Health Control Guide
health-control is Kodachi's emergency and hardening toolkit: kill switches, four-level panic modes, secure wiping, identity rotation, memory and swap protection, and a live security score. This guide is scenario-first, real run order, warnings, and recovery. For the exhaustive flag catalog, use the generated CLI reference.
v10.0.3 (build 75) · 255 commands · 22.2 MB · most actions need sudo
Documentation Navigation
This page is scenario-first (operational workflows, real run order, and troubleshooting). For the full autogenerated command/flag catalog, use the CLI Reference.
File Information
| Property | Value |
|---|---|
| Binary Name | health-control |
| Version | 10.0.3 (build 75) |
| Build Date | Not disclosed |
| Rust Version | 1.82.0 |
| File Size | 22.2MB |
| Author | Warith Al Maawali |
| License | Proprietary |
| Category | Security & Authentication |
| Description | Health control system for Kodachi that includes network connectivity checks and system health monito... |
| JSON Data | View Raw JSON |
SHA256 Checksum
66eb3da93c3c1a6e68b8e3b6f9b8a1c3e56bebff85b3910e622baf42fbfcd3c0
Key Features
Emergency Response System
| Feature | Description |
|---|---|
| Panic Modes | Four levels of emergency response (soft, medium, hard, destroy) |
| Kill Switch | Instant network termination with armed/disarmed states |
| Data Destruction | Secure wiping of files and logs |
| Identity Management | MAC address and hostname randomization |
Why Health Control is Critical
| Benefit | Description |
|---|---|
| Immediate Threat Response | React instantly to security breaches |
| Network Isolation | Cut all connections when compromised |
| Evidence Elimination | Secure data wiping prevents recovery |
| Hardware Anonymization | Change device fingerprints on demand |
| Recovery Options | Restore normal operations after threats pass |
TL;DR - Essential Commands
Important: Most commands require sudo as they modify system-level settings.
Network Control & Diagnostics
# Network connectivity testing
sudo health-control net-check # Test IP & DNS connectivity
sudo health-control net-check-http # Include HTTP connectivity test
sudo health-control net-check --ip-only # Test IP connectivity only (skip DNS)
sudo health-control net-check # Test DNS and IP connectivity
sudo health-control net-check --timeout 15 # Custom timeout (seconds)
sudo health-control list-ips # Show test IP addresses
sudo health-control list-domains # Show test domain names
# Block internet traffic (multiple methods available)
sudo health-control block-internet # Auto-detect best method
sudo health-control block-internet --method nftables # Modern firewall (preferred)
sudo health-control block-internet --method iptables # Legacy firewall
sudo health-control block-internet --method firewall # UFW (Uncomplicated Firewall)
sudo health-control block-internet --method interfaces # Disable network interfaces
sudo health-control block-internet --method all # Apply ALL methods
sudo health-control block-internet --allow-local # Block internet but allow LAN
# Restore internet access
sudo health-control unblock-internet # Auto-detect
sudo health-control unblock-internet --method all # Clear ALL blocks
# Check blocking status
sudo health-control internet-status # Current blocking status
# Emergency operations
sudo health-control kill-network # Kill all network interfaces
sudo health-control kill-network-interface --interface wlan0 # Kill specific interface
sudo health-control recover-internet # Auto-diagnose & fix connectivity
sudo health-control recover-internet --check-dns # Include DNS fixes
sudo health-control fast-recover-internet # Fast recovery: bounce interface, restart NetworkManager, renew DHCP
Identity Management
# Change all MAC addresses (original MACs are NOT restored on reboot)
sudo health-control mac-change-all
# MAC address advanced operations
sudo health-control mac-force-change # Force change all MACs (disable interfaces first)
sudo health-control mac-change-specific --interface eth0 # Change specific interface MAC
sudo health-control mac-show-interfaces # Show available network interfaces
sudo health-control mac-show-macs # Show current MAC addresses
sudo health-control mac-reset-all # Reset all MACs to default
sudo health-control mac-active-interface # Show active network interface
sudo health-control mac-rotation --enable --interval-minutes 120 # Rotate MACs on a timer (off by default)
health-control mac-rotation --status # Is timed rotation on, and how often
sudo health-control mac-rotation --disable # Turn timed rotation off
health-control wifi-hidden-audit # Saved Wi-Fi profiles that call out their network name
# Set random hostname (original hostname is NOT restored on reboot)
sudo health-control set-random-hostname
# Get current hostname
health-control get-hostname
# Change hostname (prompts for new hostname)
sudo health-control change-hostname
sudo health-control change-hostname new-hostname
# Set custom hostname
sudo health-control set-custom-hostname --name MyHost
# Set default hostname
sudo health-control set-default-hostname
# List available hostnames by category
health-control list-hostnames
health-control list-hostnames --category windows
health-control list-hostnames --category linux
# Set random hostname from specific category
sudo health-control set-random-hostname-category --category windows
# Get logged-in user (handles sudo correctly)
health-control get-logged-user
# RESTORE WARNING: Document original MAC addresses and hostname before changing!
# Use 'ip link show' to view current MACs and 'hostname' for current hostname
Timezone Management
# Show current system timezone
health-control show-timezone
# Sync timezone based on IP geolocation
sudo health-control sync-timezone
# Show timezone based on current IP location
health-control show-remote-timezone
# Set system timezone
sudo health-control set-timezone --timezone America/New_York
sudo health-control set-timezone --timezone Europe/London
# List available timezones by category
health-control list-timezones
health-control list-timezones --category americas
health-control list-timezones --category europe
health-control list-timezones --category asia
# Set random timezone from specific category
sudo health-control set-random-timezone
sudo health-control set-random-timezone --category americas
Secure Data Wiping
DANGER: All wipe operations permanently destroy data. Files cannot be recovered!
