gandalf/secubox-deb
0
1
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 15:28:24 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Add Multiboot Live OS announcement and documentation 

- Add v2.2.3 announcement banner on Home page
- Create Multiboot.md with full multiboot documentation
- Update sidebar with Multiboot and Eye Remote links
- Version bump to v2.2.3

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
CyberMind-FR 2026-04-27 11:36:43 +02:00
parent 619e46024f
commit 1404d99551
3 changed files with 366 additions and 158 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

208
Home.md

@ -1,175 +1,149 @@
# SecuBox OS # SecuBox
**CyberMind · Gondwana · Notre-Dame-du-Cruet · Savoie** | [FR](Home-FR) | [中文](Home-ZH) **CyberMind · Gondwana · Notre-Dame-du-Cruet · Savoie** | [FR](Home-FR) | [中文](Home-ZH)
**SecuBox OS** — Appliance de cybersécurité complète portée depuis OpenWrt vers Debian bookworm. Complete security appliance solution ported from OpenWrt to Debian bookworm. Designed for GlobalScale ARM64 boards (MOCHAbin, ESPRESSObin) and x86_64 systems. **125 packages** with **2000+ API endpoints**.
Conçue pour boards ARM64 GlobalScale (MOCHAbin, ESPRESSObin) et systèmes x86_64.
**125 modules · 2000+ endpoints API · Candidat ANSSI CSPN**
--- ---
## Qu'est-ce que SecuBox OS ? > **NEW v2.2.3 — Multi-Boot Live OS with Eye Remote Integration**
>
SecuBox OS est un système d'exploitation durci orienté sécurité réseau : > Dual-architecture bootable image (ARM64 + AMD64) with RAM-based execution and shared persistent storage. Boot from USB or use Pi Zero Eye Remote as USB gadget to boot ESPRESSObin/MOCHAbin.
>
| Fonction | Description | > **Features:**
|----------|-------------| > - Boot any ARM64 (U-Boot) or AMD64 (UEFI) system from one USB stick
| **Firewall** | nftables DEFAULT DROP, règles automatiques | > - Pi Zero presents multiboot image as USB storage for ESPRESSObin boot
| **IDS/IPS** | CrowdSec + Suricata, threat intelligence temps réel | > - RAM-based live execution — minimal I/O, perfect for USB gadgets
| **WAF** | HAProxy + mitmproxy, 300+ règles ModSecurity | > - Shared data partition accessible from both architectures
| **VPN** | WireGuard natif, mesh P2P | >
| **DPI** | nDPId + netifyd, analyse trafic L7 | > See [[Multiboot]] for documentation | [Download v2.2.3](https://github.com/CyberMind-FR/secubox-deb/releases/tag/multiboot-v2.2.3)
| **DNS** | Unbound Vortex, blocklists automatiques |
--- ---
## 🔴 BOOT — Démarrage rapide ## 🔴 BOOT — Quick Start
### VirtualBox (Recommandé) ### VirtualBox (2 Minutes) ⭐
Test SecuBox instantly in VirtualBox — no USB drive needed:
```bash
# Download latest image
wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz
gunzip secubox-live-amd64-bookworm.img.gz
# Convert to VDI format
VBoxManage convertfromraw secubox-live-amd64-bookworm.img secubox-live.vdi --format VDI
# Create and start VM
curl -sLO https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/image/create-vbox-vm.sh
chmod +x create-vbox-vm.sh
./create-vbox-vm.sh secubox-live.vdi
```
**One-liner with auto-download:**
```bash ```bash
# One-liner avec téléchargement auto
curl -sL https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/image/create-vbox-vm.sh | bash -s -- --download curl -sL https://raw.githubusercontent.com/CyberMind-FR/secubox-deb/master/image/create-vbox-vm.sh | bash -s -- --download
``` ```
Voir [[Live-USB-VirtualBox]] pour les détails. See [[Live-USB-VirtualBox]] for full documentation.
### Live USB ### Live USB (Hardware) ⚡
Boot directly from USB on physical hardware:
```bash ```bash
wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz wget https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-live-amd64-bookworm.img.gz
zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress zcat secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
``` ```
Voir [[Live-USB]] pour le guide complet. See [[Live-USB]] for complete guide.
### Installation APT ### APT Installation (Existing Debian)
```bash ```bash
curl -fsSL https://apt.secubox.in/install.sh | sudo bash curl -fsSL https://apt.secubox.in/install.sh | sudo bash
sudo apt install secubox-full sudo apt install secubox-full # or secubox-lite
``` ```
--- See [[Installation]] for detailed instructions.
