§1Overview & Core Tenets
RoamSwitch Server Edition is a headless, resident autonomous network security and integrity protection suite purpose-built for Linux server infrastructures across cloud providers (AWS, GCP, Azure, bare-metal VPS) and on-premises data centers.
Unlike client workstation editions focused on mobility and Wi-Fi perimeter adaptation, the Server Edition is founded on five uncompromising tenets: Inbound Default Drop, Critical Path File Integrity Monitoring (FIM), Preemptive Kernel LPE & Privilege Escalation Hardening, eBPF Runtime Threat Telemetry, and Autonomous Air-Gap Host Isolation with Pre-severance Emergency Alerts.
Built with a strict Zero Telemetry guarantee, the software contains zero external HTTP/TLS analytics or tracking libraries. All administrative secrets and tokens are cryptographically secured under strict 0600 permissions.
1.1 Comparison: Client Edition vs. Server Edition
| Dimension | Client Edition (Desktop/Mobile) | Server Edition (Headless/Infrastructure) |
|---|---|---|
| Deployment | Laptops, mobile developer workstations | Cloud VMs, bare-metal nodes, container hosts |
| Network Behavior | Dynamic profile switching based on Wi-Fi SSID / Gateway MAC | Static Inbound Default Drop. Only explicitly allowed ports are exposed |
| User Interface | GTK3 Desktop GUI + Tray indicator | Pure Headless CUI. CLI commands + Interactive wizard |
| Incident Notifications | Desktop notifications (libnotify) | Direct push to Telegram Bot, LINE Messaging API, and Webhooks (Slack/Discord) |
| Primary Defenses | Public Wi-Fi ARP spoofing, BadUSB, ransomware document encryption | External reconnaissance drop, FIM tampering detection, container escapes, kernel LPE (CVE-2026-53362) |
1.2 Core Architectural Principles
- Zero Telemetry: The software never transmits telemetry, metrics, or telemetry to external servers. External network calls occur strictly for user-configured incident alerts via subprocess
curlexecution. By default it carries no external communication library. The one exception: only if the operator explicitly opts in tocve_kernel_map_updates_enabled(default false) doesroamswitch-updateranonymously fetch the container-isolation kernel CVE database from lafine.net once a day. - Inbound Default Drop: Inbound packets not destined for an explicitly declared service port or the administrative SSH maintenance port are discarded at the
nftableskernel level without generating ICMP RST packets. - Fail-Closed Autonomous Containment: Emergency Air-Gap rules survive daemon restarts and process crashes. If external actors attempt to flush nftables tables, the daemon detects the drift and restores isolation within seconds.
- 0600 Cryptographic Secret Protection:
/etc/roamswitch/server.confenforces strict0600permissions (readable only by root) upon creation and every update.
§2Threat Landscape & Adversary Model
Modern internet-facing servers confront relentless automated scanning, container breakout vectors, and zero-day kernel privilege escalations.
- Automated Reconnaissance & DB Exposure: Internet-wide scanners locating unintentionally exposed internal database ports (MySQL 3306, Redis 6379, Postgres 5432).
- Critical Path Tampering & Backdoor Insertion: Intruders establishing persistence by modifying core authentication binaries (
/bin/login,/usr/bin/sudo,/etc/pam.d/*,/etc/shadow). - Kernel Privilege Escalation (CVE-2026-53362 Frag Gap): Unprivileged attackers weaponizing user namespaces (
unshare -U -r) to trigger kernel memory corruption and escalate to root. - Container Socket Breakout: Misconfigured containers with mounted
/var/run/docker.sockor--privilegedflags executing root actions on the host OS. - Process Memory Snooping: Attackers attaching
ptraceor reading/proc/$pid/memacross processes to extract private keys or credentials.
§3System Architecture
RoamSwitch Server Edition operates as native Rust binaries designed for minimal memory and zero CPU overhead.
