
health-control offline-modem-manager --action check
Step 64: Enable ModemManager service
sudo health-control offline-modem-manager --action enable
Step 65: Disable ModemManager service
sudo health-control offline-modem-manager --action disable
Step 66: Check SSH service status
health-control offline-ssh --action check
Step 67: Enable SSH service
sudo health-control offline-ssh --action enable
Step 68: Disable SSH service
sudo health-control offline-ssh --action disable
Step 69: Check Apache web server status
health-control offline-apache --action check
Step 70: Enable Apache web server
sudo health-control offline-apache --action enable
Step 71: Disable Apache web server
sudo health-control offline-apache --action disable
Step 72: Check Nginx web server status
health-control offline-nginx --action check
Step 73: Enable Nginx web server
sudo health-control offline-nginx --action enable
Step 74: Disable Nginx web server
sudo health-control offline-nginx --action disable
Step 75: Check Docker service status
health-control offline-docker --action check
Step 76: Enable Docker service
sudo health-control offline-docker --action enable
Step 77: Disable Docker service
sudo health-control offline-docker --action disable
Step 78: Check MySQL database service status
health-control offline-mysql --action check
Step 79: Enable MySQL database service
sudo health-control offline-mysql --action enable
Step 80: Disable MySQL database service
sudo health-control offline-mysql --action disable
Step 81: Check PostgreSQL database service status
health-control offline-postgresql --action check
Step 82: Enable PostgreSQL database service
sudo health-control offline-postgresql --action enable
Step 83: Disable PostgreSQL database service
sudo health-control offline-postgresql --action disable
Step 84: Enable USB storage devices
sudo health-control offline-usb-storage --action enable
Step 85: Disable USB storage devices
sudo health-control offline-usb-storage --action disable
Note
Unloads the USB storage kernel modules, so USB drives stop working entirely until you re-enable them. Anything currently mounted from USB should be unmounted first or you risk data loss.
Step 86: Lightweight connectivity ping helper (used by conky panels)
health-control ping
Note
Takes no arguments. Fast helper for status panels.
Step 87: Report how long a tracked process has been running
health-control process-age --process tor
Note
--process is required and must be 'vpn' or 'tor'.
Scenario 23: Password Generation
Generate secure passwords using multiple methods with batch support (auto-detects installed packages)
Step 1: Generate one password using all three methods
sudo health-control genpass
Note
Automatically uses system packages if available, falls back to native implementations
Step 2: Generate 10 random passwords using pwgen method
sudo health-control genpass --method pwgen --count 10
Note
Use --count for batch generation; max 1000 per method
Step 3: Generate 50 memorable XKCD-style passphrases
sudo health-control genpass --method xkcdpass --count 50
Note
XKCD method creates memorable multi-word passwords
Step 4: Generate 90 passwords from each method (270 total)
sudo health-control genpass --count 90
Note
When using --count without --method, generates specified count from ALL methods
Step 5: Generate 20 custom passwords with specific length and symbols
sudo health-control genpass --method pwgen --count 20 --length 32 --symbols "@-_!#$"
Note
Customize password generation with --length and --symbols options
Step 6: Generate 15 passwords with only uppercase letters and digits
sudo health-control genpass --uppercase --digits --count 15
Step 7: Generate 100 passwords from each method in JSON format
sudo health-control genpass --count 100 --json
Note
JSON output ideal for scripting and automation
Step 8: Force use of native Rust implementations (skip package detection)
sudo health-control genpass --force-native --count 25
Note
