Security Ops Rootless Classroom Stack

Português do Brasil

Security Ops®
In Code We Trust

Security Ops Classroom creates a private security, privacy and development lab from an ordinary Linux account. It is designed for course terminals, temporary cloud workspaces, shared machines, GNU/Linux desktops and Termux sessions where Docker or host-level administrator access may be unavailable.

The host is not converted to Ubuntu. Selected applications run from a private Ubuntu 24.04 userspace stored under the current account, while local services bind to 127.0.0.1. Web applications can optionally be published through Loophole HTTPS and individual Tor Onion Services.

Version 10.3.0 provides 22 selectable components. Every compatible component starts selected by default. The menu can reduce the installation before any large download begins.

Quick start

The recommended command works from Bash, Dash, Ash, Zsh, Fish and other shells because the downloaded entry point is executed by POSIX sh:

curl -fsSL https://short.securityops.co/class | sh

With wget:

wget -qO- https://short.securityops.co/class | sh

Pass non-interactive options through the pipe:

curl -fsSL https://short.securityops.co/class \
  | sh -s -- --profile classroom --yes

To inspect the launcher before running it:

curl -fsSL \
  https://raw.githubusercontent.com/cristiancmoises/classroom/main/script.sh \
  -o script.sh

less script.sh
sh script.sh

From a release archive:

tar -xzf securityops-classroom-stack-v10.3.0.tgz
cd securityops-classroom-stack-v10.3.0
sh menu.sh

On conventional GNU/Linux systems, ./script.sh and ./menu.sh also work after chmod +x. On Termux, sh script.sh is the most portable form because Android does not provide the usual desktop Linux filesystem layout for script interpreters.

What the launcher does

The small public script.sh is POSIX shell. It:

1. detects Linux, CPU architecture and Termux;
2. checks the small host-side command set;
3. detects the native package manager;
4. offers to install missing bootstrap packages when the account has permission;
5. downloads the complete source tree into a versioned user cache;
6. hands control to the Bash controller and interactive menu.

Package-manager guidance is included for:

Termux pkg
APT
DNF, YUM and MicroDNF
Zypper
Pacman
APK
XBPS
Portage
Eopkg
Urpmi
swupd
Slackpkg
GNU Guix
Nix

Automatic host dependency installation is never required. Disable the prompt and receive only the suggested command with:

SECURITYOPS_AUTO_INSTALL_DEPS=0 sh script.sh

Allow installation without a confirmation prompt with:

SECURITYOPS_AUTO_INSTALL_DEPS=1 sh script.sh --yes

The applications themselves remain rootless. Host package installation, when explicitly approved, is only for the launcher prerequisites such as Bash, Python, curl, tar and PRoot.

Termux

A minimal Termux start is:

pkg update -y
pkg install -y curl
curl -fsSL https://short.securityops.co/class | sh

The launcher installs or requests the remaining Termux packages, including its Android-adapted proot. It automatically exports the PRoot path expected by udocker and selects the P1 execution mode.

Termux is still Android, not a conventional GNU/Linux host. The following restrictions remain:

• no real root privileges are created;
• privileged ports, kernel firewall rules and route changes remain unavailable;
• Android may stop background work to reclaim resources;
• graphical applications are heavier and may be slow on phones;
• Torando can be installed and opened, but its transparent-routing action normally requires host privileges Android does not grant;
• browser and camera integration depends on the Android device and Termux environment.

CPU architecture support

Architecture	Compatible tools	Notes
x86_64 / amd64	22 of 22	Complete catalog
aarch64 / arm64	19 of 22	Evelin, the packaged Tor Browser archive and qTox AppImage are hidden because the pinned upstream bundles used by this release are not available in equivalent ARM64 form

An unsupported component is shown as unavailable instead of downloading the wrong binary. Saved selections are normalized when moved between architectures.

Rootless model

The host side runs as the current account. udocker and PRoot create a private Ubuntu filesystem in:

~/.local/share/rootless-web-stack

The Private APT terminal available through noVNC runs as an emulated root user only inside that filesystem:

apt update
apt upgrade -y
apt install -y package-name

These commands do not modify the host package database or host /etc. Root emulation does not grant capabilities for packet capture, firewall administration, network interfaces, mounts or privileged ports.

Choose a different persistent directory before the first installation:

ROOTLESS_STACK_HOME="$HOME/classroom-stack" sh script.sh

Default fonts

The portal, IRC client and Security Ops Call now use a local-first font stack:

Interface: Noto Sans
Terminal and code: Noto Sans Mono
Fallbacks: Liberation, DejaVu, Ubuntu, Cantarell and system fonts

No web-font request or font binary is bundled. The private Ubuntu desktop installs the Noto core and monospace packages and configures XFCE to use them. Other hosts fall back cleanly to fonts already installed on the device.

Tool selector

Open the menu:

sh menu.sh

or:

sh script.sh --menu

All compatible tools begin selected. Enter a number, comma-separated numbers, or ranges such as 8-12.

