WiFi does not connect automatically by default, consistent with LainOS's privacy-first posture. (iwd autostart and usb automounting are the same way.)

Turn WiFi on and connect:

wifi on 
wscan

This will scan for available networks, display a numbered list, and prompt for a passphrase if needed(and randomize your MAC address). Known networks skip the passphrase prompt when you select them, but still require you to run wscan -- nothing connects on its own.

Disconnect: Select [d] from the network menu, or:

iwctl station <interface> disconnect

Turn WiFi fully off (stops iwd and blocks the radio at the hardware level, not just disconnects, your MAC address will be randomized each time):

wifi off
wifi status

Restore automatic WiFi at boot:

wifi-autostart enable
wifi-autostart disable   # back to off-by-default
wifi-autostart status

Manual control:

iwctl                          # interactive iwctl shell
rc-service iwd start           # start iwd if not running
rc-service iwd restart         # restart iwd

Note: Your WiFi MAC address is randomized every time iwd starts.

Note: wscan disables AutoConnect on every network immediately after connecting to it. The passphrase stays saved (so reconnecting later via wscan won't re-prompt for it), but iwd will never silently reconnect to a network on its own just because it's in range and the radio is up -- every connection is something you deliberately chose, via wscan.

Want normal auto-connect behavior instead? wifi-autoconnect stores a preference that wscan checks each time you connect -- it doesn't touch iwd directly itself, it just tells wscan what to do:

wifi-autoconnect enable    # wscan leaves AutoConnect on for new connections
wifi-autoconnect disable   # wscan disables AutoConnect after connecting (default)
wifi-autoconnect status    # show the current preference

This only affects networks you connect to after changing the setting. To flip a network you already connected to before switching, either reconnect to it via wscan, or run:

iwctl known-networks "<SSID>" set-property AutoConnect yes

For guidance on using these controls together for sensitive work, see Privacy Guide for Sensitive Work or run lainos-privacy-help.

Ethernet

Like WiFi, wired networking is toggled with a dedicated tool rather than left up permanently, so it fits the same deliberate on/off model the rest of LainOS uses.

Turn eth0 on:

eth0 on

Brings the wired interface up and allows it to obtain a DHCP lease (or use a static config, if you've set one). Your MAC address is randomized each time the interface comes up, same as WiFi.

Turn eth0 off:

eth0 off

Brings the interface fully down. No DHCP request will fire even if a cable is plugged in while it's off.

Check status:

eth0 status

For guidance on using eth0 alongside Tor, sdwdate, and WiFi for sensitive work, see Privacy Guide for Sensitive Work or private-mode below.

VPN ~ WireGuard

lainos-utils includes a WireGuard tunnel manager supporting up to 4 tunnels.

Setup:

Place your WireGuard config files at /etc/wireguard/wg1.conf, wg2.conf, etc.

doas cp your-vpn.conf /etc/wireguard/wg1.conf
doas chmod 600 /etc/wireguard/wg1.conf

Usage:

wg1          # bring up tunnel 1
wg1d         # bring down tunnel 1
wg2          # bring up tunnel 2
wg2d         # bring down tunnel 2

Supports tunnels wg1 through wg4.

Tor Daemon ~ Anonymous Networking

Start/stop Tor. to start with pluggable transports, check the Pluggable transports section below:

torctl s       # start Tor
torctl st      # stop Tor
torctl r       # restart Tor
torctl stat    # check status

Monitor Tor connections with nyx:

nyx

Route application traffic through Tor:

torsocks <application>

Route traffic through an isolated Tor circuit: see Tor Stream Isolation below for tor1-tor4, which keep specific applications on their own permanently separate circuits.

Note: Tor works over the regular Tor network by default. If Tor is blocked or censored on your network, use bridges (below) to circumvent this.

Pluggable Transports ~ Bridges

If Tor connections are blocked on your network, bridges disguise your Tor traffic to evade censorship. LainOS ships toggles for two bridge types. These also start the tor daemon.

