{ "report_info": { "version": "9.0.1", "generated_at": "2026-07-11T19:39:00Z", "binary_name": "health-control" }, "binary": { "name": "health-control", "path": "/opt/kodachi/dashboard/hooks/health-control", "timestamp": "2026-07-11T19:39:00Z", "file_info": { "size": 15630848, "sha256": "9d2a2e3466cebaf138cbe8a7bd8bc7bf5de336a67051d034f91f2fbe9bbab9cd" }, "flag_n": { "command": "info", "data": { "author": "Warith Al Maawali", "copyright": "© 2026 Kodachi", "description": "Health control system for Kodachi that includes network connectivity checks and system health monitoring", "features": [ "Network connectivity monitoring", "Internet traffic control", "Security hardening", "System integrity checking", "Offline system management" ], "license": "Proprietary", "name": "health-control", "securityFeatures": { "authentication": "Not provided by cli-core (see online-auth)", "encryption": "Not provided by cli-core", "inputValidation": "Argument parsing via clap; per-command validation is the consumer's responsibility", "rateLimiting": "Not provided by cli-core" }, "systemRequirements": { "dependencies": [ "OpenSSL", "libcurl" ], "os": "Linux (Debian-based)", "privileges": "root/sudo for system operations" }, "version": "9.8.4 (build 320)", "website": "https://www.digi77.com" }, "errors": [], "metadata": { "executionTime": 20, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-11T19:39:00.637202981Z", "version": "9.8.4 (build 320)", "warnings": [] }, "flag_v": { "command": "version", "data": { "buildDate": "REDACTED-BUILD-TIME", "gitCommit": "unknown", "name": "health-control", "rustVersion": "1.82.0", "version": "9.8.4 (build 320)" }, "errors": [], "metadata": { "executionTime": 17, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-11T19:39:00.748032683Z", "version": "9.8.4 (build 320)", "warnings": [] }, "flag_h": { "command": "help", "data": { "commandCategories": [ { "category": "Data Destruction", "commands": [ { "description": "Securely wipe a file with multiple passes", "examples": [ "sudo health-control wipe-file --file /path/to/file.txt", "sudo health-control wipe-file --file /path/to/file.txt --passes 7 --json" ], "name": "wipe-file", "options": [], "requires_sudo": true, "usage": "health-control wipe-file [OPTIONS]" }, { "description": "Securely wipe an entire directory and its contents", "examples": [ "sudo health-control wipe-directory --path /tmp/sensitive_dir", "sudo health-control wipe-directory --path /path/to/directory --passes 7 --json" ], "name": "wipe-directory", "options": [], "requires_sudo": true, "usage": "health-control wipe-directory [OPTIONS]" }, { "description": "Securely wipe a common user directory (downloads, desktop, documents)", "examples": [ "sudo health-control wipe-user-dir --target downloads", "sudo health-control wipe-user-dir --target desktop", "sudo health-control wipe-user-dir --target documents --json" ], "name": "wipe-user-dir", "options": [], "requires_sudo": true, "usage": "health-control wipe-user-dir [OPTIONS]" }, { "description": "Securely wipe system logs (journal, syslog, auth.log, kern.log), user history (bash, zsh, python), and application cache logs", "examples": [ "sudo health-control wipe-logs # Wipe all logs (system + user)", "sudo health-control wipe-logs --type system # Wipe only system logs (/var/log/*, journal)", "sudo health-control wipe-logs --type user # Wipe only user logs (history, cache)", "sudo health-control wipe-logs --type all --json # Show detailed JSON output" ], "name": "wipe-logs", "options": [], "requires_sudo": true, "usage": "health-control wipe-logs [OPTIONS]" }, { "description": "Batch wipe multiple files", "examples": [ "sudo # Multiple file paths as arguments:", "sudo health-control wipe-batch file1.png file2.png --passes 7", "sudo health-control wipe-batch /tmp/sensitive.doc /home/user/data.txt", "sudo ", "sudo # Alternative comma-separated format:", "sudo health-control wipe-batch --paths \"file1.png,file2.png\" --passes 7", "sudo health-control wipe-batch --paths \"/tmp/file1,/tmp/file2\" --json", "sudo ", "sudo ⚠ Security Note: Using actual paths may expose system directory structure" ], "name": "wipe-batch", "options": [], "requires_sudo": true, "usage": "health-control wipe-batch [OPTIONS]" }, { "description": "Wipe browser data and history", "examples": [ "sudo health-control wipe-browser-data # Wipe all browsers", "sudo health-control wipe-browser-data --browser firefox # Firefox only", "sudo health-control wipe-browser-data --browser brave # Brave only", "sudo health-control wipe-browser-data --browser tor # Tor Browser only", "sudo health-control wipe-browser-data --browser all --json" ], "name": "wipe-browser-data", "options": [], "requires_sudo": true, "usage": "health-control wipe-browser-data [OPTIONS]" }, { "description": "Securely wipe free space on a mounted filesystem (use mount points like '/', '/home' or device paths)", "examples": [ "sudo health-control wipe-free-space --device /", "sudo health-control wipe-free-space --device /home", "sudo health-control wipe-free-space --device /dev/DEVICE --json", "sudo health-control wipe-free-space --device /tmp" ], "name": "wipe-free-space", "options": [], "requires_sudo": true, "usage": "health-control wipe-free-space [OPTIONS]" }, { "description": "Wipe files matching pattern (use --pattern flag or positional argument)", "examples": [ "sudo health-control wipe-pattern --pattern '*.tmp'", "sudo health-control wipe-pattern '*.tmp'", "sudo health-control wipe-pattern --pattern '*.log' --directory /var/log", "sudo health-control wipe-pattern '*.log' --directory /var/log", "sudo health-control wipe-pattern --pattern 'backup*' --json", "sudo health-control wipe-pattern 'backup*' --json", "sudo health-control wipe-pattern --pattern '*.cache' --directory ~/.cache", "sudo health-control wipe-pattern '*.cache' --directory ~/.cache" ], "name": "wipe-pattern", "options": [], "requires_sudo": true, "usage": "health-control wipe-pattern [OPTIONS]" }, { "description": "Schedule automatic data wiping", "examples": [ "sudo health-control wipe-schedule temp --frequency daily", "sudo health-control wipe-schedule logs --frequency weekly", "sudo health-control wipe-schedule browser --json" ], "name": "wipe-schedule", "options": [], "requires_sudo": true, "usage": "health-control wipe-schedule [OPTIONS]" }, { "description": "Verify that a file was wiped properly", "examples": [ "sudo health-control wipe-verify --path /tmp/sensitive.txt", "sudo health-control wipe-verify --path /home/user/data.bin --json" ], "name": "wipe-verify", "options": [], "requires_sudo": true, "usage": "health-control wipe-verify [OPTIONS]" } ] }, { "category": "Display & Power", "commands": [ { "description": "Start Conky widget", "examples": [ "health-control conky-enable", "health-control conky-enable --json" ], "name": "conky-enable", "options": [], "requires_sudo": false, "usage": "health-control conky-enable [OPTIONS]" }, { "description": "Stop Conky widget", "examples": [ "health-control conky-disable", "health-control conky-disable --json" ], "name": "conky-disable", "options": [], "requires_sudo": false, "usage": "health-control conky-disable [OPTIONS]" }, { "description": "Check Conky running/installed/boot state", "examples": [ "health-control conky-status", "health-control conky-status --json" ], "name": "conky-status", "options": [], "requires_sudo": false, "usage": "health-control conky-status [OPTIONS]" }, { "description": "Enable Conky on boot (autostart/systemd)", "examples": [ "health-control conky-boot-enable", "health-control conky-boot-enable --json" ], "name": "conky-boot-enable", "options": [], "requires_sudo": false, "usage": "health-control conky-boot-enable [OPTIONS]" }, { "description": "Disable Conky on boot", "examples": [ "health-control conky-boot-disable", "health-control conky-boot-disable --json" ], "name": "conky-boot-disable", "options": [], "requires_sudo": false, "usage": "health-control conky-boot-disable [OPTIONS]" }, { "description": "Disable XFCE screensaver", "examples": [ "health-control screensaver-disable", "health-control screensaver-disable --json" ], "name": "screensaver-disable", "options": [], "requires_sudo": false, "usage": "health-control screensaver-disable [OPTIONS]" }, { "description": "Enable XFCE screensaver", "examples": [ "health-control screensaver-enable", "health-control screensaver-enable --json" ], "name": "screensaver-enable", "options": [], "requires_sudo": false, "usage": "health-control screensaver-enable [OPTIONS]" }, { "description": "Check screensaver status", "examples": [ "health-control screensaver-status", "health-control screensaver-status --json" ], "name": "screensaver-status", "options": [], "requires_sudo": false, "usage": "health-control screensaver-status [OPTIONS]" }, { "description": "Disable display power management", "examples": [ "health-control dpms-disable", "health-control dpms-disable --json" ], "name": "dpms-disable", "options": [], "requires_sudo": false, "usage": "health-control dpms-disable [OPTIONS]" }, { "description": "Enable display power management", "examples": [ "health-control dpms-enable", "health-control dpms-enable --json" ], "name": "dpms-enable", "options": [], "requires_sudo": false, "usage": "health-control dpms-enable [OPTIONS]" }, { "description": "Check DPMS and timeout settings", "examples": [ "health-control dpms-status", "health-control dpms-status --json" ], "name": "dpms-status", "options": [], "requires_sudo": false, "usage": "health-control dpms-status [OPTIONS]" }, { "description": "Lock the screen", "examples": [ "health-control lock-screen", "health-control lock-screen --json" ], "name": "lock-screen", "options": [], "requires_sudo": false, "usage": "health-control lock-screen [OPTIONS]" }, { "description": "End XFCE session", "examples": [ "health-control session-logout", "health-control session-logout --json" ], "name": "session-logout", "options": [], "requires_sudo": false, "usage": "health-control session-logout [OPTIONS]" }, { "description": "Suspend to RAM", "examples": [ "health-control suspend", "health-control suspend --json" ], "name": "suspend", "options": [], "requires_sudo": false, "usage": "health-control suspend [OPTIONS]" }, { "description": "Mask sensitive info in Conky panels", "examples": [ "health-control conky-mask-enable", "health-control conky-mask-enable --json" ], "name": "conky-mask-enable", "options": [], "requires_sudo": false, "usage": "health-control conky-mask-enable [OPTIONS]" }, { "description": "Unmask Conky panels", "examples": [ "health-control conky-mask-disable", "health-control conky-mask-disable --json" ], "name": "conky-mask-disable", "options": [], "requires_sudo": false, "usage": "health-control conky-mask-disable [OPTIONS]" }, { "description": "Check if Conky privacy masking is active", "examples": [ "health-control conky-mask-status", "health-control conky-mask-status --json" ], "name": "conky-mask-status", "options": [], "requires_sudo": false, "usage": "health-control conky-mask-status [OPTIONS]" } ] }, { "category": "Emergency Operations", "commands": [ { "description": "Arm the emergency kill switch - sets system to high-alert state for manual activation. NOTE: This prepares the system for rapid response but does NOT actively monitor for threats. It's a preparedness state that allows quick manual activation via kill-switch-activate command.", "examples": [ "sudo health-control kill-switch-arm", "sudo health-control kill-switch-arm --json" ], "name": "kill-switch-arm", "options": [], "requires_sudo": true, "usage": "health-control kill-switch-arm [OPTIONS]" }, { "description": "Disarm the emergency kill switch", "examples": [ "sudo health-control kill-switch-disarm", "sudo health-control kill-switch-disarm --json" ], "name": "kill-switch-disarm", "options": [], "requires_sudo": true, "usage": "health-control kill-switch-disarm [OPTIONS]" }, { "description": "Check if kill switch monitoring is armed/disarmed. Shows armed time, trigger count, and monitoring state. Does NOT activate anything - just displays current status.", "examples": [ "health-control kill-switch-status", "health-control kill-switch-status --json" ], "name": "kill-switch-status", "options": [], "requires_sudo": false, "usage": "health-control kill-switch-status [OPTIONS]" }, { "description": "IMMEDIATELY activate emergency procedures. Unlike 'arm' which monitors, this executes panic mode NOW. Choose level: soft (network+lock), medium (default: +kill processes), hard (+RAM wipe+shutdown)", "examples": [ "sudo health-control kill-switch-activate", "sudo health-control kill-switch-activate --level hard --force", "sudo health-control kill-switch-activate --level soft --json", "sudo health-control kill-switch-activate --dry-run --json" ], "name": "kill-switch-activate", "options": [], "requires_sudo": true, "usage": "health-control kill-switch-activate [OPTIONS]" }, { "description": "IMMEDIATE soft panic mode. Actions: Kill all network connections, clear clipboard, lock screen. NO CONFIRMATION. Reversible by restarting network. Use for quick privacy protection.", "examples": [ "sudo health-control panic-soft", "sudo health-control panic-soft --json", "sudo health-control panic-soft --dry-run" ], "name": "panic-soft", "options": [], "requires_sudo": true, "usage": "health-control panic-soft [OPTIONS]" }, { "description": "IMMEDIATE hard panic mode with CONFIRMATION. CRITICAL: Kill network, clear clipboard, terminate ALL processes, clear memory, unmount devices, wipe RAM, IMMEDIATE SHUTDOWN. IRREVERSIBLE - system will shutdown!", "examples": [ "sudo health-control panic-hard", "sudo health-control panic-hard --json", "sudo health-control panic-hard --dry-run" ], "name": "panic-hard", "options": [], "requires_sudo": true, "usage": "health-control panic-hard [OPTIONS]" }, { "description": "IMMEDIATE medium panic mode with CONFIRMATION. Actions: Kill network, clear clipboard, terminate non-essential processes, clear memory, unmount devices, lock screen. Requires manual system restart to fully restore.", "examples": [ "sudo health-control panic-medium", "sudo health-control panic-medium --json", "sudo health-control panic-medium --dry-run" ], "name": "panic-medium", "options": [], "requires_sudo": true, "usage": "health-control panic-medium [OPTIONS]" }, { "description": "Configure automated emergency response profile that defines system actions during panic mode activation", "examples": [ "sudo # Configure light security response (recommended for public wifi):", "sudo health-control panic-profile --profile stealth", "sudo ", "sudo # Configure maximum security lockdown (for high-risk situations):", "sudo health-control panic-profile --profile paranoid", "sudo ", "sudo # Configure recovery mode (to restore system to safe state):", "sudo health-control panic-profile --profile recovery", "sudo ", "sudo # Get JSON output with profile configuration details:", "sudo health-control panic-profile --profile paranoid --json" ], "name": "panic-profile", "options": [], "requires_sudo": true, "usage": "health-control panic-profile [OPTIONS]" }, { "description": "Activate panic recovery mode", "examples": [ "sudo health-control panic-recover", "sudo health-control panic-recover --json" ], "name": "panic-recover", "options": [], "requires_sudo": true, "usage": "health-control panic-recover [OPTIONS]" }, { "description": "Create system recovery checkpoint", "examples": [ "sudo health-control create-recovery-point", "sudo health-control create-recovery-point --name pre-update", "sudo health-control create-recovery-point --json" ], "name": "create-recovery-point", "options": [], "requires_sudo": true, "usage": "health-control create-recovery-point [OPTIONS]" }, { "description": "Execute emergency data destruction sequence (DANGEROUS - use --dry-run for testing)", "examples": [ "health-control nuke-execute --dry-run", "health-control nuke-execute --method fast --dry-run", "health-control nuke-execute --method paranoid --dry-run --json" ], "name": "nuke-execute", "options": [ { "default": "secure", "description": "Wipe method: fast, secure (default), paranoid", "flag": "--method, -m ", "required": false }, { "description": "Test mode - shows actions without executing", "flag": "--dry-run", "required": false }, { "description": "Skip confirmation prompt (DANGEROUS)", "flag": "--force, -f", "required": false } ], "requires_sudo": false, "usage": "health-control nuke-execute [--method fast|secure|paranoid] [--dry-run] [--force]" }, { "description": "Get current nuke mode execution progress", "examples": [ "health-control nuke-progress", "health-control nuke-progress --json" ], "name": "nuke-progress", "options": [], "requires_sudo": false, "usage": "health-control nuke-progress" }, { "description": "Detect storage type (SSD/HDD/NVMe) for a device", "examples": [ "health-control nuke-storage-detect --device /dev/DEVICE", "health-control nuke-storage-detect -d /dev/nvme0n1 --json" ], "name": "nuke-storage-detect", "options": [ { "description": "Device path to check", "flag": "--device, -d ", "required": true } ], "requires_sudo": false, "usage": "health-control nuke-storage-detect --device /dev/DEVICE" } ] }, { "category": "Emergency Shortcuts", "commands": [ { "description": "Execute an emergency plan (dashboard, luks, both). Requires local session token from kodachi-session-helper daemon. Use --dry-run for testing.", "examples": [ "sudo health-control emergency-trigger --plan dashboard --dry-run", "sudo health-control emergency-trigger --plan luks --device /dev/DEVICE --dry-run", "sudo health-control emergency-trigger --plan both --device /dev/DEVICE --dry-run --json" ], "name": "emergency-trigger", "options": [ { "description": "Emergency plan: dashboard, luks, both", "flag": "--plan ", "required": true }, { "description": "LUKS device path (required for luks/both plans)", "flag": "--device ", "required": false }, { "description": "Log planned actions without executing", "flag": "--dry-run", "required": false }, { "description": "Suppress stdout output", "flag": "--silent", "required": false }, { "description": "Skip readiness checks", "flag": "--force", "required": false } ], "requires_sudo": true, "usage": "health-control emergency-trigger --plan [--device ] [--silent] [--force] [--dry-run]" }, { "description": "Start a delayed countdown that triggers an emergency plan when the timer expires. Persists state for crash recovery. Requires local session token.", "examples": [ "sudo health-control emergency-lockdown --delay 300 --dry-run", "sudo health-control emergency-lockdown --delay 60 --plan luks --device /dev/DEVICE", "sudo health-control emergency-lockdown --delay 120 --plan both --device /dev/DEVICE --json" ], "name": "emergency-lockdown", "options": [ { "description": "Countdown delay in seconds", "flag": "--delay ", "required": true }, { "default": "dashboard", "description": "Emergency plan: dashboard (default), luks, both", "flag": "--plan ", "required": false }, { "description": "LUKS device path (required for luks/both plans)", "flag": "--device ", "required": false }, { "description": "Log planned actions without starting timer", "flag": "--dry-run", "required": false } ], "requires_sudo": true, "usage": "health-control emergency-lockdown --delay [--plan ] [--device ] [--dry-run]" }, { "description": "Show current emergency lockdown state: active/inactive, remaining seconds, plan. No authentication required (read-only).", "examples": [ "health-control emergency-lockdown-status", "health-control emergency-lockdown-status --json" ], "name": "emergency-lockdown-status", "options": [], "requires_sudo": false, "usage": "health-control emergency-lockdown-status [--json]" }, { "description": "Cancel an active emergency lockdown countdown. Requires local session token.", "examples": [ "sudo health-control emergency-lockdown-cancel", "sudo health-control emergency-lockdown-cancel --json" ], "name": "emergency-lockdown-cancel", "options": [], "requires_sudo": true, "usage": "health-control emergency-lockdown-cancel" } ] }, { "category": "Hardware Security", "commands": [ { "description": "Verify hardware random number generator status", "examples": [ "sudo health-control hardware-rng-verify", "sudo health-control hardware-rng-verify --json" ], "name": "hardware-rng-verify", "options": [], "requires_sudo": true, "usage": "health-control hardware-rng-verify [OPTIONS]" }, { "description": "Check system entropy pool status and quality", "examples": [ "sudo health-control entropy-status", "sudo health-control entropy-status --json" ], "name": "entropy-status", "options": [], "requires_sudo": true, "usage": "health-control entropy-status [OPTIONS]" }, { "description": "Enable cold boot defense mechanisms", "examples": [ "sudo health-control coldboot-defense-enable", "sudo health-control coldboot-defense-enable --json" ], "name": "coldboot-defense-enable", "options": [], "requires_sudo": true, "usage": "health-control coldboot-defense-enable [OPTIONS]" }, { "description": "Disable cold boot defense mechanisms", "examples": [ "sudo health-control coldboot-defense-disable", "sudo health-control coldboot-defense-disable --json", "sudo health-control coldboot-defense-disable --json-human" ], "name": "coldboot-defense-disable", "options": [], "requires_sudo": true, "usage": "health-control coldboot-defense-disable [OPTIONS]" }, { "description": "Check cold boot defense mechanisms status", "examples": [ "sudo health-control coldboot-defense-status", "sudo health-control coldboot-defense-status --json" ], "name": "coldboot-defense-status", "options": [], "requires_sudo": true, "usage": "health-control coldboot-defense-status [OPTIONS]" }, { "description": "Check boot chain integrity and security status", "examples": [ "sudo health-control boot-integrity-check", "sudo health-control boot-integrity-check --json" ], "name": "boot-integrity-check", "options": [], "requires_sudo": true, "usage": "health-control boot-integrity-check [OPTIONS]" } ] }, { "category": "Hostname Management", "commands": [ { "description": "Set the default hostname", "examples": [ "sudo health-control set-default-hostname", "sudo health-control set-default-hostname --json" ], "name": "set-default-hostname", "options": [], "requires_sudo": true, "usage": "health-control set-default-hostname [OPTIONS]" }, { "description": "Set a random hostname", "examples": [ "sudo health-control set-random-hostname", "sudo health-control set-random-hostname --json" ], "name": "set-random-hostname", "options": [], "requires_sudo": true, "usage": "health-control set-random-hostname [OPTIONS]" }, { "description": "Set a custom hostname", "examples": [ "sudo health-control set-custom-hostname --name MyHost", "sudo health-control set-custom-hostname --name secure-host --json" ], "name": "set-custom-hostname", "options": [], "requires_sudo": true, "usage": "health-control set-custom-hostname [OPTIONS]" } ] }, { "category": "Internet Traffic Control", "commands": [ { "description": "Block all internet traffic", "examples": [ "sudo health-control block-internet", "sudo health-control block-internet --method firewall", "sudo health-control block-internet --method ufw", "sudo health-control block-internet --method iptables", "sudo health-control block-internet --method nftables", "sudo health-control block-internet --method interfaces", "sudo health-control block-internet --method all", "sudo health-control block-internet --allow-local", "sudo health-control block-internet --method iptables --allow-local", "sudo health-control block-internet --method all --allow-local", "sudo health-control block-internet --json" ], "name": "block-internet", "options": [], "requires_sudo": true, "usage": "health-control block-internet [OPTIONS]" }, { "description": "Unblock internet traffic", "examples": [ "sudo health-control unblock-internet", "sudo health-control unblock-internet --method firewall", "sudo health-control unblock-internet --method ufw", "sudo health-control unblock-internet --method iptables", "sudo health-control unblock-internet --method nftables", "sudo health-control unblock-internet --method interfaces", "sudo health-control unblock-internet --method all", "sudo health-control unblock-internet --json" ], "name": "unblock-internet", "options": [], "requires_sudo": true, "usage": "health-control unblock-internet [OPTIONS]" }, { "description": "Block outbound ICMP echo-requests (ping) via iptables and ip6tables", "examples": [ "sudo health-control block-ping", "sudo health-control block-ping --family ipv4", "sudo health-control block-ping --family ipv6", "sudo health-control block-ping --json" ], "name": "block-ping", "options": [], "requires_sudo": true, "usage": "health-control block-ping [OPTIONS]" }, { "description": "Unblock outbound ICMP echo-requests (ping), remove the DROP rules", "examples": [ "sudo health-control unblock-ping", "sudo health-control unblock-ping --family ipv4", "sudo health-control unblock-ping --family ipv6", "sudo health-control unblock-ping --json" ], "name": "unblock-ping", "options": [], "requires_sudo": true, "usage": "health-control unblock-ping [OPTIONS]" }, { "description": "Check internet blocking status", "examples": [ "sudo health-control internet-status", "sudo health-control internet-status --silent", "sudo health-control internet-status --skipnotification", "sudo health-control internet-status --skip-notification", "sudo health-control internet-status --skipnotifcation", "sudo health-control internet-status --json" ], "name": "internet-status", "options": [], "requires_sudo": true, "usage": "health-control internet-status [OPTIONS]" }, { "description": "Recover internet connectivity", "examples": [ "sudo health-control recover-internet", "sudo health-control recover-internet --check-dns", "sudo health-control recover-internet --force", "sudo health-control recover-internet --check-dns --force", "sudo health-control recover-internet --silent", "sudo health-control recover-internet --skipnotification", "sudo health-control recover-internet --skip-notification", "sudo health-control recover-internet --skipnotifcation", "sudo health-control recover-internet --json" ], "name": "recover-internet", "options": [], "requires_sudo": true, "usage": "health-control recover-internet [OPTIONS]" }, { "description": "Fast internet recovery - bounce interface, restart NetworkManager, renew DHCP", "examples": [ "sudo health-control fast-recover-internet", "sudo health-control fast-recover-internet --force", "sudo health-control fast-recover-internet --force --silent", "sudo health-control fast-recover-internet --silent", "sudo health-control fast-recover-internet --skipnotification", "sudo health-control fast-recover-internet --skip-notification", "sudo health-control fast-recover-internet --skipnotifcation", "sudo health-control fast-recover-internet --json" ], "name": "fast-recover-internet", "options": [], "requires_sudo": true, "usage": "health-control fast-recover-internet [OPTIONS]" }, { "description": "Emergency network kill switch", "examples": [ "sudo health-control kill-network", "sudo health-control kill-network --json" ], "name": "kill-network", "options": [], "requires_sudo": true, "usage": "health-control kill-network [OPTIONS]" }, { "description": "Kill specific network interface", "examples": [ "sudo health-control kill-network-interface --interface wlan0", "sudo health-control kill-network-interface --interface eth0 --json" ], "name": "kill-network-interface", "options": [], "requires_sudo": true, "usage": "health-control kill-network-interface [OPTIONS]" }, { "description": "Kill specific process by name or PID", "examples": [ "sudo health-control kill-process --process firefox", "sudo health-control kill-process --process 1234 --json" ], "name": "kill-process", "options": [], "requires_sudo": true, "usage": "health-control kill-process [OPTIONS]" }, { "description": "Enable a watch-guard to monitor system changes and block internet on triggers", "examples": [ "sudo health-control enable --type watch-guard --watch ip --method nftables", "sudo health-control enable --type watch-guard --watch timezone --method iptables", "sudo health-control enable --type watch-guard --watch timezone --method iptables --daemon", "sudo health-control enable --type watch-guard --watch interfaces --method firewall", "sudo health-control enable --type watch-guard --watch process --target tor --method all", "sudo health-control enable --type watch-guard --watch process --target firefox --method auto", "sudo health-control enable --type watch-guard --watch mac --method nftables --interval 5", "sudo health-control enable --type watch-guard --watch hostname --method iptables", "sudo health-control enable --type watch-guard --watch vpn --method nftables --interval 3", "sudo health-control enable --type watch-guard --watch dns --method firewall", "sudo health-control enable --type watch-guard --watch mac --method nftables --actions log_event,randomize_hostname", "sudo health-control enable --type watch-guard --watch vpn --method nftables --actions log_event,show_alert,block_network" ], "name": "enable", "options": [ { "description": "Type of watch-guard to enable", "flag": "--type", "required": true }, { "description": "What to watch for changes (ip, timezone, interfaces, process)", "flag": "--watch", "required": true }, { "description": "Process name to watch (required for process watch)", "flag": "--target", "required": false }, { "description": "Blocking method to use when triggered", "flag": "--method", "required": true }, { "description": "Run monitoring as a persistent daemon process", "flag": "--daemon", "required": false }, { "default": "varies by watch type", "description": "Custom check interval in seconds (1-300)", "flag": "--interval", "required": false }, { "default": "log_event,show_alert,play_sound,block_network", "description": "Comma-separated actions to execute when triggered", "flag": "--actions", "required": false } ], "requires_sudo": true, "usage": "health-control enable --type watch-guard --watch --method " }, { "description": "Disable an active watch-guard and optionally unblock internet", "examples": [ "sudo health-control disable --type watch-guard ip", "sudo health-control disable --type watch-guard timezone", "sudo health-control disable --type watch-guard interfaces", "sudo health-control disable --type watch-guard tor", "sudo health-control disable --type watch-guard all", "sudo health-control disable --type watch-guard all --no-unblock" ], "name": "disable", "options": [ { "description": "Type of command to disable", "flag": "--type", "required": true }, { "description": "Do not unblock internet after disabling watch-guard", "flag": "--no-unblock", "required": false } ], "requires_sudo": true, "usage": "health-control disable --type watch-guard " }, { "description": "Show status of active watch-guards", "examples": [ "sudo health-control watch-guard status", "sudo health-control watch-guard status --json" ], "name": "watch-guard", "options": [], "requires_sudo": true, "usage": "health-control watch-guard status" }, { "description": "Run watch-guard monitoring as a persistent daemon process", "examples": [ "sudo health-control daemon --config-id " ], "name": "daemon", "options": [ { "description": "Configuration ID to monitor", "flag": "--config-id", "required": true } ], "requires_sudo": true, "usage": "health-control daemon --config-id " } ] }, { "category": "MAC Address Management", "commands": [ { "description": "Change all MAC addresses", "examples": [ "sudo health-control mac-change-all", "sudo health-control mac-change-all --json" ], "name": "mac-change-all", "options": [], "requires_sudo": true, "usage": "health-control mac-change-all [OPTIONS]" }, { "description": "Force change all MAC addresses (disable interfaces first)", "examples": [ "sudo health-control mac-force-change", "sudo health-control mac-force-change --json" ], "name": "mac-force-change", "options": [], "requires_sudo": true, "usage": "health-control mac-force-change [OPTIONS]" }, { "description": "Change specific interface MAC address", "examples": [ "sudo health-control mac-change-specific --interface eth0", "sudo health-control mac-change-specific --interface wlan0 --json" ], "name": "mac-change-specific", "options": [], "requires_sudo": true, "usage": "health-control mac-change-specific [OPTIONS]" }, { "description": "Show available network interfaces", "examples": [ "sudo health-control mac-show-interfaces", "sudo health-control mac-show-interfaces --json" ], "name": "mac-show-interfaces", "options": [], "requires_sudo": true, "usage": "health-control mac-show-interfaces [OPTIONS]" }, { "description": "Show current MAC addresses", "examples": [ "sudo health-control mac-show-macs", "sudo health-control mac-show-macs --json" ], "name": "mac-show-macs", "options": [], "requires_sudo": true, "usage": "health-control mac-show-macs [OPTIONS]" }, { "description": "Reset all MAC addresses to default", "examples": [ "sudo health-control mac-reset-all", "sudo health-control mac-reset-all --json" ], "name": "mac-reset-all", "options": [], "requires_sudo": true, "usage": "health-control mac-reset-all [OPTIONS]" }, { "description": "Show active network interface", "examples": [ "sudo health-control mac-active-interface", "sudo health-control mac-active-interface --json" ], "name": "mac-active-interface", "options": [], "requires_sudo": true, "usage": "health-control mac-active-interface [OPTIONS]" } ] }, { "category": "Memory Management", "commands": [ { "description": "Clean memory caches and buffers", "examples": [ "sudo health-control memory-clean", "sudo health-control memory-clean --json" ], "name": "memory-clean", "options": [], "requires_sudo": true, "usage": "health-control memory-clean [OPTIONS]" }, { "description": "Force clean memory by killing top process", "examples": [ "sudo health-control memory-force-clean", "sudo health-control memory-force-clean --json" ], "name": "memory-force-clean", "options": [], "requires_sudo": true, "usage": "health-control memory-force-clean [OPTIONS]" }, { "description": "Secure RAM wipe (sdmem)", "examples": [ "sudo health-control memory-wipe", "sudo health-control memory-wipe --json" ], "name": "memory-wipe", "options": [], "requires_sudo": true, "usage": "health-control memory-wipe [OPTIONS]" }, { "description": "Wipe memory of specific process", "examples": [ "sudo health-control memory-wipe-process --value firefox", "sudo health-control memory-wipe-process --value 1234 --json" ], "name": "memory-wipe-process", "options": [], "requires_sudo": true, "usage": "health-control memory-wipe-process [OPTIONS]" }, { "description": "Manage process memory limits", "examples": [ "sudo health-control memory-limits", "sudo health-control memory-limits --value firefox --limit 1024", "sudo health-control memory-limits --value chrome --limit 2048", "sudo health-control memory-limits --value brave --limit 1536", "sudo health-control memory-limits --json" ], "name": "memory-limits", "options": [], "requires_sudo": true, "usage": "health-control memory-limits [OPTIONS]" }, { "description": "Display memory statistics and history", "examples": [ "sudo health-control memory-stats", "sudo health-control memory-stats --history --json" ], "name": "memory-stats", "options": [], "requires_sudo": true, "usage": "health-control memory-stats [OPTIONS]" }, { "description": "Configure swap settings", "examples": [ "sudo health-control swap-configure --swappiness 10 --cache-pressure 50", "sudo health-control swap-configure --swappiness 0 --json" ], "name": "swap-configure", "options": [], "requires_sudo": true, "usage": "health-control swap-configure [OPTIONS]" }, { "description": "Disable swap memory", "examples": [ "sudo health-control disable-swap", "sudo health-control disable-swap --json" ], "name": "disable-swap", "options": [], "requires_sudo": true, "usage": "health-control disable-swap [OPTIONS]" }, { "description": "Enable swap memory", "examples": [ "sudo health-control enable-swap", "sudo health-control enable-swap --size 2048", "sudo health-control enable-swap --size 4096", "sudo health-control enable-swap --json" ], "name": "enable-swap", "options": [], "requires_sudo": true, "usage": "health-control enable-swap [OPTIONS]" } ] }, { "category": "Network Connectivity", "commands": [ { "description": "Check network connectivity (IP ping, DNS, and HTTP probe)", "examples": [ "sudo health-control net-check", "sudo health-control net-check --json", "sudo health-control net-check --timeout 15", "sudo health-control net-check --http", "sudo health-control net-check --http --json", "sudo health-control net-check --ip-only", "sudo health-control net-check --domain-only", "sudo health-control net-check --http-only", "sudo health-control net-check --http-only --json", "sudo health-control net-check --domain-only --dns-server 127.0.0.1:5353" ], "name": "net-check", "options": [ { "default": "10", "description": "Timeout in seconds for each connectivity check", "flag": "--timeout ", "required": false }, { "description": "Run the extended HTTP-focused check path (IP ping + DNS + HTTP, verbose per-target reporting)", "flag": "--http", "required": false }, { "description": "Check IP ping only, skip DNS lookups and HTTP probe", "flag": "--ip-only", "required": false }, { "description": "Check DNS resolution only, skip IP ping and HTTP probe", "flag": "--domain-only", "required": false }, { "description": "Check HTTP reachability only, skip IP ping and DNS lookups (returns HTTP_ONLY_CONNECTIVITY/5 on success)", "flag": "--http-only", "required": false }, { "description": "Custom DNS server address (e.g., 127.0.0.1:5353 for Tor DNS)", "flag": "--dns-server ", "required": false } ], "requires_sudo": true, "usage": "health-control net-check [--timeout ] [--http] [--ip-only|--domain-only|--http-only] [--dns-server ]" }, { "description": "Check network connectivity including HTTP", "examples": [ "sudo health-control net-check-http", "sudo health-control net-check-http --timeout 15", "sudo health-control net-check-http --json" ], "name": "net-check-http", "options": [], "requires_sudo": true, "usage": "health-control net-check-http [OPTIONS]" }, { "description": "List IPs used for connectivity testing", "examples": [ "sudo health-control list-ips", "sudo health-control list-ips --json" ], "name": "list-ips", "options": [], "requires_sudo": true, "usage": "health-control list-ips [OPTIONS]" }, { "description": "List domains used for connectivity testing", "examples": [ "sudo health-control list-domains", "sudo health-control list-domains --json" ], "name": "list-domains", "options": [], "requires_sudo": true, "usage": "health-control list-domains [OPTIONS]" } ] }, { "category": "Offline Actions", "commands": [ { "description": "Manage PostgreSQL database service", "examples": [ "sudo health-control offline-postgresql --action disable", "sudo health-control offline-postgresql --action enable", "sudo health-control offline-postgresql --action check --json" ], "name": "offline-postgresql", "options": [], "requires_sudo": true, "usage": "health-control offline-postgresql [OPTIONS]" } ] }, { "category": "Password Generation", "commands": [ { "description": "Generate secure passwords using multiple methods (pass, pwgen, xkcdpass)", "examples": [ "sudo health-control genpass", "sudo health-control genpass --method pwgen", "sudo health-control genpass --count 10", "sudo health-control genpass --method pwgen --count 50", "sudo health-control genpass --method xkcdpass --count 20 --json", "sudo health-control genpass --length 32 --symbols \"@-_!#$\"" ], "name": "genpass", "options": [], "requires_sudo": true, "usage": "health-control genpass [OPTIONS]" } ] }, { "category": "Security", "commands": [ { "description": "Show comprehensive security status", "examples": [ "sudo health-control security-status", "sudo health-control security-status --category network", "sudo health-control security-status --category all --json", "sudo health-control security-status all", "sudo health-control security-status network --json" ], "name": "security-status", "options": [], "requires_sudo": true, "usage": "health-control security-status [OPTIONS]" } ] }, { "category": "Security Assessment", "commands": [ { "description": "Calculate security score and get recommendations", "examples": [ "health-control security-score", "health-control security-score --json" ], "name": "security-score", "options": [], "requires_sudo": false, "usage": "health-control security-score [OPTIONS]" }, { "description": "Generate comprehensive security report", "examples": [ "sudo health-control security-report", "sudo health-control security-report --format detailed", "sudo health-control security-report --format compliance --json" ], "name": "security-report", "options": [], "requires_sudo": true, "usage": "health-control security-report [OPTIONS]" }, { "description": "Set security profile and thresholds", "examples": [ "sudo health-control security-profile --value minimal", "sudo health-control security-profile --value balanced", "sudo health-control security-profile --value paranoid", "sudo health-control security-profile --value balanced --json" ], "name": "security-profile", "options": [], "requires_sudo": true, "usage": "health-control security-profile [OPTIONS]" }, { "description": "View security configuration history", "examples": [ "sudo health-control security-history", "sudo health-control security-history --days 30", "sudo health-control security-history --json" ], "name": "security-history", "options": [], "requires_sudo": true, "usage": "health-control security-history [OPTIONS]" }, { "description": "Auto-remediate security issues", "examples": [ "sudo health-control security-remediate", "sudo health-control security-remediate --bool true", "sudo health-control security-remediate --bool false --json" ], "name": "security-remediate", "options": [], "requires_sudo": true, "usage": "health-control security-remediate [OPTIONS]" }, { "description": "Schedule security scans (hourly, daily, weekly, monthly, disable)", "examples": [ "sudo health-control security-schedule --value daily", "sudo health-control security-schedule --value weekly", "sudo health-control security-schedule --value disable --json" ], "name": "security-schedule", "options": [], "requires_sudo": true, "usage": "health-control security-schedule [OPTIONS]" }, { "description": "Enhanced rootkit scanning with multiple tools", "examples": [ "sudo health-control rootkit-scan-enhanced", "sudo health-control rootkit-scan-enhanced --deep", "sudo health-control rootkit-scan-enhanced --json" ], "name": "rootkit-scan-enhanced", "options": [], "requires_sudo": true, "usage": "health-control rootkit-scan-enhanced [OPTIONS]" }, { "description": "Run Lynis security audit", "examples": [ "sudo health-control lynis-audit", "sudo health-control lynis-audit --value quick", "sudo health-control lynis-audit --value pentest --json" ], "name": "lynis-audit", "options": [], "requires_sudo": true, "usage": "health-control lynis-audit [OPTIONS]" }, { "description": "Check Lynis installation status", "examples": [ "health-control lynis-status", "health-control lynis-status --json" ], "name": "lynis-status", "options": [], "requires_sudo": false, "usage": "health-control lynis-status [OPTIONS]" }, { "description": "Scan system with ClamAV antivirus", "examples": [ "sudo health-control clamav-scan", "sudo health-control clamav-scan --path /home --recursive", "sudo health-control clamav-scan --quarantine --json" ], "name": "clamav-scan", "options": [], "requires_sudo": true, "usage": "health-control clamav-scan [OPTIONS]" }, { "description": "Perform comprehensive system security audit", "examples": [ "sudo health-control system-audit", "sudo health-control system-audit --level comprehensive", "sudo health-control system-audit --modules network,filesystem --json" ], "name": "system-audit", "options": [], "requires_sudo": true, "usage": "health-control system-audit [OPTIONS]" } ] }, { "category": "Security Hardening", "commands": [ { "description": "Apply comprehensive security hardening", "examples": [ "sudo health-control security-harden", "sudo health-control security-harden --profile standard", "sudo # STANDARD PROFILE (soft), Nothing breaks, score 5/7", "sudo # Applies: Safe kernel sysctls, secure filesystem mounts,", "sudo # ASLR=2, symlink/hardlink protection, SYN flood protection,", "sudo # auditd monitoring, AppArmor/Firejail detection", "sudo # Also normalizes: Reverts any stricter settings left from medium/paranoid", "sudo # Safe for: All systems, all browsers, VPN/Tor routing", "sudo ", "sudo health-control security-harden --profile medium", "sudo # MEDIUM PROFILE (moderate), Browsers+internet still work, score 6/7", "sudo # Includes Standard, PLUS: hidepid=2 on /proc, hardened_malloc,", "sudo # vm.dirty_ratio tuning, file integrity monitoring", "sudo # Also normalizes: Reverts paranoid-only settings (namespaces, IP forwarding)", "sudo # May affect: LUKS systems (higher memory from hardened_malloc)", "sudo ", "sudo health-control security-harden --profile paranoid", "sudo # PARANOID PROFILE (maximum), Full lockdown, score 7/7", "sudo # Includes Medium, PLUS: disable user namespaces, disable IP forwarding,", "sudo # MAC spoofing, DNS firewall, LKRG, Tirdad, SMT off, RAM wipe", "sudo # WILL BREAK: Browsers, Internet, VPN/Tor routing", "sudo # Recover: health-control security-recover", "sudo ", "sudo health-control security-harden --break-monitoring", "sudo # Alias for --profile paranoid + makes /sys/class/net root-only", "sudo ", "sudo health-control security-harden --modules kernel,network --json", "sudo # Apply only specific modules with JSON output", "sudo ", "sudo # LUKS encryption notice:", "sudo # On LUKS systems, medium/paranoid profiles increase memory usage.", "sudo # If OOM or browser crashes occur: health-control security-recover" ], "name": "security-harden", "options": [], "requires_sudo": true, "usage": "health-control security-harden [OPTIONS]" }, { "description": "Verify if security hardening is properly applied (checks all 7 modules and reports their status)", "examples": [ "sudo health-control security-verify", "sudo # Check status of all 7 security modules against current profile", "sudo # Also checks for forbidden leftover settings from higher profiles", "sudo # Standard expects: 5/7 modules, no medium/paranoid leftovers", "sudo # Medium expects: 6/7 modules, no paranoid leftovers", "sudo # Paranoid expects: 7/7 modules configured", "sudo ", "sudo health-control security-verify --profile medium", "sudo # Verify against medium profile expectations", "sudo ", "sudo health-control security-verify --profile paranoid", "sudo # Verify against paranoid profile expectations", "sudo ", "sudo health-control security-verify --json", "sudo # Get detailed JSON output with all verification data + leftover warnings" ], "name": "security-verify", "options": [], "requires_sudo": true, "usage": "health-control security-verify [OPTIONS]" }, { "description": "Temporarily revert security hardening (keeps framework enabled for quick re-hardening)", "examples": [ "sudo # Temporarily revert security hardening (keeps framework ready for re-hardening)", "sudo health-control security-recover", "sudo ", "sudo # After recovery, modules show 'ENABLED (needs configuration)'", "sudo # This means: Framework is ready but no restrictions are enforced", "sudo # Use this when: Troubleshooting issues, planning to re-harden later", "sudo ", "sudo # Recover only specific modules", "sudo health-control security-recover --modules network,kernel", "sudo ", "sudo # LUKS systems: If hardening caused OOM kills or browser crashes,", "sudo # recovery restores vm.dirty_ratio=20 (default) and re-enables", "sudo # user namespaces for browser sandbox compatibility.", "sudo ", "sudo # To re-apply hardening after recovery:", "sudo health-control security-harden" ], "name": "security-recover", "options": [], "requires_sudo": true, "usage": "health-control security-recover [OPTIONS]" }, { "description": "Completely disable all security modules and framework (permanent removal)", "examples": [ "sudo # Completely disable all security modules and framework", "sudo health-control security-reset", "sudo ", "sudo # After reset, security-verify shows modules as NOT HARDENED", "sudo # This means: All applied security hardening has been reverted", "sudo # Use this when: You want to permanently remove security hardening", "sudo ", "sudo # Skip confirmation prompt", "sudo health-control security-reset --force", "sudo ", "sudo # Warning: After reset, security-harden will need to rebuild framework" ], "name": "security-reset", "options": [], "requires_sudo": true, "usage": "health-control security-reset [OPTIONS]" }, { "description": "Enable system monitoring features", "examples": [ "sudo health-control monitoring-enable", "sudo health-control monitoring-enable --modules auditd,lkrg,file-integrity", "sudo health-control monitoring-enable --json" ], "name": "monitoring-enable", "options": [], "requires_sudo": true, "usage": "health-control monitoring-enable [OPTIONS]" }, { "description": "Disable system monitoring features", "examples": [ "sudo health-control monitoring-disable", "sudo health-control monitoring-disable --modules auditd,lkrg", "sudo health-control monitoring-disable --json" ], "name": "monitoring-disable", "options": [], "requires_sudo": true, "usage": "health-control monitoring-disable [OPTIONS]" }, { "description": "Check system security monitoring status", "examples": [ "sudo health-control monitoring-status", "sudo health-control monitoring-status --json" ], "name": "monitoring-status", "options": [], "requires_sudo": true, "usage": "health-control monitoring-status [OPTIONS]" }, { "description": "Disable IPv6 system-wide", "examples": [ "sudo health-control ipv6-disable", "sudo health-control ipv6-disable --json" ], "name": "ipv6-disable", "options": [], "requires_sudo": true, "usage": "health-control ipv6-disable [OPTIONS]" }, { "description": "Enable IPv6 system-wide", "examples": [ "sudo health-control ipv6-enable", "sudo health-control ipv6-enable --json" ], "name": "ipv6-enable", "options": [], "requires_sudo": true, "usage": "health-control ipv6-enable [OPTIONS]" }, { "description": "Enable Tirdad TCP ISN randomization", "examples": [ "sudo health-control tirdad-enable", "sudo health-control tirdad-enable --json" ], "name": "tirdad-enable", "options": [], "requires_sudo": true, "usage": "health-control tirdad-enable [OPTIONS]" }, { "description": "Disable Tirdad TCP ISN randomization", "examples": [ "sudo health-control tirdad-disable", "sudo health-control tirdad-disable --json" ], "name": "tirdad-disable", "options": [], "requires_sudo": true, "usage": "health-control tirdad-disable [OPTIONS]" }, { "description": "Check Tirdad TCP ISN randomization status", "examples": [ "health-control tirdad-status", "health-control tirdad-status --json" ], "name": "tirdad-status", "options": [], "requires_sudo": false, "usage": "health-control tirdad-status [OPTIONS]" }, { "description": "Check IPv6 status", "examples": [ "health-control ipv6-status", "health-control ipv6-status --json" ], "name": "ipv6-status", "options": [], "requires_sudo": false, "usage": "health-control ipv6-status [OPTIONS]" }, { "description": "Enable secure RAM wiping on shutdown", "examples": [ "sudo health-control ram-wipe", "sudo health-control ram-wipe --json" ], "name": "ram-wipe", "options": [], "requires_sudo": true, "usage": "health-control ram-wipe [OPTIONS]" }, { "description": "Install RAM wipe system (hooks + configuration) - Run this first if not already installed", "examples": [ "sudo health-control wipe-ram-install", "sudo health-control wipe-ram-install --policy kodachi-wiper", "sudo health-control wipe-ram-install --policy sdmem --passes 3", "sudo health-control wipe-ram-install --time 120", "sudo health-control wipe-ram-install --policy sdmem --passes 5", "sudo health-control wipe-ram-install --policy both --time 120 --passes 3", "sudo health-control wipe-ram-install --force", "sudo health-control wipe-ram-install --json" ], "name": "wipe-ram-install", "options": [ { "default": "false", "description": "Force installation even if Kicksecure/Whonix RAM wipe detected. WARNING: May conflict with existing systems", "flag": "--force" }, { "default": "kodachi-wiper", "description": "Initial wipe policy: kodachi-wiper (fast, recommended)|sdmem (secure DoD-standard)|both (hybrid)|auto (intelligent auto-selection)", "flag": "--policy " }, { "default": "60", "description": "Time budget for shutdown RAM wiping (default: 60s). Recommended: 60-90s desktops, 120-300s servers", "flag": "--time " }, { "default": "3", "description": "Number of sdmem overwrite passes 1-9 (default: 3). More passes = more secure but slower. Recommended: 3 balanced, 7+ high-security", "flag": "--passes " } ], "requires_sudo": true, "usage": "health-control wipe-ram-install [OPTIONS]" }, { "description": "Show RAM wipe system status - Check this first before installing or configuring", "examples": [ "sudo health-control ram-wipe-status", "sudo health-control ram-wipe-status --json" ], "name": "ram-wipe-status", "options": [], "requires_sudo": true, "usage": "health-control ram-wipe-status [OPTIONS]" }, { "description": "Update RAM wipe configuration - Use this to modify settings after installation", "examples": [ "sudo health-control wipe-ram-config --policy auto", "sudo health-control wipe-ram-config --policy kodachi-wiper", "sudo health-control wipe-ram-config --time 120", "sudo health-control wipe-ram-config --passes 5", "sudo health-control wipe-ram-config --split 70", "sudo health-control wipe-ram-config --policy both --time 120", "sudo health-control wipe-ram-config --policy both --time 90 --passes 3 --split 60", "sudo health-control wipe-ram-config --json" ], "name": "wipe-ram-config", "options": [ { "description": "Set policy: kodachi-wiper (fast native wiper)|sdmem (secure multi-pass)|both (balanced hybrid)|auto (intelligent auto-detection: prefers kodachi-wiper, falls back to sdmem if unavailable)", "flag": "--policy " }, { "description": "Set time budget for shutdown RAM wiping. Recommended: 60-90s desktops, 120-300s servers", "flag": "--time " }, { "description": "Set number of sdmem passes (1-9). More = secure but slower. Recommended: 3 balanced, 7+ high-security", "flag": "--passes " }, { "description": "Set time split for 'both' mode (10-90). Example: 70 = 70% kodachi-wiper, 30% sdmem. Higher = faster but less secure", "flag": "--split " } ], "requires_sudo": true, "usage": "health-control wipe-ram-config [OPTIONS]" }, { "description": "Enable automatic RAM wiping on shutdown", "examples": [ "sudo health-control ram-wipe-enable", "sudo health-control ram-wipe-enable --schedule immediate", "sudo health-control ram-wipe-enable --schedule delay", "sudo health-control ram-wipe-enable --passes 5", "sudo health-control ram-wipe-enable --schedule shutdown --passes 3", "sudo health-control ram-wipe-enable --json" ], "name": "ram-wipe-enable", "options": [], "requires_sudo": true, "usage": "health-control ram-wipe-enable [OPTIONS]" }, { "description": "Disable automatic RAM wiping", "examples": [ "sudo health-control ram-wipe-disable", "sudo health-control ram-wipe-disable --preserve-config", "sudo health-control ram-wipe-disable --json" ], "name": "ram-wipe-disable", "options": [], "requires_sudo": true, "usage": "health-control ram-wipe-disable [OPTIONS]" }, { "description": "Test RAM wipe operation (dry-run with short time budget) - Run this to verify installation before relying on automatic wipes", "examples": [ "sudo health-control wipe-ram-test", "sudo health-control wipe-ram-test --policy kodachi-wiper", "sudo health-control wipe-ram-test --policy sdmem", "sudo health-control wipe-ram-test --policy both --time 60", "sudo health-control wipe-ram-test --time 30", "sudo health-control wipe-ram-test --policy kodachi-wiper --time 20", "sudo health-control wipe-ram-test --json" ], "name": "wipe-ram-test", "options": [ { "description": "Test specific wipe policy: kodachi-wiper (fast)|sdmem (secure DoD-standard)|both (hybrid)|auto (intelligent auto-selection)", "flag": "--policy " }, { "default": "10", "description": "Test time budget in seconds (default: 10). Quick test only - actual shutdown wipe uses configured time budget from wipe-ram-config", "flag": "--time " } ], "requires_sudo": true, "usage": "health-control wipe-ram-test [OPTIONS]" }, { "description": "Execute RAM wipe operation (primarily used by systemd/init shutdown hooks, but can be run manually for testing)", "examples": [ "sudo health-control wipe-ram", "sudo health-control wipe-ram --policy kodachi-wiper", "sudo health-control wipe-ram --policy sdmem", "sudo health-control wipe-ram --policy both --time 120", "sudo health-control wipe-ram --time 120", "sudo health-control wipe-ram --no-console", "sudo health-control wipe-ram --json", "sudo health-control wipe-ram --shutdown-mode" ], "name": "wipe-ram", "options": [ { "default": "false", "description": "INTERNAL USE - Shutdown-optimized mode for systemd/init hooks. Users should use 'wipe-ram' without this flag", "flag": "--shutdown-mode" }, { "default": "false", "description": "Disable console output for silent operation (useful in scripts and background tasks)", "flag": "--no-console" }, { "description": "Override wipe policy: kodachi-wiper (fast native wiper for quick shutdowns)|sdmem (secure DoD-standard multi-pass for maximum security)|both (hybrid approach: fast+secure)|auto (intelligent auto-selection based on system capabilities)", "flag": "--policy " }, { "description": "Override time budget in seconds (how long to spend wiping RAM). Higher values = more memory wiped but longer shutdown time", "flag": "--time " } ], "requires_sudo": true, "usage": "health-control wipe-ram [OPTIONS]" }, { "description": "Detect Kicksecure/Whonix RAM wipe installation", "examples": [ "sudo health-control ram-wipe-detect-kicksecure", "sudo health-control ram-wipe-detect-kicksecure --json", "sudo health-control ram-wipe-detect-kicksecure --json-human" ], "name": "ram-wipe-detect-kicksecure", "options": [], "requires_sudo": true, "usage": "health-control ram-wipe-detect-kicksecure" }, { "description": "Update RAM wipe configuration (alias for wipe-ram-config)", "examples": [ "sudo health-control ram-wipe-update --policy auto", "sudo health-control ram-wipe-update --policy both --time 150", "sudo health-control ram-wipe-update --policy kodachi-wiper", "sudo health-control ram-wipe-update --time 120", "sudo health-control ram-wipe-update --passes 5", "sudo health-control ram-wipe-update --json" ], "name": "ram-wipe-update", "options": [ { "description": "Set policy: kodachi-wiper (fast native wiper)|sdmem (secure multi-pass)|both (balanced hybrid)|auto (intelligent auto-detection: prefers kodachi-wiper, falls back to sdmem if unavailable)", "flag": "--policy " }, { "description": "Set time budget in seconds", "flag": "--time " }, { "description": "Set sdmem passes (1-9)", "flag": "--passes " }, { "description": "Set custom/sdmem split for 'both' mode (10-90)", "flag": "--split " } ], "requires_sudo": true, "usage": "health-control ram-wipe-update [OPTIONS]" }, { "description": "Check disk encryption status and security", "examples": [ "sudo health-control disk-encryption-status", "sudo health-control disk-encryption-status --json" ], "name": "disk-encryption-status", "options": [], "requires_sudo": true, "usage": "health-control disk-encryption-status [OPTIONS]" }, { "description": "Enable swap partition/file", "examples": [ "sudo health-control swap-enable", "sudo health-control swap-enable --json" ], "name": "swap-enable", "options": [], "requires_sudo": true, "usage": "health-control swap-enable [OPTIONS]" }, { "description": "Disable swap partition/file", "examples": [ "sudo health-control swap-disable", "sudo health-control swap-disable --json" ], "name": "swap-disable", "options": [], "requires_sudo": true, "usage": "health-control swap-disable [OPTIONS]" }, { "description": "Encrypt swap partition/file", "examples": [ "sudo health-control swap-encrypt", "sudo health-control swap-encrypt --json" ], "name": "swap-encrypt", "options": [], "requires_sudo": true, "usage": "health-control swap-encrypt [OPTIONS]" }, { "description": "Check swap status and configuration", "examples": [ "sudo health-control swap-status", "sudo health-control swap-status --json" ], "name": "swap-status", "options": [], "requires_sudo": true, "usage": "health-control swap-status [OPTIONS]" }, { "description": "Decrypt encrypted swap partition/file", "examples": [ "sudo health-control swap-decrypt", "sudo health-control swap-decrypt --device /dev/DEVICE", "sudo health-control swap-decrypt --json" ], "name": "swap-decrypt", "options": [], "requires_sudo": true, "usage": "health-control swap-decrypt [OPTIONS]" }, { "description": "Check swap encryption status", "examples": [ "sudo health-control swap-encrypt-status", "sudo health-control swap-encrypt-status --json" ], "name": "swap-encrypt-status", "options": [], "requires_sudo": true, "usage": "health-control swap-encrypt-status [OPTIONS]" }, { "description": "List all USB devices", "examples": [ "sudo health-control usb-list", "sudo health-control usb-list --json" ], "name": "usb-list", "options": [], "requires_sudo": true, "usage": "health-control usb-list [OPTIONS]" }, { "description": "Manage LUKS nuke passwords", "examples": [ "sudo # AUTOMATED HEADER BACKUP + Nuke Configuration", "sudo ", "sudo # Check nuke password status", "sudo health-control luks-nuke --action status", "sudo → Shows all LUKS devices and nuke password status", "sudo ", "sudo # Check specific device", "sudo health-control luks-nuke --action status --device /dev/DEVICE", "sudo → Shows nuke password status for /dev/DEVICE only", "sudo ", "sudo # Configure nuke password (FULLY AUTOMATED)", "sudo health-control luks-nuke --action configure --device /dev/DEVICE", "sudo → Backs up LUKS header AUTOMATICALLY to /backups/", "sudo → Encrypts backup with GPG automatically", "sudo → Configures nuke password via cryptsetup-nuke-password", "sudo → Verifies everything works", "sudo → NO manual cryptsetup commands needed!", "sudo ", "sudo # Configure with CLI password (INSECURE - visible in history)", "sudo health-control luks-nuke --action configure --device /dev/DEVICE --password ''", "sudo ⚠️ WARNING: Password visible in shell history!", "sudo → Still backs up header automatically", "sudo ", "sudo # Header backup location", "sudo # Saved to: /backups/header-{device-name}-{timestamp}.img.gpg", "sudo # Keep this file SAFE - it's your ONLY recovery option!", "sudo ", "sudo # Remove nuke password", "sudo health-control luks-nuke --action remove --device /dev/DEVICE", "sudo → Removes nuke password via cryptsetup-nuke-password", "sudo ", "sudo # MANUAL EMERGENCY EXECUTE (IRREVERSIBLE)", "sudo health-control luks-nuke --action execute --device /dev/DEVICE --force-execute", "sudo → Immediately destroys LUKS key material on selected device.", "sudo → Data becomes permanently unrecoverable.", "sudo ", "sudo # ℹ️ FILE-BASED LUKS CONTAINERS SUPPORTED", "sudo # Works with both block devices (/dev/*) AND file-based containers", "sudo ", "sudo # Configure nuke for live-boot persistence image (AUTOMATED)", "sudo health-control luks-nuke --action configure --device /tmp/persistence", "sudo → Backs up header automatically", "sudo → Supports file-based LUKS containers created by create-persistence", "sudo ", "sudo # Check nuke status on encrypted persistence file", "sudo health-control luks-nuke --action status --device /media/kodachi/persistence", "sudo → File must exist and be a valid LUKS container", "sudo ", "sudo # Remove nuke from file-based container", "sudo health-control luks-nuke --action remove --device /tmp/encrypted-container.img", "sudo → Works identically with files and block devices", "sudo ", "sudo # COMPLETE AUTOMATED WORKFLOW", "sudo # Create encrypted persistence with nuke password - ZERO manual steps", "sudo ", "sudo # Step 1: List devices to find USB", "sudo health-control list-storage-devices", "sudo ", "sudo # Step 2: Check device safety", "sudo health-control usb-safety-check --device /dev/DEVICE", "sudo ", "sudo # Step 3: Create encrypted persistence (AUTOMATED)", "sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali --encrypted", "sudo → Confirms device selection", "sudo → Formats automatically", "sudo → Creates persistence.conf automatically", "sudo → Done!", "sudo ", "sudo # Step 4: Configure nuke password (AUTOMATED)", "sudo health-control luks-nuke --action configure --device /dev/DEVICE", "sudo → Backs up header automatically to /backups/", "sudo → Configures nuke password automatically", "sudo → Verifies everything works", "sudo → Done!", "sudo ", "sudo # ✅ ZERO MANUAL COMMANDS!", "sudo # ✅ NO manual mounting/unmounting!", "sudo # ✅ NO manual backup commands!", "sudo # ✅ Everything automated with safety confirmations!", "sudo ", "sudo # EMERGENCY: Restore header if nuke password used accidentally", "sudo gpg -d /backups/header-DEVICE-*.img.gpg | sudo cryptsetup luksHeaderRestore /dev/DEVICE", "sudo ", "sudo # List available encrypted header backups", "sudo health-control luks-nuke --action list-backups --device /dev/DEVICE", "sudo ", "sudo # Restore from encrypted backup", "sudo health-control luks-nuke --action restore-backup --device /dev/DEVICE --backup-file header-DEVICE-20260304-014630.img.gpg", "sudo ", "sudo # Delete old backup", "sudo health-control luks-nuke --action delete-backup --backup-file header-sda1-20260304-014630.img.gpg", "sudo ⚠️ USE ONLY IF nuke password was accidentally entered!", "sudo ", "sudo # JSON output for monitoring", "sudo health-control luks-nuke --action status --json" ], "name": "luks-nuke", "options": [], "requires_sudo": true, "usage": "health-control luks-nuke [OPTIONS]" }, { "description": "Detect valid LUKS devices on the system", "examples": [ "sudo health-control luks-detect", "sudo health-control luks-detect --all-devices", "sudo health-control luks-detect --json" ], "name": "luks-detect", "options": [], "requires_sudo": true, "usage": "health-control luks-detect [OPTIONS]" }, { "description": "Manage LUKS encrypted devices", "examples": [ "sudo health-control luks-manage --action list", "sudo health-control luks-manage --action unlock --device /dev/DEVICE", "sudo health-control luks-manage --action lock --device /dev/DEVICE" ], "name": "luks-manage", "options": [], "requires_sudo": true, "usage": "health-control luks-manage [OPTIONS]" }, { "description": "Advanced LUKS nuke configuration (emergency wipe)", "examples": [ "sudo health-control luks-nuke-advanced --device /dev/DEVICE --password ''", "sudo health-control luks-nuke-advanced --device /dev/DEVICE --json" ], "name": "luks-nuke-advanced", "options": [], "requires_sudo": true, "usage": "health-control luks-nuke-advanced [OPTIONS]" }, { "description": "Remove LUKS encryption from device", "examples": [ "sudo health-control luks-remove \"$LUKS_DEVICE\"", "sudo health-control luks-remove \"$LUKS_DEVICE\" --force" ], "name": "luks-remove", "options": [], "requires_sudo": true, "usage": "health-control luks-remove [OPTIONS]" }, { "description": "Advanced LUKS device management", "examples": [ "sudo health-control luks-manage-advanced --action backup-header --device /dev/DEVICE --backup-file /tmp/header.backup", "sudo health-control luks-manage-advanced --action restore-header --device /dev/DEVICE --backup-file /tmp/header.backup", "sudo health-control luks-manage-advanced --action add-key --device /dev/DEVICE --key-file /tmp/newkey" ], "name": "luks-manage-advanced", "options": [], "requires_sudo": true, "usage": "health-control luks-manage-advanced [OPTIONS]" }, { "description": "Create Debian live-boot persistence media", "examples": [ "sudo health-control create-persistence", "sudo health-control create-persistence --size 8", "sudo health-control create-persistence --encrypted", "sudo health-control create-persistence --encrypted --size 8", "sudo health-control create-persistence --encrypted --password ''", "sudo health-control create-persistence --size 4 --output /tmp/persistence --json" ], "name": "create-persistence", "options": [], "requires_sudo": true, "usage": "health-control create-persistence [OPTIONS]" }, { "description": "Create persistence for other Linux distributions (Kali, Parrot, Tails)", "examples": [ "sudo # FULLY AUTOMATED - No manual mounting needed!", "sudo ", "sudo # RECOMMENDED: List devices first to see what's safe", "sudo health-control list-storage-devices", "sudo → Shows which devices are SAFE vs DANGEROUS", "sudo ", "sudo # Check if your device is safe", "sudo health-control usb-safety-check --device /dev/DEVICE", "sudo → Verifies device before formatting", "sudo ", "sudo # Unencrypted persistence for Kali Linux (AUTOMATED)", "sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali", "sudo → Confirms device selection", "sudo → Formats partition automatically", "sudo → Creates persistence.conf automatically", "sudo → Ready to use - NO manual mounting!", "sudo ", "sudo # Encrypted persistence for Parrot OS (FULLY AUTOMATED)", "sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type parrot --encrypted", "sudo → Password prompted securely (not visible in history)", "sudo → Confirms device selection", "sudo → Encrypts partition automatically", "sudo → Mounts, configures, unmounts automatically", "sudo → Everything automated with safety confirmations!", "sudo ", "sudo # Encrypted persistence for Tails with CLI password (INSECURE)", "sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type tails --encrypted --password ''", "sudo ⚠️ WARNING: Password visible in shell history!", "sudo ", "sudo # Complete safe workflow (AUTOMATED)", "sudo health-control list-storage-devices && \\", "sudo health-control usb-safety-check --device /dev/DEVICE && \\", "sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali --encrypted", "sudo → Entire workflow automated - just type YES when prompted!", "sudo ", "sudo # With JSON output", "sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali --encrypted --json" ], "name": "create-persistence-other-os", "options": [], "requires_sudo": true, "usage": "health-control create-persistence-other-os [OPTIONS]" }, { "description": "Check storage encryption status", "examples": [ "sudo # Check overall system encryption status", "sudo health-control encryption-status", "sudo → Shows: LUKS devices, encrypted filesystems, swap encryption", "sudo → Shows: Home directory encryption, full disk encryption status", "sudo → Reports: Encryption count summary (X/Y devices encrypted)", "sudo → Lists: Active encrypted containers and their mount points", "sudo ", "sudo # Typical output includes:", "sudo # - LUKS devices: /dev/DEVICE (/, 120 GB), /dev/OTHER_DEVICE (backup, 500 GB)", "sudo # - Encrypted swap: Yes (dm-crypt)", "sudo # - Home encryption: Yes (LUKS)", "sudo # - Full disk encryption: Yes (all partitions encrypted)", "sudo # - Encryption strength: AES-256-XTS", "sudo ", "sudo # JSON output for monitoring/scripting", "sudo health-control encryption-status --json", "sudo → Structured data: luks_devices[], encrypted_filesystems[]", "sudo → Boolean flags: home_encryption, swap_encrypted, full_disk_encryption", "sudo → Device details: cipher, key_size, device_path, mount_point, size", "sudo → Use in monitoring scripts for encryption compliance" ], "name": "encryption-status", "options": [], "requires_sudo": true, "usage": "health-control encryption-status [OPTIONS]" }, { "description": "Create encrypted container", "examples": [ "sudo # Create encrypted container (default: ext4, 1GB)", "sudo health-control container-create --path /tmp/secure.img", "sudo → Size: 1024 MB (default)", "sudo → Filesystem: ext4 (default)", "sudo → Creates sparse file (doesn't use full size immediately)", "sudo → Ready to mount and use", "sudo ", "sudo # Create large LUKS encrypted container", "sudo health-control container-create --path /secure/data.img --size 5000 --fs-type luks", "sudo → Size: 5000 MB (5 GB)", "sudo → Prompts for strong password (8+ chars recommended)", "sudo → Uses cryptsetup for LUKS2 format", "sudo → Hardware crypto acceleration if available", "sudo ", "sudo # Create VeraCrypt compatible container", "sudo health-control container-create --path /backup/portable.img --size 2048 --fs-type veracrypt", "sudo → Cross-platform compatibility (Windows, Mac, Linux)", "sudo → Can be opened with VeraCrypt GUI", "sudo → Good for external backup drives", "sudo ", "sudo # Filesystem types explained:", "sudo # --fs-type ext4:", "sudo # - Standard Linux filesystem (fastest)", "sudo # - No encryption by default", "sudo # - Best for temporary/non-sensitive data", "sudo ", "sudo # --fs-type luks:", "sudo # - LUKS2 encrypted container (RECOMMENDED for sensitive data)", "sudo # - AES-256-XTS encryption", "sudo # - Linux native, best performance", "sudo # - Requires password to mount", "sudo ", "sudo # --fs-type veracrypt:", "sudo # - VeraCrypt compatible (cross-platform)", "sudo # - Works on Windows, Mac, Linux", "sudo # - Slightly slower than LUKS", "sudo # - Good for portability", "sudo ", "sudo # Size guidelines:", "sudo # Small (100-500 MB): Documents, passwords, keys", "sudo # Medium (500-2000 MB): Photos, code projects", "sudo # Large (2000-10000 MB): Videos, backups, archives", "sudo # Very Large (10000+ MB): Full system backups" ], "name": "container-create", "options": [], "requires_sudo": true, "usage": "health-control container-create [OPTIONS]" }, { "description": "Mount encrypted container", "examples": [ "sudo # Mount encrypted container (password prompted securely)", "sudo health-control container-mount --container /path/to/secure.img --mount-point /mnt/secure", "sudo → Prompts for LUKS password (not visible, not logged)", "sudo → Creates /mnt/secure automatically if it doesn't exist", "sudo → Opens LUKS device with cryptsetup", "sudo → Mounts to /mnt/secure/ - ready to use", "sudo ", "sudo # Complete workflow: create → mount → use → unmount", "sudo ", "sudo # Step 1: Create encrypted container", "sudo health-control container-create --path /tmp/data.img --size 500 --fs-type luks", "sudo ", "sudo # Step 2: Mount container", "sudo health-control container-mount --container /tmp/data.img --mount-point /mnt/data", "sudo # Enter password when prompted", "sudo ", "sudo # Step 3: Use the container (copy files, edit, etc.)", "sudo cp -r /sensitive/documents /mnt/data/", "sudo echo 'secret data' > /mnt/data/confidential.txt", "sudo ", "sudo # Step 4: Unmount when done", "sudo health-control container-unmount --mount-point /mnt/data", "sudo ", "sudo # ✅ Complete encrypted container lifecycle!", "sudo # ✅ Data encrypted at rest, decrypted only when mounted", "sudo # ✅ Mount point automatically created and cleaned up" ], "name": "container-mount", "options": [], "requires_sudo": true, "usage": "health-control container-mount [OPTIONS]" }, { "description": "Unmount encrypted container", "examples": [ "sudo # Safely unmount encrypted container", "sudo health-control container-unmount --mount-point /mnt/secure", "sudo → Unmounts filesystem from /mnt/secure", "sudo → Closes LUKS mapper device automatically", "sudo → Cleans up mount point (removes directory)", "sudo → ⚠️ Close all files in /mnt/secure BEFORE unmounting!", "sudo ", "sudo # Check if anything is using the mount before unmounting", "sudo lsof +D /mnt/secure # List open files in mount point", "sudo # If files are open, close them first, then:", "sudo health-control container-unmount --mount-point /mnt/secure", "sudo ", "sudo # Error handling: If unmount fails due to busy device", "sudo # 1. Check for open files:", "sudo lsof +D /mnt/secure", "sudo # 2. Kill processes using the mount:", "sudo fuser -km /mnt/secure # Kill processes (use with caution!)", "sudo # 3. Try unmounting again:", "sudo health-control container-unmount --mount-point /mnt/secure", "sudo ", "sudo # Safe workflow: Always unmount before system shutdown", "sudo # 1. Copy files out of container", "sudo # 2. Close all applications accessing the mount", "sudo # 3. Unmount container", "sudo # 4. Container is now encrypted and safe to store/transport" ], "name": "container-unmount", "options": [], "requires_sudo": true, "usage": "health-control container-unmount [OPTIONS]" } ] }, { "category": "Security Tools", "commands": [ { "description": "Quick rootkit scan (fast, essential checks)", "examples": [ "sudo health-control rootkit-scan", "sudo health-control rootkit-scan --json" ], "name": "rootkit-scan", "options": [], "requires_sudo": true, "usage": "health-control rootkit-scan [OPTIONS]" }, { "description": "Check Kloak keyboard anonymization status", "examples": [ "health-control kloak-status", "health-control kloak-status --json" ], "name": "kloak-status", "options": [], "requires_sudo": false, "usage": "health-control kloak-status [OPTIONS]" }, { "description": "Enable Kloak keyboard anonymization", "examples": [ "sudo health-control kloak-enable", "sudo health-control kloak-enable --json" ], "name": "kloak-enable", "options": [], "requires_sudo": true, "usage": "health-control kloak-enable [OPTIONS]" }, { "description": "Disable Kloak keyboard anonymization", "examples": [ "sudo health-control kloak-disable", "sudo health-control kloak-disable --json" ], "name": "kloak-disable", "options": [], "requires_sudo": true, "usage": "health-control kloak-disable [OPTIONS]" }, { "description": "Configure Kloak keystroke anonymization settings", "examples": [ "sudo health-control kloak-configure --delay 100", "sudo health-control kloak-configure --mode aggressive --jitter 50", "sudo health-control kloak-configure --json" ], "name": "kloak-configure", "options": [], "requires_sudo": true, "usage": "health-control kloak-configure [OPTIONS]" }, { "description": "Set Kloak event processing mode", "examples": [ "sudo health-control kloak-event-mode --mode raw", "sudo health-control kloak-event-mode --mode filtered", "sudo health-control kloak-event-mode --mode adaptive --json" ], "name": "kloak-event-mode", "options": [], "requires_sudo": true, "usage": "health-control kloak-event-mode [OPTIONS]" }, { "description": "Show Kloak keystroke anonymization statistics", "examples": [ "health-control kloak-stats", "health-control kloak-stats --reset", "health-control kloak-stats --json" ], "name": "kloak-stats", "options": [], "requires_sudo": false, "usage": "health-control kloak-stats [OPTIONS]" }, { "description": "Update AIDE database after legitimate changes", "examples": [ "sudo health-control aide-update", "sudo health-control aide-update --accept-changes", "sudo health-control aide-update --json" ], "name": "aide-update", "options": [], "requires_sudo": true, "usage": "health-control aide-update [OPTIONS]" }, { "description": "Check file integrity with AIDE", "examples": [ "sudo health-control aide-check", "sudo health-control aide-check --json" ], "name": "aide-check", "options": [], "requires_sudo": true, "usage": "health-control aide-check [OPTIONS]" }, { "description": "Initialize AIDE database for file integrity monitoring", "examples": [ "sudo health-control aide-init", "sudo health-control aide-init --config ./aide.conf", "sudo health-control aide-init --timeout 7200", "sudo health-control aide-init --background", "sudo health-control aide-init --json" ], "name": "aide-init", "options": [], "requires_sudo": true, "usage": "health-control aide-init [OPTIONS]" }, { "description": "Reinitialize AIDE database (reset baseline)", "examples": [ "sudo health-control aide-reinit", "sudo health-control aide-reinit --force", "sudo health-control aide-reinit --background --timeout 7200 --json", "sudo health-control aide-reinit --json" ], "name": "aide-reinit", "options": [], "requires_sudo": true, "usage": "health-control aide-reinit [OPTIONS]" }, { "description": "Scan specific directory with AIDE", "examples": [ "sudo health-control aide-scan-dir ./config", "sudo health-control aide-scan-dir /usr/bin --recursive", "sudo health-control aide-scan-dir /home --json" ], "name": "aide-scan-dir", "options": [], "requires_sudo": true, "usage": "health-control aide-scan-dir [OPTIONS]" } ] }, { "category": "Storage & USB Security", "commands": [ { "description": "List all storage devices with safety information for persistence operations", "examples": [ "sudo # List all storage devices with safety indicators", "sudo health-control list-storage-devices", "sudo → Shows which devices are safe (USB) vs dangerous (system)", "sudo ", "sudo # Include all devices (loop, ram, etc)", "sudo health-control list-storage-devices --all", "sudo ", "sudo # JSON output for scripting", "sudo health-control list-storage-devices --json", "sudo ", "sudo # Before creating persistence (recommended workflow)", "sudo health-control list-storage-devices && \\", "sudo health-control create-persistence-other-os --device /dev/DEVICE --os-type kali" ], "name": "list-storage-devices", "options": [], "requires_sudo": true, "usage": "health-control list-storage-devices [OPTIONS]" }, { "description": "Check if a device is safe for persistence/formatting operations", "examples": [ "sudo # Check if device is safe for persistence", "sudo health-control usb-safety-check --device /dev/DEVICE", "sudo → Returns: SAFE, CAUTION, or DANGER with details", "sudo ", "sudo # Check system drive (will warn)", "sudo health-control usb-safety-check --device /dev/DEVICE", "sudo → Shows why device is dangerous (system drive)", "sudo ", "sudo # JSON output for scripting", "sudo health-control usb-safety-check --device /dev/DEVICE --json" ], "name": "usb-safety-check", "options": [], "requires_sudo": true, "usage": "health-control usb-safety-check [OPTIONS]" } ] }, { "category": "Storage Security", "commands": [ { "description": "Securely wipe storage devices and free space", "examples": [ "sudo health-control storage-wipe --free-space", "sudo health-control storage-wipe --device /dev/DEVICE --json", "sudo health-control storage-wipe --device /dev/DEVICE --allow-root-device --json" ], "name": "storage-wipe", "options": [], "requires_sudo": true, "usage": "health-control storage-wipe [OPTIONS]" }, { "description": "Encrypt a storage device", "examples": [ "sudo health-control storage-encrypt --device /dev/DEVICE", "sudo health-control storage-encrypt --device /dev/DEVICE --json" ], "name": "storage-encrypt", "options": [], "requires_sudo": true, "usage": "health-control storage-encrypt [OPTIONS]" }, { "description": "Optimize encryption performance and security settings", "examples": [ "sudo # Understanding encryption performance profiles", "sudo ", "sudo # Benchmark all ciphers and show recommendations (dry-run, no changes)", "sudo health-control encryption-tune --profile performance --benchmark", "sudo → Benchmarks all available ciphers", "sudo → Recommends fastest cipher for your hardware", "sudo → Shows throughput in MB/s", "sudo → No changes applied (dry-run mode)", "sudo ", "sudo # Apply performance optimizations", "sudo health-control encryption-tune --profile performance --apply", "sudo → Sets: aes-xts-plain64 cipher, 256-bit key", "sudo → Optimizes: I/O scheduler (deadline), queue depth (256)", "sudo → Enables hardware crypto acceleration", "sudo → May require reboot for full effect", "sudo ", "sudo # Security-focused tuning (paranoid mode)", "sudo health-control encryption-tune --profile security --iter-time 5000 --apply", "sudo → Maximizes key derivation time (slower unlock, more secure)", "sudo → Uses strongest available cipher", "sudo → 5000ms iteration time (vs 2000ms default)", "sudo → Recommended for high-security environments", "sudo ", "sudo # Balanced profile (default)", "sudo health-control encryption-tune --profile balanced", "sudo → Good balance between performance and security", "sudo → aes-xts-plain64 with 256-bit key", "sudo → Standard iteration time (2000ms)", "sudo → Shows recommendations without applying (add --apply to implement)", "sudo ", "sudo # Device-specific tuning for external drive", "sudo health-control encryption-tune --device /dev/DEVICE --cipher aes-xts-plain64 --key-size 512", "sudo → Applies settings to specific device only", "sudo → 512-bit key for maximum security", "sudo → Requires unlocking and reformatting (data loss!)", "sudo ", "sudo # Check current tuning status", "sudo health-control encryption-tune", "sudo → Shows current encryption settings", "sudo → Shows cipher, key size, iteration time", "sudo → No changes made (default dry-run)", "sudo ", "sudo # JSON output for scripting", "sudo health-control encryption-tune --json", "sudo → Structured output with recommendations", "sudo → Cipher benchmarks and current settings" ], "name": "encryption-tune", "options": [], "requires_sudo": true, "usage": "health-control encryption-tune [OPTIONS]" } ] }, { "category": "System Control", "commands": [ { "description": "Get the current hostname", "examples": [ "health-control get-hostname", "health-control get-hostname --json" ], "name": "get-hostname", "options": [], "requires_sudo": false, "usage": "health-control get-hostname" }, { "description": "Change hostname (prompts for new hostname)", "examples": [ "sudo health-control change-hostname", "sudo health-control change-hostname new-hostname", "sudo health-control change-hostname --json" ], "name": "change-hostname", "options": [], "requires_sudo": true, "usage": "health-control change-hostname [OPTIONS]" }, { "description": "List available hostnames by category", "examples": [ "health-control list-hostnames", "health-control list-hostnames --category all", "health-control list-hostnames --category windows", "health-control list-hostnames --category linux", "health-control list-hostnames --category apple", "health-control list-hostnames --category network", "health-control list-hostnames --category mobile", "health-control list-hostnames --category iot", "health-control