Astra Linux - Inside the Russian Military's Operating System

[@cobaltdust22]

Astra Linux in basic security mode doesn't make much sense - basically in that case it is a Debian 10 on somewhat customized kernel and with custom DE. The main thing is proprietary multi-level security and integrity protection coupled with custom hardened kernel. This distro is not intended for home use with nice user experience but for government computer systems where MAC and MLS is needed.

[@hatkidchan_]

As a note, Chromium GOST is a fork of Chromium with patches for GOST encryption, as well as some root certificates added that are controlled by Russian CA. It's a pretty recent addition made just in case you wouldn't have access to global CAs for whatever reason, or if they wouldn't let signing of Russian domains. Other than that it's pretty much the same, mmmaybe with the exception of added cryptoprovider called CryptoPro (not sure if it's installed on Astra's build of it though).

[@gosh-its-arch7580]

Just to clarify here my caution isn't because it isn't made in the west. It is because its endorsed by and used specifically by military; I would be hesitant of any distro that has additional protection in place!

[@geraldcragg9313]

yea! I'm going to stick with Deepin Linux 🤣

[@Leonard_MT]

Yeah, bet it's not fun getting locked out of your own OS... Also I bet some of those extra security features aren't good for everyday use.

[@abhabh6896]

You know US is also switching to debian? I dont think they use these versions, they use their own forks.

[@tornadot2025]

What about Red Hat? The US Army is their largest customer, and the US Army actively uses Red Hat. Would you be hesitant to run Red Hat or a Red Hat-based distro due to this connection?

[@SteffenWernicke]

I am using Astra Linux in every day. I checked the traffic with wireshark. If I dont use the internet, there is also no traffic on the line. If a microsoft os is running, there is permanent traffic. I think it is safe and it is fast. I have two login options in the smolensk version.

[@ContemplativeCat]

I'm curious about access to repositories. Does it limit access at all or does it basically behave like any other Debian derivative?

[@SteffenWernicke]

@@ContemplativeCat It is configurable. You have access to repositories. I have a specialist who do the things where I cant move on myself. I am also in the learning process. There are plenty of russian sites where people describe solutions. There are 3 different types of installations. One for the home user, another for lets say companies and one special protected for the state institutions. In the last one you have two login options. Low level and high level of protection. I could install and do anything in the high protection level. Until now, what I needed. Only remmina is crashing often and unfortunately it is not included in the standard installstion, like it was in the common version.

[@megapeiron]

I don't think it is prudent.

[@theITGuy-no3nt]

I doubt the version of Astra the Russian military uses is open source, so it is not Astra; it is a closed source fork.

[@ronscherbinske4524]

I have the Special Edition but have not tried to install it yet.

[@Aku-Signal]

35th Like! Very interesting video, thanks 👍

[@crazystupidgamer]

This looks quite a bit like a window Vista or 7 themed window XP. Which probably is intentional.

[@peterwilliams2152]

It is intentional. It was devised to replace Windows for the Military, Government and Educational Institutions. It's not pretty, but then neither is Windows, but it is extremely stable.

[@ContemplativeCat]

I'm actually curious to know if it will let you install a different desktop environment?

[@ZXGAMER22]

What wallpaper u using as thumbnail for this

[@dingokidneys]

To try this out completely, I would set up a virtual network with a virtual router dedicated to managing it so I could firewall off my actual network, monitor and capture all network traffic and provide a DNS server so that I could readily sink-hole stuff until I could validate that it was benign. Actually it's pretty easy to set up a pfSense VM to do this. I've done this before in VirtualBox using a bridged or NATted i/f for WAN and an internal network for the untrusted LAN though I didn't try setting up something like a PiHole to manage DNS at that time. There's a significant chance that you'd uncover nothing of very great interest but I would be vaguely curious to see what it reached out to other than the dedicated repos.

[@virtualtech11]

I find your comments interesting about using this distro. You can find out what it's doing because it's open source and you can look at the source and figure out what it's doing. In addition, it's interesting that you don't make those same comments about western world Linux distros.

[@stargazerspark4499]

indeed. Its quite possible that linux open-source communities and kernel maintenance groups are infiltrated to some degree by western intelligence agencies. There is speculation that systemd could be compromised, the initialization values of the RNG module may be suspect, etc. Russia, China and other countries would of course want their own custom built kernels & distros with additional security features for running on govt computers.

[@drakemallard6100]

Very interesting, thanks! Do anyone know some details about the 3 security levels that you can choose from during the installation process?

[@SteffenWernicke]

For the grandma you can choose the version Orel (Eagle) - the name of a city sourh of moscow. The mid level release has the name of the city Voronezh. The high level version - that I use - has the name of the city Smolensk. There you have two login options: Security level low - nice user experience. Security level high - not so nice, but yes - if you want not to be spied by the US and Microsoft - thats the OS of choice. I checked with wireshark. No suspicious traffic. The traffic is only caused by the browser. There is chromium gost installed by default.

[@mirknight]

I'm actually curious what the EULA is but cautious about connecting to any server that hosts it. Not torrenting it either

[@михаилказанцев-п4щ]

All i could say. They touched the kernel, so many stuff under the hood. It will leak not more information than google and other big corporationn coolect on you. And google spyware of cource is deprecated in this distro as well as windows telemetry. But in my oppinion is also bloated in size, optimized for speed. fly-wm working in old PCs - DDR1,pentium 4.

[@MinaSchloch]

Russian Debian KDE that is so bloated that it works offline (who preinstalls 3 browsers and blender?) and a weird theme and ugly proprietary Desktop. Like, they literally copied entire pages of Dolphin and systemsettings into their proprietary stuff. The display config and that properties are 100% stolen, not sure if KDE is even that permissive?

[@sergebuable]

kde is opensource. So everybody can fork steal something and use it.

[@MikeC1]

A license is only as good as the jurisdiction it's in.

[@Ratimir101]

you have no idea what you are talking about, its just bunch of hate driven screaming