Snowflake

Routes traffic through volunteer-run WebRTC proxies. Works well in most censorship scenarios and requires no bridge list maintenance.

snowflake enable    # add (if needed) and activate Snowflake bridges
snowflake disable   # deactivate Snowflake bridges
snowflake status    # show current bridge config and Tor status

To a network observer, Snowflake traffic resembles:

A web hosting/admin panel connection (Plesk, phpMyAdmin)
Traffic to a major commercial CDN (CDN77)
A WebRTC video/voice call setting up via STUN servers (Google, and several VoIP providers)
An ordinary web browser's TLS handshake

obfs4

Disguises Tor traffic as random-looking data using a fixed set of bridge relays.

obfs4 enable    # add (if needed) and activate obfs4 bridges
obfs4 disable   # deactivate obfs4 bridges
obfs4 status    # show current bridge config and Tor status

Note: Only enable one bridge type at a time. Both can technically run simultaneously without breaking Tor, but this isn't a tested or intentional configuration ~ pick whichever transport works for your situation.

Tor Stream Isolation

By default, every application you route through Tor (via plain torsocks <application>) can end up sharing circuits with every other application doing the same -- meaning two unrelated activities could, in principle, be linked together by an observer who compromises a shared exit node. Stream isolation keeps specific applications on their own dedicated circuits so they're never bundled together.

The default port (9050, used by plain torsocks) already isolates by destination ~ each different site/service you connect to gets its own circuit, rather than reusing one circuit across unrelated destinations. You don't need to do anything extra for this; it's built into the default configuration.

For stronger isolation ~ a fully separate, dedicated circuit pool per application ~ use tor1 through tor4, matching the same model as the wg1-wg4 WireGuard tunnels:

tor1 profanity -a user@example.onion
tor2 signal-desktop
tor3 element-desktop
tor4 gajim

Each of tor1-tor4 routes through its own dedicated Tor SocksPort. Whatever you run through tor1 never shares a circuit ~ or even a port ~ with anything run through tor2, tor3, tor4, or plain torsocks on the default port.

Usage is identical for every application ~ just run the command normally. tor1-tor4 automatically detect whether the target is a plain command-line tool (routed via torsocks), a GTK application like Gajim or Dino (also routed via torsocks ~ these use standard networking and don't need any special handling), or an Electron/Chromium app like Signal or Element. You don't need to know or specify which category an app falls into.

Electron apps get automatic fixes for two real, confirmed issues:

Electron/Chromium apps do their own networking inside a sandboxed renderer process and never go through the calls torsocks intercepts, so they're routed instead via Chromium's own --proxy-server flag, applied automatically once the app is detected as Electron-based.
LD_PRELOAD is stripped before launching. This matters because alacritty runs under a forced hardened_malloc wrapper regardless of the system-wide toggle (see hardened_malloc), and several Electron apps (Signal, confirmed) crash outright if launched from a terminal that's inherited it.
XDG_CURRENT_DESKTOP is overridden to GNOME for the launched process. Chromium's keyring/safeStorage backend detection doesn't recognize sway as a supported desktop even when gnome-keyring-daemon's Secret Service interface is genuinely available, so without this override, Electron apps can incorrectly report "no supported keyring backend."

Note: isolation here is by port, not by individual command invocation. Running tor1 curl https://example.com twice in a row can still reuse the same circuit for that second call, since Tor groups circuits by destination within an isolated port, not by which time you happened to run the command. The isolation guarantee is "this application/purpose never mixes with that one" ~ not "every single invocation gets a brand-new circuit."

Note: if an app is already running when you launch it through tor1-tor4 (e.g. you already have a window open), most single-instance applications (Signal, Element, and especially Firefox-based browsers) will just hand off to that existing window rather than starting a fresh process ~ meaning none of the isolation actually applies, since no new process with the isolated settings was ever created. Fully quit the app first if you need to confirm isolation is actually in effect.

