// docs

Commands

RedderOS's own commands live in /usr/local/sbin/. If anything on this page does not match what you see on your system, what the system does is the reference: let us know so we can fix it.

redder-status

A summary of the system's privacy status. It is what the "RedderOS status" desktop shortcut opens.

redder-status

Each line is marked ✔ or ✘. It checks:

Check	Correct if…
Tor	The `tor` service is active.
Firewall	The `inet redder` table is loaded (without root: the `nftables` service is active).
sysctl	`kernel.kptr_restrict = 2` and `kernel.yama.ptrace_scope = 2`.
Lockdown	The kernel booted with `lockdown=confidentiality`.
AppArmor	Profiles are loaded (without root: the module and the service are active).
IPv6	It is disabled in the kernel.
Root	`/` is `overlay` or `tmpfs`, meaning it lives in RAM.
Swap	No swap is active.
MAC	Every network interface has a random MAC address, not the factory one.

It exits with code 0 if everything is fine and 1 if anything fails, so it can be used in scripts.

redder-wipe

Wipes memory and shuts down, to make a cold boot attack harder.

redder-wipe

Drops the kernel caches.
Overwrites free RAM with sdmem (from secure-delete).
Shuts the computer down.

It needs root, but it works in any session: it relaunches itself with sudo, and a rule in /etc/sudoers.d/redderos-wipe lets every user run it without a password, only with no arguments. It is the only thing that can be run as root without the administrator boot entry.

redder-profile

Manages encrypted profiles. It needs root. Concepts and warnings are in Profiles.

redder-profile init   <disco>
redder-profile create <disco> <nombre> [hueco]
redder-profile open   <nombre>
redder-profile close  <nombre>
redder-profile status
redder-profile disks

Subcommand	What it does
`init`	Turns the disk (`<disco>`) into a vault by filling it with random data. Erases all its contents. Asks you to type `SÍ`.
`create`	Creates a profile in the given slot (`<hueco>`, 0–7) or a random one, and opens it. Overwrites that slot.
`open`	Asks for the passphrase and searches every candidate disk for the profile. If found, mounts it at `/home/<nombre>`.
`close`	Ends the user's processes, unmounts their `/home`, closes the encryption and deletes the user from the system.
`status`	Lists open profiles and the space they use, or reports that the session is amnesic.
`disks`	Lists the disks that can hold a vault, with size and model (used by the login screen).

With no arguments, it shows the help.

The passphrase is read from the terminal without echo. If input is not a terminal, it is read from a single line of stdin; this is how the login screen and the self-test use it. With REDDER_YES=1 the init and create confirmations are skipped: use it only in scripts.

Messages

Message	Meaning
`No se ha podido abrir el perfil.`	Non-existent name or wrong passphrase. It is the same on purpose.
`Ese perfil ya existe`	The vault already has a profile with that name and passphrase.
`La frase debe tener al menos 12 caracteres`	The passphrase is too short (minimum 12 characters).
`Disco demasiado pequeño (mínimo 257 MiB)`	The disk is too small for 8 slots of 32 MiB (minimum 257 MiB).

Internal commands

The system uses these itself; there is no need to run them by hand.

Command	What it does
`redder-login`	Login on the text console (`tty1` and serial port): asks for a name and passphrase or opens the amnesic session.
`redder-greeter-loop`	Starts the graphical login screen, launches the desktop and, on logout, closes the profile.
`redder-admin-mode`	On every boot, grants or removes `sudo` for `anon` depending on `redderos.admin=1`.
`redder-selftest`	Boot self-test (only with `redderos.selftest=1`). See Self-test.