## 🟠 AUTH — Accès
| Service | Utilisateur | Mot de passe | Port |
|---------|-------------|--------------|------|
| Web UI | admin | secubox | 9443 |
| SSH | root | secubox | 2222 |
--- ---
## 🟢 ROOT — Matériel supporté ## 🟠 AUTH — Access Credentials
### ARM64 (Production) | Service | Username | Password |
|---------|----------|----------|
| Board | SoC | Profil | Usage | | **Web UI** | admin | secubox |
|-------|-----|--------|-------| | **SSH** | root | secubox |
| MOCHAbin | Armada 7040 | Full | Entreprise, datacenter | | **Access** | https://localhost:9443 | SSH port 2222 |
| ESPRESSObin v7 | Armada 3720 | Lite | PME, agences |
| ESPRESSObin Ultra | Armada 3720 | Lite+ | PME étendu |
### x86_64 (Dev/Test)
| Plateforme | Profil | Usage |
|------------|--------|-------|
| VirtualBox | Full | Développement |
| QEMU/KVM | Full | Test/CI |
| Bare metal | Full | Production x86 |
--- ---
## 🟣 MIND — Stack modulaire ## 🟢 ROOT — System Requirements
SecuBox OS est organisé en 6 stacks fonctionnelles : | Board | SoC | Profile | Use Case |
|-------|-----|---------|----------|
| MOCHAbin | Armada 7040 | Full | Enterprise Gateway |
| ESPRESSObin v7 | Armada 3720 | Lite | Home/SMB Router |
| ESPRESSObin Ultra | Armada 3720 | Lite+ | Home with Wi-Fi |
| Raspberry Pi 400 | BCM2711 | Full | Maker Projects |
| VM x86_64 | Any | Full | Testing/Development |
| QEMU ARM64 | Emulated | Full | ARM testing on x86 |
| Stack | Code couleur | Modules clés | ---
|-------|--------------|--------------|
| 🟠 **AUTH** | Orange | auth, portal, nac, users |
| 🟡 **WALL** | Jaune | crowdsec, waf, ipblock, threats |
| 🔴 **BOOT** | Rouge | cloner, vault, vm, backup |
| 🟣 **MIND** | Violet | dpi, ai-insights, netdata |
| 🟢 **ROOT** | Vert | core, hub, system, admin |
| 🔵 **MESH** | Bleu | wireguard, haproxy, qos, mesh |
Voir [[Modules]] pour les 125 modules. ## 🟣 MIND — Feature Overview
| Stack | Description | Modules |
|-------|-------------|---------|
| 🟠 **AUTH** | Authentication, ZeroTrust, MFA | auth, portal, users, nac |
| 🟡 **WALL** | Firewall, CrowdSec, WAF, IDS/IPS | crowdsec, waf, threats, ipblock |
| 🔴 **BOOT** | Deployment, provisioning | cloner, vault, vm, rezapp |
| 🟣 **MIND** | AI, behavioral analysis, DPI | dpi, netifyd, ai-insights, soc |
| 🟢 **ROOT** | System, CLI, hardening | core, hub, system, console |
| 🔵 **MESH** | Network, WireGuard, QoS | wireguard, haproxy, netmodes, turn |
**Total: 125 packages**
See [[MODULES-EN|Modules]] for complete module documentation.