# Wipe specific file (PERMANENTLY DESTROYED - UNRECOVERABLE)
sudo health-control wipe-file --file /path/to/sensitive.txt
sudo health-control wipe-file --file /path/to/file --passes 7 # Custom passes
# Wipe entire directory
sudo health-control wipe-directory --path /tmp/sensitive_dir
# Batch wipe multiple files
sudo health-control wipe-batch --paths /tmp/file1,/tmp/file2,/tmp/file3
# Wipe logs
sudo health-control wipe-logs # All logs
sudo health-control wipe-logs --type system # System logs only
sudo health-control wipe-logs --type all # Everything
# Clear your traces: shell and tool histories, the recently used list, thumbnails. Needs sudo and a login
sudo health-control clear-user-traces --dry-run # Show what would be cleared
sudo health-control clear-user-traces # Clear them (your account and root; cannot be undone)
# Wipe browser data
sudo health-control wipe-browser-data # All browsers
sudo health-control wipe-browser-data --browser firefox
sudo health-control wipe-browser-data --browser all
# Advanced wipe operations
sudo health-control wipe-free-space --device / # Wipe free space on filesystem
sudo health-control wipe-pattern '*.tmp' # Wipe files matching pattern
sudo health-control wipe-pattern '*.log' --directory /var/log
sudo health-control wipe-schedule temp --frequency daily # Schedule automatic wiping
sudo health-control wipe-schedule logs --frequency weekly
# Verify wipe was successful
sudo health-control wipe-verify --path /path/to/wiped/file
# RAM wipe operations
sudo health-control wipe-ram-install # Install RAM wipe system
sudo health-control wipe-ram-config --policy auto # Update RAM wipe configuration
sudo health-control wipe-ram-test # Test RAM wipe operation
sudo health-control wipe-ram # Execute RAM wipe
Phone Companion
A phone you pair can read a short status of this machine (the route, whether the kill switch is armed and enforcing, whether Tor runs, the unread SOC alerts) and start a soft or medium panic with your PIN, from anywhere, through an onion service that only that phone can reach (v3 client authorization). It is off by default, listens on no network port, and can never unlock, recover or destroy anything. Five wrong PINs lock it until you run companion-enable again at the machine.
Before you start: companion-enable and companion-pair need sudo and a login (the dashboard's login, or sudo online-auth authenticate). companion-disable, companion-unpair and companion-status need sudo only. companion-serve is not a command to run yourself: companion-enable installs a service that runs it, and it refuses to run any other way.
Pairing runs in a terminal and shows the phone's key once; the key is never stored on this machine, written to a log or put in JSON output. A panic from the phone answers first and starts 2 seconds later, because it cuts the network and the phone's connection with it.
# Install and start the phone companion (off by default; nothing is published until a phone is paired)
sudo health-control companion-enable
# Pair a phone: choose the PIN twice, then add the line shown once to Tor Browser or Orbot on the phone
sudo health-control companion-pair --name pixel
# Is it running and published? Which phones are paired? Is it locked after wrong PINs?
sudo health-control companion-status --json
# Unpair one phone, or every phone (the next pairing gets a new address)
sudo health-control companion-unpair --name pixel
sudo health-control companion-unpair --all
# Stop it and remove its units
sudo health-control companion-disable
Password Generation
Generate secure passwords using multiple methods with customizable options:
# Generate single password (all methods)
sudo health-control genpass
# Generate using specific method
sudo health-control genpass --method pwgen # Random password
sudo health-control genpass --method xkcdpass # Memorable passphrase
sudo health-control genpass --method pass # GPG-style password
# Batch generate multiple passwords
sudo health-control genpass --count 10
sudo health-control genpass --method pwgen --count 50
# Customize password generation
sudo health-control genpass --length 32 --symbols "@-_!#$"
sudo health-control genpass --uppercase --lowercase --digits
# JSON output
sudo health-control genpass --json
sudo health-control genpass --method xkcdpass --count 20 --json
Password Generation Methods:
| Method | Description | Example Output |
|---|---|---|
| pass | GPG-based random characters | Jk9@mP-xQ2_aB5nRt8@Zy3 |
| pwgen | Pronounceable random passwords | pL7-xM@kW_bN5cD9rF |
| xkcdpass | Memorable word-based passphrases | correct-horse-battery-staple |
Key Features:
| Feature | Description |
|---|---|
| Batch Generation | Generate up to 1000 passwords at once |
| Customization | Control length (default: 25), character sets, symbols |
| Multiple Methods | Generate from all methods simultaneously |
| Native Fallback | Works even without packages installed |
| Package Detection | Shows install instructions for missing packages |
Examples:
# Default: generates from all methods
sudo health-control genpass
# Output: Passwords from pass, pwgen, and xkcdpass
# Specific method with batch generation
sudo health-control genpass --method pwgen --count 50
# Output: 50 random passwords
# Memorable passphrases
sudo health-control genpass --method xkcdpass --count 10
# Output: 10 word-based passphrases
# Custom length and symbols
sudo health-control genpass --length 32 --symbols "@-_!#$%^&*"
# JSON output for automation
sudo health-control genpass --method pwgen --count 5 --json
Package Requirements:
| Package | Installation | Purpose |
|---|---|---|
| pass | sudo apt install pass |
GPG-based generation |
| pwgen | sudo apt install pwgen |
Random passwords |
| xkcdpass | sudo apt install xkcdpass |
Memorable passphrases |
Note: All methods work with native Rust fallback if packages aren't installed. Use --force-native to skip package detection.