Firefox-based browsers (LibreWolf) are a known exception. torsocks is not reliable for Firefox-based browsers ~ their multi-process architecture and async DNS resolution don't consistently go through the calls torsocks intercepts, and torsocks's own documentation advises against relying on it for Firefox. Configure LibreWolf's proxy natively instead: about:preferences -> Network Settings -> Manual proxy configuration -> SOCKS Host 127.0.0.1, Port 9052 (or whichever tunnel's port), SOCKS v5, with "Proxy DNS when using SOCKS v5" checked.

LESME uses tor1 by default (see Secure Messaging ~ LESME) so it's never on the same circuit as anything else you route through Tor.

Time Sync ~ sdwdate

By default, LainOS uses chrony for time sync (plaintext NTP, always available). sdwdate(ported from Whonix/Kicksecure) is also installed, offering Tor-based, fingerprint-resistant time sync instead ~ fetching time from multiple independent Tor onion services and cross-validating against Tor's own network consensus data.

sdwdate has no fallback source. If Tor is unreachable, sdwdate cannot sync time at all. It is not enabled by default for this reason; switching to it is a deliberate choice, not the default.

Toggle between chrony and sdwdate:

lainos-sdwdate enable    # stop chrony, start Tor + sdwdate
lainos-sdwdate disable   # stop sdwdate, start chrony (default)
lainos-sdwdate status    # show which is currently active

Check sync status:

doas tail -f /var/log/sdwdate.log

A healthy sync contacts several onion sources, reports Tor Consensus Time Sanity Check: sane for each, and applies any needed correction gradually. A small correction (a few seconds) on an already-accurate clock is the expected, healthy result ~ the benefit is in how the check happens (anonymized, cross-validated), not in how far the clock moves.

Secure Messaging ~ LESME

The LainOS Ephemeral Secure Messaging Environment sets up encrypted onion XMPP messaging automatically.

Requirements:

Create an account on the LainOS XMPP server first -- see https://lain.rocks
Generate your XMPP password in KeePassXC: 45 characters, special characters disabled

Setup:

lainos-secure-messaging

The script will:

Generate a random-identity RSA 4096 PGP keypair
Configure pass with encrypted credential storage
Pre-configure Profanity with OMEMO encryption

Connect after setup:

torctl s                                    # start Tor
nyx                                         # verify Tor is connected
tor1 profanity -a you@server.onion          # connect, on its own isolated circuit

In Profanity:

/tls allow
/join private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.Onion

Note: You will be prompted for your PGP passphrase multiple times ~ this is expected.

Note: LESME does not configure Tor bridges. Use snowflake or obfs4 (see Pluggable Transports ~ Bridges) to set up bridges independently.

Note: tor1 routes this connection through a dedicated, isolated Tor circuit, separate from anything else you torsocks or run through tor2/tor3/tor4 -- see Tor Stream Isolation below.

Privacy Tools

Keystroke Anonymization ~ kloak

kloak anonymizes your typing patterns to prevent keystroke fingerprinting.

kloak

Machine ID

Your machine ID is regenerated on every boot ~ your system appears as a different machine each session.

MAC Randomization

Your WiFi and eth0 MAC addresses change every time the respective interface comes up.

Privacy Guide for Sensitive Work

LainOS ships a dedicated, step-by-step privacy guide for sensitive work sessions ~ covering the correct order to enable WiFi/eth0 controls, sdwdate, and bridges before connecting to any network, downloading Tor Browser safely over Tor, and returning to a clean default state afterward.

lainos-privacy-help

This opens the guide with glow. It's worth reading in full before your first sensitive-work session, since the ordering of steps matters ~ enabling protections after you're already connected doesn't undo what already happened.