Useful for testing or when system packages are unreliable
Scenario 24: RAM Wipe & Cold Boot Protection
Automatic RAM wiping on shutdown with multiple policies (custom, sdmem, both, auto), installation, configuration, testing, and cold boot attack defenses
Step 1: Complete workflow for first-time RAM wipe setup
# WORKFLOW: Setting up RAM wipe on shutdown
Note
STEP 1: Install hooks (REQUIRED FIRST): sudo health-control wipe-ram-install STEP 2: Configure policy (OPTIONAL): sudo health-control wipe-ram-config --policy sdmem STEP 3: Enable if disabled: sudo health-control ram-wipe-enable STEP 4: Verify status: sudo health-control ram-wipe-status KEY DIFFERENCES: • wipe-ram-install = FIRST-TIME SETUP (installs systemd shutdown hooks) • ram-wipe-enable = ENABLE/DISABLE (turns functionality on/off, hooks must exist) • wipe-ram-config = UPDATE SETTINGS (change policy, passes, time budget) • wipe-ram = MANUAL EXECUTION (test or emergency wipe NOW, not on shutdown)
Step 2: Install RAM wipe system with the default settings (kodachi-wiper policy, 60 second time budget), or the settings already saved
sudo health-control wipe-ram-install
Note
FIRST-TIME SETUP - Installs systemd hooks, configures policies, detects Kicksecure compatibility. Creates /etc/kodachi/wipe-ram.conf with the defaults the first time. A later run keeps what is saved
Step 3: Install RAM wipe with kodachi-wiper policy and 60 second time budget
sudo health-control wipe-ram-install --policy kodachi-wiper --time 60
Note
Fastest installation - Single-pass wipe, suitable for systems with <8GB RAM or frequent reboots
Step 4: Install RAM wipe with sdmem policy using 3 overwrite passes
sudo health-control wipe-ram-install --policy sdmem --passes 3
Note
SECURE INSTALLATION - Runs sdmem -f up to 3 times at shutdown, each run cut off at its share of the time budget. Recommended for 8-16GB RAM systems
Step 5: Install the hybrid policy (kodachi-wiper then sdmem) with a 60 second shutdown time budget
sudo health-control wipe-ram-install --policy both --time 60
Note
HYBRID APPROACH - "both" runs kodachi-wiper (fast) and sdmem (thorough) inside the --time budget. The flags are --force, --policy, --time and --passes: there is no --split flag. Recommended budget: 60 for desktops and laptops. The shutdown hook stops at 80 seconds, because systemd ends a shutdown hook at 90
Step 6: Force installation even if Kicksecure/Whonix RAM wipe detected
sudo health-control wipe-ram-install --force
Note
OVERRIDE MODE - Bypasses Kicksecure detection. Use when you want Kodachi's RAM wipe instead of Kicksecure's built-in wipe. May cause conflicts
Step 7: Check RAM wipe configuration and current status
sudo health-control ram-wipe-status
Note
Shows: enabled/disabled state, current policy (kodachi-wiper/sdmem/both/auto), time budget, sdmem passes, total RAM size, Kicksecure detection
Step 8: RAM wipe status in JSON format for automation
sudo health-control ram-wipe-status --json
Note
JSON OUTPUT DEMO - Shows all config fields in machine-readable format for scripts and monitoring systems
Step 9: Update existing RAM wipe policy to auto
sudo health-control wipe-ram-config --policy auto
Note
Changes what happens at every shutdown from now on. A larger time budget or more passes means a longer shutdown; too small a budget means RAM is only partially wiped. Check the result with 'sudo health-control ram-wipe-status'.
Step 10: Update sdmem passes to 5 and time split to 70/30
sudo health-control wipe-ram-config --passes 5 --split 70
Note
PASS COUNT - How many times sdmem runs inside the time budget (1-9), so more passes means less time for each. SPLIT - The kodachi-wiper share of the time budget when the policy is both
Step 11: Enable RAM wipe configuration (hooks must be installed first)
sudo health-control ram-wipe-enable
Note
IMPORTANT: This only enables the CONFIG. You must run 'wipe-ram-install' FIRST to install systemd hooks. Will show clear warning if hooks are missing.
