The Air-Gap Security Checklist

The six checks below should pass on any Linux machine before you call it air-gapped. One to three commands each, with the output you should see. Bitcoin Witness station runs them before every workflow, See our full threat model.

6 checks · any Linux+4 · Bitcoin Witnessabout 10 minutesnothing here phones home

Run them beside the machine.

Eight air-gap checks, grouped into six cards. Nothing assumes Bitcoin Witness is installed.

01

No network interfaces active

A network interface is any connection to the outside world: WiFi, Ethernet, Bluetooth. On an air-gapped device all of them are down. An interface that is up but unconnected can still be exploited. Station check 1.

Type
ip -o link show | grep "state UP"
Expect
Nothing. Empty output means no interface is up.
If not
eth0 or wlan0 listed means that interface is still active. Bring it down: sudo ip link set wlan0 down, with the name that appeared.
02

No default routes

A route tells the device how to reach the internet. A default route is a known path out, even with no cable plugged in. Station check 2.

Type
ip -4 route show default
ip -6 route show default
Expect
Nothing from either command. No route, no path.
If not
A line beginning default via is a route. Remove it: sudo ip route del default
03

No DNS resolvers

DNS turns names into addresses. A configured resolver is a potential path to the internet. On an air-gapped device the file is empty. Station check 3.

Type
grep nameserver /etc/resolv.conf
Expect
Nothing, or No such file or directory. Both mean DNS is not configured.
If not
Lines starting nameserver are resolvers. Clear the file: sudo truncate -s 0 /etc/resolv.conf
04

No listening sockets

A socket is an open door other machines can connect to: SSH, a web server, file sharing. Only loopback connections, the device talking to itself, are acceptable. Station check 4.

Type
ss -tuln | grep -vE "127\.0\.0\.1|\[::1\]"
Expect
Nothing, or only lines mentioning 127.0.0.1 or [::1].
If not
Lines with 0.0.0.0 or [::] mean a service is listening on all networks. Find and stop it before going further.
05

No wireless hardware active

Bitcoin Witness blocks radios at four independent layers, numbered as on the security page: 1 · hardware, a device-tree overlay so the SoC never initialises the radio; 2 · driver, a kernel-module blacklist; 3 · firmware, the blobs deleted from disk; 4 · OS, an rfkill soft-block and masked services. Three commands show the layers visible at runtime, iw asks whether the kernel sees a radio at all (layer 1), rfkill whether it is blocked (layer 4), and lsmod whether a driver is loaded (layer 2), the authoritative one: firmware with no driver is inert. Station checks 5, 6 and 7.

Type
iw dev 2>/dev/null
rfkill list
lsmod | grep -E "brcmfmac|brcmutil|cfg80211|mac80211|bluetooth|btbcm|hci_uart"
Expect
iw: nothing. rfkill: every entry Soft blocked: yes, or no entries at all. A hardened box may have had its radios removed rather than blocked. lsmod: nothing.
If not
iw listing phy#0 or Interface wlan0 means the radio initialised and the overlay is not in effect. Any rfkill entry Soft blocked: no: run sudo rfkill block all. lsmod listing brcmfmac, cfg80211 or bluetooth means a driver loaded despite the blacklist. Stop and investigate before handling keys.
06

No networking daemons or tools running

SSH, curl, wget and netcat exist to talk over a network. The same command also looks for the three daemons Bitcoin Witness masks at install, wpa_supplicant, bluetoothd, avahi-daemon , layer 4, and the station’s check 8.

Type
ps aux | grep -E "ssh|curl|wget|nc |ncat|wpa_supplicant|bluetoothd|avahi"
Expect
One line: the grep you just ran, finding itself.
If not
sshd, curl or similar: stop them. A running wpa_supplicant, bluetoothd or avahi-daemon means a masked unit started anyway. Investigate that first. Find the process number in the second column and sudo kill 1234 with the real number.

Verify the mechanism, not only the effect.

The six above prove nothing is talking. Three of these read the install itself: the overlay, the blacklist and the masked units the security page names. The fourth reads the disk for firmware, one per layer. They assume the Linux system is hardened and airgapped during Bitcoin Witness installation, and will not pass on most other machines.

W1

The overlay is set

Layer 1. The device-tree overlay tells the SoC firmware never to initialise the WiFi or Bluetooth radio. Check 05’s empty iw is the effect. This is the setting.

Type
grep -E "^dtoverlay=(disable-wifi|disable-bt)" /boot/firmware/config.txt
Expect
Two lines: dtoverlay=disable-wifi and dtoverlay=disable-bt. On older images the file is /boot/config.txt.
If not
A missing line means the radio is initialised at boot and only the layers above it keep it quiet. Add the line, reboot, and rerun check 05.
W2

The blacklist is in place

Layer 2, the authoritative one. Thirty wireless and Bluetooth modules are blacklisted in sentinel-blacklist.conf. Check 05’s empty lsmod is the effect.

Type
grep -c "^blacklist" /etc/modprobe.d/sentinel-blacklist.conf
Expect
30.
If not
No such file means the blacklist was never installed. A smaller number means it was edited. Either way, treat check 05’s lsmod line as the only thing standing between you and a loaded driver, and reinstall before handling keys.
W3

The daemons are masked, not just stopped

Layer 4. Check 06 catches a daemon that is running. This confirms the three units cannot be started at all.

Type
systemctl is-enabled wpa_supplicant bluetooth avahi-daemon 2>&1
Expect
masked three times.
If not
disabled or enabled means the unit can still be started by hand or by a dependency. Mask it: sudo systemctl mask wpa_supplicant bluetooth avahi-daemon
W4

The firmware is gone from disk

Layer 3, and the station’s check 9. That is a warning, not a violation, because it reads the disk rather than testing the running machine. A driver cannot bring a radio up if its firmware file is absent, which is why Bitcoin Witness deletes those files at install. Belt and braces: check 05 is what proves a radio cannot come up.

Type
ls /lib/firmware/brcm/ 2>/dev/null | grep -E "brcmfmac|BCM.*\.hcd"
Expect
Nothing. Neither the WiFi blobs nor the Bluetooth HCI firmware is left for a driver to load.
If not
brcmfmac43455-sdio.bin (WiFi) or BCM4345C0.hcd (Bluetooth) still on disk is a defence-in-depth gap, not an open radio. A warning here, on an installed station in strict mode, a violation. Removing them is a decision: a reinstall is the only way back.

Bitcoin Witness runs these before every workflow.

▸ System Health CheckPi 5   air-gap ✓ VERIFIED
  BITCOIN WITNESS — System Health Check
  2026-08-05 00:00:00 UTC
  ──────────────────────────────────────────────
  [1] Air-Gap         PASS  all airgap checks passed
  [2] Entropy         PASS  256 bits available
  [3] Disk Space      PASS
  [4] Applications    PASS
  [5] File Integrity  PASS  SHA-256 manifest OK
  [6] System Time     PASS
  [7] Python Modules  PASS
  [8] Swap            PASS  zram-zstd (no plaintext)
  ──────────────────────────────────────────────
  Overall: 8/8 PASS, 0 FAIL
  All required checks passed. Device is ready.
Q menuruns even when the air-gap guard would fail
Eight checks, 8/8 PASS. This is the on-demand System Health Check. Its air-gap line is the machine running the by-hand checks above for you. The check that runs before every workflow is the air-gap guard, described below.

Keep reading

Watch the station run them.

Bitcoin Witness runs checks like these before every workflow. The walk-through shows every screen, including the health check that refuses to continue when one fails.