See also private-mode below, which automates the network-ordering portion of this guide.

private-mode ~ Automated Sensitive-Work Sequence

private-mode automates the network-ordering steps from the Privacy Guide: it wraps snowflake, lainos-sdwdate, wifi, and eth0 into a single command, in the correct order, in both directions.

private-mode on       # force network down, confirm it's down,
                       # enable Snowflake + sdwdate, then bring
                       # WiFi/eth0 back up
private-mode off      # force network down, confirm it's down,
                       # disable sdwdate, stop Tor
private-mode status    # show current state of Snowflake, sdwdate,
                        # WiFi, and eth0 together

Why it forces the network down first on on, not just on off: if WiFi or eth0 happen to already be up when you run private-mode on (e.g. you forgot to turn it off, or a cable was left plugged in), starting Tor/sdwdate at that point would not actually protect the first packets sent ~ the whole point of the ordering in the Privacy Guide. private-mode on doesn't assume the network is already off; it forces it off, confirms it's actually down (not just told to go down), and only then starts Snowflake/sdwdate.

Why off waits before disabling sdwdate: disabling sdwdate switches you back to chrony, which fires a plaintext NTP request the moment it starts. If the network interface is still technically live when that happens (even mid-teardown), that request could leak in the clear. private-mode off confirms there's no active default route before it touches sdwdate.

You'll be asked for your password once per direction (on or off), not once per sub-step.

This does not replace the manual verification steps in the Privacy Guide. After private-mode on, you still need to:

wscan             # connect, if using WiFi (skip if using eth0)
nyx               # wait for Bootstrapped 100% (done)
lainos-sdwdate status
doas tail -20 /var/log/sdwdate.log   # confirm a recent 'success' line

private-mode will not tell you it's safe to proceed with sensitive work ~ only checking Tor's actual bootstrap state and sdwdate's actual sync log can confirm that.

Note: private-mode off stops Tor directly (torctl st) rather than disabling the Snowflake bridge config. The bridge config is left in place between sessions ~ harmless at rest, since Tor itself is fully stopped. If you want to remove the bridge config entirely, run snowflake disable separately.

Audio

LainOS Layer 02 uses PipeWire for audio, started automatically on login via the lainos-audio-init package.

Check audio status:

pactl info
pactl list sinks short

Volume control(use volume keys):

pactl set-sink-volume @DEFAULT_SINK@ +5%    # volume up
pactl set-sink-volume @DEFAULT_SINK@ -5%    # volume down
pactl set-sink-volume @DEFAULT_SINK@ 100%    # max volume
pactl set-sink-mute @DEFAULT_SINK@ toggle    # mute/unmute

ALSA mixer:

alsamixer

Screen Brightness(bind your own brightness keys)

brightness 15     # maximum brightness
brightness 5      # low brightness
brightness 0      # screen off

Password Management ~ KeePassXC

KeePassXC is the recommended password manager. It launches with hardened_malloc for additional security.

keepassxc

Recommended settings:

Use Argon2id key derivation
Enable database encryption
Generate passwords with 45+ characters, special characters optional
For XMPP passwords: 45 characters, special characters disabled

Browser ~ LibreWolf

LibreWolf is a hardened Firefox fork with privacy settings enabled by default.

librewolf

Note: LibreWolf uses mozjemalloc. Running librewolf --version fails under system-wide hardened_malloc, but LibreWolf itself launches and runs normally in all other contexts.

File Manager ~ Thunar

Super-key+f or:

thunar

USB Drives ~ Auto-Mount

By default, USB automounting is disabled to prevent 'Evil Maid' type attacks, it can be enabled with the following commands.

