Kodachi Terminal Server edition

# Login credentials
# Username: kodachi
# Password: Security4All

sudo routing-switch connect wireguard              # Connect to VPN
sudo tor-switch torrify-system-nftables-dns       # Torrify system + Tor DNS
sudo dns-switch switch --names dnscrypt-quad9      # Privacy-focused DNS

# Configure V2Ray with SOCKS5 inbound
v2ray run -config /path/to/config.json
# Default SOCKS5 port: 10808

microsocks -i 0.0.0.0 -p 30050  # Listen on all interfaces, port 30050

sudo apt install dante-server
sudo systemctl start danted
# Configure /etc/danted.conf for your network

sudo ip-fetch fetch          # Check exit IP
health-control net-check      # Verify no leaks
sudo dns-leak test            # DNS leak test

# Monitor active proxy connections
sudo netstat -tulpn | grep microsocks

# Configure firewall to restrict proxy access to trusted IPs
sudo iptables -A INPUT -p tcp --dport 30050 -s TRUSTED_IP -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 30050 -j DROP

# Force DNSCrypt setup even if marker exists
kodachi-autoshield.sh --force-dns-setup

# Force DNSCrypt reconfiguration
kodachi-autoshield.sh --force-dns-setup

# Skip AutoShield permanently
export KODACHI_SKIP_WELCOME=1

# Add to ~/.bashrc for persistent skip
echo 'export KODACHI_SKIP_WELCOME=1' >> ~/.bashrc

AUTO_REFRESH_TIMEOUT=600  # Default: 10 minutes (600 seconds)
# Change to desired value (e.g., 300 for 5 minutes, 1200 for 20 minutes)

/etc/profile.d/kodachi-autoshield.sh

# Explore all available commands with -e flag
health-control -e              # 50+ health control commands
routing-switch -e              # All routing and protocol commands
workflow-manager list          # List all 96 workflow profiles
tor-switch -e                  # Tor management commands
dns-switch -e                  # DNS configuration commands
cd /opt/kodachi/dashboard/hooks && ./global-launcher -e  # Binary deployment commands
online-auth -e                 # Authentication commands
integrity-check -e             # System verification commands
dns-leak -e                    # DNS leak detection commands
permission-guard -e            # Permission management commands
logs-hook -e                   # Logging system commands
deps-checker -e                # Dependency checking commands
online-info-switch -e          # Online information commands

# AI & Intelligence commands (KAICS - pre-installed)
ai-cmd -e                      # Natural language command interface
ai-gateway -e                  # Agent-safe command gateway and policy firewall
ai-trainer -e                  # ML model training and validation
ai-learner -e                  # Learning orchestration and analysis
ai-admin -e                    # Database management and diagnostics
ai-discovery -e                # Binary watcher and auto-indexer
ai-scheduler -e                # Cron-based task scheduler
ai-monitor -e                  # Proactive system monitoring

# Quick status checks
health-control security-score  # Comprehensive security analysis (0-100)
ip-fetch --json                # Current IP and geolocation (JSON format)
dns-leak test                  # DNS leak detection
routing-switch status          # Network connection status
tor-switch which-is-active     # Active Tor configuration
dns-switch status              # Current DNS configuration

# AI-powered operations (natural language interface)
ai-cmd query "check my network" # Natural language → command execution
ai-cmd interactive               # Start conversational AI session
ai-cmd query "test dns leaks" --engine onnx     # Use ONNX semantic model
ai-cmd query "analyze security" --engine mistral # Use local Mistral.rs GGUF model
ai-cmd query "check all services" --engine genai # Use Ollama local provider
ai-cmd query "analyze threats" --engine claude   # Use Claude CLI
ai-cmd tiers --json              # Show available AI tiers and status
ai-cmd tools --json              # List callable AI tools
ai-monitor status                # Proactive monitoring status
ai-monitor suggestions           # AI-generated security suggestions

# ai-gateway machine/agent integration
ai-gateway search "tor status" --limit 1 --json | jq '.data.results[0].invocation'
ai-gateway run tor-switch --command tor-status --dry-run --json
ai-gateway run ip-fetch --command fetch --args-json '{}' --dry-run --json
ai-gateway capabilities --agent-id anonymous --json

# Trusted agent example (token + trusted batch mode)
KODACHI_TRUSTED_BATCH_MODE=true KODACHI_AGENT_TOKEN_NULLCLAW=your_token \
ai-gateway run --agent-id nullclaw --agent-token your_token \
  --batch-json '[{"service":"tor-switch","command":"tor-status","dry_run":true}]' --json