--- ---
## 🔵 MESH — Documentation ## 🔵 MESH — Documentation
### Démarrage ### Getting Started
- [[Live-USB-VirtualBox|VirtualBox]] - [[Live-USB-VirtualBox|VirtualBox Quick Start]] ⭐
- [[Live-USB|USB Boot]] - [[Live-USB]] — Bootable USB guide
- [[ARM-Installation|Boards ARM]] - [[ARM-Installation]] — ARM boards & U-Boot ⚡
- [[QEMU-ARM64|Émulation QEMU]] - [[QEMU-ARM64]] — ARM emulation on x86 🖥️
### Configuration ### Configuration
- [[Configuration]] - [[Configuration]] — System configuration
- [[Configuration-Advanced]] - [[Troubleshooting]] — Common issues
- [[Troubleshooting]]
### Architecture ### Reference
- [[Architecture-Boot|Couches de boot]] - [[MODULES-EN|Modules]] — All 125 modules
- [[Architecture-Modules|Design modulaire]] - [[API-Reference]] — REST API (2000+ endpoints)
- [[Architecture-Security|Modèle de sécurité]]
### Développement
- [[Developer-Guide]]
- [[Design-System|UI/UX]]
- [[API-Reference]]
--- ---
## 🟡 WALL — Sécurité ## 🟡 WALL — Security Features
### Firewall & IDS - **CrowdSec** — Community-driven IDS/IPS
- **nftables** — DEFAULT DROP, règles dynamiques - **WAF** — 300+ ModSecurity rules
- **CrowdSec** — IDS communautaire, bouncer automatique - **nftables** — Default DROP policy
- **Suricata** — Signatures ET Open - **AI-Insights** — ML threat detection
- **IPBlock** — Automated blocklist management
### WAF & Inspection - **MAC-Guard** — MAC address control
- **HAProxy** — TLS 1.3, load balancing
- **mitmproxy** — Inspection HTTPS transparente
- **300+ règles** — OWASP ModSecurity CRS
### AI & Threat Intel
- **AI-Insights** — Détection ML anomalies
- **Threat feeds** — AbuseIPDB, Emerging Threats
- **Geo-blocking** — Blocage par pays
--- ---
## Addons ## Links
### 👁️ Eye Remote (Addon) - [GitHub Repository](https://github.com/CyberMind-FR/secubox-deb)
Dashboard USB gadget compact pour monitoring SecuBox.
| Composant | Description |
|-----------|-------------|
| Hardware | Pi Zero W + HyperPixel 2.1 Round (480×480) |
| Connexion | USB OTG (10.55.0.0/30) ou WiFi |
| Modes | Normal, Flash, Debug, TTY, Auth |
**Documentation :** [[Eye-Remote|Eye Remote Addon]]
```bash
# Build image Pi Zero W
cd remote-ui/round
sudo ./build-eye-remote-image.sh -i raspios-lite.img.xz
```
---
## Liens
- [GitHub](https://github.com/CyberMind-FR/secubox-deb)
- [Releases](https://github.com/CyberMind-FR/secubox-deb/releases) - [Releases](https://github.com/CyberMind-FR/secubox-deb/releases)
- [APT Repository](https://apt.secubox.in) - [Issues](https://github.com/CyberMind-FR/secubox-deb/issues)
- [CyberMind](https://cybermind.fr) - [CyberMind](https://cybermind.fr)
--- ---

253
Multiboot.md Normal file

@ -0,0 +1,253 @@
# Multi-Boot Live OS
**SecuBox v2.2.3** — Dual-architecture bootable live system with RAM-based execution.
---
## Overview
Multi-architecture bootable live operating system supporting both ARM64 (U-Boot) and AMD64 (UEFI) systems from a single image. Designed for:
- **Live Demo/Recovery** — Boot from USB for demonstrations, repair, or factory reset
- **Pi Zero Eye Remote** — USB mass storage gadget presenting bootable image to MOCHAbin/ESPRESSObin
- **Portable Installation** — Boot on any ARM64 or AMD64 system with persistent data
### Supported Architectures
| Architecture | Boot Method | Target Boards |
|--------------|-------------|---------------|
| **ARM64** | U-Boot | ESPRESSObin, MOCHAbin, Armada boards |
| **AMD64** | UEFI GRUB | Any x86_64 PC, laptop, server |
| **Shared** | — | Cross-architecture persistent storage |
---
## Use Cases
### 1. Eye Remote USB Boot (Pi Zero W)
The Pi Zero runs Eye Remote firmware and presents the multiboot image as USB mass storage. ESPRESSObin/MOCHAbin boots directly from the USB storage.
```
┌─────────────┐ USB OTG ┌─────────────────┐
│ Pi Zero W │◄────────────────►│ ESPRESSObin │
│ Eye Remote │ mass_storage │ U-Boot │
│ (32GB uSD) │ 16GB multiboot │ boots from USB │
└─────────────┘ └─────────────────┘
```
**Setup:**
1. Flash Eye Remote image to SD card (32GB recommended)
2. Copy multiboot image to `/var/lib/secubox/eye-remote/storage.img`
3. Connect Pi Zero to ESPRESSObin via USB OTG
4. ESPRESSObin U-Boot detects USB storage and boots SecuBox
### 2. Direct USB Boot
Flash multiboot image to USB stick, boot any ARM64/AMD64 system directly.