If a USB drive isn't showing up automatically in Thunar, this is almost certainly why:

usb-automount enable    # allow ext-family drives to auto-mount
usb-automount disable   # restore default security behavior
usb-automount status    # check current state

Anime Streaming ~ ani-cli

ani-cli <search term>       # search and stream
ani-cli -c                  # continue from history
ani-cli -d <search term>    # download episode
ani-cli -q 720p <term>      # specific quality
ani-cli --dub <term>        # dubbed version
ani-cli -e 5-10 <term>      # episode range

Virtual Machines ~ KVM

KVM support requires the lainos-kvm package:

doas pacman -S lainos-kvm qemu-full virt-manager libvirt dnsmasq

After install, log out and back in, then:

sg libvirt -c "virt-manager"

No internet access inside a guest? LainOS ships a default-drop firewall policy for security, so KVM guest networking (DHCP + NAT) is not opened automatically. If a guest gets an IP but can't reach the internet, run:

lainos-kvm-enable-firewall

This adds the necessary forwarding rules for virbr0 to /etc/nftables.conf and reloads the firewall. A backup of your previous config is saved automatically.

hardened_malloc

hardened_malloc is a security-hardened memory allocator from GrapheneOS. It is active by default for specific applications via wrappers: alacritty, element, gnome-keyring-daemon, keepassxc, kleopatra, mpv, and the tor daemon.

Toggle system-wide hardened_malloc:

lainos-hardened-malloc status    # check current state
lainos-hardened-malloc enable    # inject into ALL processes (takes effect next login)
lainos-hardened-malloc disable   # per-app wrappers only (takes effect next login)

Known quirk: running librewolf --version fails under system-wide hardened_malloc. LibreWolf itself launches and runs normally in every other context.

You must unset LD_preload when compiling certain software:

unset LD_PRELOAD && makepkg -si

ram-wipe

ram-wipe defends against RAM-extraction attacks (an attacker physically pulling RAM contents after a forced shutdown, to recover encryption keys or other sensitive data still resident in memory). It's a LainOS port of Kicksecure/Whonix's ram-wipe: a dracut shutdown hook that drops the reclaimable disk cache from RAM during every reboot/poweroff, combined with init_on_alloc=1/init_on_free=1 kernel parameters that continuously poison memory pages the moment they're allocated or freed.

The continuous protection (init_on_alloc/init_on_free) is always on and isn't part of this toggle -- it's cheap, unconditional, and already active regardless of anything below.

Toggle the shutdown-time wipe pass specifically:

ram-wipe enable    # RAM wipe runs at every shutdown/reboot (default)
ram-wipe disable   # skip the wipe pass, for a faster shutdown
ram-wipe status    # show current GRUB config and the running kernel's cmdline

Toggling requires a reboot to take effect -- ram-wipe enable/disable rebuild grub.cfg immediately, but the currently running kernel's cmdline doesn't change until next boot.

⚠️ Known limitation ~ this has not been visually confirmed working. The dracut module is confirmed correctly installed (present in the built initramfs, correct file contents, correct hook registration), and multiple reboots with it active have completed cleanly with no hangs. However, the actual on-screen shutdown message the wipe produces could not be visually confirmed on Sway/wlroots hardware during testing -- the display did not show kernel console text during the shutdown transition on the hardware tested, most likely due to how the GPU driver hands the screen back from graphics mode to a plain text console at that exact moment (a driver/display-layer question, not something this package controls). If you have a way to verify this yourself (a second machine for netconsole, different hardware, or simply a display that does show the message), verification and a documentation update would be genuinely useful.

Building Software ~ Sandboxed Build Requirements

Some software (LibreWolf's own build process, confirmed; likely other Electron/Chromium-adjacent build tooling too) uses unprivileged user namespaces as part of its own build-time sandboxing. LainOS locks this down by default as a hardening measure:

sysctl kernel.unprivileged_userns_clone

This is set to 0 via /etc/sysctl.d/99-lainos-hardening.conf, consistent with the same hardening philosophy as hardened_malloc, ram-wipe, and the other kernel parameters set at boot (see hardened_malloc).