list-hostnames --category gaming", "health-control list-hostnames --category fiction", "health-control list-hostnames --json" ], "name": "list-hostnames", "options": [], "requires_sudo": false, "usage": "health-control list-hostnames [OPTIONS]" }, { "description": "Set a random hostname from a specific category", "examples": [ "sudo health-control set-random-hostname-category", "sudo health-control set-random-hostname-category --category windows", "sudo health-control set-random-hostname-category --category linux", "sudo health-control set-random-hostname-category --category apple", "sudo health-control set-random-hostname-category --category network", "sudo health-control set-random-hostname-category --category fiction --json" ], "name": "set-random-hostname-category", "options": [], "requires_sudo": true, "usage": "health-control set-random-hostname-category [OPTIONS]" }, { "description": "Get the actual logged-in user (handles sudo correctly)", "examples": [ "health-control get-logged-user", "health-control get-logged-user --json", "sudo health-control get-logged-user", "sudo health-control get-logged-user --json-pretty" ], "name": "get-logged-user", "options": [], "requires_sudo": false, "usage": "health-control get-logged-user [OPTIONS]" }, { "description": "Show current system timezone", "examples": [ "health-control show-timezone", "health-control show-timezone --json" ], "name": "show-timezone", "options": [], "requires_sudo": false, "usage": "health-control show-timezone [OPTIONS]" }, { "description": "Sync timezone based on IP geolocation", "examples": [ "sudo health-control sync-timezone", "sudo health-control sync-timezone --json" ], "name": "sync-timezone", "options": [], "requires_sudo": true, "usage": "health-control sync-timezone [OPTIONS]" }, { "description": "Show timezone based on current IP location", "examples": [ "health-control show-remote-timezone", "health-control show-remote-timezone --json" ], "name": "show-remote-timezone", "options": [], "requires_sudo": false, "usage": "health-control show-remote-timezone [OPTIONS]" }, { "description": "Set system timezone", "examples": [ "sudo health-control set-timezone --timezone America/New_York", "sudo health-control set-timezone --timezone Europe/London", "sudo health-control set-timezone --timezone Asia/Tokyo --json", "sudo health-control set-timezone --value America/Chicago" ], "name": "set-timezone", "options": [], "requires_sudo": true, "usage": "health-control set-timezone [OPTIONS]" }, { "description": "List available timezones by category", "examples": [ "health-control list-timezones", "health-control list-timezones --category all", "health-control list-timezones --category africa", "health-control list-timezones --category americas", "health-control list-timezones --category asia", "health-control list-timezones --category europe", "health-control list-timezones --category australia", "health-control list-timezones --category pacific", "health-control list-timezones --category utc", "health-control list-timezones --json" ], "name": "list-timezones", "options": [], "requires_sudo": false, "usage": "health-control list-timezones [OPTIONS]" }, { "description": "Set a random timezone from a specific category", "examples": [ "sudo health-control set-random-timezone", "sudo health-control set-random-timezone --category americas", "sudo health-control set-random-timezone --category europe", "sudo health-control set-random-timezone --category asia", "sudo health-control set-random-timezone --category africa", "sudo health-control set-random-timezone --category pacific --json" ], "name": "set-random-timezone", "options": [], "requires_sudo": true, "usage": "health-control set-random-timezone [OPTIONS]" }, { "description": "Play notification sound", "examples": [ "sudo health-control play-sound", "sudo health-control play-sound --sound alert", "sudo health-control play-sound success", "sudo health-control play-sound warning -m mp3", "sudo health-control play-sound alert --debug" ], "name": "play-sound", "options": [], "requires_sudo": true, "usage": "health-control play-sound [OPTIONS]" }, { "description": "Send desktop notification", "examples": [ "health-control notify --message \"Security check complete\"", "health-control notify --message \"Hello from Kodachi\"", "health-control notify --message \"Alert\" --body \"VPN connected\"", "health-control notify --message \"Warning\" --urgency critical --duration 30", "health-control notify --message \"Update\" --notify-icon \"/path/to/icon.png\"" ], "name": "notify", "options": [], "requires_sudo": false, "usage": "health-control notify [OPTIONS]" } ] }, { "category": "System Information", "commands": [ { "description": "Display comprehensive system information", "examples": [ "sudo health-control offline-info-system", "sudo health-control offline-info-system --json" ], "name": "offline-info-system", "options": [], "requires_sudo": true, "usage": "health-control offline-info-system [OPTIONS]" }, { "description": "Display hardware information", "examples": [ "sudo health-control offline-info-hardware", "sudo health-control offline-info-hardware --json" ], "name": "offline-info-hardware", "options": [], "requires_sudo": true, "usage": "health-control offline-info-hardware [OPTIONS]" }, { "description": "Display process information", "examples": [ "sudo health-control offline-info-process", "sudo health-control offline-info-process --json" ], "name": "offline-info-process", "options": [], "requires_sudo": true, "usage": "health-control offline-info-process [OPTIONS]" }, { "description": "Display security and encryption status", "examples": [ "sudo health-control offline-info-security", "sudo health-control offline-info-security --json" ], "name": "offline-info-security", "options": [], "requires_sudo": true, "usage": "health-control offline-info-security [OPTIONS]" }, { "description": "Display network information", "examples": [ "sudo health-control offline-info-network", "sudo health-control offline-info-network --json" ], "name": "offline-info-network", "options": [], "requires_sudo": true, "usage": "health-control offline-info-network [OPTIONS]" }, { "description": "Display user information", "examples": [ "sudo health-control offline-info-user", "sudo health-control offline-info-user --json" ], "name": "offline-info-user", "options": [], "requires_sudo": true, "usage": "health-control offline-info-user [OPTIONS]" }, { "description": "Display storage information", "examples": [ "sudo health-control offline-info-storage", "sudo health-control offline-info-storage --json" ], "name": "offline-info-storage", "options": [], "requires_sudo": true, "usage": "health-control offline-info-storage [OPTIONS]" }, { "description": "Display system services information", "examples": [ "sudo health-control offline-info-services", "sudo health-control offline-info-services --json" ], "name": "offline-info-services", "options": [], "requires_sudo": true, "usage": "health-control offline-info-services [OPTIONS]" }, { "description": "Display all system information", "examples": [ "sudo health-control offline-info-all", "sudo health-control offline-info-all --json" ], "name": "offline-info-all", "options": [], "requires_sudo": true, "usage": "health-control offline-info-all [OPTIONS]" }, { "description": "Ping a random privacy-respecting target and return latency", "examples": [ "health-control ping", "health-control ping --json" ], "name": "ping", "options": [], "requires_sudo": false, "usage": "health-control ping [OPTIONS]" }, { "description": "Get process uptime for VPN or Tor", "examples": [ "health-control process-age --process vpn", "health-control process-age --process tor", "health-control process-age --process vpn --json", "health-control process-age --process tor --json" ], "name": "process-age", "options": [], "requires_sudo": false, "usage": "health-control process-age [OPTIONS]" } ] }, { "category": "System Information & Offline Actions", "commands": [ { "description": "Enable/disable/check Bluetooth service", "examples": [ "sudo health-control offline-bluetooth --action disable", "sudo health-control offline-bluetooth --action enable", "sudo health-control offline-bluetooth --action check --json" ], "name": "offline-bluetooth", "options": [], "requires_sudo": true, "usage": "health-control offline-bluetooth [OPTIONS]" }, { "description": "Manage WiFi connectivity", "examples": [ "sudo health-control offline-wifi --action disable", "sudo health-control offline-wifi --action enable", "sudo health-control offline-wifi --action check --json" ], "name": "offline-wifi", "options": [], "requires_sudo": true, "usage": "health-control offline-wifi [OPTIONS]" }, { "description": "Manage USB storage devices", "examples": [ "sudo health-control offline-usb-storage --action disable", "sudo health-control offline-usb-storage --action enable", "sudo health-control offline-usb-storage --action check --json" ], "name": "offline-usb-storage", "options": [], "requires_sudo": true, "usage": "health-control offline-usb-storage [OPTIONS]" }, { "description": "Manage webcam device", "examples": [ "sudo health-control offline-webcam --action disable", "sudo health-control offline-webcam --action enable", "sudo health-control offline-webcam --action check --json" ], "name": "offline-webcam", "options": [], "requires_sudo": true, "usage": "health-control offline-webcam [OPTIONS]" }, { "description": "Manage microphone device", "examples": [ "sudo health-control offline-microphone --action disable", "sudo health-control offline-microphone --action enable", "sudo health-control offline-microphone --action check --json" ], "name": "offline-microphone", "options": [], "requires_sudo": true, "usage": "health-control offline-microphone [OPTIONS]" }, { "description": "Manage system logging", "examples": [ "sudo health-control offline-systemlogs --action disable", "sudo health-control offline-systemlogs --action enable", "sudo health-control offline-systemlogs --action check --json" ], "name": "offline-systemlogs", "options": [], "requires_sudo": true, "usage": "health-control offline-systemlogs [OPTIONS]" }, { "description": "Manage CUPS printing service", "examples": [ "sudo health-control offline-cups --action disable # Disable printer service (CUPS)", "sudo health-control offline-cups --action enable # Enable printer service (CUPS)", "sudo health-control offline-cups --action check --json" ], "name": "offline-cups", "options": [], "requires_sudo": true, "usage": "health-control offline-cups [OPTIONS]" }, { "description": "Manage NetworkManager service", "examples": [ "sudo health-control offline-networkmanager --action disable", "sudo health-control offline-networkmanager --action enable", "sudo health-control offline-networkmanager --action check --json" ], "name": "offline-networkmanager", "options": [], "requires_sudo": true, "usage": "health-control offline-networkmanager [OPTIONS]" }, { "description": "Manage NumLock configuration", "examples": [ "sudo health-control offline-numlock --action enable", "sudo health-control offline-numlock --action disable", "sudo health-control offline-numlock --action check --json" ], "name": "offline-numlock", "options": [], "requires_sudo": true, "usage": "health-control offline-numlock [OPTIONS]" }, { "description": "Manage command history", "examples": [ "sudo health-control offline-cmdhistory --action disable", "sudo health-control offline-cmdhistory --action enable", "sudo health-control offline-cmdhistory --action check --json" ], "name": "offline-cmdhistory", "options": [], "requires_sudo": true, "usage": "health-control offline-cmdhistory [OPTIONS]" }, { "description": "Enable/disable/check auto-login functionality", "examples": [ "sudo health-control offline-autologin --action disable", "sudo health-control offline-autologin --action enable", "sudo health-control offline-autologin --action check --json" ], "name": "offline-autologin", "options": [], "requires_sudo": true, "usage": "health-control offline-autologin [OPTIONS]" }, { "description": "Manage screen locking", "examples": [ "sudo health-control offline-screen-lock --action enable", "sudo health-control offline-screen-lock --action disable", "sudo health-control offline-screen-lock --action check --json" ], "name": "offline-screen-lock", "options": [], "requires_sudo": true, "usage": "health-control offline-screen-lock [OPTIONS]" }, { "description": "Enable/disable/check file descriptor limits", "examples": [ "sudo health-control offline-fdlimit --action enable --soft-limit 1024 --hard-limit 4096", "sudo health-control offline-fdlimit --action disable", "sudo health-control offline-fdlimit --action check --json" ], "name": "offline-fdlimit", "options": [], "requires_sudo": true, "usage": "health-control offline-fdlimit [OPTIONS]" }, { "description": "Enable/disable/check network optimization", "examples": [ "sudo health-control offline-netoptimize --action enable", "sudo health-control offline-netoptimize --action disable", "sudo health-control offline-netoptimize --action check --json" ], "name": "offline-netoptimize", "options": [], "requires_sudo": true, "usage": "health-control offline-netoptimize [OPTIONS]" }, { "description": "Enable/disable/check BBR congestion control", "examples": [ "sudo health-control offline-bbr --action enable", "sudo health-control offline-bbr --action disable", "sudo health-control offline-bbr --action check --json" ], "name": "offline-bbr", "options": [], "requires_sudo": true, "usage": "health-control offline-bbr [OPTIONS]" }, { "description": "Enable/disable/check interface speed optimization", "examples": [ "sudo health-control offline-ifspeed --action enable --interface eth0 --speed 1000", "sudo health-control offline-ifspeed --action disable", "sudo health-control offline-ifspeed --action check --json", "sudo health-control offline-ifspeed --action enable --interface wlan0" ], "name": "offline-ifspeed", "options": [], "requires_sudo": true, "usage": "health-control offline-ifspeed [OPTIONS]" }, { "description": "Manage Avahi daemon service", "examples": [ "sudo health-control offline-avahi --action disable", "sudo health-control offline-avahi --action enable", "sudo health-control offline-avahi --action check --json" ], "name": "offline-avahi", "options": [], "requires_sudo": true, "usage": "health-control offline-avahi [OPTIONS]" }, { "description": "Manage ModemManager service", "examples": [ "sudo health-control offline-modem-manager --action disable", "sudo health-control offline-modem-manager --action enable", "sudo health-control offline-modem-manager --action check --json" ], "name": "offline-modem-manager", "options": [], "requires_sudo": true, "usage": "health-control offline-modem-manager [OPTIONS]" }, { "description": "Manage SSH daemon service", "examples": [ "sudo health-control offline-ssh --action disable", "sudo health-control offline-ssh --action enable", "sudo health-control offline-ssh --action check --json" ], "name": "offline-ssh", "options": [], "requires_sudo": true, "usage": "health-control offline-ssh [OPTIONS]" }, { "description": "Manage Apache web server service", "examples": [ "sudo health-control offline-apache --action disable", "sudo health-control offline-apache --action enable", "sudo health-control offline-apache --action check --json" ], "name": "offline-apache", "options": [], "requires_sudo": true, "usage": "health-control offline-apache [OPTIONS]" }, { "description": "Manage Nginx web server service", "examples": [ "sudo health-control offline-nginx --action disable", "sudo health-control offline-nginx --action enable", "sudo health-control offline-nginx --action check --json" ], "name": "offline-nginx", "options": [], "requires_sudo": true, "usage": "health-control offline-nginx [OPTIONS]" }, { "description": "Manage Docker container service", "examples": [ "sudo health-control offline-docker --action disable", "sudo health-control offline-docker --action enable", "sudo health-control offline-docker --action check --json" ], "name": "offline-docker", "options": [], "requires_sudo": true, "usage": "health-control offline-docker [OPTIONS]" }, { "description": "Manage MySQL database service", "examples": [ "sudo health-control offline-mysql --action disable", "sudo health-control offline-mysql --action enable", "sudo health-control offline-mysql --action check --json" ], "name": "offline-mysql", "options": [], "requires_sudo": true, "usage": "health-control offline-mysql [OPTIONS]" } ] }, { "category": "System Maintenance", "commands": [ { "description": "Enable automatic security updates", "examples": [ "sudo health-control auto-updates-enable", "sudo health-control auto-updates-enable --json" ], "name": "auto-updates-enable", "options": [], "requires_sudo": true, "usage": "health-control auto-updates-enable [OPTIONS]" }, { "description": "Disable automatic security updates", "examples": [ "sudo health-control auto-updates-disable", "sudo health-control auto-updates-disable --json" ], "name": "auto-updates-disable", "options": [], "requires_sudo": true, "usage": "health-control auto-updates-disable [OPTIONS]" }, { "description": "Check automatic updates status", "examples": [ "sudo health-control auto-updates-status", "sudo health-control auto-updates-status --json" ], "name": "auto-updates-status", "options": [], "requires_sudo": true, "usage": "health-control auto-updates-status [OPTIONS]" }, { "description": "Enable system maintenance settings", "examples": [ "health-control system-maintenance-enable", "health-control system-maintenance-enable --json" ], "name": "system-maintenance-enable", "options": [], "requires_sudo": false, "usage": "health-control system-maintenance-enable [OPTIONS]" }, { "description": "Disable system maintenance settings", "examples": [ "health-control system-maintenance-disable", "health-control system-maintenance-disable --json" ], "name": "system-maintenance-disable", "options": [], "requires_sudo": false, "usage": "health-control system-maintenance-disable [OPTIONS]" }, { "description": "Check system maintenance status", "examples": [ "health-control system-maintenance-status", "health-control system-maintenance-status --json" ], "name": "system-maintenance-status", "options": [], "requires_sudo": false, "usage": "health-control system-maintenance-status [OPTIONS]" }, { "description": "Enable password policy enforcement", "examples": [ "sudo health-control password-policy-enable", "sudo health-control password-policy-enable --json" ], "name": "password-policy-enable", "options": [], "requires_sudo": true, "usage": "health-control password-policy-enable [OPTIONS]" }, { "description": "Disable password policy enforcement", "examples": [ "sudo health-control password-policy-disable", "sudo health-control password-policy-disable --json" ], "name": "password-policy-disable", "options": [], "requires_sudo": true, "usage": "health-control password-policy-disable [OPTIONS]" }, { "description": "Check password policy status", "examples": [ "sudo health-control password-policy-status", "sudo health-control password-policy-status --json" ], "name": "password-policy-status", "options": [], "requires_sudo": true, "usage": "health-control password-policy-status [OPTIONS]" }, { "description": "Enable user security hardening", "examples": [ "sudo health-control user-security-enable", "sudo health-control user-security-enable --json" ], "name": "user-security-enable", "options": [], "requires_sudo": true, "usage": "health-control user-security-enable [OPTIONS]" }, { "description": "Disable user security hardening", "examples": [ "sudo health-control user-security-disable", "sudo health-control user-security-disable --json" ], "name": "user-security-disable", "options": [], "requires_sudo": true, "usage": "health-control user-security-disable [OPTIONS]" }, { "description": "Check user security status", "examples": [ "sudo health-control user-security-status", "sudo health-control user-security-status --json" ], "name": "user-security-status", "options": [], "requires_sudo": true, "usage": "health-control user-security-status [OPTIONS]" }, { "description": "Enable two-factor authentication", "examples": [ "# ⚠️ WARNING: 2FA has known bugs with XFCE/LightDM login!", "# Works reliably for: SSH, sudo | Unreliable for: XFCE login, lock screen", "health-control 2fa-enable", "health-control 2fa-enable --value $(whoami) --json", " ⚠ Security Note: Using $(whoami) exposes current username in command history" ], "name": "2fa-enable", "options": [], "requires_sudo": false, "usage": "health-control 2fa-enable [OPTIONS]" }, { "description": "Disable two-factor authentication", "examples": [ "# ⚠️ WARNING: 2FA has known bugs with XFCE/LightDM login!", "health-control 2fa-disable", "health-control 2fa-disable --json" ], "name": "2fa-disable", "options": [], "requires_sudo": false, "usage": "health-control 2fa-disable [OPTIONS]" }, { "description": "Check two-factor authentication status", "examples": [ "# ⚠️ WARNING: 2FA has known bugs with XFCE/LightDM login!", "# Works reliably for: SSH, sudo | Unreliable for: XFCE login, lock screen", "health-control 2fa-status", "health-control 2fa-status --json" ], "name": "2fa-status", "options": [], "requires_sudo": false, "usage": "health-control 2fa-status [OPTIONS]" }, { "description": "Check and install required packages", "examples": [ "sudo health-control check-and-install tor openvpn", "sudo health-control check-and-install rkhunter chkrootkit --json" ], "name": "check-and-install", "options": [], "requires_sudo": true, "usage": "health-control check-and-install [OPTIONS]" }, { "description": "Execute installation after checking dependencies", "examples": [ "sudo health-control check-and-install-do", "sudo health-control check-and-install-do --json" ], "name": "check-and-install-do", "options": [], "requires_sudo": true, "usage": "health-control check-and-install-do [OPTIONS]" }, { "description": "Clean up unnecessary packages", "examples": [ "health-control package-cleanup", "health-control package-cleanup --json" ], "name": "package-cleanup", "options": [], "requires_sudo": false, "usage": "health-control package-cleanup [OPTIONS]" }, { "description": "Clear system memory caches", "examples": [ "sudo health-control clear-cache", "sudo health-control clear-cache --level 1", "sudo health-control clear-cache --level 2", "sudo health-control clear-cache --level 3", "sudo health-control clear-cache --json" ], "name": "clear-cache", "options": [], "requires_sudo": true, "usage": "health-control clear-cache [OPTIONS]" } ] }, { "category": "System Recovery", "commands": [ { "description": "Fix broken sudo permissions (uses pkexec/su, no sudo required)", "examples": [ "sudo health-control fix-sudo", "sudo health-control fix-sudo --json", "sudo # This command tries pkexec first, then su -c, to fix sudo without sudo" ], "name": "fix-sudo", "options": [], "requires_sudo": true, "usage": "health-control fix-sudo [OPTIONS]" }, { "description": "Check sudo installation status and permissions", "examples": [ "sudo health-control check-sudo", "sudo health-control check-sudo --json" ], "name": "check-sudo", "options": [], "requires_sudo": true, "usage": "health-control check-sudo [OPTIONS]" } ] }, { "category": "USB Security", "commands": [ { "description": "Check USB Guard protection status", "examples": [ "sudo health-control usb-status", "sudo health-control usb-status --json" ], "name": "usb-status", "options": [], "requires_sudo": true, "usage": "health-control usb-status [OPTIONS]" }, { "description": "Enable USB Guard protection", "examples": [ "sudo health-control usb-guard-enable", "sudo health-control usb-guard-enable --json" ], "name": "usb-guard-enable", "options": [], "requires_sudo": true, "usage": "health-control usb-guard-enable [OPTIONS]" }, { "description": "Disable USB Guard protection", "examples": [ "sudo health-control usb-guard-disable", "sudo health-control usb-guard-disable --json" ], "name": "usb-guard-disable", "options": [], "requires_sudo": true, "usage": "health-control usb-guard-disable [OPTIONS]" }, { "description": "Manage USB device policies", "examples": [ "sudo health-control usb-policy --action list", "sudo health-control usb-policy --action add --device-id 1234:5678 --allow", "sudo health-control usb-policy --action remove --device-id 1234:5678" ], "name": "usb-policy", "options": [], "requires_sudo": true, "usage": "health-control usb-policy [OPTIONS]" }, { "description": "Monitor USB device connections in real-time", "examples": [ "sudo health-control usb-monitor", "sudo health-control usb-monitor --duration 300", "sudo health-control usb-monitor --alert", "sudo health-control usb-monitor --block-unauthorized --log-only", "sudo health-control usb-monitor --json" ], "name": "usb-monitor", "options": [], "requires_sudo": true, "usage": "health-control usb-monitor [OPTIONS]" }, { "description": "View USB device connection history", "examples": [ "sudo health-control usb-history", "sudo health-control usb-history --days 30", "sudo health-control usb-history --device-id 1234:5678", "sudo health-control usb-history --clear --days 90", "sudo health-control usb-history --json" ], "name": "usb-history", "options": [], "requires_sudo": true, "usage": "health-control usb-history [OPTIONS]" }, { "description": "Manage USB device whitelist", "examples": [ "sudo # Find device IDs first (use lsusb)", "sudo lsusb # Shows vendor:product IDs (e.g., 1234:5678)", "sudo → Bus 003 Device 002: ID 1234:5678 Vendor Name Product Name", "sudo ", "sudo # List current whitelist", "sudo health-control usb-whitelist --action list", "sudo → Shows all whitelisted device IDs", "sudo ", "sudo # Add device to whitelist", "sudo health-control usb-whitelist --action add --device-id 1234:5678", "sudo → Device allowed to connect automatically", "sudo ", "sudo # Remove device from whitelist", "sudo health-control usb-whitelist --action remove --device-id 1234:5678", "sudo → Device will be blocked on next connection", "sudo ", "sudo # Export whitelist (backup configuration)", "sudo health-control usb-whitelist --action export --file ~/usb-whitelist-backup.json", "sudo → Saves whitelist to JSON file for backup/transfer", "sudo ", "sudo # Import whitelist (restore configuration)", "sudo health-control usb-whitelist --action import --file ~/usb-whitelist-backup.json", "sudo → Restores whitelist from JSON backup file", "sudo ", "sudo # Clear all whitelisted devices", "sudo health-control usb-whitelist --action clear", "sudo ⚠️ WARNING: Removes ALL whitelisted devices - use with caution!", "sudo ", "sudo # Repair the base policy (composite mice/mics getting blocked?)", "sudo health-control usb-whitelist --action repair-policy", "sudo → Installs the canonical block-first policy if the on-disk one is", "sudo missing/empty or the legacy 'equals' policy; keeps your whitelist", "sudo and backs up the old file. Safe no-op if already current.", "sudo ", "sudo # JSON output for scripting", "sudo health-control usb-whitelist --action list --json" ], "name": "usb-whitelist", "options": [], "requires_sudo": true, "usage": "health-control usb-whitelist [OPTIONS]" } ] } ], "description": "Health control system for Kodachi that includes network connectivity checks and system health monitoring", "environmentVariables": [ { "default": "info", "description": "Set logging level", "name": "RUST_LOG", "values": "error|warn|info|debug|trace" }, { "default": "unset", "description": "Disable all colored output when set", "name": "NO_COLOR", "values": "1|true|yes (any value disables color)" } ], "exitCodes": { "0": "Success", "1": "General error", "2": "Invalid arguments", "3": "Permission denied", "4": "Network error", "5": "File not found" }, "globalOptions": [ { "description": "Print help information", "flag": "-h, --help" }, { "description": "Print version information", "flag": "-v, --version" }, { "description": "Display detailed information", "flag": "-n, --info" }, { "description": "Show usage examples", "flag": "-e, --examples" }, { "description": "Output in JSON format", "flag": "--json" }, { "description": "Force output format (text|json)", "flag": "-o, --output-format " }, { "description": "Pretty-print JSON output with indentation", "flag": "--json-pretty" }, { "description": "Enhanced JSON output with improved formatting (like jq)", "flag": "--json-human" }, { "description": "Select specific fields to include in output (comma-separated)", "flag": "--fields " }, { "description": "Limit number of results returned", "flag": "--limit " }, { "description": "Skip first N results (for pagination)", "flag": "--offset " }, { "description": "Working