The moment danger is detected, Linux isolates itself.
From desktop to cloud VPS, autonomous Linux defense with no complex setup. Client Edition: Wi-Fi auto-detection and a VPN kill-switch. Server Edition: SSH lockout prevention and millisecond intrusion detection. Both fully headless.
Install from your distribution
Adding the official repository lets updates flow through your normal update command and makes the in-app update check work. Select "Client Edition (Desktop)" or "Server Edition (Headless)" for your use case.
Ubuntu / Debian / Mint / Pop!_OS / Raspberry Pi OS (APT)
curl -fsSL https://lafine.net/apt/roamswitch-archive-keyring.asc \ | sudo gpg --dearmor -o /usr/share/keyrings/roamswitch-archive-keyring.gpg echo "deb [arch=amd64,arm64 signed-by=/usr/share/keyrings/roamswitch-archive-keyring.gpg] https://lafine.net/apt stable main" \ | sudo tee /etc/apt/sources.list.d/roamswitch.list sudo apt update && sudo apt install roamswitch
Fedora / RHEL / CentOS Stream (DNF)
sudo rpm --import https://lafine.net/rpm/RPM-GPG-KEY-roamswitch sudo curl -fsSL -o /etc/yum.repos.d/roamswitch.repo https://lafine.net/rpm/fedora/roamswitch.repo sudo dnf install roamswitch
openSUSE (zypper)
sudo rpm --import https://lafine.net/rpm/RPM-GPG-KEY-roamswitch sudo zypper addrepo https://lafine.net/rpm/opensuse/roamswitch.repo sudo zypper refresh && sudo zypper install roamswitch
Arch / Manjaro / EndeavourOS
Not published on the AUR. Build from the bundled PKGBUILD (the release tarball is verified against the signing key).
gpg --recv-keys 9C12964366B8547511AAEAF5773A9A39ECBD1537 curl -fsSLO https://lafine.net/linux/dl/PKGBUILD curl -fsSLO https://lafine.net/linux/dl/roamswitch.install makepkg -si
Without a repository, download signed tarballs (.tar.gz + .tar.gz.asc, amd64 / aarch64) directly from lafine.net/linux/dl (the in-app update check will not work in that case).
After installation, roamswitch.service starts automatically and the tray icon runs at login. An onboarding wizard (GTK) appears on first launch. The CLI (roamswitch status) prints diagnostics in Japanese or English depending on your OS locale.
Autonomous defense, running natively on Linux
🛡️ Autonomous nftables profile switchingClient Edition only
On trusted networks (home) it allows comfortable local traffic; at work it watches suspicious ports; on public Wi-Fi it stealth-drops all inbound. Decided by gateway MAC, switched in milliseconds.
🚨 Autonomous ransomware isolationClient Edition only
fanotify + Shannon entropy detects an encryption write burst, freezes the offending process with SIGSTOP and notifies you (the notification includes the command to resume it). All external traffic and sharing services are also cut in an emergency (Air-Gap), as they are when tampering with a canary (decoy) file is detected. YARA scanning of written files is done separately.
🧷 Suspicious autostart detectionClient Edition only
Checks newly created or rewritten autostart entries (systemd, cron, desktop autostart) and notifies only about those that look like how malware persists: a reverse shell, decoding data and running it directly, downloading and running it directly, or running a program from a temporary or hidden folder. Notification only; nothing is blocked, and ordinary-looking entries are only logged. On by default.
📶 Wi-Fi encryption-strength warningClient Edition only
On Open / WEP / WPA networks it raises the protection level automatically with a desktop notification. It also stops and restores sharing services (SSH/Samba/RDP) automatically (on by default; can be turned off any time).
🔌 Unauthorized USB / BadUSB guardClient Edition only
An unapproved USB storage device is held for approval; a keystroke-injection device (a BadUSB keyboard) has its input suppressed in software via evdev — never a kernel-level port cutoff. Bundles ClamAV auto-scan and quarantine for the Downloads folder.
📜 27/34-item security audit
Scores 27 client items — LUKS, Secure Boot, LSM, SSH/sudo, sysctl, ARP pinning, exposed ports, browser Safe Browsing and more — or 34 CIS-Benchmark items on the Server Edition, in all 10 languages. Available from the GUI, the CLI and MCP. Each item also carries a NIST CSF 2.0 / CIS Controls v8 mapping, useful for audits.
🤖 Bundled MCP server
roamswitch-mcp lets AI agents such as Claude read the security state over JSON-RPC (stdio). Read-only and fully local. See MCP setup.