┌─────────────────────────────────────────────────────────────┐
│ User & administrator space │
│ │
│ roamswitch (CLI) roamswitch-mcp (AI Agent) │
│ · server status (30-item) · security audit tool suite │
│ · server config / setup · stdio JSON-RPC │
│ · fim verify / update │
│ │ │ │
└───────┼───────────────────────────────────┼─────────────────┘
│ (CLI commands & config apply) │ (stdio)
┌───────▼───────────────────────────────────▼─────────────────┐
│ System foundation (systemd + root privilege) │
│ │
│ roamswitch-server-daemon │
│ ├── CriticalPathFim (SHA-256 background sweep) │
│ ├── eBPF / Falco integration module │
│ ├── Notifier (instant Telegram / LINE / Webhook alerts) │
│ └── Air-Gap Controller (deploys nftables emergency rules) │
│ │
│ Config: /etc/roamswitch/server.conf (permission 0600) │
│ Integrity DB: /var/lib/roamswitch/fim_baseline.db │
└─────────────────────────────────────────────────────────────┘
§4Core Defense Mechanisms
4.1 Boundary Security (Inbound Default Drop)
nftables applies policy drop on inbound traffic, permitting established connections, loopback, and explicitly configured ssh_ports and allowed_ports.
Preservation of SSH management ports prevents accidental operator lockout during emergency Air-Gap states.
4.2 Critical Path File Integrity Monitoring (FIM)
Monitors 150+ critical OS authentication and administrative files (/bin/login, /usr/sbin/sshd, /etc/pam.d/*, etc.). Calculates SHA-256 hashes against /var/lib/roamswitch/fim_baseline.db. Package manager hook /etc/apt/apt.conf.d/99roamswitch-fim automatically updates the baseline following authorized apt upgrade operations.
4.3 Kernel & Container Hardening
Frag Gap (CVE-2026-53362) Mitigation: Enforces user.max_user_namespaces = 0 via sysctl, neutralizing LPE vectors. Yama LSM Protection enforces kernel.yama.ptrace_scope = 2, preventing unauthorized memory inspection. Container workloads are audited for docker.sock exposure.
Docker's published ports (-p) are known to bypass the host's standard firewall, so protect_docker_ports=true (default) permanently inserts inspection rules into the DOCKER-USER chain, blocking any external traffic that isn't explicitly permitted. In addition, an always-on guard watches docker events in real time and immediately notifies you when a --privileged container starts or /var/run/docker.sock is bind-mounted — a container-escape risk (no configuration needed; notify-only, no automatic blocking). For hosts that handle files for others — a mail relay, a shared folder — an optional File Scan Guard (embedded YARA plus optional ClamAV) provides periodic scanning and automatic quarantine.
4.4 eBPF Runtime Threat Telemetry & Anti-Bloat Tuning
Utilizes Modern eBPF (CO-RE / BTF) probes to intercept privilege escalation and container breakout attempts in milliseconds. To eliminate the standard pain points of Falco—log bloat, disk exhaustion, and CPU overhead—RoamSwitch standardizes an optimized profile (/etc/falco/config.d/99-roamswitch-optimized.yaml):
- Severity Filtering (
priority: warning): Suppresses noisy operational telemetry (Info/Notice) by 95%, surfacing strictly actionable security incidents. - Kernel-Level Pre-Drop (
drop_failed_exit: true): Discards failed syscall exits directly in the kernel probe, cutting CPU context switches by over 50%. - Memory Footprint Optimization (
cpus_for_each_buffer: 2): Compresses ring buffers from 8MB down to 2MB, strictly limiting memory usage to 30–50MB. - Direct UNIX Domain Socket IPC: Direct streaming to
/var/run/roamswitch/events.sockcompletely eliminates disk I/O thrashing. - Automated Log Cap (
/etc/logrotate.d/roamswitch-falco): Daily rotation withmaxsize 50Mand 7 compressed cycles permanently prevents disk capacity exhaustion.
4.5 Emergency Air-Gap Isolation with Pre-Severance Alerts
Immediately prior to cutting network interfaces upon critical tampering, the daemon synchronously dispatches emergency alerts to Telegram, LINE, and Webhooks. Alerts automatically append the server Hostname and Primary IP Address.