directory (defaults to auto-detected base directory)", "flag": "-d, --work-dir " }, { "description": "Set custom port number (1024-65535)", "flag": "--port " }, { "description": "Set log level (error|warn|info|debug)", "flag": "--log-level " }, { "description": "Enable verbose output", "flag": "--verbose" }, { "description": "Suppress non-essential output", "flag": "--quiet" }, { "description": "Disable colored output", "flag": "--no-color" }, { "description": "Use custom configuration file", "flag": "--config " }, { "description": "Set operation timeout in seconds (optional; no default applied)", "flag": "--timeout " }, { "description": "Retry attempts (optional; no default applied)", "flag": "--retry " } ], "name": "health-control", "usage": "health-control [OPTIONS] [COMMAND] [ARGS]" }, "errors": [], "metadata": { "executionTime": 20, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-11T19:39:00.854856932Z", "version": "9.8.4 (build 320)", "warnings": [] }, "flag_e": { "command": "examples", "data": { "categories": [ { "description": "Test network connectivity and configuration", "examples": [ { "command": "sudo health-control net-check", "description": "Full connectivity check: IP ping + DNS + HTTP probe", "expectedOutput": "NETWORK_STATUS: FULL_CONNECTIVITY (ping: , DNS: , HTTP: ) (2)" }, { "command": "sudo health-control net-check --http", "description": "Full check via the extended HTTP path with per-target verbose reporting", "expectedOutput": "Full internet connectivity confirmed (IP, DNS and HTTP)" }, { "command": "sudo health-control net-check --json", "description": "Full connectivity check with JSON output for automation", "expectedOutput": "JSON payload with ping/DNS/HTTP timings and status_code 2 (FULL)" }, { "command": "sudo health-control net-check --http --json", "description": "Extended HTTP check path with JSON output", "expectedOutput": "JSON payload with per-target HTTP probe details" }, { "command": "sudo health-control net-check --ip-only", "description": "Check IP ping only, skip DNS lookups and HTTP probe", "expectedOutput": "NETWORK_STATUS: IP_ONLY_CONNECTIVITY (ping: ) (1)", "notes": "Mutually exclusive with --domain-only and --http-only." }, { "command": "sudo health-control net-check --domain-only", "description": "Check DNS resolution only, skip IP ping and HTTP probe", "expectedOutput": "NETWORK_STATUS: DOMAIN_ONLY_CONNECTIVITY (DNS: ) (4)", "notes": "Mutually exclusive with --ip-only and --http-only." }, { "command": "sudo health-control net-check --http-only", "description": "Check HTTP reachability only, skip IP ping and DNS lookups", "expectedOutput": "NETWORK_STATUS: HTTP_ONLY_CONNECTIVITY (HTTP: ) (5)", "notes": "Mutually exclusive with --ip-only and --domain-only." }, { "command": "sudo health-control net-check --http-only --json", "description": "HTTP-only reachability check with JSON output", "expectedOutput": "JSON payload with HTTP probe latency and status_code 5 (HTTP_ONLY)" }, { "command": "sudo health-control net-check --timeout 15", "description": "Full connectivity check with a custom 15 second timeout", "expectedOutput": "NETWORK_STATUS: FULL_CONNECTIVITY (ping: , DNS: , HTTP: ) (2)" }, { "command": "sudo health-control net-check --ip-only --json", "description": "IP-only ping check with JSON output", "expectedOutput": "JSON payload with ping latency and status_code 1 (IP_ONLY)" }, { "command": "sudo health-control net-check --domain-only --timeout 20", "description": "Domain-only DNS check with a custom 20 second timeout", "expectedOutput": "NETWORK_STATUS: DOMAIN_ONLY_CONNECTIVITY (DNS: ) (4)" }, { "command": "sudo health-control list-ips", "description": "Show IPs used for connectivity testing", "expectedOutput": "List of test IP addresses" }, { "command": "sudo health-control list-domains", "description": "Show domains used for connectivity testing", "expectedOutput": "List of test domain names" }, { "command": "sudo health-control net-check-http --timeout 10", "description": "Dedicated HTTP connectivity probe with a custom timeout in seconds", "expectedOutput": "HTTP reachability result with per-target probe latency", "notes": "--timeout defaults to 10 seconds when omitted." } ], "id": "1_network_connectivity", "title": "Network Connectivity" }, { "description": "Block and unblock internet traffic", "examples": [ { "command": "sudo health-control block-internet", "description": "Block internet using auto-detected method (tries nftables, then iptables, then UFW, then interfaces)", "expectedOutput": "Internet blocked successfully", "notes": "Without --method specified, health-control automatically selects the best available method" }, { "command": "sudo health-control block-internet --method iptables", "description": "Block using iptables firewall rules", "expectedOutput": "Iptables rules applied successfully" }, { "command": "sudo health-control block-internet --method nftables", "description": "Block using nftables firewall rules (preferred modern firewall)", "expectedOutput": "Nftables rules applied successfully" }, { "command": "sudo health-control block-internet --method firewall", "description": "Block using UFW (Uncomplicated Firewall)", "expectedOutput": "UFW rules applied successfully" }, { "command": "sudo health-control block-internet --method interfaces", "description": "Block by disabling network interfaces", "expectedOutput": "Network interfaces disabled successfully" }, { "command": "sudo health-control block-internet --method all", "description": "Block using ALL methods (UFW, nftables, iptables, and interfaces)", "expectedOutput": "All blocking methods applied successfully", "notes": "Applies all available blocking methods for maximum security" }, { "command": "sudo health-control block-internet --allow-local", "description": "Block internet but allow local network traffic", "expectedOutput": "Internet blocked, local traffic allowed" }, { "command": "sudo health-control block-internet --json", "description": "Block internet with JSON output", "expectedOutput": "JSON formatted blocking status" }, { "command": "sudo health-control block-internet --method iptables --allow-local --json", "description": "Block internet with iptables, allow local, JSON output", "expectedOutput": "JSON formatted blocking status with details" }, { "command": "sudo health-control block-internet --method all --allow-local", "description": "Block using ALL methods but allow local network traffic", "expectedOutput": "All blocking methods applied, local traffic allowed" }, { "command": "sudo health-control unblock-internet", "description": "Unblock internet traffic", "expectedOutput": "Internet unblocked successfully" }, { "command": "sudo health-control unblock-internet --method nftables", "description": "Unblock using nftables specifically", "expectedOutput": "Internet unblocked using nftables" }, { "command": "sudo health-control unblock-internet --method iptables", "description": "Unblock using iptables specifically", "expectedOutput": "Internet unblocked using iptables" }, { "command": "sudo health-control unblock-internet --method firewall", "description": "Unblock using UFW specifically", "expectedOutput": "Internet unblocked using UFW" }, { "command": "sudo health-control unblock-internet --method all", "description": "Unblock ALL methods (clears UFW, nftables, iptables, and re-enables interfaces)", "expectedOutput": "All blocking methods cleared successfully", "notes": "Ensures complete restoration by clearing all possible blocks" }, { "command": "sudo health-control unblock-internet --json", "description": "Unblock internet with JSON output", "expectedOutput": "JSON formatted unblocking status" }, { "command": "sudo health-control block-ping", "description": "Block OUTBOUND ICMP echo-requests (ping) for both IPv4 and IPv6. Inserts a DROP rule in the iptables/ip6tables OUTPUT chain so this host can no longer ping out, while all normal TCP/UDP traffic (web, DNS, apps) keeps working", "expectedOutput": "ping block [ipv4]: blocked / ping block [ipv6]: blocked", "notes": "Equivalent to: sudo iptables -I OUTPUT -p icmp --icmp-type echo-request -j DROP AND sudo ip6tables -I OUTPUT -p ipv6-icmp --icmpv6-type echo-request -j DROP. Idempotent, running it twice does not add duplicate rules. Use this to reduce the host's network fingerprint (stealth) without killing connectivity." }, { "command": "sudo health-control block-ping --family ipv4", "description": "Block ping for IPv4 only (iptables), leave IPv6 ICMP untouched", "expectedOutput": "ping block [ipv4]: blocked", "notes": "Equivalent to: sudo iptables -I OUTPUT -p icmp --icmp-type echo-request -j DROP" }, { "command": "sudo health-control block-ping --family ipv6", "description": "Block ping for IPv6 only (ip6tables)", "expectedOutput": "ping block [ipv6]: blocked", "notes": "Equivalent to: sudo ip6tables -I OUTPUT -p ipv6-icmp --icmpv6-type echo-request -j DROP. Reports 'unavailable' if ip6tables is absent (IPv6 disabled)." }, { "command": "sudo health-control block-ping --json", "description": "Block ping with JSON output (per-family result envelope)", "expectedOutput": "{ \"results\": [{\"family\":\"ipv4\",\"state\":\"blocked\"}, ...] }" }, { "command": "sudo health-control unblock-ping", "description": "Unblock OUTBOUND ICMP echo-requests (ping), removes the DROP rule(s) for both IPv4 and IPv6 so this host can ping out again", "expectedOutput": "ping unblock [ipv4]: unblocked / ping unblock [ipv6]: unblocked", "notes": "Equivalent to: sudo iptables -D OUTPUT -p icmp --icmp-type echo-request -j DROP AND sudo ip6tables -D OUTPUT -p ipv6-icmp --icmpv6-type echo-request -j DROP. Removes every duplicate copy of the rule; safe to run when no rule exists (reports 'already-unblocked')." }, { "command": "sudo health-control unblock-ping --family ipv4", "description": "Unblock ping for IPv4 only", "expectedOutput": "ping unblock [ipv4]: unblocked", "notes": "Equivalent to: sudo iptables -D OUTPUT -p icmp --icmp-type echo-request -j DROP" }, { "command": "sudo health-control unblock-ping --family ipv6 --json", "description": "Unblock ping for IPv6 only with JSON output", "expectedOutput": "JSON envelope with ipv6 state" }, { "command": "sudo health-control internet-status", "description": "Check current internet blocking status", "expectedOutput": "Internet traffic status" }, { "command": "sudo health-control internet-status --json", "description": "Check if internet traffic is blocked with JSON output", "expectedOutput": "JSON formatted block status" }, { "command": "sudo health-control kill-switch-arm", "description": "ARM the emergency kill switch - sets system to high-alert monitoring mode", "expectedOutput": "Kill switch ARMED - Monitoring mode active", "notes": "MONITORING MODE: Sets up automated threat detection using multiple monitoring methods:\n• NETWORK MONITORING: Uses netstat, ss, and iptables logs to detect unauthorized connections\n• FILE SYSTEM WATCHING: Monitors critical system files via inotify for unauthorized modifications\n• PROCESS MONITORING: Tracks running processes using ps/proc for suspicious behavior patterns\n• AUTH MONITORING: Watches /var/log/auth.log for failed login attempts (threshold: 5 failures)\n• SYSTEM INTEGRITY: Checks system file hashes and permissions for tampering\nDoes NOT take action until triggered - only prepares for rapid response. Auto-activates MEDIUM panic level when threats detected." }, { "command": "sudo health-control kill-switch-disarm", "description": "DISARM kill switch monitoring", "expectedOutput": "Kill switch DISARMED", "notes": "Stops monitoring mode. Use after threat has passed or false alarm." }, { "command": "sudo health-control kill-switch-status", "description": "Check if monitoring is armed/disarmed", "expectedOutput": "Shows armed status, trigger count, armed time", "notes": "READ-ONLY: Just displays current state, takes no action" }, { "command": "sudo health-control kill-switch-activate", "description": "IMMEDIATELY activate kill switch (default: medium panic)", "expectedOutput": "KILL SWITCH ACTIVATED - emergency procedures executed", "notes": "IMMEDIATE ACTION: Unlike 'arm', this executes panic NOW. Prompts for confirmation. Use --level soft/medium/hard" }, { "command": "sudo health-control panic-soft", "description": "IMMEDIATE soft panic (NO confirmation)", "expectedOutput": "Soft panic activated", "notes": "Actions: Kill network, clear clipboard (adaptive: wl-copy/xclip/xsel for Wayland/X11), lock screen. Reversible." }, { "command": "sudo health-control panic-medium", "description": "IMMEDIATE medium panic (WITH confirmation)", "expectedOutput": "Medium panic activated", "notes": "Actions: Kill network, terminate processes, clear memory, unmount devices. Requires manual restart." }, { "command": "sudo health-control panic-hard", "description": "IMMEDIATE hard panic with SHUTDOWN (WITH confirmation)", "expectedOutput": "Hard panic activated - system will shutdown", "notes": "CRITICAL: Wipes RAM, unmounts all, IMMEDIATE SHUTDOWN. IRREVERSIBLE!" }, { "command": "sudo health-control panic-recover", "description": "Recover from panic mode", "expectedOutput": "System recovered from panic mode", "notes": "Re-enables network, remounts volumes, restores services" }, { "command": "sudo health-control kill-network", "description": "⚠️ Immediately kill ALL network connectivity (emergency cut-off)", "expectedOutput": "All network interfaces brought down and traffic blocked", "notes": "⚠️ DANGEROUS: Severs all networking instantly. Takes no arguments. Use recover-internet / panic-recover to restore connectivity." } ], "id": "2_internet_traffic_control", "title": "Internet Traffic Control" }, { "description": "Monitor system changes and block internet on triggers", "examples": [ { "command": "sudo health-control enable --type watch-guard --watch ip --method nftables", "description": "Enable watch-guard to block internet if IP changes (VPN protection)", "expectedOutput": "Watch-guard enabled message with initial IP", "notes": "Blocks internet using nftables if external IP changes" }, { "command": "sudo health-control enable --type watch-guard --watch timezone --method iptables", "description": "Enable watch-guard for timezone changes", "expectedOutput": "Watch-guard enabled with current timezone", "notes": "Detects system time manipulation attempts" }, { "command": "sudo health-control enable --type watch-guard --watch interfaces --method firewall", "description": "Monitor network interfaces for changes", "expectedOutput": "Watch-guard monitoring interface list", "notes": "Blocks if new interfaces appear or existing ones change" }, { "command": "sudo health-control enable --type watch-guard --watch process --target tor --method interfaces", "description": "Monitor Tor process and block if it dies", "expectedOutput": "Watch-guard watching Tor process count", "notes": "Ensures no clearnet traffic if Tor crashes" }, { "command": "sudo health-control enable --type watch-guard --watch process --target firefox --method all", "description": "Monitor Firefox and use all block methods if it stops", "expectedOutput": "Watch-guard active for Firefox process", "notes": "Maximum blocking using all available methods" }, { "command": "sudo health-control watch-guard status", "description": "Show all active watch-guards and their trigger counts", "expectedOutput": "List of active watch-guards with details" }, { "command": "sudo health-control disable --type watch-guard ip", "description": "Disable IP watch-guard and unblock internet", "expectedOutput": "Watch-guard disabled confirmation", "notes": "Automatically unblocks internet unless --no-unblock used" }, { "command": "sudo health-control disable --type watch-guard all --no-unblock", "description": "Disable all watch-guards but keep internet blocked", "expectedOutput": "All watch-guards disabled message", "notes": "Use when you want manual control over unblocking" }, { "command": "sudo health-control daemon --config-id \"$WATCHGUARD_CONFIG_ID\"", "description": "Run watch-guard monitoring as a persistent daemon process", "expectedOutput": "Daemon started, monitoring the selected watch-guard configuration", "notes": "--config-id is required. Add --json for machine-readable output. Long-running foreground process intended for service supervision." } ], "id": "3_watchguard", "title": "Watch-Guard Management" }, { "description": "Diagnose and fix connectivity issues", "examples": [ { "command": "sudo health-control recover-internet", "description": "Automatically diagnose and fix connectivity issues", "expectedOutput": "Recovery steps performed and status" }, { "command": "sudo health-control recover-internet --check-dns", "description": "Include DNS resolution testing and fixes", "expectedOutput": "Recovery with DNS diagnostics" }, { "command": "sudo health-control recover-internet --force", "description": "Force recovery even if connectivity appears working", "expectedOutput": "Forced recovery completion status" }, { "command": "sudo health-control recover-internet --silent", "description": "Run full internet recovery without desktop/terminal notifications", "expectedOutput": "Recovery runs silently (no notifications)", "notes": "Also supports --skipnotification, --skip-notification, and typo-compatible --skipnotifcation" }, { "command": "sudo health-control fast-recover-internet", "description": "Fast recovery: bounce interface + restart NetworkManager + DHCP renew", "expectedOutput": "FAST_RECOVER: SUCCESS", "notes": "Lightweight alternative to recover-internet, tries quick fix before full 9-method recovery" }, { "command": "sudo health-control fast-recover-internet --silent", "description": "Run fast recovery without desktop/terminal notifications", "expectedOutput": "FAST_RECOVER runs silently (no notifications)", "notes": "Also supports --skipnotification, --skip-notification, and typo-compatible --skipnotifcation" }, { "command": "sudo health-control fast-recover-internet --json", "description": "Fast recovery with JSON output", "expectedOutput": "JSON envelope with success status and method details" } ], "id": "4_network_recovery", "title": "Network Recovery" }, { "description": "Manage system timezone settings", "examples": [ { "command": "sudo health-control sync-timezone", "description": "Sync timezone based on IP geolocation", "expectedOutput": "Timezone synchronized to detected location" }, { "command": "sudo health-control show-timezone", "description": "Show current system timezone", "expectedOutput": "Current timezone information" }, { "command": "sudo health-control set-timezone --timezone \"America/New_York\"", "description": "Set specific timezone", "expectedOutput": "Timezone set to America/New_York" }, { "command": "sudo health-control show-remote-timezone", "description": "Show timezone based on current IP location", "expectedOutput": "Remote location timezone information" }, { "command": "health-control list-timezones", "description": "List all timezone categories", "expectedOutput": "List of timezone categories with counts" }, { "command": "health-control list-timezones --category all", "description": "List all available timezones", "expectedOutput": "Complete list of timezones" }, { "command": "health-control list-timezones --category africa", "description": "List African timezones", "expectedOutput": "List of African timezones" }, { "command": "health-control list-timezones --category americas", "description": "List American timezones", "expectedOutput": "List of North and South American timezones" }, { "command": "health-control list-timezones --category asia", "description": "List Asian timezones", "expectedOutput": "List of Asian timezones" }, { "command": "health-control list-timezones --category europe", "description": "List European timezones", "expectedOutput": "List of European timezones" }, { "command": "health-control list-timezones --category australia", "description": "List Australian timezones", "expectedOutput": "List of Australian timezones" }, { "command": "health-control list-timezones --category pacific", "description": "List Pacific timezones", "expectedOutput": "List of Pacific timezones" }, { "command": "health-control list-timezones --category utc", "description": "List UTC timezones", "expectedOutput": "List of UTC timezones" }, { "command": "health-control list-timezones --json", "description": "List timezone categories in JSON format", "expectedOutput": "JSON output of timezone categories" }, { "command": "sudo health-control set-random-timezone", "description": "Set a random timezone from all available", "expectedOutput": "Timezone set to random value", "notes": "Requires sudo privileges" }, { "command": "sudo health-control set-random-timezone --category americas", "description": "Set random American timezone", "expectedOutput": "Timezone set to random American timezone", "notes": "Requires sudo privileges" }, { "command": "sudo health-control set-random-timezone --category europe", "description": "Set random European timezone", "expectedOutput": "Timezone set to random European timezone", "notes": "Requires sudo privileges" }, { "command": "sudo health-control set-random-timezone --category asia", "description": "Set random Asian timezone", "expectedOutput": "Timezone set to random Asian timezone", "notes": "Requires sudo privileges" }, { "command": "sudo health-control set-random-timezone --category africa", "description": "Set random African timezone", "expectedOutput": "Timezone set to random African timezone", "notes": "Requires sudo privileges" }, { "command": "sudo health-control set-random-timezone --category pacific --json", "description": "Set random Pacific timezone with JSON output", "expectedOutput": "JSON output of timezone change", "notes": "Requires sudo privileges" } ], "id": "5_timezone_management", "title": "Timezone Management" }, { "description": "Change and manage MAC addresses", "examples": [ { "command": "sudo health-control mac-change-all", "description": "Change MAC addresses for all interfaces", "expectedOutput": "All MAC addresses changed" }, { "command": "sudo health-control mac-force-change", "description": "Force change MAC addresses", "expectedOutput": "MAC addresses force-changed", "notes": "Use when regular change fails" }, { "command": "sudo health-control mac-change-specific --interface eth0", "description": "Change MAC for specific interface", "expectedOutput": "MAC address changed for eth0" }, { "command": "sudo health-control mac-show-interfaces", "description": "Show all network interfaces", "expectedOutput": "List of network interfaces" }, { "command": "sudo health-control mac-show-macs", "description": "Show current MAC addresses", "expectedOutput": "List of interfaces and MAC addresses" }, { "command": "sudo health-control mac-reset-all", "description": "Reset all MACs to original values", "expectedOutput": "MAC addresses reset to original" }, { "command": "sudo health-control mac-active-interface", "description": "Show active network interface", "expectedOutput": "Currently active network interface" } ], "id": "6_mac_address_management", "title": "MAC Address Management" }, { "description": "Get and set system hostname", "examples": [ { "command": "sudo health-control get-hostname", "description": "Get current system hostname", "expectedOutput": "Current hostname" }, { "command": "sudo health-control get-hostname --json", "description": "Get hostname in JSON format", "expectedOutput": "JSON formatted hostname" }, { "command": "health-control get-logged-user", "description": "Get the actual logged-in user (handles sudo correctly)", "expectedOutput": "Username of logged-in user", "notes": "Returns actual user even when run with sudo" }, { "command": "sudo health-control get-logged-user --json", "description": "Get logged user with additional info in JSON format", "expectedOutput": "JSON with username, home directory, and detection method" }, { "command": "sudo health-control set-default-hostname", "description": "Set default system hostname", "expectedOutput": "Default hostname set" }, { "command": "sudo health-control set-random-hostname", "description": "Set random hostname for privacy", "expectedOutput": "Random hostname set" }, { "command": "sudo health-control set-random-hostname --json", "description": "Set random hostname with JSON output", "expectedOutput": "JSON formatted hostname change result" }, { "command": "sudo health-control set-custom-hostname --name MyHost", "description": "Set custom hostname", "expectedOutput": "Hostname set to MyHost" }, { "command": "sudo health-control set-custom-hostname --name privacy-machine", "description": "Set descriptive custom hostname", "expectedOutput": "Hostname set to privacy-machine" }, { "command": "sudo health-control set-custom-hostname --name secure-workstation --json", "description": "Set custom hostname with JSON output", "expectedOutput": "JSON formatted hostname change result" }, { "command": "health-control list-hostnames", "description": "List all hostname categories", "expectedOutput": "List of available hostname categories with counts" }, { "command": "health-control list-hostnames --category all", "description": "List all available hostnames", "expectedOutput": "Complete list of all predefined hostnames" }, { "command": "health-control list-hostnames --category windows", "description": "List Windows hostnames", "expectedOutput": "List of Windows-style hostnames" }, { "command": "health-control list-hostnames --category linux", "description": "List Linux hostnames", "expectedOutput": "List of Linux distribution hostnames" }, { "command": "health-control list-hostnames --category apple", "description": "List Apple/Mac hostnames", "expectedOutput": "List of macOS and Apple device hostnames" }, { "command": "health-control list-hostnames --json", "description": "List hostname categories in JSON format", "expectedOutput": "JSON formatted category list with counts" }, { "command": "sudo health-control set-random-hostname-category", "description": "Set random hostname from all categories", "expectedOutput": "Random hostname selected and set" }, { "command": "sudo health-control set-random-hostname-category --category windows", "description": "Set random Windows hostname", "expectedOutput": "Random Windows-style hostname set" }, { "command": "sudo health-control set-random-hostname-category --category linux", "description": "Set random Linux hostname", "expectedOutput": "Random Linux distribution hostname set" }, { "command": "sudo health-control set-random-hostname-category --category fiction --json", "description": "Set random fictional hostname with JSON output", "expectedOutput": "Random fictional hostname set with JSON result" }, { "command": "sudo health-control change-hostname mylaptop", "description": "Set the system hostname to a specific value", "expectedOutput": "Hostname changed to mylaptop", "notes": "HOSTNAME positional argument is optional; when omitted a hostname is generated/applied per default behavior." } ], "id": "7_hostname_management", "title": "Hostname Management" }, { "description": "Control and monitor IPv6 protocol settings", "examples": [ { "command": "sudo health-control ipv6-status", "description": "Check current IPv6 configuration status", "expectedOutput": "IPv6 Status: ENABLED/DISABLED with interface details", "notes": "Shows runtime status, boot config, and active interfaces" }, { "command": "sudo health-control ipv6-disable", "description": "Disable IPv6 system-wide (sysctl and GRUB)", "expectedOutput": "IPv6 disabled with details of changes applied", "notes": "Reboot recommended for full effect" }, { "command": "sudo health-control ipv6-enable", "description": "Enable IPv6 system-wide", "expectedOutput": "IPv6 enabled with details of changes applied", "notes": "Reboot recommended for full effect" }, { "command": "sudo health-control ipv6-status --json", "description": "Get detailed IPv6 status in JSON format", "expectedOutput": "Complete IPv6 configuration including runtime, boot config, and interfaces" } ], "id": "8_ipv6_management", "title": "IPv6 Management" }, { "description": "Apply and verify comprehensive security settings (7 modules: kernel, process, filesystem, network, memory, monitoring, sandboxing)", "examples": [ { "command": "sudo health-control security-harden", "description": "Apply standard security hardening (network-safe): kernel hardening, process isolation, filesystem security, memory protection, monitoring, sandboxing - PRESERVES internet connectivity", "expectedOutput": "Security hardening completed (network connectivity preserved)", "notes": "Standard profile maintains system usability and network