# Dangerous command policy behavior
ai-gateway run health-control --command wipe-logs --dry-run --json
ai-gateway run health-control --command wipe-logs --confirm "I understand" --json

# Network operations (commands used by submenus)
dns-switch random              # Set random reputable DNS servers
dns-switch fallback            # Set fallback DNS servers
tor-switch restart-all-instances         # Restart all Tor instances
tor-switch list-instances-with-ip        # List Tor IPs and countries
tor-switch flush-iptables      # Flush iptables firewall rules
tor-switch flush-nftables      # Flush nftables firewall rules
integrity-check check-all      # Full system integrity verification
online-info-switch releases    # Check latest Kodachi releases

# Start SOCKS5 proxy server
routing-switch microsocks-enable -u USERNAME -p PASSWORD

# List all available workflows (96 profiles)
workflow-manager list

# Run specific VPN protocol workflows
sudo workflow-manager run initial_terminal_setup_wireguard_only
sudo workflow-manager run initial_terminal_setup_openvpn_only
sudo workflow-manager run initial_terminal_setup_v2ray_only
sudo workflow-manager run initial_terminal_setup_xray_vless_reality_only
sudo workflow-manager run initial_terminal_setup_shadowsocks_only
sudo workflow-manager run initial_terminal_setup_hysteria2_only
sudo workflow-manager run initial_terminal_setup_dante_only
sudo workflow-manager run initial_terminal_setup_mita_only

# Run Tor/Torrification workflows
sudo workflow-manager run torrify-balance-nftables-roundrobin
sudo workflow-manager run torrify-balance-nftables-consistent
sudo workflow-manager run torrify-balance-nftables-weighted
sudo workflow-manager run initial_terminal_setup_tor_only
sudo workflow-manager run initial_terminal_setup_auth_torrify_only

# Run DNS workflows
sudo workflow-manager run dns-dnscrypt-enable
sudo workflow-manager run tor-dns-nftables-full

# Run system/recovery workflows
sudo workflow-manager run routing-disconnect-clean
sudo workflow-manager run detorrify-complete-verify
sudo workflow-manager run recovery-master-complete

# Create custom workflow
workflow-manager create my-custom-workflow

# Set environment variable before login
export KODACHI_SKIP_WELCOME=1

# Or add to ~/.bashrc to skip permanently
echo 'export KODACHI_SKIP_WELCOME=1' >> ~/.bashrc

# Skip just once
KODACHI_SKIP_WELCOME=1 bash

# Source AutoShield directly
source /etc/profile.d/kodachi-autoshield.sh

# Or type the shortcut command (if configured)
kodachi

# With force DNS reconfiguration
kodachi-autoshield.sh --force-dns-setup

qemu-system-x86_64 -cdrom linux-kodachi-terminal-9.0.1-amd64.iso -m 4096 -enable-kvm

# Create encrypted persistence (recommended)
sudo health-control create-persistence --encrypted

# Custom size (8GB)
sudo health-control create-persistence --encrypted --size 8192

# Safety check device first
sudo health-control list-storage-devices
sudo health-control usb-safety-check --device /dev/sdX

# List available networks
sudo nmcli dev wifi list

# Connect to WPA2/WPA3 network
sudo nmcli dev wifi connect "NetworkName" password "YourPassword"

# Connect to hidden network
sudo nmcli dev wifi connect "HiddenSSID" password "YourPassword" hidden yes

# Connect to open network (no password)
sudo nmcli dev wifi connect "OpenNetwork"

# Set static IP for connection
sudo nmcli connection modify "NetworkName" \
  ipv4.addresses "192.168.1.100/24" \
  ipv4.gateway "192.168.1.1" \
  ipv4.dns "1.1.1.1 1.0.0.1" \
  ipv4.method manual

# Revert to DHCP
sudo nmcli connection modify "NetworkName" ipv4.method auto

# Set DNS servers (for privacy)
sudo nmcli connection modify "NetworkName" ipv4.dns "1.1.1.1 1.0.0.1"
sudo nmcli connection modify "NetworkName" ipv4.ignore-auto-dns yes

# Disable IPv6 (privacy/anonymity)
sudo nmcli connection modify "NetworkName" ipv6.method ignore

# Set connection priority (auto-connect preference)
sudo nmcli connection modify "NetworkName" connection.autoconnect-priority 10