Step 12: Disable automatic RAM wiping
sudo health-control ram-wipe-disable
Note
WARNING - Disabling RAM wipe leaves sensitive data in RAM accessible to physical attacks
Step 13: Test RAM wipe system with dry-run (no actual wiping)
sudo health-control wipe-ram-test
Note
SAFE TESTING - Reads the configuration and reports the policy, time budget and tools a real wipe would use. Nothing is overwritten. Use before first real wipe
Step 14: Dry run of the kodachi-wiper policy with a 10 second time budget
sudo health-control wipe-ram-test --policy kodachi-wiper --time 10
Note
Dry run - Reports what kodachi-wiper would do. Nothing runs for those 10 seconds
Step 15: RAM wipe dry run in JSON
sudo health-control wipe-ram-test --json
Note
DIAGNOSTIC OUTPUT - Returns the policy, time budget, pass count, whether sdmem is installed and the tools a real wipe would use. Nothing is overwritten
Step 16: Execute RAM wipe operation manually with configured policy
sudo health-control wipe-ram
Note
ADVANCED - Manually trigger RAM wipe using system configuration. Automatically called by shutdown hooks. Use for testing or emergency wipe
Step 17: Execute RAM wipe optimized for shutdown context
sudo health-control wipe-ram --shutdown-mode
Note
INTERNAL USE - Shutdown-optimized mode disables unnecessary checks and output. Used by systemd shutdown hooks
Step 18: Execute RAM wipe using kodachi-wiper overwrite policy
sudo health-control wipe-ram --policy kodachi-wiper
Note
POLICY: Kodachi-wiper, the built-in wiper - Overwrites free memory once with zeros, until only 5% of RAM stays available (at least 256 MiB) or the time budget ends. The fastest policy
Step 19: Execute RAM wipe using sdmem utility (multiple passes)
sudo health-control wipe-ram --policy sdmem
Note
POLICY: sdmem (secure-delete memory) - Runs sdmem -f once per configured pass (1-9, default 3), each run cut off at its share of the time budget. sdmem overwrites the free memory it can reach. Slower than kodachi-wiper
Step 20: Execute RAM wipe using both kodachi-wiper AND sdmem sequentially
sudo health-control wipe-ram --policy both
Note
POLICY: Kodachi-wiper FIRST (fast pass), then sdmem, sharing the time budget (60% and 40% by default). Without sdmem, only kodachi-wiper runs. Recommended for high-security environments
Step 21: Execute RAM wipe with the auto policy
sudo health-control wipe-ram --policy auto
Note
POLICY: Auto - Runs kodachi-wiper, which is built in and always available. It does not look at RAM size or time
Step 22: Execute RAM wipe with 120 second time budget
sudo health-control wipe-ram --time 120
Note
TIME BUDGET - The most seconds this manual wipe may take. It stops when the time runs out and the system keeps running. A shutdown hook never gets more than 80 seconds, whatever is set
Step 23: Detect if Kicksecure/Whonix RAM wipe is installed
sudo health-control ram-wipe-detect-kicksecure
Note
COMPATIBILITY CHECK - Detects Kicksecure's ram-wipe-on-boot package. Prevents conflicts between Kodachi and Kicksecure RAM wipe systems
Step 24: Update RAM wipe policy to auto with 80 second time budget
sudo health-control ram-wipe-update --policy auto --time 80
Note
The same as wipe-ram-config. Auto runs kodachi-wiper: it does not look at RAM size, shutdown urgency or battery
Step 25: Enable cold boot attack defense mechanisms
sudo health-control coldboot-defense-enable
Note
PHYSICAL SECURITY - Reduces what a cold boot attack can recover from RAM. Starts overwriting free memory before suspend or hibernate, when the power supply or battery goes offline, and when the CPU sensor stays at 1 to 4 C (then powers off). From the next boot the kernel zeroes memory when it is allocated and freed. It does not wipe RAM at shutdown (that is wipe-ram-install) and adds no DMA protection. The lid and power-button handlers need acpid installed
Step 26: Disable cold boot attack defense
sudo health-control coldboot-defense-disable
Note
WARNING - Disabling leaves encryption keys vulnerable to physical RAM extraction attacks. Only disable if you have alternative physical security
Step 27: Show current cold boot attack defense status
sudo health-control coldboot-defense-status
Note
READ-ONLY: Takes no arguments. Reports the active cold boot protection state.
