SedirOS

SedirOS 1.1based on Debian 13 trixiefree and open source

Hardened Debian for servers. And it tells you when that changes.

SedirOS is based on Debian and comes with secure defaults from the first boot: a firewall, key-only SSH, AppArmor and an encrypted disk you can unlock over SSH. Every day it checks that the hardening is still in place and reports when something got worse.

Download the ISO Try it in a VM

For amd64 and arm64 with UEFI. Apache-2.0 licensed.

Terminal: sudo sediros-audit on an installed SedirOS system, every check passed: kernel settings, SSH, firewall, AppArmor, accounts, updates, disk encryption and Secure Boot

Features

Everything a server needs to start safe, nothing it does not

SedirOS adds a few packages to Debian; it does not replace it. Your Debian knowledge, documentation and packages still apply.

Hardened by default

Kernel and network hardening, AppArmor, a firewall that denies incoming traffic, key-only SSH with modern cryptography, fewer setuid programs, automatic security updates.

A daily audit

sediros-audit checks every day that the hardening is still in place, names the file that changed a setting, and reports by e-mail, webhook or Prometheus when something got worse.

Encrypted, unlockable remotely

The installer encrypts the disk and can let you unlock it over SSH at boot, for servers you cannot reach physically. sediros unlock does it in one command.

Plain Debian underneath

The same packages, the same security updates from Debian's security team, the same apt. SedirOS's own packages come from a signed repository that cannot replace Debian's.

Many servers, one table

sediros fleet shows the hardening state of all your servers over SSH, and fails when one needs attention, so it fits in cron or CI.

Fast VMs on your Mac

sediros launch starts a SedirOS VM on macOS (Apple Silicon) or Linux in a few seconds: for testing, development, or to try SedirOS before installing it.

How it protects a server

Three layers, in order of importance

No single setting makes a server safe. SedirOS combines Debian's fixes, a smaller attack surface, and a check that both stay in place.

Updates

Debian's security team fixes the bugs; SedirOS installs their fixes automatically every day. When a fixed kernel needs a reboot, SedirOS says so at login.

A smaller attack surface

The hardening turns off what servers do not need, so bugs in that code cannot be reached, including bugs nobody has found yet.

Checking that it stays so

Installed software, updates and people change settings. The daily audit notices, and tells you instead of silently reverting.

An example: CVE-2026-98432

A critical remote use-after-free in the Linux kernel's IPv4 TCP connection setup. The fix is Debian's kernel 6.12.113 or later, which SedirOS images ship and installed systems get through updates.

Until a server reboots into it, SedirOS's defaults already block the network path to the bug: IPv4 TCP packets carrying IP options are dropped before they reach the TCP code, and the two other ways in are turned off.

A closer look

Simple to install, quick to try

An installer that asks only what matters

Disk, hostname, admin user, your SSH key (paste it, or fetch it with gh:<user>), and the disk passphrase. Every answer is checked before anything is written, and the installation takes under a minute.

  • Full disk encryption (LUKS2), Secure Boot can stay on
  • Optional unlock over SSH at boot
  • Every question has a flag, for automated installs
Terminal: the SedirOS installer asks for disk, hostname, keyboard layout, user, SSH key and passphrase, then shows its install plan

A throwaway SedirOS VM in seconds

The sediros CLI runs SedirOS VMs with QEMU on macOS and Linux. Each VM has its own copy-on-write disk, so a fresh system is one command away.

  • SSH, file transfer, port forwarding and snapshots built in
  • Images are checked against the release's checksums
  • The VM's SSH port listens on 127.0.0.1 only
Terminal: sediros launch dev starts a SedirOS VM in about four seconds

Get started

Two ways to use SedirOS

Install it as the operating system of a server, or try it in a VM on your own machine. The two are independent.

Install on a server, PC or VM

Needs a 64-bit machine that boots with UEFI and 8 GiB of disk.

  1. Download the ISO for your machine and check its SHA-256.
  2. Boot it from a USB stick or as a VM's CD drive, in UEFI mode.
  3. Run sudo sediros-install install and answer the questions.
  4. Reboot, enter the disk passphrase, log in over SSH.
Download SedirOS 1.1

Try it on macOS or Linux

With Homebrew, which also installs QEMU:

$ brew tap sediros/sediros https://github.com/sediros/sediros
$ brew trust sediros/sediros
$ brew install sediros
$ sediros pull          # download the VM image
$ sediros launch dev
$ sediros shell dev
Linux without Homebrew
Which ISO to download
Your machineISO
PC or server with Intel or AMD, or a VM on one (VirtualBox, VMware, Proxmox, Hyper-V, QEMU/KVM)sediros-1.1-install-amd64.iso
Mac with Apple Silicon (VM in UTM, Parallels, VMware Fusion), or an ARM serversediros-1.1-install-arm64.iso

FAQ

Frequently asked questions

Is SedirOS a fork of Debian?

No, it is a Debian derivative. It uses Debian's packages unchanged and adds a few of its own: the hardening, the installer, the daily audit and a login greeting. This is a deliberate choice: security fixes come straight from Debian's security team, and SedirOS does not rebuild or delay them. SedirOS 1 follows Debian 13 (trixie); SedirOS 2 will follow Debian 14.

How do I get updates? Do I need to reinstall?

No reinstall. Debian's security updates install automatically every day, and SedirOS's own packages come through its signed apt repository with the same apt. New ISOs are only for new installations.

Can a compromised SedirOS repository replace Debian packages?

No. apt is pinned so that only packages named sediros-* are taken from the SedirOS repository; any other package from it is ignored. Even with a stolen signing key, Debian's packages cannot be replaced.

Is the firewall on by default?

Yes, from the first boot. It denies every incoming connection except SSH, and even SSH is rate-limited, so repeated connection attempts are slowed down. Outgoing connections are allowed. A service you install stays unreachable from the network until you open its port, for example sudo ufw allow 443/tcp: only what you open on purpose is exposed.

Can I use SedirOS as a desktop?

No. SedirOS has no graphical desktop: it is made for servers and is managed over SSH or the console. It installs on a PC as well, for example as a home server. For a desktop, use Debian itself.

What else should I do to keep a server safe?

SedirOS sets up a solid base; the software you run on it is up to you. Three habits are enough: reboot when an update brings a new kernel, configure the services you install with strong passwords and only the ports they need, and get the daily audit’s reports by e-mail or webhook. The audit reports a change but never reverts it, since it may have been made on purpose.

Is it ready for production?

SedirOS is a young volunteer project: 1.0 was released in November 2026. Every release is installed and tested automatically in VMs with Secure Boot, and on Apple Silicon by hand. Physical hardware has not been tested yet; reports are welcome.

How do I report a security problem?

Privately, through GitHub's vulnerability reporting, as described in the security policy. Please do not open a public issue for it.

Start with a safer server

Download the ISO, or follow the project on GitHub to see what comes next.

Download SedirOS 1.1 Star on GitHub