Beyond the everyday commands
The groups above cover what most people run day to day. health-control ships 255 commands in total; the rest are grouped families you reach for in specific situations. Rather than reproduce the whole catalog here (and risk it drifting from the binary), each family below is documented in full, with every flag and example, on the auto-generated health-control reference. The scenarios further down this page show these families in real, end-to-end run order.
| Command family | What it covers |
|---|---|
| Security assessment | security-status, security-score, security-report, profiles, remediation, and scheduling. See the Security Scoring System section below for how the score is built. |
| Memory and swap security | Memory cleaning and wiping, per-process limits, RAM-wipe-on-shutdown, and swap encryption or disabling. |
| Hardware and advanced security | Hardware RNG and entropy checks, cold-boot defense, and boot-chain verification. |
| System doctor and boot readiness | system-doctor and boot-readiness: read-only health reports that print the repair command for each problem. See System doctor and boot readiness below. |
| Security tools and hardening | Lynis, AIDE, kernel and user hardening helpers, and the watch-guard monitor. |
| Offline system information | Read-only host, hardware, and network facts gathered without touching the network. |
| Offline actions (service management) | Start, stop, and lock down local services for sensitive work. |
| System maintenance and updates | Package maintenance, cleanup, and update helpers. |
| Notifications and system control | Desktop notifications, display and power control, and session actions. |
| USB and storage security | USB device policy, isolation, and storage-security controls. |
| LUKS emergency operations | Encrypted-volume nuke and recovery controls. Destructive: read the warnings on the reference before use. |
| Persistent storage and containers | Persistence layers for live USB and encrypted containers. |
| Emergency operations and recovery | Kill switches, panic modes, recovery points, and panic-recover. See Panic Mode Escalation and Recovery Guidance below. |
These families include destructive commands
Wiping, LUKS nuke, and hard/destroy panic modes permanently destroy data. Test with --dry-run where available, keep verified backups, and read the recovery notes before running them for real.
System doctor and boot readiness
sudo health-control system-doctor checks five things and prints the command that fixes each problem it finds. It never changes anything itself, and its text pastes into a support chat as it is.
- Stability: whether the last five boots ended with a clean shutdown. For a boot that did not, it names the most likely cause from the last minute of the kernel log (a kernel fault, overheating, a disk that stopped answering, running out of memory, a graphics hang or a USB device disconnecting) and quotes the line. When the log shows nothing, it says the cause is unclear instead of guessing. A live session keeps no earlier boots, so this check is skipped there.
- Boot readiness: the same checks as
boot-readinessbelow. - Services: system services that have failed, with the command that shows why and the one that restarts them.
- Disk space: the system disk,
/home,/varand/tmpwhen they are separate, warning at 85% and failing at 95%;/bootand the EFI partition by the free space the next kernel needs. - Firewall guard: when the firewall rules watch below is on, the result of its last check (kept in place, put back, stopped after three tries in a minute, or could not read what you applied). When the watch is off, this check is skipped and says so.
The firewall rules watch (watch-guard type firewall-rules, off until you turn it on) notices when the Tor firewall you applied is removed, for example by another program flushing the firewall, and has tor-switch firewall-guard put the same torrify back. It only puts back what you applied in this boot; after a reboot, a detorrify, an internet block, a panic mode, nuke or an internet recovery there is nothing to put back until you torrify again. It does nothing while one of those is in progress or the system is shutting down, never removes a rule, and stops after three tries in a minute. Turn it on with sudo health-control enable --type watch-guard --watch firewall-rules --method auto; --method is required by enable but not used by this watch, which never blocks.
sudo health-control boot-readiness answers one question: will this system still start after a kernel, initramfs, GRUB or encryption change? It checks that every installed kernel has its initramfs, that each initramfs can unlock an encrypted system disk, that the GRUB menu names kernels that exist, that GRUB can open an encrypted /boot (LUKS1, or LUKS2 with PBKDF2 key slots), that a nuke password you set is inside every initramfs, and that /boot has room for the next kernel. On an installed system it also runs by itself after kernel updates and once a day; when it finds a kernel that would not start, you see a desktop notice and a line when you open a terminal. A live session is skipped: it starts from its own image.
Both commands exit with code 0 when nothing is wrong, 2 for warnings (including a check that could not read what it needed: unknown is never reported as fine) and 1 when something fails. Add --json for the full report as JSON; boot-readiness --quiet prints nothing and answers with the exit code only.
Understanding Key Security Features
Security Scoring System
Health Control evaluates your system security across 7 critical categories:
| Category | Weight | Check Item | Status |
|---|---|---|---|
| System Security | 30% | Disk encryption | Verified |
| System Security | 30% | Firewall status | Active |
| System Security | 30% | System updates | Current |
| System Security | 30% | Kernel hardening | Enabled |
| Privacy & Anonymity | 25% | VPN/Proxy status | Connected |
| Privacy & Anonymity | 25% | Tor configuration | Optimized |
| Privacy & Anonymity | 25% | DNS encryption | Active |
| Privacy & Anonymity | 25% | IP masking | Enabled |
| Network Security | 20% | Kill switch | Armed |
| Network Security | 20% | DNS leak protection | Active |
| Network Security | 20% | IPv6 privacy | Configured |
| Network Security | 20% | Network isolation | Enabled |
| Authentication | 10% | Kodachi auth status | Authenticated |
| Authentication | 10% | 2FA configuration | Enabled |
| Authentication | 10% | Password policies | Enforced |
| Authentication | 10% | Session security | Protected |
| Device Security | 5% | USB protection | Active |
| Device Security | 5% | Hardware RNG | Verified |
| Device Security | 5% | Secure boot | Enabled |
| Device Security | 5% | Physical ports | Secured |
| Advanced Privacy | 5% | Tirdad kernel module | Loaded |
| Advanced Privacy | 5% | RAM wipe config | Configured |
| Advanced Privacy | 5% | Cold boot defense | Active |
| Advanced Privacy | 5% | Anti-forensics | Enabled |
| Data Protection | 5% | Secure deletion | Configured |
| Data Protection | 5% | Browser privacy | Hardened |
| Data Protection | 5% | Clipboard security | Protected |
| Data Protection | 5% | Temp file handling | Secure |