connectivity" }, { "command": "sudo health-control security-harden --profile medium", "description": "Apply MEDIUM profile - Enhanced security with hidepid, hardened_malloc, file integrity monitoring. Browsers and internet still work", "expectedOutput": "Medium security hardening applied (browsers and internet preserved)", "notes": "Medium profile adds hidepid=2, hardened_malloc, dirty_ratio tuning, file integrity. May increase memory on LUKS systems" }, { "command": "sudo health-control security-harden --profile paranoid", "description": "Apply PARANOID profile - WARNING: WILL BREAK browsers and internet: disables user namespaces, IP forwarding, DNS firewall, MAC spoofing", "expectedOutput": "Paranoid security applied (network isolated)", "notes": "⚠️ BROWSERS AND INTERNET DISABLED - To recover: sudo health-control security-recover" }, { "command": "sudo health-control security-harden --break-monitoring", "description": "Apply paranoid profile plus break-monitoring mode: forces /sys/class/net to root-only and breaks non-root monitoring tools (btop/conky/dashboard)", "expectedOutput": "Paranoid hardening applied with monitoring intentionally restricted", "notes": "⚠️ ALSO BREAKS NON-ROOT MONITORING - Use only when this behavior is explicitly required" }, { "command": "sudo health-control security-verify", "description": "Check if all 7 security modules are enabled and properly configured", "expectedOutput": "Shows each module: ENABLED/DISABLED and configuration status", "notes": "Use after security-harden to verify settings are applied" }, { "command": "sudo health-control security-harden --modules kernel,network", "description": "Apply only specific modules (kernel sysctl and network firewall)", "expectedOutput": "Applied 2 modules: kernel and network hardening", "notes": "Modules: kernel, process, filesystem, network, memory, monitoring, sandboxing" }, { "command": "sudo health-control security-recover", "description": "Temporarily revert security hardening (keeps framework ready for quick re-hardening)", "expectedOutput": "Security recovery completed - modules show 'ENABLED (needs configuration)'", "notes": "Use for troubleshooting. Framework remains enabled for easy re-hardening with security-harden." }, { "command": "sudo health-control security-recover --modules network,kernel", "description": "Recover only specific security modules", "expectedOutput": "Selected modules recovered", "notes": "Available modules: kernel, filesystem, network, memory, monitoring, smt" }, { "command": "sudo health-control security-reset", "description": "Completely disable all security modules and framework (permanent removal)", "expectedOutput": "All modules show 'DISABLED' - framework completely removed", "notes": "WARNING: Unlike security-recover, this permanently disables the framework. Requires rebuilding to re-enable." }, { "command": "sudo health-control security-reset --force", "description": "Reset security framework without confirmation prompt", "expectedOutput": "Security framework completely disabled", "notes": "Use --force to skip the confirmation prompt in automation scripts" }, { "command": "sudo health-control monitoring-enable", "description": "Enable system security monitoring (auditd, LKRG, file integrity, auth events)", "expectedOutput": "Security monitoring enabled", "notes": "Enables auditd for system call auditing, LKRG for kernel integrity, file integrity monitoring (AIDE/Tripwire), and auth event logging" }, { "command": "sudo health-control monitoring-disable", "description": "Disable system security monitoring services", "expectedOutput": "Security monitoring disabled", "notes": "Stops all security monitoring services - reduces system overhead but decreases security visibility" }, { "command": "sudo health-control monitoring-status", "description": "Check current system security monitoring status", "expectedOutput": "Security monitoring status details", "notes": "Shows status of auditd, LKRG, AIDE, and auth logging - helps verify which monitoring services are active" }, { "command": "sudo health-control tirdad-enable", "description": "Enable Tirdad kernel module for TCP ISN randomization (prevents OS fingerprinting)", "expectedOutput": "Tirdad enabled successfully", "notes": "Randomizes TCP Initial Sequence Numbers to prevent remote OS fingerprinting attacks and TCP sequence prediction" }, { "command": "sudo health-control tirdad-disable", "description": "Disable Tirdad TCP ISN randomization module", "expectedOutput": "Tirdad disabled successfully", "notes": "Restores default TCP ISN generation - may make system identifiable via network fingerprinting" }, { "command": "sudo health-control tirdad-status", "description": "Check Tirdad TCP ISN randomization module status", "expectedOutput": "Tirdad status: ENABLED/DISABLED", "notes": "Shows if kernel module is loaded and TCP ISN randomization is active" }, { "command": "sudo health-control disk-encryption-status", "description": "Check disk encryption status", "expectedOutput": "Disk encryption configuration", "notes": "Displays LUKS encryption status for all disks, cipher algorithms, and key slot usage" }, { "command": "sudo health-control usb-list", "description": "List all USB devices", "expectedOutput": "Connected USB devices", "notes": "Shows all connected USB devices with vendor/product IDs for security auditing" }, { "command": "sudo health-control create-persistence", "description": "Create unencrypted live-boot persistence media", "expectedOutput": "Debian live-boot persistence media created successfully", "notes": "Creates a 4GB unencrypted ext4 persistence image named 'persistence' with a root persistence.conf of '/ union' so /opt, /etc, and other system paths survive reboots on Kodachi live USBs. Use --encrypted for LUKS encryption or --size to change size." }, { "command": "sudo health-control create-persistence --encrypted", "description": "Create encrypted persistence (interactive)", "expectedOutput": "Encrypted persistence media created", "notes": "Creates LUKS2-encrypted Debian live-boot persistence media named 'persistence' and writes '/ union' to persistence.conf. Secure method - password not visible in history." }, { "command": "read -rsp 'Persistence password: ' PERSISTENCE_PASSWORD && printf '\\n' && sudo health-control create-persistence --encrypted --password \"$PERSISTENCE_PASSWORD\" && unset PERSISTENCE_PASSWORD", "description": "Create encrypted persistence with a hidden interactive password prompt", "expectedOutput": "Encrypted persistence media created", "notes": "The password is read without terminal echo and is never embedded in the catalog or shell history. The variable is cleared after a successful command." }, { "command": "sudo health-control encryption-status", "description": "Show overall encryption status", "expectedOutput": "System encryption status report", "notes": "Comprehensive report of all encryption: disks, swap, home directories, and key management" } ], "id": "9_security_hardening", "title": "Security Hardening" }, { "description": "Monitor system health and run security audits", "examples": [ { "command": "sudo health-control system-audit", "description": "Perform comprehensive system security audit", "expectedOutput": "System audit status report" }, { "command": "sudo health-control rootkit-scan", "description": "Scan system for rootkits", "expectedOutput": "Rootkit scan results" }, { "command": "sudo health-control security-status --json", "description": "Check system security status", "expectedOutput": "JSON formatted security status info" }, { "command": "sudo health-control lynis-audit", "description": "Run comprehensive Lynis security audit", "expectedOutput": "Complete Lynis audit report", "notes": "Comprehensive security assessment" }, { "command": "sudo health-control lynis-status", "description": "Check Lynis installation and status", "expectedOutput": "Lynis service status" }, { "command": "sudo health-control aide-init", "description": "Initialize AIDE database", "expectedOutput": "AIDE database created successfully", "notes": "First time setup required" }, { "command": "sudo health-control aide-check", "description": "Check file integrity with AIDE", "expectedOutput": "File integrity check results" }, { "command": "sudo health-control kloak-status", "description": "Check kloak keystroke anonymization status", "expectedOutput": "Kloak service status and configuration" }, { "command": "sudo health-control kloak-enable", "description": "Enable kloak keystroke anonymization", "expectedOutput": "Kloak enabled successfully" }, { "command": "sudo health-control kloak-disable", "description": "Disable kloak keystroke anonymization", "expectedOutput": "Kloak disabled successfully" }, { "command": "sudo health-control kloak-configure --delay 100 --jitter 30 --mode normal", "description": "Configure kloak keystroke delay, jitter and operating mode", "expectedOutput": "Kloak configuration updated", "notes": "--mode accepts normal, aggressive, or minimal. All flags are optional." }, { "command": "sudo health-control kloak-event-mode --mode adaptive", "description": "Set the kloak event-processing mode", "expectedOutput": "Kloak event mode set to adaptive", "notes": "--mode is required: raw, filtered, or adaptive." }, { "command": "sudo health-control kloak-stats", "description": "Show kloak keystroke anonymization statistics", "expectedOutput": "Kloak counters and timing statistics", "notes": "Add --reset to clear the statistics counters." }, { "command": "sudo health-control aide-update", "description": "Update the AIDE baseline database after reviewing changes", "expectedOutput": "AIDE database updated", "notes": "Add --accept-changes to accept all detected changes and update the baseline." }, { "command": "sudo health-control aide-reinit --background --timeout 7200 --json", "description": "Start AIDE database reinitialization in the background", "expectedOutput": "JSON background launch status with log path", "notes": "Use --force only when intentionally replacing an existing baseline." }, { "command": "sudo health-control aide-scan-dir /etc --recursive", "description": "Run an AIDE integrity scan against a specific directory", "expectedOutput": "File integrity results for the scanned directory", "notes": "PATH positional argument is required. -r/--recursive scans subdirectories." } ], "id": "10_system_health_security", "title": "System Health & Security Tools" }, { "description": "LUKS nuke passwords for emergency data destruction", "examples": [ { "command": "sudo health-control luks-nuke --action status", "description": "List all LUKS devices and nuke password status", "expectedOutput": "LUKS device status and configuration", "notes": "Shows which devices have nuke passwords configured" }, { "command": "sudo health-control luks-nuke --action status --device \"$LUKS_DEVICE\"", "description": "⚠️ STEP 1: Check current nuke status for target device", "expectedOutput": "Current LUKS nuke configuration status for the selected device", "notes": "⚠️ ALWAYS backup header BEFORE configuring nuke password. This status check helps confirm current device state before changes." }, { "command": "sudo health-control luks-nuke --action configure --device \"$LUKS_DEVICE\" --password \"$LUKS_NUKE_PASSWORD\"", "description": "⚠️ STEP 2: Configure nuke password (DATA DESTRUCTION FEATURE)", "expectedOutput": "Nuke password configured in keyslot 7", "notes": "⚠️ CRITICAL WARNING: This creates a password that will PERMANENTLY DESTROY all data on the selected LUKS device when entered! Use only if you understand the consequences. Requires header backup from STEP 1. Password must be strong (12+ chars, mixed case, numbers, symbols). Avoid obvious words like 'nuke', 'destroy', 'emergency'." }, { "command": "sudo health-control luks-nuke --action remove --device \"$LUKS_DEVICE\"", "description": "Remove nuke password from device", "expectedOutput": "Nuke password removed from keyslot 7", "notes": "Removes the data destruction feature from the device. You will be prompted to confirm which keyslot to remove (usually keyslot 7). Requires current LUKS password." }, { "command": "gpg -d \"$LUKS_HEADER_BACKUP\" | sudo cryptsetup luksHeaderRestore \"$LUKS_DEVICE\"", "description": "⚠️ EMERGENCY: Restore LUKS header after nuke password was used", "expectedOutput": "LUKS header restored from backup", "notes": "⚠️ USE ONLY IF nuke password was accidentally used! This restores the LUKS header from your encrypted backup. You MUST have created a header backup BEFORE the nuke password was triggered. After restoration, you can unlock the device with your original LUKS password. Without a backup, data is PERMANENTLY LOST." }, { "command": "sudo health-control luks-detect", "description": "Detect LUKS-encrypted devices on the system", "expectedOutput": "List of detected LUKS containers", "notes": "Add --all-devices to also scan loop and other block devices." }, { "command": "sudo health-control luks-manage --action list", "description": "Manage LUKS devices (add, remove, unlock, lock, list)", "expectedOutput": "LUKS device management result", "notes": "--action defaults to list. Use --device to target a specific device path for add/remove/unlock/lock." }, { "command": "sudo health-control luks-manage-advanced --action backup-header --device \"$LUKS_DEVICE\" --backup-file \"$LUKS_HEADER_BACKUP\"", "description": "Advanced LUKS header operations and key management", "expectedOutput": "Advanced LUKS operation completed", "notes": "--action is required: create, format, backup-header, restore-header, change-key, add-key, remove-key. Provide --device / --key-file / --backup-file as the action requires." }, { "command": "sudo health-control luks-nuke-advanced --device \"$LUKS_DEVICE\" --password \"$LUKS_NUKE_PASSWORD\"", "description": "⚠️ Configure an advanced LUKS nuke password (DATA DESTRUCTION)", "expectedOutput": "Advanced nuke configuration applied to the selected LUKS device", "notes": "⚠️ CRITICAL: --device is required; entering the nuke --password later PERMANENTLY DESTROYS all data on the device. Always back up the LUKS header first." }, { "command": "sudo health-control luks-remove \"$LUKS_DEVICE\" --force", "description": "⚠️ Remove LUKS encryption from a device", "expectedOutput": "LUKS removed from the selected device", "notes": "⚠️ DESTRUCTIVE: DEVICE positional argument is required. --force skips the confirmation prompt." } ], "id": "11_luks_nuke_operations", "title": "LUKS Nuke & Data Destruction" }, { "description": "Full system data destruction for emergency situations. IRREVERSIBLE - use with extreme caution.", "examples": [ { "command": "health-control nuke-execute --dry-run", "description": "⚠️ TEST MODE: Preview what would be destroyed without actually wiping", "expectedOutput": "[DRY_RUN] messages showing all files/directories that would be wiped", "notes": "ALWAYS test with --dry-run first! Shows exactly what will be destroyed including: SSH keys, GPG keys, crypto wallets, browser data, messaging apps, email, documents, and system logs." }, { "command": "health-control nuke-execute --method fast --dry-run", "description": "Fast wipe mode (1-pass) - quickest destruction (~27 seconds)", "expectedOutput": "Fast wipe simulation with single-pass overwrite", "notes": "Best for SSDs where multi-pass is ineffective. Uses blkdiscard for SSDs, single shred pass for HDDs." }, { "command": "health-control nuke-execute --method secure --dry-run", "description": "Secure wipe mode (3-pass DoD) - balanced security (~45 seconds)", "expectedOutput": "Secure wipe simulation with 3-pass DoD standard", "notes": "DEFAULT mode. 3-pass overwrite following DoD 5220.22-M standard. Good balance of speed and security for HDDs." }, { "command": "health-control nuke-execute --method paranoid --dry-run", "description": "Paranoid wipe mode (7-pass) - maximum security (~60 seconds)", "expectedOutput": "Paranoid wipe simulation with 7-pass Gutmann-style", "notes": "Maximum security. 7-pass overwrite. Also wipes boot sector, GRUB, kernel, initrd, and MBR. System will be unbootable." }, { "command": "health-control nuke-execute --method fast --force", "description": "⚠️ DANGER: Execute REAL fast wipe - DESTROYS ALL DATA", "expectedOutput": "Data destruction in progress... System will reboot when complete.", "notes": "⚠️ IRREVERSIBLE! This PERMANENTLY DESTROYS: ~/.ssh, ~/.gnupg, crypto wallets (Bitcoin/Monero/Electrum), all browsers, Signal/Telegram/Discord, Thunderbird, Documents/Downloads/Desktop, AWS/Docker/Kube credentials, bash history, system logs. System forces reboot after completion." }, { "command": "health-control nuke-progress", "description": "Check current nuke operation progress", "expectedOutput": "Phase: 5 - browser_data, Complete: false, Active: true", "notes": "Monitor ongoing destruction progress. Shows current phase, completion status, and any errors." }, { "command": "health-control nuke-storage-detect --device \"${TARGET_DEVICE:?Set TARGET_DEVICE after reviewing lsblk output}\"", "description": "Detect storage type for optimal wipe method", "expectedOutput": "Selected device path and detected storage type", "notes": "Detects if device is SSD, HDD, or NVMe. SSDs use blkdiscard (instant secure erase), HDDs use shred (multi-pass overwrite), NVMe uses nvme format command." } ], "id": "11b_emergency_nuke_operations", "title": "Emergency Nuke Operations" }, { "description": "Complete USB security management - device listing, USBGuard policies, storage control, and monitoring", "examples": [ { "command": "", "description": "UNDERSTANDING USB SECURITY LAYERS", "expectedOutput": "", "notes": "USB security has TWO independent control systems:\n\n1. USBGuard (usb-guard-* commands):\n- Controls WHICH devices are allowed/blocked\n- Device authorization policy management\n- Works at the USBGuard daemon level\n\n2. USB Storage Modules (offline-usb-storage):\n- Controls IF USB storage drivers are loaded at all\n- Manages kernel modules (usb_storage, uas)\n- Manages device authorization at kernel level\n- Integrates with USBGuard automatically\n\n⚠️ CRITICAL: For USB drives to work, you need:\n- USB storage modules enabled (offline-usb-storage --action enable)\n- USBGuard allowing the device (or disabled)\n- Device authorized at kernel level (handled by offline-usb-storage)\n\n💡 TIP: Use 'offline-usb-storage --action enable' for complete USB storage access.\nIt handles all 4 layers automatically!" }, { "command": "sudo health-control usb-list", "description": "List all connected USB devices", "expectedOutput": "USB device list with security status" }, { "command": "sudo health-control offline-usb-storage --action check", "description": "Check USB storage module status (all 4 layers)", "expectedOutput": "Modules loaded: yes/no, Blacklist exists: yes/no, USBGuard active: yes/no, Authorized devices: N", "notes": "Shows complete status of all USB storage control layers" }, { "command": "sudo health-control offline-usb-storage --action enable", "description": "Enable USB storage completely (recommended)", "expectedOutput": "USB storage enabled successfully - All layers configured", "notes": "Handles ALL 4 layers: Removes blacklist, loads modules, authorizes devices, integrates with USBGuard.\nYour USB drives should appear immediately in 'lsblk' after this command." }, { "command": "sudo health-control offline-usb-storage --action enable --verbose", "description": "Enable USB storage with detailed layer-by-layer output", "expectedOutput": "Shows: modules loaded → devices authorized → USBGuard integration → udev triggered", "notes": "Use verbose mode to see exactly what happens at each layer" }, { "command": "sudo health-control offline-usb-storage --action disable", "description": "Disable USB storage completely (security lockdown)", "expectedOutput": "USB storage disabled successfully - All layers configured", "notes": "Blocks USB storage at all 4 layers: deauthorizes devices, blocks in USBGuard, unloads modules, creates blacklist" }, { "command": "sudo health-control usb-guard-enable", "description": "Enable USB Guard protection service", "expectedOutput": "USB Guard enabled successfully", "notes": "⚠️ This only enables USBGuard service - does NOT enable USB storage modules!\nIf USB storage modules are blocked, your drives won't appear even with USBGuard enabled.\nUse 'offline-usb-storage --action enable' for complete access." }, { "command": "sudo health-control usb-guard-disable", "description": "Disable USB Guard protection service", "expectedOutput": "USB Guard disabled successfully", "notes": "Disables USBGuard service but does NOT affect USB storage modules.\nStorage modules may still be blocked separately." }, { "command": "sudo health-control usb-policy --action add --device-id 1234:5678 --allow", "description": "Add USB device to USBGuard allow policy", "expectedOutput": "USB device policy added", "notes": "Use lsusb to find device IDs. This manages USBGuard policy only.\nDevice must also be authorized at kernel level (handled by offline-usb-storage)." }, { "command": "sudo health-control usb-policy --action list", "description": "List all USB policies in USBGuard", "expectedOutput": "Current USB device policies" }, { "command": "sudo health-control usb-policy --action status", "description": "Check USB security policies", "expectedOutput": "USB security policy assessment" }, { "command": "sudo health-control usb-monitor", "description": "Start USB device monitoring", "expectedOutput": "USB monitoring started" }, { "command": "sudo health-control usb-history --days 7", "description": "View USB device history for last 7 days", "expectedOutput": "USB device connection history" }, { "command": "sudo health-control usb-status", "description": "Show overall USB security status", "expectedOutput": "USB security status summary" }, { "command": "sudo health-control usb-whitelist --action add --device-id 1234:5678", "description": "Manage the USB device whitelist (add, remove, list, import, export)", "expectedOutput": "USB whitelist updated", "notes": "--action defaults to list. Use --device-id (vendor:product) for add/remove, or --file for import/export." } ], "id": "12_usb_device_security", "title": "USB & Device Security" }, { "description": "Secure data wiping procedures", "examples": [ { "command": "sudo health-control wipe-file --file /path/to/file --passes 7", "description": "Securely wipe file with 7 passes", "expectedOutput": "File securely wiped and unrecoverable", "notes": "Multiple passes increase security" }, { "command": "sudo health-control wipe-directory --path /path/to/directory --passes 3", "description": "Securely wipe entire directory", "expectedOutput": "Directory and contents wiped securely", "notes": "All files in directory will be destroyed" }, { "command": "sudo health-control wipe-free-space --device \"$TARGET_BLOCK_DEVICE\"", "description": "Wipe free space on device", "expectedOutput": "Free space wiped securely", "notes": "Prevents recovery of deleted files" }, { "command": "sudo health-control wipe-logs", "description": "Wipe system and application logs", "expectedOutput": "Logs wiped successfully", "notes": "Removes log file traces" }, { "command": "sudo health-control wipe-browser-data", "description": "Wipe browser history and data", "expectedOutput": "Browser data wiped", "notes": "Removes browsing history and cache" }, { "command": "sudo health-control wipe-schedule temp --frequency daily", "description": "Schedule automatic temporary file wiping daily", "expectedOutput": "File wipe scheduled successfully", "notes": "Automatically wipes temp files based on frequency" }, { "command": "sudo health-control wipe-pattern \"*.tmp\"", "description": "Wipe all temporary files matching pattern", "expectedOutput": "Files matching pattern wiped", "notes": "Uses glob patterns to match files for wiping" }, { "command": "sudo health-control wipe-verify /path/to/file", "description": "Verify file has been securely wiped", "expectedOutput": "File wipe verification results" }, { "command": "sudo health-control wipe-batch /path1 /path2 /path3 --passes 7", "description": "Batch wipe multiple files with 7 passes", "expectedOutput": "Batch file wiping completed", "notes": "Space-separated file paths" }, { "command": "sudo health-control wipe-user-dir --target downloads", "description": "⚠️ Securely wipe a standard user directory", "expectedOutput": "User directory securely wiped", "notes": "⚠️ DESTRUCTIVE: --target is required and must be one of downloads, desktop, documents. All contents are permanently destroyed." } ], "id": "13_data_destruction", "title": "Data Destruction & Secure Wiping" }, { "description": "Automated updates, password policies, and system maintenance", "examples": [ { "command": "sudo health-control auto-updates-enable", "description": "Enable automatic security updates", "expectedOutput": "Automatic security updates enabled" }, { "command": "sudo health-control auto-updates-disable", "description": "Disable automatic updates", "expectedOutput": "Automatic updates disabled" }, { "command": "sudo health-control auto-updates-status", "description": "Check automatic updates status", "expectedOutput": "Auto-updates configuration status" }, { "command": "sudo health-control password-policy-enable", "description": "Enable strong password policy", "expectedOutput": "Strong password policy enforced" }, { "command": "sudo health-control password-policy-disable", "description": "Disable strong password policy", "expectedOutput": "Password policy disabled" }, { "command": "sudo health-control user-security-enable", "description": "Enable user security checks", "expectedOutput": "User security policies enabled" }, { "command": "sudo health-control 2fa-enable --value username", "description": "Enable 2FA for specific user", "expectedOutput": "Two-factor authentication enabled" }, { "command": "sudo health-control 2fa-disable", "description": "Disable 2FA for user", "expectedOutput": "Two-factor authentication disabled" }, { "command": "sudo health-control system-maintenance-enable", "description": "Enable automatic system maintenance", "expectedOutput": "System maintenance automation enabled" }, { "command": "sudo health-control package-cleanup", "description": "Clean up unnecessary packages", "expectedOutput": "System packages cleaned and optimized" }, { "command": "sudo health-control password-policy-status", "description": "Check password policy status", "expectedOutput": "Current password policy configuration" }, { "command": "sudo health-control user-security-disable", "description": "Disable user security checks", "expectedOutput": "User security policies disabled" }, { "command": "sudo health-control user-security-status", "description": "Check user security status", "expectedOutput": "User security configuration status" }, { "command": "sudo health-control 2fa-status", "description": "Check 2FA status for users", "expectedOutput": "Two-factor authentication status" }, { "command": "sudo health-control system-maintenance-disable", "description": "Disable automatic system maintenance", "expectedOutput": "System maintenance automation disabled" }, { "command": "sudo health-control system-maintenance-status", "description": "Check system maintenance status", "expectedOutput": "System maintenance configuration status" }, { "command": "sudo health-control check-and-install curl wget", "description": "Check whether packages are installed and install the missing ones", "expectedOutput": "Package check and installation results", "notes": "PACKAGES is a required, space-separated list of one or more package names." }, { "command": "sudo health-control check-and-install-do", "description": "Run the predefined check-and-install routine for required packages", "expectedOutput": "Required packages checked and installed", "notes": "Takes no arguments; installs the built-in required package set." }, { "command": "sudo health-control clear-cache --level 3", "description": "Clear system caches at the specified level", "expectedOutput": "System caches cleared", "notes": "--level accepts 1, 2 or 3 (defaults to 3, the most thorough)." }, { "command": "sudo health-control check-sudo", "description": "Diagnose whether sudo is working correctly", "expectedOutput": "Sudo health diagnostic report", "notes": "Read-only check; takes no arguments. Use fix-sudo to repair a broken sudo configuration." }, { "command": "sudo health-control fix-sudo", "description": "Repair a broken sudo configuration without requiring sudo", "expectedOutput": "Sudo configuration repaired", "notes": "Takes no arguments. Designed to recover from a misconfigured/broken sudoers