🔒 VPN tunnel + kill-switchClient Edition only
On public Wi-Fi, route all traffic through an encrypted WireGuard or Tailscale (exit-node) tunnel. An nftables kill-switch drops any clear-text leak outside the tunnel and never fails open if the tunnel drops. The primary man-in-the-middle defense.
🎣 Passive link guard (blocks phishing connections)Client Edition only
Reads the destination hostname of outbound connections from the DNS question, the TLS SNI and the HTTP Host header, and warns about or blocks connections to phishing / scam sites (block by default, and it works even for DoH browsers). In warn mode a no-answer is fail-closed. Verdicts use a local feed plus offline heuristics only; the destination is never sent anywhere.
🖧 Autonomous Server Defense & SSH Lockout PreventionServer Edition only
Applies inbound Default Drop automatically for cloud VPS and data center nodes. Actively preserves existing administrative SSH sessions (ESTABLISHED state) to prevent administrator lockout. An optional guard.yaml lets you fine-tune the containment action per severity, plus a safety timer that auto-restores isolation if nobody acknowledges it. Server Edition 1.10.4 and earlier had a defect. The isolation ruleset dropped the SSH replies, so the operator's SSH did not work during isolation. It was fixed in 1.10.5.
⚡ eBPF Threat Detection & Autonomous Isolation (Falco / Tetragon)
Captures kernel-level eBPF events (reverse shells, privilege escalations, unauthorized binary execution) over a UNIX socket in real time. Choose Falco (default) or Cilium Tetragon (gRPC) as the sensor. Instantly isolates compromised processes (SIGSTOP/SIGKILL) or hosts (Air-Gap) in milliseconds. The Server Edition also measures the time from detection to response, checks the alert path with a heartbeat, and detects reverse shells by itself.
📂 Critical-Path FIM (File Integrity Monitoring)
Event-driven SHA-256 hash monitoring for critical system binaries and configurations including /etc/shadow, /etc/pam.d, and /usr/bin/ — tampering is detected the instant it happens (periodic scans remain as a backstop). Instantly flags backdoor installations and unauthorized tampering. The notification names the process that made the change and the SSH login it belongs to (source, time, authentication method).
🔐 SSH brute-force detection and blocking
It reads sshd's failed logins the moment they are written, blocks new connections from a source that reaches the threshold, and cuts the SSH connections that source already had open (an authenticated session and an exempt source are never cut). It is on by default on the Server Edition. On the Client Edition it works only while sshd is running. When fail2ban or CrowdSec already guards sshd, it only detects and notifies.
🧠 Resource Exhaustion / Process Anomaly GuardServer Edition only
Detects memory-leak DoS attacks and crash loops (a sign of a use-after-free exploit attempt). A healthy GC-backed runtime's normal sawtooth memory pattern is never mistaken for a leak; only sustained RSS growth with no recovery is flagged. Crash loops are recognized structurally from systemd's own fixed vocabulary (no new polling). Correlates with eBPF/FIM events by PID to assign a confidence tier (possible/correlated).
🧱 Egress / C2 Blocking & DNS SinkholeServer Edition only
Automatically blocks outbound connections to known-malicious IPs via a local threat feed. Optionally enable a DNS sinkhole (Quad9 / Cloudflare / AdGuard / CleanBrowsing) to also block malicious domain resolution (off by default so it never breaks internal DNS).
📢 Multi-Channel Emergency Incident AlertsServer Edition only
Dispatches detailed security incident telemetry to Slack, Discord, Microsoft Teams, Syslog, or custom Webhooks the millisecond a threat is intercepted, process killed, or host air-gapped.
🐳 Docker Risk Detection & Firewall Bypass Protection
Detects a privileged (--privileged) container or a docker.sock bind-mount the instant it starts, via docker events (notify-only). DOCKER-USER chain firewall-bypass protection runs at all times on both the client and server editions.
🧫 File Scan Guard (YARA + ClamAV)Server Edition only
Periodically scans directories that store files for others — a mail relay, a shared folder, an upload endpoint (an added layer for arbitrary shared directories, separate from the client edition's automatic Downloads-folder scan). The embedded YARA engine always runs with no external dependency; ClamAV can be added as an optional second opinion. Confirmed threats are quarantined automatically.