Score Interpretation
| Score | Level | Description | Action Required |
|---|---|---|---|
| 90-100 | Excellent | Maximum protection active | Maintain current configuration |
| 75-89 | Good | Solid security, minor gaps | Review and fix recommendations |
| 60-74 | Fair | Basic protection only | Implement critical fixes |
| 40-59 | Poor | Significant vulnerabilities | Urgent remediation needed |
| 0-39 | Critical | System exposed | Immediate action required |
Check your score: sudo health-control security-score --json
Panic Mode Escalation
Four-tier emergency response system with increasing severity:
Level 1: Soft Panic
Use for: Public spaces, shoulder surfing, temporary privacy
| Action | Result | Recovery |
|---|---|---|
| Network termination | All connections cut | sudo health-control panic-recover (restores the firewall rules, services and network links the panic saved; restarting the network or unblock-internet does not undo it) |
| Screen lock | Immediate lock screen | Password unlock |
| Clipboard wipe | Sensitive data cleared | No recovery needed |
Level 2: Medium Panic
Use for: Suspected compromise, active surveillance
| Action | Result | Recovery |
|---|---|---|
| Soft panic actions | All Level 1 protections | sudo health-control panic-recover, as in Level 1 |
| Process termination | Kill browsers, terminals, file managers | Start them again yourself; panic-recover restarts only the services it saved |
| Memory clearing | Memory caches cleared | Not restored |
| Volume unmounting | External devices unmounted | Re-mount required |
Level 3: Hard Panic
Use for: Imminent seizure, critical breach
| Action | Result | Recovery |
|---|---|---|
| Network termination | All connections cut | Full system restart |
| Clipboard wipe | Sensitive data cleared | Full system restart |
| Memory clearing | Memory caches cleared | Full system restart |
| Volume unmounting | External devices unmounted | Full system restart |
| Process termination | All user processes killed | Full system restart |
| RAM wipe | A fast wipe that starts after the forced power-off and runs only until the power goes | Full system restart |
| Forced shutdown | Immediate power off | Full system restart |
Level 4: Destroy Panic
Use for: Absolute data destruction, no recovery possible
| Action | Result | Recovery |
|---|---|---|
| Hard panic actions | All Level 1+2+3 protections | , |
| LUKS header wipe | Disk encryption headers destroyed | Drive unusable |
WARNING
Hard panic causes permanent data loss in RAM and potentially on disk.
Recovery Guidance
Post-Emergency Recovery Steps:
-
After a Soft or Medium Panic:
sudo health-control panic-recover # restores the firewall rules, services and network links the panic saved -
After Network Kill:
sudo health-control fast-recover-internet # Quick fix: bounce interface + restart NetworkManager + DHCP sudo health-control recover-internet # Full auto-diagnose and restore sudo health-control unblock-internet # Clear blocking rules -
After MAC Changes:
# Restore original MACs (if documented before changes) sudo ip link set dev eth0 address 00:11:22:33:44:55 -
After Hostname Changes:
# Restore original hostname (if documented) sudo hostnamectl set-hostname original-hostname -
After Memory Wipe:
| Action | Description |
|---|---|
| System Reboot | Reboot system to restore normal memory operation |
| Session Recovery | Reload applications and restore working sessions |
- After LUKS Nuke:
| Status | Action Required |
|---|---|
| Data Status | Data is permanently lost and unrecoverable |
| Recovery Option 1 | Restore from backups if available |
| Recovery Option 2 | Reinstall system if no backups exist |
Internet Blocking Methods
Multi-layer blocking system with fallback mechanisms:
Method Hierarchy
| Priority | Method | Technology | Speed | Security | Recovery |
|---|---|---|---|---|---|
| 1 | nftables |
Kernel netfilter (modern) | Instant | Highest | unblock-internet |
| 2 | iptables |
Kernel netfilter (legacy) | Instant | High | unblock-internet |
| 3 | firewall |
UFW frontend | Fast | Medium | ufw --force reset |
| 4 | interfaces |
Physical disconnect | Slow | Absolute | Interface restart |
Blocking Strategies
| Strategy | Command | Use Case | LAN Access |
|---|---|---|---|
| Auto-detect | block-internet |
General use | Blocked |
| All methods | block-internet --method all |
Maximum security | Blocked |
| Allow local | block-internet --allow-local |
Home/office use | Allowed |
| Specific | block-internet --method nftables |
Known environment | Configurable |
How Blocking Works
User Command → Method Detection → Rule Application → Verification
↓ ↓ ↓ ↓
block-internet Check available Apply firewall Test connectivity
methods rules/disable Log results
interfaces
Network Recovery Process
| Step | Command | Description |
|---|---|---|
| 1 | sudo health-control unblock-internet |
Remove all blocking rules |
| 2 | sudo health-control fast-recover-internet |
Fast recovery: bounce interface, restart NetworkManager, renew DHCP |
| 3 | sudo health-control recover-internet |
Full auto-diagnose and fix connectivity |
| 4 | sudo health-control recover-internet --check-dns |
Include DNS resolution fixes |
| 5 | sudo health-control recover-internet --force |
Force complete network reset |
Advanced Commands
For advanced users who need access to all available commands and options, please refer to the auto-generated command reference which includes:
| Feature | Description |
|---|---|
| Memory Management | Advanced memory management commands |
| Process Control | Process termination controls |
| Wipe Algorithms | Advanced secure wipe algorithms |
| Network Management | Network interface management |
| System Checks | System integrity verification |
| Panic Profiles | Custom panic mode profiles |
| CLI Reference | All command-line flags and parameters |
Related Tools
Health Control integrates with other Kodachi tools for complete security:
| Tool | Integration |
|---|---|
| IP Fetch | Use after network recovery to verify connectivity |
| DNS Leak | Test for DNS leaks after network changes |
| Tor Switch | Manage Tor connections affected by network blocking |
| Online Auth | Authentication may be affected by emergency operations |
Security Notes
Important Security Practices:
| Practice | Description |
|---|---|
| Test First | Test panic modes in safe environment first |
| Kill Switch Safety | Keep kill switch disarmed during normal use |
| Backup Strategy | Backup data before using wipe commands |
| Document Changes | Document MAC addresses before changing |
| Appropriate Response | Use appropriate panic level for threat |
| Recovery Points | Create recovery points before major changes |
Performance
| Metric | Value |
|---|---|
| Panic Response | < 1 second activation |
| Network Block | Instant (< 100ms) |
| MAC Change | 2-3 seconds per interface |
| File Wipe | Varies by size and pattern |
| Memory Usage | ~30MB active |
Support
| Resource | Link |
|---|---|
| Website | digi77.com |
| Anonymity Verifier | kodachi.cloud |
| Discord Support | discord.gg/KEFErEx |
| GitHub | github.com/WMAL |
Scenario 1: First Boot Security Hardening
Complete security setup for a new Kodachi installation to achieve maximum protection.
