Tukzedo Linux

Tukzedo Linux brings stronger security, more security convenience, and filesystem modernisation to the Linux desktop: full-disk encryption with ZFS as the root filesystem, unlocked at boot by USB key or remotely over SSH, booting straight to a signed Unified Kernel Image with no intermediate bootloader carrying drivers of its own.

None of the individual features are new, and many have appeared in other distributions. They have simply never all been in one system at the same time.

It is not yet a distribution of its own - that is the longer goal. Today it is a complete, idiomatic build recipe against Debian stable, put together so that major upgrades still work the way the parent distribution intends. It suits headless servers too, where individual machine-level physical security matters more than datacentre security; there, the desktop stack comes out with a single command.

Highlights

• Full-disk encryption with ZFS as the root filesystem, throughout.
• Boot-time unlock by USB thumbdrive key, or remotely over SSH when there is no key to hand.
• Boots directly to the real, final kernel via a signed Unified Kernel Image, with no intermediate bootloader.
• Secure Boot capable, with signed EFI binaries, and no dependence on a TPM.
• Optional per-user home-folder encryption and secure hibernation on top.