drconopoima

Signing VirtualBox Kernel Modules

These are the steps I followed enable VirtualBox on my laptop without disabling UEFI Secure Boot. They're nearly identical to the process described on [Øyvind Stegard's blog][blog], save for a few key details. The images here are borrowed from the [Systemtap UEFI Secure Boot Wiki][systemtap].

1. Install the VirtualBox package (this might be different for your platform).

   src='https://download.virtualbox.org/virtualbox/rpm/fedora/virtualbox.repo'

drconopoima

What's Cool

• Encrypted root partition
  • AES-256 bit cipher
  • Argon2id variant for PBKDF
  • Sha3-512 bit hash
• rEFInd bootloader
  • With dreary theme
  • Optimal Settings (optimized for aesthetics, and boot time)
• Boot into backups thanks to refind-btrfs

drconopoima

#!/usr/bin/env bash

wget --no-check-certificate https://github.com/teddysun/across/raw/master/bbr.sh && chmod +x bbr.sh && ./bbr.sh


## Add sysctl config
echo 'fs.file-max = 51200
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.core.netdev_max_backlog = 250000

drconopoima

language: rust
cache: cargo
rust:
  - stable
before_cache: |
  cargo install cargo-tarpaulin
before_script:
- rustup component add rustfmt
- rustup component add clippy
- cargo install cargo-audit

drconopoima

version: 2
jobs:
  build-and-test:
    docker:
      - image: circleci/rust
    environment:
      # Fail the build if there are warnings
      RUSTFLAGS: '-D warnings'
    steps:
      - checkout

drconopoima

name: Security audit
on:
  push:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
jobs:
  security_audit:
    runs-on: ubuntu-latest
    steps:

drconopoima

image: "rust:latest"

default:
  before_script:
    - rustc --version 
    - cargo --version

stages:
  - test

drconopoima

#!/bin/bash
mkdir ~/SSLCA/root/
cd ~/SSLCA/root/
openssl genrsa -aes256 -out rootca.key 2048
openssl req -sha256 -new -x509 -days 1826 -key rootca.key -out rootca.crt
touch certindex
echo 1000 > certserial
echo 1000 > crlnumber
echo '
[ ca ]

drconopoima

# OpenSSL Root CA configuration file
# Copy to /root/ca/openssl_root.cnf

[ ca ]
default_ca = CA_default

[ CA_default ]
# Directory and file locations.
dir               = /root/ca
certs             = $dir/certs

drconopoima

Create your CA database to keep track of signed certificates

$ mkdir private certs cnf csr crl
$ touch index.txt
$ echo 1000 > serial

Create Your OpenSSL Config File