# Step 1: Verify current security status
sudo health-control security-verify
# Step 2: Apply comprehensive security hardening
sudo health-control security-harden
# Expected: All 7 security modules configured (kernel, process, filesystem, network, memory, monitoring, sandboxing)
# Step 3: Check security score
sudo health-control security-score
# Expected: Score should be >70 after initial hardening
# Step 4: Verify system integrity
sudo integrity-check check-all
# Expected: All signatures valid
# Step 5: Set proper file permissions
sudo permission-guard scan /home
# Expected: Report shows secure file permissions
# Step 6: Create recovery point
sudo health-control create-recovery-point --name first-boot-hardened
# Step 7: Verify hardening was applied
sudo health-control security-verify
# Expected: All modules show ENABLED and CONFIGURED
Cross-binary workflow: health-control + integrity-check + permission-guard
When to run: After fresh installation or system restore. Or Automate this with workflow-manager.
Scenario 2: Daily Security Health Check
Quick daily verification to ensure system protection remains intact.
# Step 1: Check network connectivity
sudo health-control net-check
# Expected: Both IP and DNS connectivity working
# Step 2: Test for DNS leaks
dns-leak test
# Expected: No DNS leaks detected
# Step 3: Verify current IP and Tor status
ip-fetch
# Expected: Shows current IP, geolocation, Tor status
# Step 4: Check security score
sudo health-control security-score --json
# Expected: Score >70 for good security
# Step 5: Verify Tor is running
tor-switch tor-status
# Expected: Tor service active and circuits established
# Step 6: Check system integrity
sudo health-control security-status
# Expected: All security features operational
Cross-binary workflow: health-control + dns-leak + ip-fetch + tor-switch
When to run: Daily before sensitive work, or schedule with workflow-manager cron job.
Scenario 3: Legal Pressure & Emergency Data Destruction
Immediate data destruction when facing legal pressure or device seizure.
# Step 1: Activate medium panic mode (kills network, processes)
sudo health-control panic-medium
# Expected: Network terminated, processes killed, memory caches cleared
# Step 2: Wipe all logs
sudo health-control wipe-logs --type all
# Expected: System logs, user history, and cache wiped
# Step 3: Wipe browser data
sudo health-control wipe-browser-data --browser all
# Expected: All browser history and cache destroyed
# Step 4: Wipe free space to eliminate deleted file remnants
sudo health-control wipe-free-space --device /
# Expected: Free space overwritten, recovery impossible
# Step 5: Verify wipe completion
sudo health-control wipe-verify --path /var/log
# Expected: Logs successfully wiped
# Step 6: Create incident log
sudo logs-hook log --script 'emergency' --level fatal 'Emergency data destruction completed'
Cross-binary workflow: health-control + logs-hook
When to run: Only in genuine emergency situations with imminent threat of device seizure.
Scenario 4: Border Crossing - Kill Switch Activation
Prepare system for high-risk border crossing with instant network kill capability.
# Step 1: Create recovery point before crossing
sudo health-control create-recovery-point --name pre-border-crossing
# Step 2: Arm the kill switch
sudo health-control kill-switch-arm
# Expected: Kill switch armed and ready for activation
# Step 3: Enable watch-guard to cut the internet if the VPN tunnel drops
sudo health-control enable --type watch-guard --watch vpn --method nftables
# Step 4: Verify kill switch status
health-control kill-switch-status
# Expected: Shows armed status with timestamp
# Step 5: If threat detected, activate immediately
# sudo health-control kill-switch-activate --level medium
# Step 6: After crossing, check routing status
sudo routing-switch status
# Expected: Current routing mode and active connections
Cross-binary workflow: health-control + routing-switch
When to run: Before entering high-risk zones like border checkpoints or security screenings.
Scenario 5: Forensic Counter-Measures (Cold Boot Defense)
Reduce what cold boot attacks and RAM forensics can recover.
# Step 1: Enable cold boot defense mechanisms
sudo health-control coldboot-defense-enable
# Expected: Cold boot protections active
# Step 2: Enable RAM wipe on shutdown
sudo health-control wipe-ram-install && sudo health-control ram-wipe-enable
# Expected: free memory is overwritten at the next shutdown
# Step 3: Overwrite free memory now
sudo health-control memory-wipe
# Expected: free memory overwritten once; running programs keep theirs
# Step 4: Verify cold boot protection status
sudo health-control coldboot-defense-status
# Expected: Shows active protection mechanisms
# Step 5: Check RAM wipe configuration
sudo health-control ram-wipe-status
# Expected: RAM wipe enabled for shutdown
# Step 6: Review boot security settings
sudo health-control boot-integrity-check
# Expected: UEFI, Secure Boot and lockdown settings (it compares no hashes)
Cross-binary workflow: health-control + integrity-check
When to run: Before handling highly sensitive data or when physical security is compromised.
Scenario 6: Active Network Threat Detection & Isolation
Respond to detected network intrusion or surveillance.