```bash
# Flash to USB drive
xzcat secubox-multiboot-2.2.3.img.xz | sudo dd of=/dev/sdX bs=4M status=progress
```
### 3. Demo/Recovery Mode
Pre-configured SecuBox environment for:
- Live demonstrations to customers
- System recovery and repair
- Factory reset and cloning
- Installation to eMMC/NVMe
---
## Partition Layout
| Part | Type | Size | Mount | Purpose |
|------|------|------|-------|---------|
| 1 | EFI (FAT32) | 512MB | /boot/efi | UEFI + U-Boot boot files |
| 2 | ext4 | 3GB | / (ARM64) | SecuBox ARM64 live rootfs |
| 3 | ext4 | 3GB | / (AMD64) | SecuBox AMD64 live rootfs |
| 4 | ext4 | 8GB+ | /srv/data | Shared application data |
### Boot Files (Partition 1)
```
/boot/efi/
├── EFI/
│ └── BOOT/
│ ├── BOOTX64.EFI # GRUB for AMD64
│ └── grub.cfg # GRUB config
├── Image # ARM64 kernel
├── initrd.img # ARM64 initramfs
├── dtbs/ # ARM64 device trees
├── boot.scr # U-Boot script (ARM64)
├── grub/
│ └── grub.cfg # GRUB config (AMD64)
├── vmlinuz # AMD64 kernel
├── initrd-amd64.img # AMD64 initramfs
└── flash/
└── secubox-emmc.img.gz # eMMC flasher image
```
---
## Boot Flow
### ARM64 (ESPRESSObin/MOCHAbin)
1. U-Boot loads `boot.scr` from partition 1
2. Kernel + initrd from partition 1
3. Rootfs from partition 2
4. Mounts partition 4 as /srv/data
5. Bind-mounts shared paths
### AMD64 (UEFI)
1. UEFI loads GRUB from EFI/BOOT/BOOTX64.EFI
2. GRUB loads vmlinuz + initrd from partition 1
3. Rootfs from partition 3
4. Mounts partition 4 as /srv/data
5. Bind-mounts shared paths
---
## Shared Data Structure
```
/srv/data/
├── etc/
│ └── secubox/ # Shared configs
│ ├── api.toml
│ ├── users.json
│ ├── tls/
│ └── modules/
├── var/
│ └── lib/
│ └── secubox/ # Application state
│ ├── crowdsec/
│ ├── haproxy/
│ ├── wireguard/
│ └── dpi/
├── srv/
│ └── secubox/ # Service data
│ ├── mitmproxy/
│ ├── nginx/
│ └── certs/
└── log/
└── secubox/ # Shared logs
```
---
## Building
### Build Multiboot Image
```bash
# Build complete multi-boot image (16GB default)
sudo ./image/multiboot/build-multiboot.sh --size 16G --output secubox-multiboot.img
# With desktop environment
sudo ./image/multiboot/build-multiboot.sh --size 32G --desktop --output secubox-multiboot-desktop.img
```
### GitHub Actions CI
Automated builds via `.github/workflows/build-multiboot.yml`:
- Configurable image sizes (8/16/32GB)
- Optional desktop environment
- Automatic release publishing on tags
---
## Eye Remote Integration
### Preparing SD Card for Pi Zero
```bash
# 1. Flash Eye Remote base image
sudo dd if=output/secubox-eye-remote-*.img of=/dev/sdX bs=4M status=progress
# 2. Expand root partition to fill card
sudo parted /dev/sdX resizepart 2 100%
sudo resize2fs /dev/sdXp2
# 3. Copy multiboot image as storage
sudo mount /dev/sdXp2 /mnt
sudo cp output/secubox-multiboot.img /mnt/var/lib/secubox/eye-remote/storage.img
sudo umount /mnt
```
### Gadget Configuration
The USB mass_storage gadget presents `/var/lib/secubox/eye-remote/storage.img` to the connected host. ESPRESSObin U-Boot detects it as a USB drive and boots from it.