🚨 [RoamSwitch IMMINENT AIR-GAP] CRITICAL: IMMINENT AIR-GAP HOST ISOLATION (cve_2026_53362_lpe)
🚨 CRITICAL SECURITY INCIDENT DETECTED: cve_2026_53362_lpe
Host: production-node-01 (IP: 192.168.1.10)
Process: exploit_payload (PID: 4921)
ACTION: Initiating host Air-Gap network isolation (SSH preservation active).
WARNING: Outbound internet connectivity will be cut immediately after this message.
Timestamp: 2026-09-06 18:00:00§530-Check Security Diagnostic Suite
The Server Edition executes 30 specialized security health audits:
| # | Category | Check Title | Standard & Logic |
|---|---|---|---|
| 1 | Auth & Access | SSH Root Login & Password Auth | Verifies PermitRootLogin no & password auth disabled |
| 2 | Auth & Access | Empty Password Accounts | Ensures no user has blank password hash in /etc/shadow |
| 3 | Auth & Access | Sudoers Privilege Hygiene | Verifies no unauthorized NOPASSWD directives exist |
| 4 | Network | Inbound Default Deny | Audits nftables for default inbound drop policy |
| 5 | Kernel & Integrity | Unprivileged User Namespaces (Frag Gap) | Ensures user.max_user_namespaces = 0 (CVE-2026-53362) |
| 6 | Kernel & Integrity | eBPF BTF Support | Validates kernel BTF type information via /sys/kernel/btf/vmlinux |
| 7 | Kernel & Integrity | eBPF LSM Active | Checks for bpf in kernel lsm= boot parameter |
| 8 | Kernel & Integrity | eBPF Runtime Security Agent | Validates telemetry link to Falco / Tetragon agents |
| 9 | Container | Docker Socket Mount Audit | Detects container mounts of /var/run/docker.sock |
| 10 | Container | Docker Privileged Containers | Audits for high-risk --privileged container workloads |
| 11 | Integrity | Critical Path File Integrity (FIM) | Validates SHA-256 hashes of 150+ core OS binaries |
| 12 | Kernel & Integrity | Yama Process Protection | Verifies kernel.yama.ptrace_scope = 2 |
| 13 | Network | IP Forwarding Disabled | Verifies net.ipv4.ip_forward = 0 |
| 14 | Network | TCP SYN Cookie Protection | Verifies net.ipv4.tcp_syncookies = 1 |
| 15 | Network | Reverse Path Filtering (rp_filter) | Verifies strict reverse path filtering (rp_filter = 1) |
| 16 | Kernel & Integrity | Core Dump Restriction | Prevents process memory leaks via fs.suid_dumpable = 0 |
| 17 | Operations | Automatic Security Updates | Validates configuration of unattended-upgrades |
| 18 | Operations | NTP Time Synchronization | Checks synchronization via chrony or systemd-timesyncd |
| 19 | Operations | SSH Brute-force Protection | Verifies active monitoring via fail2ban or crowdsec |
| 20 | Kernel & Integrity | Unprivileged eBPF Disabled | Checks kernel.unprivileged_bpf_disabled = 1 |
| 21 | Network | ICMP Redirects Ignored | Prevents route poisoning via accept_redirects = 0 |
| 22 | Network | ICMP Echo Broadcasts Ignored | Mitigates Smurf amplifier DoS attacks |
| 23 | Kernel & Integrity | Shared Memory Hardening | Ensures /dev/shm has nodev,nosuid mount options |
| 24 | Auth & Access | Legacy Insecure Protocols Absent | Verifies absence of cleartext daemons (telnet, rsh, tftp) |
| 25 | Kernel & Integrity | SUID Process Core Dumps Restricted | Prevents credential leaks on SUID binary crashes |
§6Self-Check (Reproducible Verification in a Docker Environment)
RoamSwitch Server Edition's defense mechanisms (Inbound Default Drop, Critical Path FIM, guard.yaml severity-based containment, the protected-process safety rail, the safety timer, kernel LPE hardening, and more) can be fully reproduced and verified on your own machine by running a separate Docker container as the external attacker against the real roamswitch-server v1.3.2 package installed from the official APT repository (not a locally built binary). Below are the eight verification scenarios and the behavior (pass criteria) each one should exhibit. See 6.3 below for the exact steps and scripts.