# Step 1: Check current network status
sudo health-control net-check-http
# Expected: Network connectivity status shown
# Step 2: Block all internet traffic immediately
sudo health-control block-internet --method all
# Expected: All network blocked (nftables, iptables, firewall, interfaces)
# Step 3: Switch to secure DNS
sudo dns-switch dnscrypt-set --resolver cloudflare
# Step 4: Change routing to Tor-only
sudo routing-switch connect tor
# Expected: All traffic routed through Tor
# Step 5: Verify internet blocking status
sudo health-control internet-status
# Expected: Shows blocked status and methods used
# Step 6: After threat passes, quick-recover network
sudo health-control fast-recover-internet
# Expected: Interface bounced, NetworkManager restarted, DHCP renewed
# Step 7: Full recovery with DNS fixes if needed
sudo health-control recover-internet --check-dns --force
Timed MAC rotation: mac-rotation --enable changes your MAC addresses every N minutes (15 to 1440, default 60) until you turn it off. It is off by default, and the first change comes one full interval after you turn it on. Each rotation changes the interface you are connected through only while VPN routing and Tor are off, so a protected connection is never dropped; with them on, only your other interfaces change. A rotation briefly drops that connection for a few seconds and can give it a new address, which is why Kodachi keeps one MAC per boot unless you ask for more.
Hidden Wi-Fi networks: a saved Wi-Fi profile marked as a hidden network makes your machine call out that network's name wherever you are, so anyone nearby can learn the networks you know and imitate one. wifi-hidden-audit lists such profiles with the exact command that turns the flag off, changes nothing itself, and the security score counts them under Device Security.
Cross-binary workflow: health-control + routing-switch + dns-switch
When to run: When network intrusion detected or during active surveillance.
Scenario 7: Privacy Identity Rotation (MAC, Hostname, Timezone, Kloak)
Complete identity refresh to avoid tracking and correlation attacks.
# Step 1: Check current IP and identity
ip-fetch
# Expected: Shows current IP, location, hostname
# Step 2: Change all MAC addresses
sudo health-control mac-change-all
# Expected: All network interface MACs randomized
# Step 3: Set random hostname
sudo health-control set-random-hostname
# Expected: Hostname changed to random value
# Step 4: Randomize system timezone
sudo health-control set-random-timezone
# Expected: Timezone set to random value
# Step 5: Get new Tor circuit
sudo tor-switch new-tor-circuit
# Expected: New Tor exit node assigned
# Step 6: Verify IP changed
ip-fetch
# Expected: New IP, new geolocation, new identity
Cross-binary workflow: health-control + tor-switch + ip-fetch
When to run: Periodically during sensitive operations or when identity correlation is suspected.
Scenario 8: USB Threat Isolation & Device Policy
Protect against malicious USB devices and BadUSB attacks.
# Step 1: List current USB devices
sudo health-control usb-list
# Expected: Shows all connected USB devices
# Step 2: Enable USB Guard protection
sudo health-control usb-guard-enable
# Expected: USB Guard active, unauthorized devices blocked
# Step 3: Monitor USB connections in real-time
sudo health-control usb-monitor
# Expected: Shows USB connection events
# Step 4: View USB connection history
sudo health-control usb-history --days 7
# Expected: Past week's USB activity log
# Step 5: Add trusted device policy
sudo health-control usb-policy --action add --device-id 1234:5678 --allow
# Step 6: Verify system integrity after USB insertion
sudo integrity-check check-all
# Expected: No system tampering detected
Cross-binary workflow: health-control + integrity-check
When to run: When using untrusted USB devices or in high-security environments.
Scenario 9: Emergency Encryption Key Destruction (LUKS Nuke)
Destroy encryption keys to make data permanently unrecoverable under extreme duress.
# Step 1: Detect all LUKS encrypted devices
sudo health-control luks-detect
# Expected: Lists all LUKS-encrypted partitions
# Step 2: Check current encryption status
sudo health-control disk-encryption-status
# Expected: Shows encryption details for each device
# Step 3: Verify storage device safety before nuke
sudo health-control list-storage-devices
# Expected: Shows safety level (SAFE/CAUTION/DANGER)
# Step 4: CRITICAL - Execute LUKS nuke (DESTROYS ALL DATA)
# sudo health-control luks-nuke
# WARNING: This permanently destroys all encrypted data
# Step 5: Verify encryption headers destroyed
sudo health-control encryption-status
# Expected: LUKS headers no longer accessible
# Step 6: Confirm data is unrecoverable
sudo integrity-check check-all
# Expected: Encrypted volumes inaccessible
Cross-binary workflow: health-control + integrity-check
When to run: ONLY in extreme emergencies when data destruction is the only option.
Scenario 10: Persistence Layer for Live USB
Create encrypted persistence on USB drive for portable secure storage.
# Step 1: List storage devices and verify USB safety
sudo health-control list-storage-devices
# Expected: Shows USB drives marked as SAFE
# Step 2: Verify specific USB device is safe
sudo health-control usb-safety-check --device /dev/sdb1
# Expected: Returns SAFE status
# Step 3: Create encrypted persistence file (8GB)
sudo health-control create-persistence --encrypted --size 8
# Expected: Creates encrypted casper-rw file, prompts for password
# Step 4: Verify persistence file exists
ls -lh /media/*/casper-rw
# Expected: Shows 8GB persistence file
# Step 5: Check encryption status
sudo health-control encryption-status
# Expected: Shows casper-rw encryption details
# Step 6: Verify integrity of persistence setup
sudo integrity-check check-all
Cross-binary workflow: health-control + integrity-check
When to run: After creating bootable USB or when setting up portable workspace.
Scenario 11: System Hardening Before Sensitive Work (Lynis, AIDE, Kernel)
Comprehensive security audit and hardening before high-risk operations.
# Step 1: Run Lynis security audit
sudo health-control lynis-audit
# Expected: Detailed security audit report
# Step 2: Check Lynis audit status
health-control lynis-status
# Expected: Shows audit score and recommendations
# Step 3: Apply security hardening
sudo health-control security-harden --profile paranoid
# Expected: Maximum security hardening applied
# Step 4: Initialize AIDE file integrity monitoring
sudo health-control aide-init
# Expected: AIDE database created
# Step 5: Compute the overall security score from the real read-only checks
sudo health-control security-score --json
# Expected: Security score with per-check breakdown
# Step 6: Verify all hardening applied correctly
sudo health-control security-verify
# Expected: All 7 security modules ENABLED and CONFIGURED
# Step 7: Check final security score
sudo health-control security-score --json
# Expected: Score >90 for paranoid configuration
Cross-binary workflow: health-control + integrity-check
When to run: Before handling classified data, whistleblowing, or journalism work.