state." } ], "id": "14_system_maintenance", "title": "System Maintenance & Updates" }, { "description": "System configuration and control operations", "examples": [ { "command": "sudo health-control play-sound --sound alert", "description": "Play system alert sound", "expectedOutput": "Sound played successfully" }, { "command": "sudo health-control play-sound success", "description": "Play success notification sound", "expectedOutput": "Success sound played" }, { "command": "sudo health-control play-sound warning -m mp3", "description": "Play warning sound in MP3 format", "expectedOutput": "Warning sound played in MP3" }, { "command": "sudo health-control play-sound alert --debug", "description": "Play alert sound with debug output", "expectedOutput": "Alert sound played with debug info" }, { "command": "health-control notify --message \"Security check complete\"", "description": "Send system notification", "expectedOutput": "Notification sent successfully" }, { "command": "health-control notify --message \"Hello from Kodachi\"", "description": "Send basic notification message", "expectedOutput": "Notification sent successfully" }, { "command": "health-control notify --message \"Alert\" --body \"VPN connected\"", "description": "Send notification with message body", "expectedOutput": "Detailed notification sent" }, { "command": "health-control notify --message \"Warning\" --urgency critical --duration 30", "description": "Send critical notification with 30 second duration", "expectedOutput": "Critical notification sent" }, { "command": "health-control notify --message \"Update\" --notify-icon \"/path/to/icon.png\"", "description": "Send notification with custom icon", "expectedOutput": "Notification with icon sent" } ], "id": "15_system_control", "title": "System Control & Notifications" }, { "description": "Emergency security measures with two modes: MONITORING (arm/disarm) prepares for threats, IMMEDIATE (panic/activate) executes emergency procedures", "examples": [ { "command": "sudo health-control kill-switch-arm", "description": "ARM kill switch monitoring (preparation mode)", "expectedOutput": "Kill switch ARMED - Monitoring mode active", "notes": "MONITORING MODE: Sets up automated threat detection using multiple monitoring methods:\n• NETWORK MONITORING: Uses netstat, ss, and iptables logs to detect unauthorized connections\n• FILE SYSTEM WATCHING: Monitors critical system files via inotify for unauthorized modifications\n• PROCESS MONITORING: Tracks running processes using ps/proc for suspicious behavior patterns\n• AUTH MONITORING: Watches /var/log/auth.log for failed login attempts (threshold: 5 failures)\n• SYSTEM INTEGRITY: Checks system file hashes and permissions for tampering\nDoes NOT take action until triggered - only prepares for rapid response. Auto-activates MEDIUM panic level when threats detected." }, { "command": "sudo health-control kill-switch-disarm", "description": "DISARM kill switch monitoring", "expectedOutput": "Kill switch DISARMED", "notes": "Stops monitoring mode. Use after threat has passed or false alarm." }, { "command": "sudo health-control kill-switch-status", "description": "Check if monitoring is armed/disarmed", "expectedOutput": "Shows armed status, trigger count, armed time", "notes": "READ-ONLY: Just displays current state, takes no action" }, { "command": "sudo health-control kill-switch-activate", "description": "IMMEDIATELY activate kill switch (default: medium panic)", "expectedOutput": "KILL SWITCH ACTIVATED - emergency procedures executed", "notes": "IMMEDIATE ACTION: Unlike 'arm', this executes panic NOW. Prompts for confirmation. Use --level soft/medium/hard" }, { "command": "sudo health-control panic-soft", "description": "IMMEDIATE soft panic (NO confirmation)", "expectedOutput": "Network killed, clipboard cleared (adaptive: Wayland/X11), screen locked", "notes": "INSTANT: Kill network + clear clipboard (wl-copy/xclip/xsel) + lock screen. Reversible. Good for quick privacy." }, { "command": "sudo health-control panic-medium", "description": "IMMEDIATE medium panic (requires confirmation)", "expectedOutput": "Panic mode activated after confirmation", "notes": "WITH CONFIRMATION: Kill network + clear clipboard (adaptive: wl-copy/xclip/xsel) + terminate processes + clear memory + unmount devices + lock screen (6 actions). Requires manual restart to restore." }, { "command": "sudo health-control panic-hard", "description": "IMMEDIATE hard panic (double confirmation)", "expectedOutput": "System shutdown initiated", "notes": "CRITICAL - DOUBLE CONFIRM: All medium actions + RAM wipe + IMMEDIATE shutdown (7 actions total). IRREVERSIBLE! System shuts down NOW!" }, { "command": "sudo health-control create-recovery-point", "description": "Create recovery checkpoint BEFORE panic", "expectedOutput": "Recovery point created", "notes": "Create BEFORE activating panic modes. Allows restoration of configs after emergency." }, { "command": "sudo health-control panic-recover", "description": "Restore system after panic activation", "expectedOutput": "System recovered from panic mode", "notes": "Use AFTER panic to restore normal operation. Restarts services, fixes permissions." }, { "command": "sudo health-control panic-profile --profile paranoid", "description": "Configure panic response to paranoid security level", "expectedOutput": "Panic profile set: paranoid\nActions configured: 12", "notes": "PROFILE MODES:\n• STEALTH: Light response (network blocking only, preserve user data)\n• PARANOID: Maximum security (network kill, data wipe, process termination, interface shutdown)\n• RECOVERY: System restoration (restart services, fix permissions, restore connectivity)\n\nProfile determines automatic actions when panic mode triggers. Use 'kill-switch-activate' to manually trigger the configured profile." }, { "command": "sudo health-control kill-network-interface --interface eth0", "description": "Kill specific network interface", "expectedOutput": "Network interface eth0 terminated", "notes": "Selective network isolation" }, { "command": "sudo health-control kill-process --process firefox", "description": "Terminate specific process immediately", "expectedOutput": "Process firefox terminated", "notes": "Emergency process termination" } ], "id": "16_emergency_operations", "title": "Emergency Operations - Kill Switch & Panic Modes" }, { "description": "Storage device encryption, secure wiping, LUKS encrypted containers, and volume management", "examples": [ { "command": "sudo health-control list-storage-devices", "description": "List all storage devices with safety indicators (SAFE/CAUTION/DANGER)", "expectedOutput": "Shows devices categorized by safety level for persistence operations", "notes": "Use BEFORE creating persistence to identify safe devices. Protects against accidental system drive formatting." }, { "command": "sudo health-control list-storage-devices --all", "description": "List all storage devices including loop and ram devices", "expectedOutput": "Complete device inventory with safety categorization including virtual devices" }, { "command": "sudo health-control usb-safety-check --device \"${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}\"", "description": "Check if specific device is safe for persistence operations", "expectedOutput": "Returns safety level: SAFE, CAUTION, or DANGER with detailed warnings", "notes": "Validates device before destructive operations. Prevents accidental system drive formatting." }, { "command": "sudo health-control storage-encrypt --device \"${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}\"", "description": "Encrypt storage device", "expectedOutput": "Storage device encrypted successfully", "notes": "Backup data before encryption" }, { "command": "sudo health-control storage-wipe --device \"${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}\" --passes 3", "description": "Securely wipe storage device", "expectedOutput": "Storage device wiped securely", "notes": "Data will be permanently destroyed" }, { "command": "sudo health-control container-create /secure/data.img --size 500", "description": "Create encrypted container (500MB)", "expectedOutput": "Encrypted container created successfully", "notes": "Creates LUKS2-encrypted container file. You'll be prompted for password interactively.\nContainer file path is positional argument (not --output)." }, { "command": "sudo health-control container-create /tmp/secure.img --size 100", "description": "Create small encrypted container (100MB)", "expectedOutput": "Container created: /tmp/secure.img, Size: 100 MB", "notes": "Smaller size for testing. Password will be prompted." }, { "command": "sudo health-control container-mount /secure/data.img --mount-point /mnt/secure", "description": "Mount encrypted container", "expectedOutput": "Container mounted successfully", "notes": "You'll be prompted for the container password.\nMount point will be created automatically if it doesn't exist." }, { "command": "sudo health-control container-unmount /mnt/secure", "description": "Unmount encrypted container", "expectedOutput": "Container unmounted: /mnt/secure", "notes": "Automatically closes the LUKS mapper device." }, { "command": "sudo health-control encryption-tune --profile balanced", "description": "Recommend or apply LUKS encryption tuning settings", "expectedOutput": "Encryption tuning recommendations (dry-run by default)", "notes": "--profile defaults to balanced (also performance, security). Optional --cipher, --key-size, --iter-time, --device, --benchmark. Runs as a dry-run unless --apply is given." }, { "command": "sudo health-control create-persistence-other-os --device \"${REMOVABLE_DEVICE:?Set REMOVABLE_DEVICE after reviewing lsblk output}\" --os-type kali --force", "description": "Create persistence storage for another live OS (Kali, Parrot, or Tails)", "expectedOutput": "Persistence media created for the target OS", "notes": "⚠️ --device and --os-type are required; targets/formats the given partition. --force is required for non-interactive use (dashboard/scripts/--json). Add --encrypted (optionally with --password) for LUKS." } ], "id": "17_storage_encryption", "title": "Storage Encryption & Secure Containers" }, { "description": "Security scoring and reporting", "examples": [ { "command": "sudo health-control security-score", "description": "Calculate overall security score", "expectedOutput": "Shows score (0-100), security level (Critical/Basic/Fair/Good/Excellent), and actionable fixes" }, { "command": "sudo health-control security-score --json", "description": "Get security score in JSON format", "expectedOutput": "Full JSON with category breakdowns (Core/Network/Hardening/Device/Advanced), individual check scores, and specific remediation commands" }, { "command": "sudo health-control security-report", "description": "Generate comprehensive security report", "expectedOutput": "Detailed security assessment report" }, { "command": "sudo health-control security-report --json", "description": "Generate security report in JSON format", "expectedOutput": "JSON formatted security report" }, { "command": "sudo health-control security-history --days 30", "description": "View security score history for last 30 days", "expectedOutput": "Security score trends and historical data", "notes": "Shows security improvements over time" }, { "command": "sudo health-control security-history --days 7 --json", "description": "View last 7 days security history in JSON", "expectedOutput": "JSON formatted security history" }, { "command": "sudo health-control security-remediate", "description": "Review security fixes before applying", "expectedOutput": "Security fix recommendations displayed", "notes": "Manual review mode for security fixes" }, { "command": "sudo health-control rootkit-scan-enhanced --deep", "description": "Run the enhanced rootkit scanner", "expectedOutput": "Enhanced rootkit scan results", "notes": "Add --deep to perform a thorough deep scan." }, { "command": "sudo health-control clamav-scan --path / --recursive", "description": "Scan the filesystem for malware with ClamAV", "expectedOutput": "ClamAV scan results with any detections", "notes": "--path defaults to /. Add --recursive to descend into subdirectories and --quarantine to isolate infected files." }, { "command": "sudo health-control security-profile --value balanced", "description": "Set the security profile and scoring thresholds", "expectedOutput": "Security profile set to balanced", "notes": "--value is required: minimal, balanced, or paranoid." }, { "command": "sudo health-control security-schedule --value daily", "description": "Schedule automated security assessments", "expectedOutput": "Security assessment schedule updated", "notes": "--value is required: hourly, daily, weekly, monthly, or disable." } ], "id": "18_security_assessment", "title": "Security Assessment & Scoring" }, { "description": "Hardware-level security features", "examples": [ { "command": "sudo health-control hardware-rng-verify", "description": "Verify hardware random number generator", "expectedOutput": "Hardware RNG status and quality", "notes": "Checks if hardware RNG is available and functioning properly for cryptographic operations" }, { "command": "sudo health-control entropy-status", "description": "Check system entropy status", "expectedOutput": "Entropy pool status and quality", "notes": "Monitors available entropy for secure random number generation, critical for encryption" }, { "command": "sudo health-control boot-integrity-check", "description": "Check boot integrity", "expectedOutput": "Boot integrity verification results", "notes": "Verifies boot process integrity to detect tampering or unauthorized modifications to bootloader/kernel" } ], "id": "19_hardware_security", "title": "Hardware Security" }, { "description": "System information, diagnostics, and hardware/service management", "examples": [ { "command": "sudo health-control offline-info-system", "description": "Display comprehensive system information", "expectedOutput": "Complete system details and configuration" }, { "command": "sudo health-control offline-info-hardware", "description": "Display hardware information", "expectedOutput": "Hardware components and specifications" }, { "command": "sudo health-control offline-info-hardware --json", "description": "Display hardware information in JSON", "expectedOutput": "JSON formatted hardware details" }, { "command": "sudo health-control offline-info-process", "description": "Display process information", "expectedOutput": "Running processes and resource usage" }, { "command": "sudo health-control offline-info-security", "description": "Display security configuration", "expectedOutput": "Security settings and status" }, { "command": "sudo health-control offline-info-network", "description": "Display network configuration", "expectedOutput": "Network interfaces and settings" }, { "command": "sudo health-control offline-info-user", "description": "Display user information", "expectedOutput": "User accounts and permissions" }, { "command": "sudo health-control offline-info-storage", "description": "Display storage information", "expectedOutput": "Disk usage and filesystem details" }, { "command": "sudo health-control offline-info-services", "description": "Display services information", "expectedOutput": "System services status" }, { "command": "sudo health-control offline-info-all", "description": "Display all system information", "expectedOutput": "Complete system information report" }, { "command": "sudo health-control offline-bluetooth --action check", "description": "Check Bluetooth status", "expectedOutput": "Bluetooth status: enabled/disabled" }, { "command": "sudo health-control offline-bluetooth --action enable", "description": "Enable Bluetooth service", "expectedOutput": "Bluetooth enabled successfully" }, { "command": "sudo health-control offline-bluetooth --action disable", "description": "Disable Bluetooth service", "expectedOutput": "Bluetooth disabled successfully" }, { "command": "sudo health-control offline-wifi --action check", "description": "Check WiFi status", "expectedOutput": "WiFi status: enabled/disabled" }, { "command": "sudo health-control offline-wifi --action enable", "description": "Enable WiFi service", "expectedOutput": "WiFi enabled successfully" }, { "command": "sudo health-control offline-wifi --action disable", "description": "Disable WiFi with persistent blacklisting", "expectedOutput": "WiFi disabled and blacklisted" }, { "command": "sudo health-control offline-webcam --action check", "description": "Check webcam status", "expectedOutput": "Webcam status: enabled/disabled" }, { "command": "sudo health-control offline-webcam --action enable", "description": "Enable webcam devices", "expectedOutput": "Webcam access enabled" }, { "command": "sudo health-control offline-webcam --action disable", "description": "Disable webcam devices", "expectedOutput": "Webcam access disabled" }, { "command": "sudo health-control offline-microphone --action check", "description": "Check microphone status", "expectedOutput": "Microphone status: enabled/disabled" }, { "command": "sudo health-control offline-microphone --action enable", "description": "Enable microphone devices", "expectedOutput": "Microphone access enabled" }, { "command": "sudo health-control offline-microphone --action disable", "description": "Disable microphone devices", "expectedOutput": "Microphone access disabled" }, { "command": "sudo health-control offline-screen-lock --action check", "description": "Check automatic screen lock status", "expectedOutput": "Screen lock status reported" }, { "command": "sudo health-control offline-screen-lock --action enable", "description": "Enable automatic screen lock", "expectedOutput": "Screen lock enabled" }, { "command": "sudo health-control offline-screen-lock --action disable", "description": "Disable automatic screen lock", "expectedOutput": "Screen lock disabled" }, { "command": "sudo health-control offline-systemlogs --action check", "description": "Check system logging status", "expectedOutput": "System logging status reported" }, { "command": "sudo health-control offline-systemlogs --action enable", "description": "Enable system logging", "expectedOutput": "System logging enabled" }, { "command": "sudo health-control offline-systemlogs --action disable", "description": "Disable system logging", "expectedOutput": "System logging disabled" }, { "command": "sudo health-control offline-cups --action check", "description": "Check CUPS printing service status", "expectedOutput": "CUPS status reported" }, { "command": "sudo health-control offline-cups --action enable", "description": "Enable CUPS printing service", "expectedOutput": "CUPS printing enabled" }, { "command": "sudo health-control offline-cups --action disable", "description": "Disable CUPS printing service", "expectedOutput": "CUPS printing disabled" }, { "command": "sudo health-control offline-networkmanager --action check", "description": "Check NetworkManager status", "expectedOutput": "NetworkManager status reported" }, { "command": "sudo health-control offline-networkmanager --action enable", "description": "Enable NetworkManager", "expectedOutput": "NetworkManager enabled" }, { "command": "sudo health-control offline-networkmanager --action disable", "description": "Disable NetworkManager", "expectedOutput": "NetworkManager disabled" }, { "command": "sudo health-control offline-numlock --action check", "description": "Check NumLock-on-boot status", "expectedOutput": "NumLock status reported" }, { "command": "sudo health-control offline-numlock --action enable", "description": "Enable NumLock on boot", "expectedOutput": "NumLock enabled on boot" }, { "command": "sudo health-control offline-numlock --action disable", "description": "Disable NumLock on boot", "expectedOutput": "NumLock disabled on boot" }, { "command": "sudo health-control offline-cmdhistory --action check", "description": "Check command history logging status", "expectedOutput": "Command history status reported" }, { "command": "sudo health-control offline-cmdhistory --action enable", "description": "Enable command history logging", "expectedOutput": "Command history enabled" }, { "command": "sudo health-control offline-cmdhistory --action disable", "description": "Disable command history logging", "expectedOutput": "Command history disabled" }, { "command": "sudo health-control offline-autologin --action check", "description": "Check automatic login status", "expectedOutput": "Automatic login status reported" }, { "command": "sudo health-control offline-autologin --action enable", "description": "Enable automatic login", "expectedOutput": "Automatic login enabled" }, { "command": "sudo health-control offline-autologin --action disable", "description": "Disable automatic login", "expectedOutput": "Automatic login disabled" }, { "command": "sudo health-control offline-fdlimit --action check", "description": "Check current file descriptor limits", "expectedOutput": "File descriptor limits reported" }, { "command": "sudo health-control offline-fdlimit --action enable --soft-limit 1024 --hard-limit 4096", "description": "Set file descriptor limits", "expectedOutput": "File descriptor limit set" }, { "command": "sudo health-control offline-fdlimit --action disable", "description": "Revert file descriptor limits to defaults", "expectedOutput": "File descriptor limits reverted" }, { "command": "sudo health-control offline-netoptimize --action check", "description": "Check network optimization status", "expectedOutput": "Network optimization status reported" }, { "command": "sudo health-control offline-netoptimize --action enable", "description": "Enable network optimizations", "expectedOutput": "Network optimizations enabled" }, { "command": "sudo health-control offline-netoptimize --action disable", "description": "Disable network optimizations", "expectedOutput": "Network optimizations disabled" }, { "command": "sudo health-control offline-bbr --action check", "description": "Check BBR congestion control status", "expectedOutput": "BBR status reported" }, { "command": "sudo health-control offline-bbr --action enable", "description": "Enable BBR congestion control", "expectedOutput": "BBR congestion control enabled" }, { "command": "sudo health-control offline-bbr --action disable", "description": "Disable BBR congestion control", "expectedOutput": "BBR congestion control disabled" }, { "command": "sudo health-control offline-ifspeed --action check", "description": "Check current interface speed configuration", "expectedOutput": "Interface speed reported" }, { "command": "sudo health-control offline-ifspeed --action enable --interface eth0 --speed 1000", "description": "Configure interface speed", "expectedOutput": "Interface speed configured" }, { "command": "sudo health-control offline-ifspeed --action disable --interface eth0", "description": "Revert interface speed to auto-negotiation", "expectedOutput": "Interface speed reset" }, { "command": "sudo health-control offline-avahi --action check", "description": "Check Avahi service discovery status", "expectedOutput": "Avahi status reported", "notes": "Supported services: avahi, modem-manager, ssh, apache, nginx, docker, mysql, postgresql" }, { "command": "sudo health-control offline-avahi --action enable", "description": "Enable Avahi service discovery", "expectedOutput": "Avahi service enabled" }, { "command": "sudo health-control offline-avahi --action disable", "description": "Disable Avahi service discovery", "expectedOutput": "Avahi service disabled" }, { "command": "sudo health-control offline-modem-manager --action check", "description": "Check ModemManager service status", "expectedOutput": "ModemManager status reported" }, { "command": "sudo health-control offline-modem-manager --action enable", "description": "Enable ModemManager service", "expectedOutput": "ModemManager enabled" }, { "command": "sudo health-control offline-modem-manager --action disable", "description": "Disable ModemManager service", "expectedOutput": "ModemManager disabled" }, { "command": "sudo health-control offline-ssh --action check", "description": "Check SSH service status", "expectedOutput": "SSH status reported" }, { "command": "sudo health-control offline-ssh --action enable", "description": "Enable SSH service", "expectedOutput": "SSH service enabled" }, { "command": "sudo health-control offline-ssh --action disable", "description": "Disable SSH service", "expectedOutput": "SSH service disabled" }, { "command": "sudo health-control offline-apache --action check", "description": "Check Apache web server status", "expectedOutput": "Apache status reported" }, { "command": "sudo health-control offline-apache --action enable", "description": "Enable Apache web server", "expectedOutput": "Apache web server enabled" }, { "command": "sudo health-control offline-apache --action disable", "description": "Disable Apache web server", "expectedOutput": "Apache web server disabled" }, { "command": "sudo health-control offline-nginx --action check", "description": "Check Nginx web server status", "expectedOutput": "Nginx status reported" }, { "command": "sudo health-control offline-nginx --action enable", "description": "Enable Nginx web server", "expectedOutput": "Nginx web server enabled" }, { "command": "sudo health-control offline-nginx --action disable", "description": "Disable Nginx web server", "expectedOutput": "Nginx web server disabled" }, { "command": "sudo health-control offline-docker --action check", "description": "Check Docker service status", "expectedOutput": "Docker status reported" }, { "command": "sudo health-control offline-docker --action enable", "description": "Enable Docker service", "expectedOutput": "Docker service enabled" }, { "command": "sudo health-control offline-docker --action disable", "description": "Disable Docker service", "expectedOutput": "Docker service disabled" }, { "command": "sudo health-control offline-mysql --action check", "description": "Check MySQL database service status", "expectedOutput": "MySQL status reported" }, { "command": "sudo health-control offline-mysql --action enable", "description": "Enable MySQL database service", "expectedOutput": "MySQL service enabled" }, { "command": "sudo health-control offline-mysql --action disable", "description": "Disable MySQL database service", "expectedOutput": "MySQL service disabled" }, { "command": "sudo health-control offline-postgresql --action check", "description": "Check PostgreSQL database service status", "expectedOutput": "PostgreSQL status reported" }, { "command": "sudo health-control offline-postgresql --action enable", "description": "Enable PostgreSQL database service", "expectedOutput": "PostgreSQL service enabled" }, { "command": "sudo health-control offline-postgresql --action disable", "description": "Disable PostgreSQL database service", "expectedOutput": "PostgreSQL service disabled" }, { "command": "sudo health-control offline-usb-storage --action enable", "description": "Enable USB storage devices", "expectedOutput": "USB storage access enabled" }, { "command": "sudo health-control offline-usb-storage --action disable", "description": "Disable USB storage devices", "expectedOutput": "USB storage access blocked" }, { "command": "sudo health-control ping", "description": "Lightweight connectivity ping helper (used by conky panels)", "expectedOutput": "Ping reachability result", "notes": "Takes no arguments. Fast helper for status panels." }, { "command": "sudo health-control process-age --process tor", "description": "Report how long a tracked process has been running", "expectedOutput": "Process age/uptime for the requested service", "notes": "--process is required and must be 'vpn' or 'tor'." } ], "id": "20_system_info_offline", "title": "System Information & Offline Actions" }, { "description": "Generate secure passwords using multiple methods with batch support (auto-detects installed packages)", "examples": [ { "command": "sudo health-control genpass", "description": "Generate one password using all three methods", "expectedOutput": "Three passwords (pass, pwgen, xkcdpass)", "notes": "Automatically uses system packages if available, falls back to native implementations" }, { "command": "sudo health-control genpass --method pwgen --count 10", "description": "Generate 10 random passwords using pwgen method", "expectedOutput": "10 random passwords", "notes": "Use --count for batch generation; max 1000 per method" }, { "command": "sudo health-control genpass --method xkcdpass --count 50", "description": "Generate 50 memorable XKCD-style passphrases", "expectedOutput": "50 word-based passphrases", "notes": "XKCD method creates memorable multi-word passwords" }, { "command": "sudo health-control genpass --count 90", "description": "Generate 90 passwords from each method (270 total)", "expectedOutput": "270 passwords (90 from each of the 3 methods)", "notes": "When using --count without --method, generates specified count from ALL methods" }, { "command": "sudo health-control genpass --method pwgen --count 20 --length 32 --symbols \"@-_!