CustomOS3.1 OBSIDIAN
System posture
Sample values — on CustomOS this panel reads the running system; nothing here is live.
Firewall
nftables active
inbound default-deny · always on
Kill switch
Not armed
arms when a wg*/tun* tunnel is up
IDS
Suricata · IDS
installed by default · detection, not blocking
Live medium
dm-verity
squashfs verified at boot · fail-closed
Disk
LUKS2 unlocked
argon2id · TPM2 sealing opt-in
Boot chain
Secure Boot
shim → GRUB → kernel (installed, amd64)
- AppArmor
- not read in this demo
- auditd
- immutable rules (-e 2)
- AIDE
- baseline and daily check on a default install
auditd privileged command executed (audited)
nft inbound packet dropped by the default-deny policy
aide integrity check: changes against the baseline are reported
suricata IDS rules loaded (local rules, plus managed rules if opted in)
login interactive session started (lightdm)
updater manifest signature (Ed25519, TUF) and anti-rollback checked before any update
journalctl -b · auth →
--:--
your browser's local time
CustomOS demo shell — type help to list commands.
Sandbox: no real system access, no persistence. Try security, customos-ai, customos-chat or an attack such as rm -rf /.
demo@customos:~$
Tor
In the image · masked until you opt in
WireGuard
wg-quick installed · no peer configured
SSH server
Masked — not opted in · port 22 closed
Kill switch
Not armed · arms when wg*/tun* is up
Toggles are read-only status. Control from Terminal: customos-netsvc tor · ssh.
Press F2 for firmware SETUP · F12 boot menu · hold Shift for GRUB (password protected)
CUSTOMOS-3.1-OBSIDIAN · bit-for-bit reproducible build (verified on two runs)
[ OK ] shim → GRUB → linux kernel (Secure Boot, installed system, amd64)
[ OK ] LUKS2 cryptroot unlocked (passphrase; TPM2 sealing is opt-in)
[ OK ] AppArmor · auditd · nftables · Suricata IDS
[ .. ] customos-firstboot: TPM anti-rollback anchor · AIDE first-boot baseline
Console output stays in English, as on the real OS.