Scenario 12: Incident Response - Malware Containment
Respond to suspected malware infection with isolation and forensics.
# Step 1: Kill network immediately
sudo health-control kill-network
# Expected: All network interfaces disabled
# Step 2: Run rootkit scan
sudo health-control rootkit-scan-enhanced
# Expected: Comprehensive rootkit detection
# Step 3: Scan system with ClamAV
sudo health-control clamav-scan
# Expected: Malware scan results
# Step 4: Check AIDE for file system changes
sudo health-control aide-check
# Expected: Shows modified/new/deleted files
# Step 5: Verify system integrity
sudo integrity-check check-all --timeout 300
# Expected: Signature verification results
# Step 6: Log incident details
sudo logs-hook log --script 'security' --level warn 'Malware containment protocol executed'
# Step 7: Create recovery point if clean
sudo health-control create-recovery-point --name post-malware-scan
ClamAV is not installed by default. Install it once with sudo apt install clamav clamav-freshclam; its clamav-freshclam service then downloads the virus list in the background (a few minutes the first time) and keeps it current. Step 3 needs that list.
Cross-binary workflow: health-control + logs-hook + integrity-check
When to run: When malware infection suspected or unusual system behavior detected.
Scenario 13: Password Generation & Batch Management
Generate secure passwords for multiple accounts using different methods.
# Step 1: Generate single password using all methods
sudo health-control genpass
# Expected: Passwords from pass, pwgen, and xkcdpass
# Step 2: Batch generate 50 strong passwords
sudo health-control genpass --method pwgen --count 50
# Expected: 50 random strong passwords
# Step 3: Generate memorable passphrases
sudo health-control genpass --method xkcdpass --count 10
# Expected: 10 word-based passphrases
# Step 4: Generate custom length passwords with specific symbols
sudo health-control genpass --length 32 --symbols "@-_!#$%^&*"
# Expected: 32-character password with specified symbols
# Step 5: Generate JSON output for automation
sudo health-control genpass --method pwgen --count 20 --json > passwords.json
# Step 6: Automate password generation workflow
# workflow-manager create batch-password-gen
Cross-binary workflow: health-control + workflow-manager
When to run: During account creation, password rotation, or security audits.
Scenario 14: Off-Grid System Audit (All Offline Info Commands)
Complete system information gathering without network connectivity.
# Step 1: Get comprehensive system info
sudo health-control offline-info-all
# Expected: Complete system overview (hardware, processes, services, security)
# Step 2: Check hardware details
sudo health-control offline-info-hardware
# Expected: CPU, RAM, disk, network hardware details
# Step 3: Analyze running processes
sudo health-control offline-info-process
# Expected: Process list with CPU/memory usage
# Step 4: Review security configuration
sudo health-control offline-info-security
# Expected: Firewall, SELinux, AppArmor, encryption status
# Step 5: Check network configuration
sudo health-control offline-info-network
# Expected: Interface configuration, routing tables
# Step 6: Review storage details
sudo health-control offline-info-storage
# Expected: Disk partitions, mount points, usage
# Step 7: Log system audit
sudo logs-hook log --script 'system' --level info 'Complete offline system audit performed'
Cross-binary workflow: health-control + logs-hook
When to run: During offline operations, pre-deployment checks, or air-gapped system audits.
Scenario 15: Multi-Layer Emergency Response (Soft/Medium/Hard Panic)
Escalating emergency responses based on threat severity.
# SOFT PANIC - For public spaces, shoulder surfing
sudo health-control panic-soft
# Actions: Kill network, clear clipboard, lock screen
# Recovery: unlock the screen, then sudo health-control panic-recover (restarting the network or unblock-internet does not undo it)
# MEDIUM PANIC - For suspected compromise
# sudo health-control panic-medium
# Actions: Kill network, terminate processes, clear memory caches, lock screen
# Recovery: sudo health-control panic-recover; ended processes and unmounted devices do not come back
# HARD PANIC - For imminent seizure
# sudo health-control panic-hard
# Actions: Kill network, clear clipboard, clear memory caches, unmount devices, force the power off, then start a fast RAM wipe that runs only until the power goes
# WARNING: IRREVERSIBLE - system will shutdown immediately
# Opt-in: after the screen is locked, also clear your traces (cannot be undone)
sudo health-control panic-soft --clear-traces
sudo health-control panic-medium --clear-traces
# After a soft or medium panic, restore what it saved
sudo health-control panic-recover # firewall rules, services and network links
sudo health-control recover-internet --force # only if the network is still down afterwards
# Verify routing after recovery
sudo routing-switch status
# Check Tor status after recovery
tor-switch tor-status
Cross-binary workflow: health-control + routing-switch + tor-switch
Clearing your traces: --clear-traces (soft and medium panic) and clear-user-traces empty your shell and tool histories (bash, zsh, fish, python, less, vim and others), the recently used files list and the thumbnail cache, yours and root's. Only files each account owns inside its own home are touched, and a link is left in place, never followed. A shell that is still open writes its history back when it closes, so close open terminals first or turn history off with offline-cmdhistory --action disable.
When to run: Choose panic level based on threat severity. Soft for minor threats, hard for critical emergencies.
Scenario 16: Service Lockdown for Sensitive Operations (30+ Offline Actions)
Disable all non-essential services before sensitive work.
# Step 1: Disable Bluetooth
sudo health-control offline-bluetooth --action disable
# Expected: Bluetooth completely disabled
# Step 2: Disable WiFi
sudo health-control offline-wifi --action disable
# Expected: WiFi interfaces disabled
# Step 3: Disable USB storage
sudo health-control offline-usb-storage --action disable
# Expected: USB storage mounting blocked
# Step 4: Disable webcam
sudo health-control offline-webcam --action disable
# Expected: Webcam access blocked
# Step 5: Disable microphone
sudo health-control offline-microphone --action disable
# Expected: Microphone access blocked
# Step 6: Disable system logging
sudo health-control offline-systemlogs --action disable
# Expected: Logging services stopped
# Step 7: Disable network services
sudo health-control offline-networkmanager --action disable
# Expected: NetworkManager disabled
# Step 8: Log lockdown status
sudo logs-hook log --script 'security' --level warn 'System lockdown for sensitive operations'
Cross-binary workflow: health-control + logs-hook
When to run: Before handling extremely sensitive data or classified information.