1,4,8-12   toggle tools
 a          select every compatible tool
 n          clear optional tools
 p          select a profile
 r          reuse the saved selection
 l          enable or disable Loophole
 o          enable or disable Onion Services
 d          show the deployment plan
 s          save and install
 q          quit
 ?          help

Components

ID	Component	Purpose
desktop	XFCE, noVNC and private APT	Remote desktop, MPV and private Ubuntu administration
forgejo	Forgejo	Git repositories, issues and Git HTTP/LFS
filebrowser	File Browser	Web file manager with command execution disabled
navidrome	Navidrome	Music library and Subsonic-compatible access
vaptvupt	VaptVupt CLI and Web	Compression, encryption, inspection and extraction
matrix	Continuwuity and Element Web	Federated Matrix homeserver and browser client
evelin	Evelin	Key-authenticated post-quantum tunnel tools
tor	Tor runtime	SOCKS proxy, torsocks, proxychains and Onion Services
torbrowser	Tor Browser	Official browser archive inside XFCE
librewolf	LibreWolf	Hardened browser and optional Tor launcher
qtox	qTox	Tox messaging client inside XFCE
security-tools	Network security toolkit	Compact DNS, TLS, HTTP and network analysis tools
securitysearch	Security Search	Privacy-oriented metasearch frontend
adguardhome	AdGuard Home	Authenticated UI and loopback DNS on an unprivileged port
cyberchef	CyberChef	Browser-side encoding, crypto and data transformations
webcheck	Web-Check	Authenticated website OSINT dashboard for authorized work
invidious	Invidious	Privacy-oriented video frontend, companion and PostgreSQL
scaledrone	Security Ops Call	Responsive WebRTC page using ScaleDrone signaling
irc	Security Ops IRC	Ergo server, browser client, WebSocket and raw IRC
torando	Torando GUI	Real desktop application available through noVNC
binternet	Binternet	Image-search frontend
keywave	KeyWave	WebSocket chat with optional TURN for media

The Security Ops portal is always installed because it indexes the chosen services and operational state.

Profiles and direct selection

sh script.sh --profile minimal
sh script.sh --profile classroom
sh script.sh --profile privacy
sh script.sh --profile developer
sh script.sh --profile security
sh script.sh --profile full

Modify a profile:

sh script.sh \
  --profile classroom \
  --add matrix,evelin,invidious \
  --remove qtox \
  --yes

Install an exact set:

sh script.sh \
  --only desktop,forgejo,filebrowser,tor,securitysearch,cyberchef,irc \
  --yes

Review without changing anything:

sh script.sh --profile full --no-loophole --no-onion --show-plan

Reuse the previous selection:

sh script.sh --reuse --yes

Publication and Onion Services

Every application first binds to loopback. Publication is separate:

sh script.sh --profile classroom --no-loophole --yes
sh script.sh --profile classroom --no-onion --yes

Loophole hostnames use a persistent installation suffix:

securityops-<service>-<number>.loophole.site

Each selected web application receives its own persistent Onion Service. IRC uses one Onion identity with separate web, WebSocket and raw IRC ports:

http://<irc-address>.onion/
ws://<irc-address>.onion:8097/
<irc-address>.onion:6667

AdGuard Home publishes only its administration page. Its DNS listener remains local on a high TCP/UDP port. Torando is a desktop tool and receives no separate public website. Evelin receives a TCP Onion endpoint instead of an HTTP page.

Important service notes

AdGuard Home

Rootless mode cannot take host port 53 or replace the system resolver. The final table prints the selected loopback DNS port:

dig @127.0.0.1 -p <dns-port> example.org

Web-Check

Web-Check is protected by generated Basic Authentication and blocks common private and loopback target ranges. It is still an active analysis service. Use it only against systems you own or are authorized to assess.

Invidious

Invidious, its companion and PostgreSQL are among the heaviest components. On limited machines, deselect it before deployment.

Security Ops Call

The custom ScaleDrone page includes responsive video panels, room links and sharing actions. The default signaling configuration is suitable for demonstration. A private deployment should set its own channel ID:

SCALEDRONE_CHANNEL_ID='your-channel-id' sh script.sh --only scaledrone --yes

A separate TURN service may be required between restrictive NATs.

IRC

Ergo uses loopback listeners and a dedicated browser client. Raw IRC is not exposed to clearnet. The generated service table contains the browser URL, WebSocket endpoint and Onion raw IRC address.

Torando

The real Torando daemon and GUI are installed inside the desktop. The application does not run in mock mode. Its Connect action needs firewall, routing and DNS privileges; rootless providers and Termux normally deny those kernel operations.

Management

After installation, use either the source checkout or the persistent copy:

sh script.sh status
sh script.sh table
sh script.sh credentials
sh script.sh logs
sh script.sh onion-addresses
sh script.sh resume
sh script.sh stop

Persistent helpers are also written below:

~/.local/share/rootless-web-stack

The service table is stored in human-readable and TSV formats. Secret-bearing state uses restrictive file permissions where the filesystem supports them.

Persistence limitations

nohup, detached process groups, supervisors and the guardian keep services independent of the terminal. They cannot force a course provider, cloud IDE or Android to keep the outer process alive. If the provider destroys the workspace, processes stop. If it preserves the home directory, rerun with:

sh script.sh --reuse --yes

Disk use

All 22 components are selected by default, but the complete deployment is large. Invidious, Web-Check, Matrix, the desktop and browsers account for much of the use. For a smaller lab:

sh script.sh \
  --only desktop,forgejo,filebrowser,tor,cyberchef,adguardhome,irc \
  --yes

The installer checks available space, but user content, Matrix data, Git repositories, files and music can continue growing afterward.

Validation

From a source checkout:

make validate

The validator checks the POSIX launcher, Bash controller, x86_64 and simulated ARM64 selections, Termux path, font policy, generated portal and service table, Onion mappings, IRC configuration, JavaScript/Python syntax and source manifest.

Documentation

• Architecture
• Portability
• Troubleshooting
• Security notes
• Third-party components
• Contributing

Security Ops Classroom is a lab deployment tool, not a security boundary. Run only trusted source and use the network-analysis tools only where you have authorization.