Izemium Documentation

Sovereign Security Platform v1.1.0 — kernel-root enforcement, hardware identity, post-quantum networking. One binary, zero cloud dependencies.

Overview

Izemium runs as a single daemon (izemium) that combines six subsystems on one host:

eBPF LSM enforcement — kernel-level monitoring and blocking (socket_bind, bpf, ptrace, capable, task_kill, socket_connect).
TPM 2.0 identity (VID) — hardware-rooted identity with AES-256-GCM sealed storage; graceful software fallback in resilient mode.
Post-quantum mesh — Kyber768 key exchange over QUIC with gossip-based peer discovery; fully operational air-gapped.
Compliance engine — Ed25519-signed PDF reports with QR verification, periodic audits, CIS/NIST scanners.
Live forensics — connection tracking, packet capture, JA3/JA3S fingerprinting, GeoIP enrichment, PCAP export.
Autonomous response — YAML policy engine with rollback windows, human-in-the-loop approvals, MITRE ATT&CK mapping.

Requirements: Linux kernel 5.15+ with BTF and BPF LSM support, root privileges for kernel enforcement, optional TPM 2.0 for strict hardware identity.

Installation

Build from source:

cargo build --release

The resulting binary is target/release/izemium. Precompiled packages may be installed with make install or the provided installer script. On first install the daemon generates the dashboard API key (stored 0600 at /var/lib/izemium/dashboard_api_key) and shows it once.

Quick Start

# Start with software fallback (no TPM required)
sudo ./izemium start --resilient

# Production: require TPM 2.0 hardware root of trust
sudo ./izemium start --strict

# Always available at the loopback dashboard
https://127.0.0.1:8888

Resilient mode degrades security (no hardware root of trust) and is intended for evaluation, CI, and machines without a TPM 2.0. Use --strict in production.

Licensing

Izemium Pro is licensed per node, annually. Each machine has a hardware ID; licenses are bound to it at issuance.

Purchase. Start from the device: izemium license purchase — or open checkout.izemium.com and enter the hardware ID shown by izemium license hardware-id. Payments are processed exclusively by Paddle.
Retrieve & install. After payment: izemium license retrieve (run izemium license status once and it retrieves automatically if no license is present). Offline machines: download the signed license file and run izemium license install license.json.
Verify. izemium license status shows ACTIVE / GRACE / REVOKED and whether Pro is enabled. The dashboard License card also exposes Upgrade to Pro and Retrieve License.

Licenses are Ed25519-signed by the licensing service and verified locally against the embedded public key; hardware binding prevents license sharing. Refunds and cancellations are governed by the Refund Policy and Cancellation Policy.

CLI Reference

Command	Description
`izemium start [--strict\|--resilient]`	Start the daemon (root required for eBPF). Options: `--tun <url>`, `--fips-mode`, `--no-watchdog`.
`izemium stop`	Stop the daemon gracefully.
`izemium status`	System status and trust level.
`izemium verify`	Integrity verification (eBPF, VID).
`izemium security`	Show security configuration.
`izemium license status \| hardware-id \| purchase \| retrieve \| install <file> \| activate --token`	Full license lifecycle (online and offline).
`izemium block-ip <ip>` / `izemium unblock-ip <ip>`	Block or unblock an IP in the eBPF maps.
`izemium whitelist-ip <ip>`	Whitelist an IP (bypass blocking).
`izemium report --format pdf\|json\|txt`	Generate audit/compliance reports.
`izemium mesh`	Show mesh peers.
`izemium dashboard-key`	Display the dashboard API key.
`izemium emergency-unlock`	Emergency unlock (PIN + master TOTP + API key).
`izemium maintenance`	Enter maintenance mode (suspends enforcement).
`izemium tui`	Interactive terminal UI.

Dashboard

The sovereign dashboard runs on https://127.0.0.1:8888 (HTTPS by default with a local certificate; loopback only). Sign in with the API key (izemium dashboard-key), your operator key ID, and your TOTP code if enrolled. The dashboard shows live enforcement state, statistics, audit trail, peers, protocols, and the License card with Upgrade to Pro / Retrieve License actions.

TUN Encapsulation

Opt-in on top of the hard-coded local enforcement (userspace, spaced apart from the kernel layer):

sudo ./izemium start --tun wss://tun.izemium.com

Transport: WebSocket over TLS 1.3 to the Cloudflare relay.
Key exchange: ML-KEM-768 (FIPS 203) between client and relay.
Traffic key: split-key model — HALF_A stays on the client (hardware-derived or provisioned), HALF_B lives only in the relay.
Inner encryption: AES-256-GCM with forward error correction; only traffic routed to the iz0 interface is encapsulated.

Security Model

Kernel enforcement: eBPF LSM hooks and maps; the daemon pre-authorizes itself and fails closed. Unauthorized bpf()/ptrace() calls are denied at the hook.
Hardware identity: VID sealed to TPM PCR7; keys are AES-256-GCM sealed and constant-time compared. Resilient fallback never claims hardware trust.
Crypto: Kyber768/ML-KEM post-quantum KEX, Ed25519 signatures, SHA3-384 audit hash chain, FIPS-ready self-tests.
Audit: append-only hash-chained audit log (/var/log/izemium/audit.chain), signed compliance reports with QR verification.
Response: YAML policy engine, rollback windows, human approval for destructive actions.

Troubleshooting

eBPF not loading: verify BTF (/sys/kernel/btf/vmlinux) and BPF LSM support. Resilient mode continues in monitor-only without kernel blocking.
TPM/TCTI errors: expected on VMs and machines without TPM 2.0 — use --resilient there; production hosts should use --strict.
License not activating: confirm the hardware ID used at purchase matches izemium license hardware-id; run izemium license status to auto-retrieve; offline use izemium license install.
Dashboard unreachable: it binds loopback only (127.0.0.1:8888). Use an SSH tunnel or the local proxy; generate the key with izemium dashboard-key.
TUN activation fails: check SOVEREIGN_AUTH_TOKEN and, on machines without DMI/TPM, prefer resilient mode; provisioned HALF_A enables recovery paths.

Support

Contact support@izemium.com. Payments are processed exclusively by Paddle — billing, invoices, and refunds are also visible through your Paddle receipt emails.