Scenario 17: Complete System Wiping Before Decommissioning
Securely wipe system before disposal or transfer.
# Step 1: List all storage devices
sudo health-control list-storage-devices
# Expected: Shows all storage with safety indicators
# Step 2: Wipe all logs
sudo health-control wipe-logs --type all
# Expected: All system and user logs destroyed
# Step 3: Wipe browser data
sudo health-control wipe-browser-data --browser all
# Expected: All browser data destroyed
# Step 4: Wipe temporary files
sudo health-control wipe-pattern '*.tmp' --directory /tmp
# Step 5: Wipe free space on all partitions
sudo health-control wipe-free-space --device /
# Expected: Free space overwritten
# Step 6: Verify wipe completion
sudo health-control wipe-verify --path /var/log
# Step 7: Final integrity check
sudo integrity-check check-all
Cross-binary workflow: health-control + integrity-check
When to run: Before selling, donating, or decommissioning hardware.
Scenario 18: Malware Defense with Watch-Guard Monitoring
Automated threat detection with watch-guard monitoring.
# Step 1: Enable watch-guard for VPN monitoring
sudo health-control enable --type watch-guard --watch vpn --method nftables --interval 3
# Expected: Internet blocked if VPN drops
# Step 2: Enable watch-guard for Tor process
sudo health-control enable --type watch-guard --watch process --target tor --method nftables
# Expected: Internet blocked if Tor stops
# Step 3: Enable watch-guard for IP changes
sudo health-control enable --type watch-guard --watch ip --method nftables
# Step 4: Enable watch-guard for DNS changes
sudo health-control enable --type watch-guard --watch dns --method firewall
# Step 5: Check all active watch-guards
sudo health-control watch-guard status
# Expected: Lists all active monitoring configurations
# Step 6: Automate watch-guard with workflow-manager
# workflow-manager create security-monitoring
# Step 7: Log watch-guard configuration
sudo logs-hook log --script 'security' --level warn 'Watch-guard monitoring enabled'
Cross-binary workflow: health-control + workflow-manager + logs-hook
When to run: During high-risk operations requiring automated threat response.
Scenario 19: Hardware Security Verification (RNG, Entropy, Boot Integrity)
Verify hardware security features before sensitive cryptographic operations.
# Step 1: Verify hardware RNG availability
sudo health-control hardware-rng-verify
# Expected: Hardware RNG present and functional
# Step 2: Check system entropy pool
sudo health-control entropy-status
# Expected: Sufficient entropy available (>1000 bits)
# Step 3: Verify boot chain integrity
sudo health-control boot-integrity-check
# Expected: Boot chain secure, no tampering
# Step 4: Audit firmware and platform security posture
sudo health-control firmware-security-check
# Expected: fwupd HSI level, UEFI Secure Boot, SPI and TPM state reported
# Step 5: Check cold boot defense status
sudo health-control coldboot-defense-status
# Expected: Cold boot protections active
# Step 6: Enable Tirdad for TCP ISN randomization
sudo health-control tirdad-enable
# Expected: TCP sequence number randomization active (in compatible mode)
# Note: Requires a boot mode without module.sig_enforce=1 or lockdown=integrity
# Not available on the four signature-enforcing entries: Maximum Privacy,
# Kernel Lockdown (confidentiality), Forensics Mode, Full Hardening
# On installed systems the same four entries block it
# Step 7: Check Tirdad status
health-control tirdad-status
# Expected: Tirdad module loaded and active
# Step 8: Verify overall security
sudo health-control security-score --json
# Expected: Hardware security contributing to high score
Cross-binary workflow: health-control + integrity-check
When to run: Before cryptographic key generation or encryption operations.
Scenario 20: System Recovery After Emergency Operations
Restore normal operations after panic mode or emergency shutdown.
# Step 1: Activate panic recovery mode
sudo health-control panic-recover
# Expected: "Panic recovery verified complete" (it needs the journal a soft or medium panic saved, and refuses without one)
# Step 2: only if you had also blocked the internet; it reverses only its own block, so after a panic alone it changes nothing
sudo health-control unblock-internet --method all
# Expected: All blocking rules removed
# Step 3: Fast network recovery (quick method)
sudo health-control fast-recover-internet
# Expected: Interface bounced, NetworkManager restarted, DHCP renewed
# Step 4: Full recovery with DNS fixes if needed
sudo health-control recover-internet --check-dns --force
# Expected: Network connectivity fully restored
# Step 5: Verify network is working
sudo health-control net-check-http
# Expected: IP, DNS, and HTTP connectivity working
# Step 6: Check DNS status (status reads only, it restarts nothing)
sudo dns-switch status
# Expected: DNS service operational
# Step 7: Restore routing configuration
sudo routing-switch status
# Expected: Normal routing restored
# Step 8: Verify system integrity
sudo health-control security-score
# Expected: Security score restored to normal levels
Cross-binary workflow: health-control + routing-switch + dns-switch
When to run: After emergency operations when returning to normal system operation.
Related Workflows
- IP Fetch, Verify IP changes after identity rotation
- DNS Leak, Test for DNS leaks after network changes
- Tor Switch, Manage Tor connections for anonymity
- Routing Switch, Control network routing (VPN/Tor/Direct)
- DNS Switch, Switch DNS servers and DNSCrypt
- Integrity Check, Verify system integrity and signatures
- Permission Guard, Monitor and manage file permissions
- Online Auth, Authentication may be affected by emergency operations
- Logs Hook, Centralized logging for all operations
- Full CLI Reference: health-control commands