🔑 Secret & API Key Leak Scanner
Detects API keys (OpenAI, Anthropic, AWS, GitHub, Slack, Stripe, and more) and SSH private keys — not just in pasted text, but across an entire directory (.git and similar are skipped automatically). Available via the CLI, MCP, and the Python SDK; nothing is ever transmitted off the host.
📦 Package CVE Scan (dpkg/pacman/dnf/zypper + dependencies)Client Edition only
Checks installed OS packages and your project's dependencies (npm, PyPI, crates.io, and 4 more ecosystems) against a locally-held known-CVE map. No network activity at all.
🖥️ ClickFix Defense: Detects and Clears Malicious Commands on the ClipboardClient Edition only
Defends against "ClickFix" — a fake ad or CAPTCHA page that tells you to copy and paste a "verification code" that's actually a malicious command. Polls the clipboard via gtk::Clipboard (works transparently across both X11 and Wayland) and, the moment a known-malicious pattern is copied, clears it and warns you — catching it uniformly whether the paste destination is a terminal, the GNOME/KDE run dialog, or anywhere else.
🔔 Notification History (Past 7 Days)
Look back through the notifications RoamSwitch has sent instead of only catching them the moment they appear. Available from the CLI (roamswitch notifications), GUI, MCP (get_notification_history), and the Python SDK. Entries older than the retention window are pruned automatically.
🕵️ DNS Tunneling / Exfiltration Detection
Detects the suspicious query shapes DNS-tunneling tools (iodine, dnscat2, …) rely on — long, high-entropy labels, or TXT/NULL query types. Never inspects non-DNS traffic, and a stopped detector can never delay name resolution. Available on both Client and Server Edition.
📊 Vulnerability Scan Staleness (pass_age)Client Edition only
For every active-verification probe, see the last recorded result and the days elapsed since — from the GUI, the CLI, or MCP. Makes "when was this last actually checked" visible at a glance.
Identifies the connected gateway MAC and switches the nftables profile autonomously. Sharing-service control and ARP pinning live on this screen too.
Switch protection level instantly, set the manual-override duration, toggle DNS threat protection and language — all from the tray.
Supported environments
| Fully supported | Ubuntu 22.04 / 24.04, Debian 12+, Linux Mint, Pop!_OS, elementary, Zorin, Raspberry Pi OS 64-bit (Bookworm), Ubuntu for Raspberry Pi |
|---|---|
| Architecture | x86_64 / aarch64 (Raspberry Pi 4 / 5, AWS Graviton, etc.) |
| Required | systemd, nftables. The Client Edition's tray UI needs an AppIndicator/StatusNotifierItem desktop (KDE / Cinnamon / MATE / Budgie, or GNOME with the extension). The Server Edition runs fully headless. |
| Packages | APT (Ubuntu/Debian family), DNF (Fedora/RHEL/Rocky/Alma), zypper (openSUSE), AUR (Arch). Non-systemd distros (Alpine / Void / Devuan) are not supported. |
| Use case | We ship two packages: a Client Edition (GUI + tray) for workstations and laptops, and a Server Edition (headless, Default Drop, eBPF/Falco integration) for cloud VPS, container hosts and data centers. |
Bundled apps
The Client Edition packages (deb, rpm and tarball) bundle three apps that are separate from RoamSwitch (PersonalSOC, PathScope and AccessScope). Each has its own icon and opens from the application menu. They are licensed under the Apache License 2.0 and are not covered by RoamSwitch's End User License Agreement (EULA). The Server Edition (headless) includes only the three commands (personalsoc, pathscope and accessscope), not the window apps.
| PersonalSOC | Gathers this device's logs and defense status into a single report at the press of a button (a personal security operations center). Its LLM integration is optional and off by default. |
|---|---|
| PathScope | Works out the paths by which an ordinary user could reach root and shows where to fix first (a privilege-escalation path analysis tool). Its LLM integration is optional and off by default. |
| AccessScope | A security diagnosis tool for access logs: it finds attack attempts in web server and SSH access logs and shows the evidence log lines. Its LLM integration is optional and off by default. The command (accessscope) also ships in the Server Edition packages. |
| Updates and dependencies | The bundled apps are updated together with the RoamSwitch package. Their windows need WebKitGTK 4.1 (libwebkit2gtk-4.1), which the deb and rpm packages install automatically; on Arch (AUR) install webkit2gtk-4.1 as an optional dependency. |
Client Edition vs. Server Edition
The "Client Edition" for workstations and laptops, and the "Server Edition" for cloud VPS, container hosts and data centers — each tuned for autonomous defense in its own environment.