Step 28: ⚠️ Wipe system RAM contents immediately
sudo health-control ram-wipe
Note
⚠️ DANGEROUS: Overwrites memory contents and takes no arguments. Use ram-wipe-enable/-disable to manage the on-shutdown policy instead.
Scenario 25: Swap Management & Encryption
Swap space enable/disable, configuration, encryption with dm-crypt, and performance tuning with swappiness and cache pressure settings
Step 1: Enable and activate swap space for memory overflow
sudo health-control swap-enable
Note
STABILITY FEATURE - Activates swap partitions/files for memory overflow. Improves system stability under memory pressure but may leak sensitive data to disk
Step 2: Disable and deactivate all swap space
sudo health-control swap-disable
Note
SECURITY FEATURE - Deactivates all swap to prevent disk leakage of sensitive data. May cause out-of-memory errors if RAM insufficient
Step 3: Check swap status, devices, size, and usage
sudo health-control swap-status
Note
Shows: active swap devices, total/used/available size, swap usage percentage, encryption status, swappiness value
Step 4: Configure swap parameters for optimal performance
sudo health-control swap-configure --swappiness 10 --cache-pressure 100
Note
PERFORMANCE TUNING - Swappiness (0-100): 0=never swap, 10=minimal, 60=default, 100=aggressive. Cache pressure controls VFS cache retention (default 100)
Step 5: Encrypt swap with random key generated on each boot
sudo health-control swap-encrypt
Note
ENCRYPTION SECURITY - Uses dm-crypt with random key per boot. Protects swapped memory from offline disk forensics. Slight performance impact
Step 6: Remove swap encryption and revert to plain swap
sudo health-control swap-decrypt
Note
WARNING - Removes encryption protection. Swapped data will be readable from disk in clear text. Only use if encryption causes performance issues
Step 7: Check swap encryption status and configuration
sudo health-control swap-encrypt-status
Note
Shows: encryption enabled/disabled, the cipher family and the encrypted device mapper name
Step 8: Enable swap (alternative command alias)
sudo health-control enable-swap
Step 9: Disable swap (alternative command alias)
sudo health-control disable-swap
Note
Disabling swap frees the swap device of any paged-out secrets, but processes that were relying on swap can be OOM-killed on a low-memory machine. Save your work first.
Scenario 26: Memory Statistics & Cleanup
Memory usage statistics, cache cleaning, and memory optimization without data loss
Step 1: Show current memory usage statistics (total, available, used, cached)
sudo health-control memory-stats
Step 2: Memory statistics in human-readable JSON format
sudo health-control memory-stats --json-human
Note
JSON OUTPUT DEMO - Use --json for compact machine-readable format, --json-human for readable format with color and formatting
Step 3: Clean memory caches and buffers (pagecache, dentries, inodes)
sudo health-control memory-clean
Note
Safe operation - drops caches but does NOT kill processes. Improves available memory without data loss
Step 4: Kill the process using the most memory (kill -9)
sudo health-control memory-force-clean
Note
ADVANCED - Kills that process at once, so unsaved work in it is lost. System and session processes are never picked. It does not drop caches: memory-clean does that. Use with caution
Scenario 27: Process Memory Security
Secure process memory wiping before termination and per-process memory limits using cgroups for browsers and applications
Step 1: Overwrite free memory once (anti-forensics)
sudo health-control memory-wipe
Note
SECURITY FEATURE - Overwrites free memory once with zeros (sdmem -f -l -l, stopped at 120 seconds). Without sdmem it fills 80% of available memory with 0xFF. Memory held by running programs is not touched. Used for sensitive operations
Step 2: Close Firefox, then overwrite free memory
sudo health-control memory-wipe-process --value firefox
Note
THE PROGRAM CLOSES - Sends SIGTERM, then SIGKILL if it is still running after 5 seconds, confirms it has ended, then runs memory-wipe. Unsaved work in it is lost. If the name also matches a system or session process it refuses and closes nothing
Step 3: Close Chrome, then overwrite free memory