| # | Scenario | Attack Technique | Pass Criterion |
|---|---|---|---|
| PENT-S1 | Nmap SYN Stealth Scan | Probe across ports 22, 80, 443, 3306, 8080 | PASS (100% Stealth) |
| PENT-S2 | Unallowed Port Probing | curl direct connections to port 3306 and 8080 | PASS |
| PENT-S3 | Egress / C2 blocklist | Outbound connection attempt to an address registered in the malicious-IP feed | PASS Only the registered address is blocked; traffic to a non-blocklisted host is unaffected (not a blanket block) |
| PENT-S4 | FIM Tampering Attack | Inject backdoor payload into /bin/login |
PASS (Instant Detection) |
| PENT-S5 | guard.yaml severity-based containment |
Injected a Falco Critical event referencing a real process | PASS The offending process is network-isolated, then SIGKILLed |
| PENT-S6 | Protected-process safety rail | Injected the same kind of event referencing the real sshd PID |
PASSsshd keeps running; only a refusal is logged as a false positive |
| PENT-S7 | Safety timer | Left an Air-Gap incident unacknowledged (no operator ACK) | PASS Auto-restores when unacknowledged; stays isolated until emergency-restore once ACKed |
| PENT-S8 | Kernel LPE Frag Gap | Execute unshare -U -r as unprivileged user |
PASS (Rejected) |
SSH Lockout Prevention
While a host-wide Air-Gap (on_emergency) is engaged, the administrator's SSH session is not cut off, thanks to preserve_ssh_on_isolation=true (the default). This design structurally prevents the scenario where a false positive isolates a server completely, leaving it unreachable without physical or console access. You can verify this behavior yourself with the PENT-S7 step in the Docker test suite above.
Scope Limits (an Honest Disclosure)
Kernel hardening (disabling unprivileged user namespaces, raising Yama's ptrace_scope) cannot be verified end-to-end from inside a container. Those sysctls are not namespaced per-container, so a privileged (--privileged) container's writes to them land on the real machine running the test, not a sandbox. This verification therefore only confirms that the sysctl write degrades gracefully (no crash) against a read-only filesystem; confirming the value actually lands requires a real machine or VM, which is how the product is meant to run anyway.
Reproduce It Yourself
Every result above can be reproduced 100% on your own machine, using nothing but the official distribution package, via the Docker test suite published in the official support repository (roamswitch-support) — no source-code access, and no need to trust us, required.
# Fetch and reproduce the verification suite (automatically installs roamswitch-server from the official APT repository)
git clone https://github.com/lafine1211/roamswitch-support.git
cd roamswitch-support/test/docker/server
./run.shBuilds three disposable containers (Target, Attacker, and a C2 decoy) on Docker's default bridge network and automatically verifies all 18 items, printing a report. The full run output is published at RESULTS-PENTEST-SERVER-2026-09-07.md (including, for transparency, the test-harness issues found and fixed while building it).
§7Operations, Deployment & Lifecycle
7.1 Headless CUI Tooling & Setup Wizard
Complete remote management via CLI:
roamswitch server status: Full 30-check diagnostic output (JA/EN).roamswitch server setup: Interactive terminal wizard for ports and notifications.roamswitch server config show / set <key> <val>: Scriptable automation for Ansible/Terraform.roamswitch server test-notify [all|telegram|line|webhook]: End-to-end notification probe.
7.2 Packaging
Distributed via official Debian/Ubuntu .deb repositories, RHEL/Fedora .rpm repositories, and Arch Linux AUR (roamswitch-server-bin).
§8Conclusion
RoamSwitch Server Edition delivers an uncompromised defensive perimeter for Linux server infrastructures: Zero Telemetry privacy, Inbound Default Drop, Critical Path FIM, and proactive kernel privilege escalation mitigation, delivering unified autonomous defense for modern cloud nodes.
It is a next-generation Linux server security standard that delivers layered defense and autonomous containment (Air-Gap) across every stage of the attack vector a cyber attacker targets — initial reconnaissance, intrusion, privilege escalation, and persistence.