| Area | Client Edition (Desktop) | Server Edition (Headless) |
|---|---|---|
| Network detection & profile switching | Autonomous switching by Wi-Fi / gateway MAC (3 profiles) | Static policy (/etc/roamswitch/server.conf, fixed Default Drop) |
| Firewall posture | Auto-selects Open / Balanced / Lockdown | Default Drop + explicit allowlist of declared service ports + SSH lockout prevention |
| Outbound (egress) traffic | Passive link guard + DNS Threat Guard block phishing | Egress blocking of C2 / malicious domains + optional DNS sinkhole + emergency host Air-Gap isolation |
| VPN tunnel + kill-switch | ✅ WireGuard / Tailscale | ❌ Not available (management access is SSH-only; set up WireGuard or similar yourself via the OS if you need a VPN) |
| Ransomware, tampering & intrusion detection | fanotify autonomous ransomware detection & process freeze | eBPF intrusion detection (Falco / Tetragon) + critical-path FIM (event-driven, instant detection) + resource-exhaustion / crash-loop detection |
| Kernel hardening (sysctl / Yama / noexec) | Applied on an untrusted network | Always applied (bundled Docker-bypass protection filter) |
| Security health assessment | ✅ 27 items (GUI / CLI / MCP) | ✅ 34 items (CIS Benchmark, CLI / MCP) |
| Operator UI | GTK GUI + tray + CLI + MCP | CLI (roamswitch status --server / setup) + MCP + headless |
| Emergency notifications | Desktop notifications (GTK / libnotify) | Slack / Discord / Teams / Syslog / Webhook instant alerts |
| Central management & auditing | [Planned — not yet available] Added with a Business license | [Planned — not yet available] Added with a Business license (signed policy distribution, periodic check-in; free tier stays fully local) |
| Detailed documentation | Security Whitepaper (Client) → | Server Edition Operations Manual / Security Whitepaper (Linux Server) |
Server Edition Operations Manual Security Whitepaper (Linux Server) CLI / headless operations guide →
🏢 RoamSwitch Business (for organizations)
The personal edition (Community Edition) is free with every feature unlocked. For organizations that want to govern several Linux devices, the following management layers are planned as the paid Business tier (none is available yet). On-device defense (nftables switching, ransomware isolation, USB defense, DNS, diagnostics, MCP) is part of Community, and Business is not intended to remove any of it.
| Planned features | Summary |
|---|---|
| Fleet management | [Planned — not yet available] Enrol devices with an Ed25519-signed organisation token; aggregate protection level, health score and policy status via periodic check-in. |
| Signed bulk policy distribution | [Planned — not yet available] Distribute trusted networks, away level, sharing-service control and each guard's enforced value as Ed25519-signed JSON. Locked on the endpoint. |
| Signed private APT / RPM | A private repository signed with an organisation-specific GPG key. In-app update checks keep working. |
| SLA support | A contract-based contact for deployment design, policy design and incident response (Japanese, JST business days). |
Today there is no management server and no fleet-management feature, and the Community Edition does not talk to any management server (Zero Telemetry). Business management features are on the development roadmap; if introduced, they will be opt-in and limited to devices the organization explicitly registers, with the transmitted fields published in advance. Free Business features for macOS Pro Lifetime holders are planned for launch. Please ask about pricing and timing.
Contact us about Business🔒 Zero Telemetry / License
Your traffic, connection history, browsed URLs and system logs are never sent anywhere. By default the Client Edition makes only one kind of outbound connection: a daily update that only receives signed detection data and the like (it contains no information about you or your machine and can be switched off). By default the Server Edition also makes only one kind of outbound connection: an anonymous fetch of signed data (the kernel CVE data, the web rules and, on Ubuntu servers, the Ubuntu package CVE data used by the OS-package CVE check; the manifest is checked daily and the CVE data itself about every 30 days; it contains no information about the host and the operator can turn it off). It makes no other external connection unless the operator opts in. RoamSwitch for Linux is proprietary freeware; the official distribution package (.deb) may be redistributed unmodified with all copyright notices intact. The source code is not published. Full text at /usr/share/doc/roamswitch/copyright. The RoamSwitchKit SDK is provided separately as open source. The LLM integration of the bundled separate apps (PersonalSOC, PathScope and AccessScope, including PathScope's "LLM assist" and AccessScope's LLM analysis and log discovery) is off by default in each app; if enabled, content may be sent externally through the LLM command you choose (see each app's page).