# Monitor connection events (real-time)
nmcli monitor

# Create configuration file
sudo nano /etc/wpa_supplicant/wpa_supplicant.conf

ctrl_interface=/run/wpa_supplicant
update_config=1
country=US

# WPA2-PSK Network
network={
    ssid="YourNetworkName"
    psk="YourPassword"
    priority=1
}

# WPA3-SAE Network (newer routers)
network={
    ssid="WPA3Network"
    key_mgmt=SAE
    psk="YourPassword"
    ieee80211w=2
}

# Hidden Network
network={
    ssid="HiddenSSID"
    psk="YourPassword"
    scan_ssid=1
}

# Open Network (no encryption)
network={
    ssid="OpenNetwork"
    key_mgmt=NONE
}

# Stop NetworkManager (if running)
sudo systemctl stop NetworkManager

# Start wpa_supplicant manually
sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf

# Obtain IP address via DHCP
sudo dhclient wlan0

# Verify connection
ip addr show wlan0
ping -c 4 1.1.1.1

# Enable wpa_supplicant service
sudo systemctl enable wpa_supplicant@wlan0.service
sudo systemctl start wpa_supplicant@wlan0.service

# Check service status
sudo systemctl status wpa_supplicant@wlan0.service

# View logs
sudo journalctl -u wpa_supplicant@wlan0.service -f

# Show all wireless interfaces
iw dev

# Show interface details
iw dev wlan0 info

# Scan for networks
sudo iw dev wlan0 scan | grep -E "SSID|signal|freq"

# Bring interface up
sudo ip link set wlan0 up

# Connect to open network
sudo iw dev wlan0 connect "OpenNetworkSSID"

# Disconnect
sudo iw dev wlan0 disconnect

# Set specific channel (1-13)
sudo iw dev wlan0 set channel 6

# View wireless configuration
iwconfig wlan0

# Connect to open network
sudo iwconfig wlan0 essid "OpenNetwork"

# Set WEP key (legacy, insecure)
sudo iwconfig wlan0 key s:YourWEPKey

# Set transmission power
sudo iwconfig wlan0 txpower 20dBm

# 1. Unblock WiFi hardware
sudo rfkill unblock wifi

# 2. Restart NetworkManager
sudo systemctl restart NetworkManager

# 3. Bring interface up manually
sudo ip link set wlan0 up

# 4. Check for firmware issues
dmesg | grep -i firmware

# 5. Reload WiFi driver (example for Intel)
sudo modprobe -r iwlwifi && sudo modprobe iwlwifi

# 6. Check regulatory domain (affects available channels)
iw reg get
sudo iw reg set US  # Replace with your country code

# 7. Restart wpa_supplicant
sudo systemctl restart wpa_supplicant

# 8. Check interface power management (disable to prevent sleep)
sudo iw dev wlan0 set power_save off

# 9. Reset network stack
sudo systemctl restart networking

# 10. Check for conflicting processes
ps aux | grep -E "wpa_supplicant|NetworkManager|dhclient"

# After installing firmware, reload the driver
sudo modprobe -r <driver_name>  # Unload (e.g., iwlwifi, rtl8xxxu)
sudo modprobe <driver_name>     # Reload

# Or reboot the system
sudo reboot

# Set static IP via nmcli
sudo nmcli connection modify "NetworkName" \
  ipv4.addresses "192.168.1.100/24" \
  ipv4.gateway "192.168.1.1" \
  ipv4.dns "1.1.1.1,1.0.0.1" \
  ipv4.method manual

# Apply changes
sudo nmcli connection up "NetworkName"

# Edit network interfaces file
sudo nano /etc/network/interfaces

# Loopback interface
auto lo
iface lo inet loopback

# Ethernet static IP
auto eth0
iface eth0 inet static
    address 192.168.1.100
    netmask 255.255.255.0
    gateway 192.168.1.1
    dns-nameservers 1.1.1.1 1.0.0.1

# WiFi static IP
auto wlan0
iface wlan0 inet static
    address 192.168.1.101
    netmask 255.255.255.0
    gateway 192.168.1.1
    dns-nameservers 1.1.1.1 1.0.0.1
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

# Restart networking service
sudo systemctl restart networking

# Or manually bring interface down/up
sudo ip link set wlan0 down
sudo ip link set wlan0 up

# Enable DNSCrypt (Kodachi service)
sudo dns-switch dnscrypt-set

# Verify DNSCrypt is running
sudo systemctl status dnscrypt-proxy

# Test DNS privacy
sudo dns-leak test

# Set privacy-focused DNS (Cloudflare)
sudo nmcli connection modify "NetworkName" \
  ipv4.dns "1.1.1.1 1.0.0.1" \
  ipv4.ignore-auto-dns yes