---
## Flash to eMMC
From either architecture:
```bash
secubox-flash-emmc # Interactive installer
# Or manual:
gunzip -c /boot/efi/flash/secubox-emmc.img.gz | dd of=/dev/mmcblk0 bs=4M status=progress
```
---
## Default Credentials
| Service | Username | Password |
|---------|----------|----------|
| Web UI | admin | secubox |
| SSH | root | secubox |
| User | secubox | secubox |
---
## Troubleshooting
### Not Booting from Eye Remote
1. Check storage.img exists: `ls -lh /var/lib/secubox/eye-remote/storage.img`
2. Verify gadget status: `systemctl status secubox-eye-gadget`
3. Check USB connection: `dmesg | grep usb`
### ESPRESSObin U-Boot Commands
```
usb start
usb dev 0
ls usb 0:1
load usb 0:1 $loadaddr boot.scr
source $loadaddr
```
### AMD64 Not Booting
1. Verify UEFI boot mode (not Legacy/CSM)
2. Check Secure Boot is disabled
3. Select USB drive in boot menu (F12/F2/ESC)
---
## Downloads
- [Latest Release](https://github.com/CyberMind-FR/secubox-deb/releases/latest)
- [v2.2.3 Multiboot](https://github.com/CyberMind-FR/secubox-deb/releases/tag/multiboot-v2.2.3)
---
## Version History
| Version | Changes |
|---------|---------|
| **v2.2.3** | GitHub Actions CI, Eye Remote integration, wiki docs |
| **v2.2.2** | Initial multiboot system with ARM64 + AMD64 support |
---
*See also: [[Eye-Remote]] | [[ARM-Installation]] | [[Live-USB]]*

63
_Sidebar.md

@ -1,49 +1,30 @@
**[SecuBox OS](Home)** · [FR](Home-FR) · [中文](Home-ZH) **[SecuBox](Home)** | [FR](Home-FR) | [DE](Home-DE) | [中文](Home-ZH) | **v2.2.3**
--- ### 🔴 BOOT — Getting Started
* [[Multiboot|Multi-Boot Live OS]] ⭐ **NEW**
## SecuBox OS * [[Live-USB-VirtualBox|VirtualBox]] `run-vbox.sh`
* [[Live-USB-QEMU|QEMU]] 🖥️ `run-qemu.sh`
### 🔴 BOOT — Démarrage * [[Live-USB]] | [FR](Live-USB-FR) | [DE](Live-USB-DE) | [中文](Live-USB-ZH)
* [[Home|Overview]] * [[Installation]] | [FR](Installation-FR) | [DE](Installation-DE) | [中文](Installation-ZH)
* [[Live-USB-VirtualBox|VirtualBox]] * [[ARM-Installation|ARM / U-Boot]] | [FR](ARM-Installation-FR) | [DE](ARM-Installation-DE) | [中文](ARM-Installation-ZH) ⚡
* [[Live-USB|USB Boot]] * [[ESPRESSObin]] | [FR](ESPRESSObin-FR) | [DE](ESPRESSObin-DE) | [中文](ESPRESSObin-ZH)
* [[Installation|APT Install]] * [[Eye-Remote|Eye Remote (Pi Zero)]] 📡
* [[ARM-Installation|Boards ARM]] * [[QEMU-ARM64]] 🖥️
### 🟢 ROOT — Configuration ### 🟢 ROOT — Configuration
* [[Configuration]] * [[Configuration]] | [FR](Configuration-FR) | [DE](Configuration-DE) | [中文](Configuration-ZH)
* [[Configuration-Advanced]] * [[Troubleshooting]] | [FR](Troubleshooting-FR) | [DE](Troubleshooting-DE) | [中文](Troubleshooting-ZH)
* [[Troubleshooting]]
### 🟣 MIND — Architecture ### 🟣 MIND — Modules
* [[Architecture-Boot|Boot Layers]] * [[MODULES-EN|Modules]] 🇬🇧
* [[Architecture-Modules|Modules]] * [[MODULES-FR|Modules FR]] 🇫🇷
* [[Architecture-Security|Security]] * [[MODULES-DE|Modules DE]] 🇩🇪
* [[MODULES-ZH|Modules 中文]] 🇨🇳
### 🟡 WALL — Modules ### 🔵 MESH — Reference
* [[Modules|All Modules (125)]] * [[API-Reference]] | [FR](API-Reference-FR) | [DE](API-Reference-DE) | [中文](API-Reference-ZH)
* [[Modules-Security]] * [[UI-COMPARISON|UI Comparison]]
* [[Modules-Networking]]
### 🔵 MESH — Dev
* [[Developer-Guide]]
* [[Design-System]]
* [[API-Reference]]
---
## Addons
### 👁️ Eye Remote
* [[Eye-Remote|Overview]]
* [[Eye-Remote-Hardware|Hardware]]
* [[Eye-Remote-Implementation|Implementation]]
* [[Eye-Remote-Bootstrap|Boot Media]]
---
### Links ### Links
* [GitHub](https://github.com/CyberMind-FR/secubox-deb)
* [Releases](https://github.com/CyberMind-FR/secubox-deb/releases) * [Releases](https://github.com/CyberMind-FR/secubox-deb/releases)
* [CyberMind](https://cybermind.fr) * [Issues](https://github.com/CyberMind-FR/secubox-deb/issues)