sudo health-control memory-wipe-process --value chrome
Note
Chrome closes, so anything unsaved in it is lost. Its memory is overwritten only once it is free
Step 4: Close Thunderbird, then overwrite free memory
sudo health-control memory-wipe-process --value thunderbird
Note
Thunderbird closes, so an unsent message is lost. Its memory is overwritten only once it is free
Step 5: Close Tor Browser, then overwrite free memory
sudo health-control memory-wipe-process --value tor-browser
Note
Matches by process name, and Tor Browser's process may be named firefox.real: if nothing matches, use that name
Step 6: Set Firefox memory limit to 2048 MB using cgroups
sudo health-control memory-limits --value firefox --limit-mb 2048
Note
RESOURCE CONTROL - All running processes whose name contains this value share one cgroup with this limit, so it is their total. Programs started later are not covered, and it ends at reboot. The kernel kills a process that goes over it. Nothing system-wide changes. If the name also matches a system service or another account's program it refuses and limits nothing
Step 7: Set Chrome memory limit to 1024 MB
sudo health-control memory-limits --value chrome --limit-mb 1024
Note
The limit is the total for all of Chrome's running processes
Step 8: Set Tor Browser memory limit to 1536 MB
sudo health-control memory-limits --value tor-browser --limit-mb 1536
Note
The limit is the total for all of Tor Browser's running processes. Its process may be named firefox.real
Step 9: List all configured memory limits (run with no flags to list)
sudo health-control memory-limits
Note
Listing is the no-flag form of this command. There is no --list flag: the only flags are --value <PROCESS> and --limit-mb <MB>, which must be given together to SET a limit. Add --json for machine-readable output
Scenario 28: Emergency Shortcuts - Keyboard-Triggered Actions
Hardware keyboard shortcuts for emergency operations via kodachi-session-helper daemon. All commands use LOCAL session tokens (no online auth required). Works fully offline. Session token is read automatically from $XDG_RUNTIME_DIR/kodachi-session-helper/session.token
Step 1: Dry-run dashboard nuke to test without executing destructive actions
sudo health-control emergency-trigger --plan dashboard --dry-run
Note
SAFE TESTING - Validates session token and plan without executing. Use for testing shortcut configuration and daemon integration. Session token read from $XDG_RUNTIME_DIR/kodachi-session-helper/session.token
Step 2: Trigger dashboard nuke via emergency shortcut (wipe dashboard data, logs, configs)
sudo health-control emergency-trigger --plan dashboard
Note
KEYBOARD: The session helper uses the shortcut currently configured in the dashboard. Hold the approved combo for roughly 2-3 seconds. The global trigger is silent and does not reopen the dashboard UI.
Step 3: Trigger LUKS nuke via emergency shortcut (destroy encrypted partition headers)
sudo health-control emergency-trigger --plan luks --device "${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}"
Note
KEYBOARD: Uses the dashboard-configured approved combo. Hold it for roughly 2-3 seconds. IRREVERSIBLE - destroys LUKS headers making encrypted data unrecoverable. --device is required for luks and both plans.
Step 4: Trigger full nuke (dashboard + LUKS combined) via emergency shortcut
sudo health-control emergency-trigger --plan both --device "${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}"
Note
KEYBOARD: Uses the dashboard-configured approved combo and should be held for roughly 2-3 seconds. Combines dashboard-nuke and luks-nuke for maximum data destruction. IRREVERSIBLE.
Step 5: Trigger emergency action with JSON output for automation
sudo health-control emergency-trigger --plan dashboard --json
Note
JSON output includes: plan name, success status, execution duration, affected components. Useful for logging and monitoring.
Step 6: Dry-run LUKS nuke with JSON output for pre-flight validation
sudo health-control emergency-trigger --plan luks --device "${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}" --dry-run --json
Note
Combines --dry-run and --json for safe testing with machine-readable output. Ideal for dashboard integration testing.