#$\"", "description": "Generate 20 custom passwords with specific length and symbols", "expectedOutput": "20 passwords with 32 characters including specified symbols", "notes": "Customize password generation with --length and --symbols options" }, { "command": "sudo health-control genpass --uppercase --digits --count 15", "description": "Generate 15 passwords with only uppercase letters and digits", "expectedOutput": "15 alphanumeric passwords (uppercase + digits only)" }, { "command": "sudo health-control genpass --count 100 --json", "description": "Generate 100 passwords from each method in JSON format", "expectedOutput": "JSON array with 300 passwords", "notes": "JSON output ideal for scripting and automation" }, { "command": "sudo health-control genpass --force-native --count 25", "description": "Force use of native Rust implementations (skip package detection)", "expectedOutput": "25 passwords from each method using native fallbacks", "notes": "Useful for testing or when system packages are unreliable" } ], "id": "21_password_generation", "title": "Password Generation" }, { "description": "Automatic RAM wiping on shutdown with multiple policies (custom, sdmem, both, auto), installation, configuration, testing, and cold boot attack defenses", "examples": [ { "command": "# WORKFLOW: Setting up RAM wipe on shutdown", "description": "Complete workflow for first-time RAM wipe setup", "expectedOutput": "Step-by-step guide", "notes": "STEP 1: Install hooks (REQUIRED FIRST): sudo health-control wipe-ram-install\nSTEP 2: Configure policy (OPTIONAL): sudo health-control wipe-ram-config --policy sdmem\nSTEP 3: Enable if disabled: sudo health-control ram-wipe-enable\nSTEP 4: Verify status: sudo health-control ram-wipe-status\n\nKEY DIFFERENCES:\n• wipe-ram-install = FIRST-TIME SETUP (installs systemd shutdown hooks)\n• ram-wipe-enable = ENABLE/DISABLE (turns functionality on/off, hooks must exist)\n• wipe-ram-config = UPDATE SETTINGS (change policy, passes, time budget)\n• wipe-ram = MANUAL EXECUTION (test or emergency wipe NOW, not on shutdown)" }, { "command": "sudo health-control wipe-ram-install", "description": "Install RAM wipe system with default settings (kodachi-wiper policy, 60s timeout)", "expectedOutput": "RAM wipe system installed successfully", "notes": "FIRST-TIME SETUP - Installs systemd hooks, configures policies, detects Kicksecure compatibility. Creates /etc/kodachi-ram-wipe.conf with defaults" }, { "command": "sudo health-control wipe-ram-install --policy kodachi-wiper --time 60", "description": "Install RAM wipe with kodachi-wiper policy and 60 second time budget", "expectedOutput": "Installed with kodachi-wiper policy", "notes": "Fastest installation - Single-pass wipe, suitable for systems with <8GB RAM or frequent reboots" }, { "command": "sudo health-control wipe-ram-install --policy sdmem --passes 3", "description": "Install RAM wipe with sdmem policy using 3 overwrite passes", "expectedOutput": "Installed with sdmem 3-pass policy", "notes": "SECURE INSTALLATION - 3 passes (random, zeros, random). Good balance of security and speed. Recommended for 8-16GB RAM systems" }, { "command": "sudo health-control wipe-ram-install --policy both --split 60", "description": "Install with both policies: 60% time for kodachi-wiper, 40% for sdmem", "expectedOutput": "Installed with dual-policy split", "notes": "HYBRID APPROACH - Time-split between kodachi-wiper (fast) and sdmem (thorough). Example: 120s budget = 72s kodachi-wiper + 48s sdmem. Maximum security coverage" }, { "command": "sudo health-control wipe-ram-install --force", "description": "Force installation even if Kicksecure/Whonix RAM wipe detected", "expectedOutput": "Force installed, Kicksecure overridden", "notes": "OVERRIDE MODE - Bypasses Kicksecure detection. Use when you want Kodachi's RAM wipe instead of Kicksecure's built-in wipe. May cause conflicts" }, { "command": "sudo health-control ram-wipe-status", "description": "Check RAM wipe configuration and current status", "expectedOutput": "RAM wipe status with memory info and auto-wipe settings", "notes": "Shows: enabled/disabled state, current policy (kodachi-wiper/sdmem/both/auto), time budget, sdmem passes, total RAM size, Kicksecure detection" }, { "command": "sudo health-control ram-wipe-status --json", "description": "RAM wipe status in JSON format for automation", "expectedOutput": "JSON formatted status with all configuration details", "notes": "JSON OUTPUT DEMO - Shows all config fields in machine-readable format for scripts and monitoring systems" }, { "command": "sudo health-control wipe-ram-config --policy auto", "description": "Update existing RAM wipe policy to auto-detection", "expectedOutput": "Policy updated to auto" }, { "command": "sudo health-control wipe-ram-config --passes 5 --split 70", "description": "Update sdmem passes to 5 and time split to 70/30", "expectedOutput": "Multiple parameters updated", "notes": "PASS COUNT - More passes = more thorough but slower. 1-3=fast, 4-6=balanced, 7-9=maximum. SPLIT - Higher kodachi-wiper%=speed, higher sdmem%=security" }, { "command": "sudo health-control ram-wipe-enable", "description": "Enable RAM wipe configuration (hooks must be installed first)", "expectedOutput": "RAM wipe configuration enabled + WARNING if hooks not installed", "notes": "IMPORTANT: This only enables the CONFIG. You must run 'wipe-ram-install' FIRST to install systemd hooks. Will show clear warning if hooks are missing." }, { "command": "sudo health-control ram-wipe-disable", "description": "Disable automatic RAM wiping", "expectedOutput": "RAM wipe disabled successfully", "notes": "WARNING - Disabling RAM wipe leaves sensitive data in RAM accessible to physical attacks" }, { "command": "sudo health-control wipe-ram-test", "description": "Test RAM wipe system with dry-run (no actual wiping)", "expectedOutput": "RAM wipe test completed successfully", "notes": "SAFE TESTING - Simulates wipe operation without actually overwriting memory. Tests configuration, timing, and policy execution. Use before first real wipe" }, { "command": "sudo health-control wipe-ram-test --policy kodachi-wiper --time 10", "description": "Test kodachi-wiper policy with 10 second time budget", "expectedOutput": "Kodachi-wiper policy test completed in 10s", "notes": "Quick test - Validates kodachi-wiper policy works correctly. 10s budget ensures fast test completion" }, { "command": "sudo health-control wipe-ram-test --json", "description": "Test RAM wipe with detailed JSON diagnostic metrics", "expectedOutput": "JSON test results with performance data", "notes": "DIAGNOSTIC OUTPUT - Returns timing, memory stats, policy execution details, and potential issues. Essential for troubleshooting" }, { "command": "sudo health-control wipe-ram", "description": "Execute RAM wipe operation manually with configured policy", "expectedOutput": "RAM wiped successfully", "notes": "ADVANCED - Manually trigger RAM wipe using system configuration. Automatically called by shutdown hooks. Use for testing or emergency wipe" }, { "command": "sudo health-control wipe-ram --shutdown-mode", "description": "Execute RAM wipe optimized for shutdown context", "expectedOutput": "RAM wiped in shutdown mode", "notes": "INTERNAL USE - Shutdown-optimized mode disables unnecessary checks and output. Used by systemd shutdown hooks" }, { "command": "sudo health-control wipe-ram --policy kodachi-wiper", "description": "Execute RAM wipe using kodachi-wiper overwrite policy", "expectedOutput": "RAM wiped with kodachi-wiper policy", "notes": "POLICY: Kodachi-wiper fast overwrite algorithm - Single pass with random data. Fastest but least thorough (60-120 seconds for 8GB)" }, { "command": "sudo health-control wipe-ram --policy sdmem", "description": "Execute RAM wipe using sdmem utility (multiple passes)", "expectedOutput": "RAM wiped with sdmem", "notes": "POLICY: sdmem (secure-delete memory) - Multiple passes with patterns. Slower but more thorough (3-7 passes configurable). Government-grade erasure" }, { "command": "sudo health-control wipe-ram --policy both", "description": "Execute RAM wipe using both kodachi-wiper AND sdmem sequentially", "expectedOutput": "RAM wiped with combined policy", "notes": "POLICY: Maximum security - Kodachi-wiper FIRST (fast pass), then sdmem (thorough passes). Best security but longest time. Recommended for high-security environments" }, { "command": "sudo health-control wipe-ram --policy auto", "description": "Execute RAM wipe with automatic policy selection based on available RAM", "expectedOutput": "RAM wiped with auto-detected policy", "notes": "POLICY: Auto-detection - Chooses policy based on RAM size and available time: <4GB=kodachi-wiper, 4-16GB=both, >16GB=sdmem. Balances speed and security" }, { "command": "sudo health-control wipe-ram --time 120", "description": "Execute RAM wipe with 120 second time budget", "expectedOutput": "RAM wiped within time limit", "notes": "TIME BUDGET - Maximum seconds allowed for wipe operation. System will shutdown/reboot when time expires even if wipe incomplete. Critical for automated shutdowns" }, { "command": "sudo health-control ram-wipe-detect-kicksecure", "description": "Detect if Kicksecure/Whonix RAM wipe is installed", "expectedOutput": "Kicksecure detection results", "notes": "COMPATIBILITY CHECK - Detects Kicksecure's ram-wipe-on-boot package. Prevents conflicts between Kodachi and Kicksecure RAM wipe systems" }, { "command": "sudo health-control ram-wipe-update --policy auto --time 150", "description": "Update RAM wipe policy to auto with 150 second time budget", "expectedOutput": "Policy and time budget updated", "notes": "SMART MODE - System automatically selects best policy based on: RAM size, shutdown urgency, battery status (laptops). Recommended for most users" }, { "command": "sudo health-control coldboot-defense-enable", "description": "Enable cold boot attack defense mechanisms", "expectedOutput": "Cold boot defense enabled", "notes": "PHYSICAL SECURITY - Protects against cold boot attacks that recover encryption keys from RAM after power loss. Enables: RAM overwriting on shutdown, memory scrambling, DMA protection" }, { "command": "sudo health-control coldboot-defense-disable", "description": "Disable cold boot attack defense", "expectedOutput": "Cold boot defense disabled", "notes": "WARNING - Disabling leaves encryption keys vulnerable to physical RAM extraction attacks. Only disable if you have alternative physical security" }, { "command": "sudo health-control coldboot-defense-status", "description": "Show current cold boot attack defense status", "expectedOutput": "Cold boot defense status (enabled/disabled) and configuration", "notes": "READ-ONLY: Takes no arguments. Reports the active cold boot protection state." }, { "command": "sudo health-control ram-wipe", "description": "⚠️ Wipe system RAM contents immediately", "expectedOutput": "RAM wipe executed", "notes": "⚠️ DANGEROUS: Overwrites memory contents and takes no arguments. Use ram-wipe-enable/-disable to manage the on-shutdown policy instead." } ], "id": "22_ram_wipe_cold_boot", "title": "RAM Wipe & Cold Boot Protection" }, { "description": "Swap space enable/disable, configuration, encryption with dm-crypt, and performance tuning with swappiness and cache pressure settings", "examples": [ { "command": "sudo health-control swap-enable", "description": "Enable and activate swap space for memory overflow", "expectedOutput": "Swap enabled successfully", "notes": "STABILITY FEATURE - Activates swap partitions/files for memory overflow. Improves system stability under memory pressure but may leak sensitive data to disk" }, { "command": "sudo health-control swap-disable", "description": "Disable and deactivate all swap space", "expectedOutput": "Swap disabled successfully", "notes": "SECURITY FEATURE - Deactivates all swap to prevent disk leakage of sensitive data. May cause out-of-memory errors if RAM insufficient" }, { "command": "sudo health-control swap-status", "description": "Check swap status, devices, size, and usage", "expectedOutput": "Swap devices list with usage statistics", "notes": "Shows: active swap devices, total/used/available size, swap usage percentage, encryption status, swappiness value" }, { "command": "sudo health-control swap-configure --swappiness 10 --cache-pressure 100", "description": "Configure swap parameters for optimal performance", "expectedOutput": "Swap parameters configured", "notes": "PERFORMANCE TUNING - Swappiness (0-100): 0=never swap, 10=minimal, 60=default, 100=aggressive. Cache pressure controls VFS cache retention (default 100)" }, { "command": "sudo health-control swap-encrypt", "description": "Encrypt swap with random key generated on each boot", "expectedOutput": "Swap space encrypted", "notes": "ENCRYPTION SECURITY - Uses dm-crypt with random key per boot. Protects swapped memory from offline disk forensics. Slight performance impact (~5-10%)" }, { "command": "sudo health-control swap-decrypt", "description": "Remove swap encryption and revert to plain swap", "expectedOutput": "Swap decrypted", "notes": "WARNING - Removes encryption protection. Swapped data will be readable from disk in clear text. Only use if encryption causes performance issues" }, { "command": "sudo health-control swap-encrypt-status", "description": "Check swap encryption status and configuration", "expectedOutput": "Encryption status with cipher details", "notes": "Shows: encryption enabled/disabled, cipher type (aes-xts-plain64), key size, whether using random keys, encrypted device mapper name" }, { "command": "sudo health-control enable-swap", "description": "Enable swap (alternative command alias)", "expectedOutput": "Swap enabled" }, { "command": "sudo health-control disable-swap", "description": "Disable swap (alternative command alias)", "expectedOutput": "Swap disabled" } ], "id": "23_swap_management", "title": "Swap Management & Encryption" }, { "description": "Memory usage statistics, cache cleaning, and memory optimization without data loss", "examples": [ { "command": "sudo health-control memory-stats", "description": "Show current memory usage statistics (total, available, used, cached)", "expectedOutput": "Memory usage breakdown with utilization percentages" }, { "command": "sudo health-control memory-stats --json-human", "description": "Memory statistics in human-readable JSON format", "expectedOutput": "Pretty-printed JSON with human-readable sizes (MB/GB)", "notes": "JSON OUTPUT DEMO - Use --json for compact machine-readable format, --json-human for readable format with color and formatting" }, { "command": "sudo health-control memory-clean", "description": "Clean memory caches and buffers (pagecache, dentries, inodes)", "expectedOutput": "Memory cleaned successfully", "notes": "Safe operation - drops caches but does NOT kill processes. Improves available memory without data loss" }, { "command": "sudo health-control memory-force-clean", "description": "Force aggressive memory cleanup (sync + drop_caches=3)", "expectedOutput": "Memory force cleaned", "notes": "ADVANCED - Kills top memory-consuming process + aggressive cache drop. Use with caution in production" } ], "id": "24_memory_stats_cleanup", "title": "Memory Statistics & Cleanup" }, { "description": "Secure process memory wiping before termination and per-process memory limits using cgroups for browsers and applications", "examples": [ { "command": "sudo health-control memory-wipe", "description": "Securely wipe memory contents (anti-forensics)", "expectedOutput": "Memory wiped securely", "notes": "SECURITY FEATURE - Overwrites memory with random data to prevent forensic recovery. Used for sensitive operations" }, { "command": "sudo health-control memory-wipe-process --value firefox", "description": "Securely wipe Firefox process memory before termination", "expectedOutput": "Firefox process memory wiped successfully", "notes": "PRIVACY PROTECTION - Clears sensitive data (passwords, session keys, browsing history) from process memory before kill" }, { "command": "sudo health-control memory-wipe-process --value chrome", "description": "Securely wipe Chrome browser memory", "expectedOutput": "Chrome process memory wiped successfully", "notes": "Clears authentication tokens, cached passwords, and browsing data from Chrome's memory space" }, { "command": "sudo health-control memory-wipe-process --value thunderbird", "description": "Securely wipe Thunderbird email client memory", "expectedOutput": "Thunderbird process memory wiped successfully", "notes": "Erases email content, credentials, and encryption keys from email client memory" }, { "command": "sudo health-control memory-wipe-process --value tor-browser", "description": "Securely wipe Tor Browser memory", "expectedOutput": "Tor Browser process memory wiped successfully", "notes": "Clears Tor circuit keys, browsing session data, and cached .onion addresses from memory" }, { "command": "sudo health-control memory-limits --value firefox --limit 2048", "description": "Set Firefox memory limit to 2048 MB using cgroups", "expectedOutput": "Firefox memory limit set to 2048 MB", "notes": "RESOURCE CONTROL - Uses Linux cgroups to enforce hard memory limits per process. Prevents single process from consuming excessive memory. Process killed if limit exceeded" }, { "command": "sudo health-control memory-limits --value chrome --limit 1024", "description": "Set Chrome memory limit to 1024 MB", "expectedOutput": "Chrome memory limit set to 1024 MB", "notes": "Chrome often consumes excessive memory. Limiting prevents system slowdown. Note: Limit applies to total browser memory across all processes" }, { "command": "sudo health-control memory-limits --value tor-browser --limit 1536", "description": "Set Tor Browser memory limit to 1536 MB", "expectedOutput": "Tor Browser memory limit set to 1536 MB", "notes": "Tor Browser requires more memory than standard browsers due to Tor circuit management and enhanced security features. 1536MB recommended minimum" }, { "command": "sudo health-control memory-limits --list", "description": "List all configured memory limits and their current usage", "expectedOutput": "Table of processes with memory limits and usage", "notes": "Shows: process name, configured limit, current memory usage, limit utilization percentage, cgroup path, status (active/inactive)" } ], "id": "25_process_memory_security", "title": "Process Memory Security" }, { "description": "Hardware keyboard shortcuts for emergency operations via kodachi-session-helper daemon. All commands use LOCAL session tokens (no online auth required). Works fully offline. Session token is read automatically from $XDG_RUNTIME_DIR/kodachi-session-helper/session.token", "examples": [ { "command": "sudo health-control emergency-trigger --plan dashboard --dry-run", "description": "Dry-run dashboard nuke to test without executing destructive actions", "expectedOutput": "DRY RUN: Would execute plan 'dashboard' - no changes made", "notes": "SAFE TESTING - Validates session token and plan without executing. Use for testing shortcut configuration and daemon integration. Session token read from $XDG_RUNTIME_DIR/kodachi-session-helper/session.token" }, { "command": "sudo health-control emergency-trigger --plan dashboard", "description": "Trigger dashboard nuke via emergency shortcut (wipe dashboard data, logs, configs)", "expectedOutput": "Emergency plan 'dashboard' executed successfully", "notes": "KEYBOARD: The session helper uses the shortcut currently configured in the dashboard. Hold the approved combo for roughly 2-3 seconds. The global trigger is silent and does not reopen the dashboard UI." }, { "command": "sudo health-control emergency-trigger --plan luks --device \"${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}\"", "description": "Trigger LUKS nuke via emergency shortcut (destroy encrypted partition headers)", "expectedOutput": "Emergency plan 'luks' executed successfully", "notes": "KEYBOARD: Uses the dashboard-configured approved combo. Hold it for roughly 2-3 seconds. IRREVERSIBLE - destroys LUKS headers making encrypted data unrecoverable. --device is required for luks and both plans." }, { "command": "sudo health-control emergency-trigger --plan both --device \"${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}\"", "description": "Trigger full nuke (dashboard + LUKS combined) via emergency shortcut", "expectedOutput": "Emergency plan 'both' executed successfully", "notes": "KEYBOARD: Uses the dashboard-configured approved combo and should be held for roughly 2-3 seconds. Combines dashboard-nuke and luks-nuke for maximum data destruction. IRREVERSIBLE." }, { "command": "sudo health-control emergency-trigger --plan dashboard --json", "description": "Trigger emergency action with JSON output for automation", "expectedOutput": "JSON result with plan, success status, execution time, and details", "notes": "JSON output includes: plan name, success status, execution duration, affected components. Useful for logging and monitoring." }, { "command": "sudo health-control emergency-trigger --plan luks --device \"${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}\" --dry-run --json", "description": "Dry-run LUKS nuke with JSON output for pre-flight validation", "expectedOutput": "JSON dry-run result showing planned actions without executing", "notes": "Combines --dry-run and --json for safe testing with machine-readable output. Ideal for dashboard integration testing." }, { "command": "sudo health-control emergency-trigger --plan both --device \"${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}\" --force --silent", "description": "Force-trigger full nuke silently (skip readiness checks, suppress output)", "expectedOutput": "(no stdout output - silent mode)", "notes": "DAEMON MODE - Used by kodachi-session-helper daemon. --force skips readiness checks, --silent suppresses stdout. For automated invocation only." }, { "command": "sudo health-control emergency-lockdown --delay 300 --plan dashboard --dry-run", "description": "Dry-run a 5-minute delayed lockdown for dashboard nuke", "expectedOutput": "DRY RUN: Would start 300s countdown for plan 'dashboard'", "notes": "SAFE TESTING - Preview lockdown without starting timer. Validates parameters and session token." }, { "command": "sudo health-control emergency-lockdown --delay 300 --plan dashboard", "description": "Start a 5-minute delayed lockdown that triggers dashboard nuke", "expectedOutput": "Lockdown started: plan 'dashboard' in 300 seconds", "notes": "DELAYED LOCKDOWN - Schedules emergency action after countdown. User can cancel before timer expires with emergency-lockdown-cancel. Useful for dead-man-switch scenarios." }, { "command": "sudo health-control emergency-lockdown --delay 60 --plan luks --device \"${LUKS_DEVICE:?Set LUKS_DEVICE from health-control luks-detect output}\"", "description": "Start a 1-minute delayed lockdown for LUKS nuke", "expectedOutput": "Lockdown started for the selected LUKS device with a 60-second countdown", "notes": "SHORT TIMER - 60 second countdown before LUKS header destruction. Cancel with emergency-lockdown-cancel if needed." }, { "command": "sudo health-control emergency-lockdown-status", "description": "Check if a delayed lockdown is currently active and its remaining time", "expectedOutput": "Lockdown active: plan 'dashboard', 247 seconds remaining", "notes": "READ-ONLY - No session token required. Shows: active status, scheduled plan, remaining seconds, start time. Returns 'No active lockdown' if none pending." }, { "command": "sudo health-control emergency-lockdown-status --json", "description": "Check lockdown status in JSON format for dashboard integration", "expectedOutput": "JSON with active, plan, device, delay_seconds, remaining_seconds, started_at, expires_at", "notes": "JSON output for dashboard polling and monitoring systems. No authentication required for status checks." }, { "command": "sudo health-control emergency-lockdown-cancel", "description": "Cancel an active delayed lockdown before it triggers", "expectedOutput": "Lockdown cancelled successfully", "notes": "Cancels pending lockdown and kills the timer process. Requires valid session token. Returns error if no lockdown is active." }, { "command": "sudo health-control emergency-lockdown-cancel --json", "description": "Cancel lockdown with JSON confirmation output", "expectedOutput": "JSON confirmation with cancelled plan details and timestamp", "notes": "Machine-readable cancellation confirmation for dashboard integration." } ], "id": "26_emergency_shortcuts", "title": "Emergency Shortcuts - Keyboard-Triggered Actions" }, { "description": "Conky, screensaver, DPMS, and session power controls", "examples": [ { "command": "health-control conky-enable", "description": "Start Conky widget", "expectedOutput": "Conky enabled. Running: yes" }, { "command": "health-control conky-disable", "description": "Stop Conky widget", "expectedOutput": "Conky disabled. Running: no" }, { "command": "health-control conky-status --json", "description": "Conky status as JSON", "expectedOutput": "JSON with installed, running, start_on_boot, service_available, autostart_enabled fields" }, { "command": "health-control conky-boot-enable", "description": "Enable Conky autostart on boot", "expectedOutput": "Conky boot enabled. Start on boot: true" }, { "command": "health-control conky-boot-disable", "description": "Disable Conky autostart", "expectedOutput": "Conky boot disabled. Start on boot: false" }, { "command": "health-control screensaver-disable", "description": "Disable XFCE screensaver", "expectedOutput": "Screensaver disabled. Running: no" }, { "command": "health-control screensaver-enable", "description": "Re-enable screensaver", "expectedOutput": "Screensaver enabled. Running: yes" }, { "command": "health-control screensaver-status --json", "description": "Check screensaver state", "expectedOutput": "JSON with screensaver_running, screensaver_autostart_enabled, screensaver_binary_available" }, { "command": "health-control dpms-disable", "description": "Keep display always on", "expectedOutput": "DPMS disabled. Display will stay on." }, { "command": "health-control dpms-enable", "description": "Restore display power saving", "expectedOutput": "DPMS enabled. Display power management active." }, { "command": "health-control dpms-status --json", "description": "Check DPMS timeouts", "expectedOutput": "JSON with dpms_enabled, standby_seconds, suspend_seconds, off_seconds, blanking fields" }, { "command": "health-control lock-screen", "description": "Lock screen immediately", "expectedOutput": "Screen locked via loginctl", "notes": "Multi-fallback: loginctl > xdg-screensaver > xflock4" }, { "command": "health-control session-logout", "description": "End XFCE session", "expectedOutput": "Session logout initiated via xfce4-session-logout", "notes": "Fallback: loginctl terminate-user" }, { "command": "health-control suspend", "description": "Suspend to RAM", "expectedOutput": "Suspend initiated via xfce4-session-logout", "notes": "Fallback: systemctl suspend" }, { "command": "health-control conky-mask-enable", "description": "Mask sensitive info in Conky panels for safe screenshots", "expectedOutput": "Privacy masking enabled. Conky panels will show masked data." }, { "command": "health-control conky-mask-disable", "description": "Unmask Conky panels to show real data", "expectedOutput": "Privacy masking disabled. Conky panels will show real data." }, { "command": "health-control conky-mask-status", "description": "Check if Conky privacy masking is active", "expectedOutput": "Privacy masking: disabled" } ], "id": "30_display_power", "title": "Display & Power" } ], "description": "Usage examples for health-control", "name": "health-control", "quickReference": [ "sudo health-control --help", "sudo health-control --version", "sudo health-control --info --json", "sudo health-control --examples --json" ] }, "errors": [], "metadata": { "executionTime": 18, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-11T19:39:01.095294078Z", "version": "9.8.4 (build 320)", "warnings": [] } } }