To build software that needs it, temporarily enable it for the current boot:

doas sysctl -w kernel.unprivileged_userns_clone=1

Restore the hardened default once you're done building:

doas sysctl -w kernel.unprivileged_userns_clone=0

This only affects the running kernel until next reboot -- /etc/sysctl.d/99-lainos-hardening.conf itself is untouched by the commands above, so a reboot restores the locked-down default automatically even if you forget to restore it manually.

Also see the LD_PRELOAD note under hardened_malloc -- compiling certain software may need both unset LD_PRELOAD and this sysctl temporarily enabled, depending on what the specific build process requires.

Power Management

Lock screen:

wlogout is used for the lockscreen and suspend and can be accessed with Ctrl+Alt+l, same with suspend, or manually below:

Suspend:

doas lainos-suspend

Shutdown / reboot / logout:

Use wlogout (Mod4+Escape or the power button in the status bar), or:

doas openrc-shutdown -h now    # shutdown
doas openrc-shutdown -r now    # reboot

Lid close:

Closing the lid automatically locks the screen with swaylock and suspends the system.

Wallpaper

Sway sets the wallpaper via swaybg, configured with one line in ~/.config/sway/config:

grep swaybg ~/.config/sway/config

To add and switch wallpapers:

Copy your image into the system wallpapers directory:

doas cp /path/to/your-image.png /usr/share/lainos/wallpapers/

Edit the exec swaybg line in ~/.config/sway/config to point at it:

exec swaybg -m fill -i /usr/share/lainos/wallpapers/your-image.png

Reload Sway to apply it immediately, without logging out:
```
Mod4+Shift+r
```
or:
```
swaymsg reload
```

Key	Action
`Mod4+Return`	Open terminal (alacritty + tmux)
`Ctrl+Alt+t`	Open terminal (alacritty + tmux)
`Mod4+t`	Open terminal (alacritty, no tmux)
`Mod4+w`	Open LibreWolf
`Mod4+f`	Open Thunar
`Mod4+m`	Open Mousepad
`Mod4+space`	Application launcher (wofi)
`Mod4+v`	Clipboard history menu
`Mod4+q`	Close focused window
`Mod4+Shift+r`	Reload Sway config
`Mod4+s`	Toggle floating
`Mod4+h`	Split horizontally
`Mod4+b`	Split vertically
`Mod4+Left/Right/Up/Down`	Focus left/right/up/down
`Mod4+Shift+Left/Right/Up/Down`	Move window left/right/up/down
`Mod4+Ctrl+Left`	Enter resize mode
`Mod4+1-9`	Switch workspace
`Mod4+Shift+1-9`	Move window to workspace
`Mod4+z`	Show/hide scratchpad window
`Mod4+Shift+z`	Move window to scratchpad
`Mod4+l`	Launch virtman (KVM VM manager)
`Mod4+Shift+b`	Open Bluetooth manager
`Ctrl+Alt+l`	Open wlogout (power menu)
`Print`	Screenshot selected region to clipboard
`Shift+Print`	Screenshot entire screen to clipboard
`Ctrl+l`	Clear terminal
Volume Up/Down keys	Adjust system volume

Resize mode (enter with Mod4+Ctrl+Left):

Key	Action
`Left/Right`	Shrink/grow width
`Up/Down`	Shrink/grow height
`Return` / `Escape`	Exit resize mode

Getting Help

Website: https://lainos.net
Matrix: https://matrix.to/#/#lainos:catgirl.cloud
IRC: irc.libera.chat #LainOS
Onion: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
XMPP: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion

What a long strange trip its been (~);}

LALL<3

This guide can be accessed by issuing lainos-help in the terminal.

The lainOS privacy guide can be accessed by issuing lainos-privacy-help in the terminal.

If you are new to OpenRC, the lainOS OpenRC guide can be accessed by issuing openrc-help in the terminal.

LainOS Layer 02 ~ User Guide(The Helping Friendly Book)

Table of Contents

WiFi