Step 7: Force-trigger full nuke silently (skip readiness checks, suppress output)
sudo health-control emergency-trigger --plan both --device "${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}" --force --silent
Note
DAEMON MODE - Used by kodachi-session-helper daemon. --force skips readiness checks, --silent suppresses stdout. For automated invocation only.
Step 8: Dry-run a 5-minute delayed lockdown for dashboard nuke
sudo health-control emergency-lockdown --delay 300 --plan dashboard --dry-run
Note
SAFE TESTING - Preview lockdown without starting timer. Validates parameters and session token.
Step 9: Start a 5-minute delayed lockdown that triggers dashboard nuke
sudo health-control emergency-lockdown --delay 300 --plan dashboard
Note
DELAYED LOCKDOWN - Schedules emergency action after countdown. User can cancel before timer expires with emergency-lockdown-cancel. Useful for dead-man-switch scenarios.
Step 10: Start a 1-minute delayed lockdown for LUKS nuke
sudo health-control emergency-lockdown --delay 60 --plan luks --device "${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}"
Note
SHORT TIMER - 60 second countdown before LUKS header destruction. Cancel with emergency-lockdown-cancel if needed.
Step 11: Check if a delayed lockdown is currently active and its remaining time
health-control emergency-lockdown-status
Note
READ-ONLY - No session token required. Shows: active status, scheduled plan, remaining seconds, start time. Returns 'No active lockdown' if none pending.
Step 12: Check lockdown status in JSON format for dashboard integration
health-control emergency-lockdown-status --json
Note
JSON output for dashboard polling and monitoring systems. No authentication required for status checks.
Step 13: Cancel an active delayed lockdown before it triggers
sudo health-control emergency-lockdown-cancel
Note
Cancels pending lockdown and kills the timer process. Requires valid session token. Returns error if no lockdown is active.
Step 14: Cancel lockdown with JSON confirmation output
sudo health-control emergency-lockdown-cancel --json
Note
Machine-readable cancellation confirmation for dashboard integration.
Scenario 29: Display & Power
Conky, screensaver, DPMS, and session power controls
Step 1: Start Conky widget
health-control conky-enable
Step 2: Stop Conky widget
health-control conky-disable
Step 3: Conky status as JSON
health-control conky-status --json
Step 4: Enable Conky autostart on boot
health-control conky-boot-enable
Step 5: Disable Conky autostart
health-control conky-boot-disable
Step 6: Disable XFCE screensaver
health-control screensaver-disable
Step 7: Re-enable screensaver
health-control screensaver-enable
Step 8: Check screensaver state
health-control screensaver-status --json
Step 9: Keep display always on
health-control dpms-disable
Step 10: Restore display power saving
health-control dpms-enable
Step 11: Check DPMS timeouts
health-control dpms-status --json
Step 12: Lock screen immediately
health-control lock-screen
Note
Multi-fallback: loginctl > xdg-screensaver > xflock4
Step 13: End XFCE session
health-control session-logout
Note
Fallback: loginctl terminate-user
Step 14: Suspend to RAM
health-control suspend
Note
Fallback: systemctl suspend
Step 15: Mask sensitive info in Conky panels for safe screenshots
health-control conky-mask-enable
Step 16: Unmask Conky panels to show real data
health-control conky-mask-disable
Step 17: Check if Conky privacy masking is active
health-control conky-mask-status
Environment Variables
| Variable | Description | Default | Values |
|---|---|---|---|
NO_COLOR |
Disable all colored output when set | unset | 1|true|yes (any value disables color) |
RUST_LOG |
Set the log level for env_logger | info | error|warn|info|debug|trace |
Exit Codes
| Code | Description |
|---|---|
| 0 | Success |
| 1 | The operation failed or only partly succeeded (with --json, the error's code field names its kind) |
| 2 | Invalid arguments; also an applied change that takes effect after a reboot, or a wipe that could not remove every item |
| 7 | Authentication required or failed |