# Or use Quad9 (malware blocking)
sudo nmcli connection modify "NetworkName" \
  ipv4.dns "9.9.9.9 149.112.112.112" \
  ipv4.ignore-auto-dns yes

# Apply changes
sudo nmcli connection up "NetworkName"

# Generate random MAC address
sudo ip link set wlan0 down
sudo macchanger -r wlan0
sudo ip link set wlan0 up

# Or use NetworkManager (persistent per connection)
sudo nmcli connection modify "NetworkName" \
  wifi.cloned-mac-address random \
  wifi.mac-address-randomization always

# Apply randomization
sudo nmcli connection up "NetworkName"

# Verify new MAC
ip link show wlan0 | grep "link/ether"

# Create systemd service
sudo nano /etc/systemd/system/mac-randomize@.service

[Unit]
Description=MAC Address Randomization for %I
Wants=network-pre.target
Before=network-pre.target
BindsTo=sys-subsystem-net-devices-%i.device
After=sys-subsystem-net-devices-%i.device

[Service]
Type=oneshot
ExecStart=/usr/bin/macchanger -r %I

[Install]
WantedBy=multi-user.target

sudo systemctl enable mac-randomize@wlan0.service
sudo systemctl start mac-randomize@wlan0.service

# Find least congested channel
sudo iw dev wlan0 scan | grep -E "freq|signal" | sort

# On your router, switch to channel with least interference
# 2.4GHz: Channels 1, 6, 11 (non-overlapping)
# 5GHz: More channels available, less congestion

# Real-time signal strength
watch -n 1 'iw dev wlan0 link'

# Detailed link statistics
iw dev wlan0 station dump

# Network speed test (requires speedtest-cli)
speedtest-cli

# Ping test to router
ping -c 50 192.168.1.1 | tail -3

# Configure firewall rules
sudo iptables -A INPUT -p tcp --dport 30050 -s TRUSTED_IP -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 30050 -j DROP

# Monitor active connections
sudo netstat -tulpn | grep microsocks

# Step 1: Detect LUKS devices on your system
health-control luks-detect
health-control luks-detect --all-devices    # Include loop and virtual devices
health-control luks-detect --json           # JSON output for scripts

# Step 2: Configure nuke password (Interactive - Recommended)
sudo health-control luks-nuke --action configure --device /dev/sda5
# Prompts for nuke password interactively (safer method)

# OR: Configure with password (Automated - for scripts)
sudo health-control luks-nuke --action configure --device /dev/sda5 --password YOUR_NUKE_PASSWORD

# Step 3: Verify nuke password is configured
health-control luks-nuke --action status                    # Check all LUKS devices
health-control luks-nuke --action status --device /dev/sda5  # Check specific device
health-control luks-nuke --action status --json             # JSON output

# Optional: Remove nuke password
sudo health-control luks-nuke --action remove --device /dev/sda5

# Add nuke password to existing LUKS partition (manual method)
sudo cryptsetup luksAddNuke /dev/sdX2

# You'll be prompted to:
# 1. Enter existing LUKS password
# 2. Enter new NUKE password (different from normal password)
# 3. Confirm nuke password

# <i class="fas fa-exclamation-triangle" style="color: #ff9800;"></i> WARNING: Manual method does NOT create header backups
# Consider using health-control for automated safety features

# During boot, when prompted for LUKS password:
# Enter NUKE password instead of normal password
# → LUKS header immediately destroyed
# → Boot fails (expected)
# → Data permanently destroyed

# Back up to an encrypted volume (LUKS / VeraCrypt / dm-crypt auto-detected)
# Add --allow-unencrypted to target an ordinary drive (you will be prompted to confirm)
kodachi-backup backup  --target /media/usb

# Restore the latest snapshot into a safe ~/Restored-<date> staging folder
kodachi-backup restore --target /media/usb

# Restore straight to original locations (overwrites current files)
kodachi-backup restore --target /media/usb --in-place

# Integrity check / list snapshots / show status
kodachi-backup verify  --target /media/usb
kodachi-backup list    --target /media/usb
kodachi-backup status  --target /media/usb

# Manage custom folders and view the full backup list
kodachi-backup categories                   # list all what-to-back-up entries as JSON
kodachi-backup add-path  --path <dir>       # add a custom folder to the backup list
kodachi-backup remove-path --path <dir>     # remove a custom folder from the backup list