Base system is Debian server LTS. Nothing added but KVM, virt-manager and a few security and administrative tools.
On boot it bypasses Debian and loads my windows 8.1 virtual machine. Cloned mac ect. All data leaving the virt windows OS gets run through a virtual interface acting like a network tap.
I use 3 monitors and one is a shell to access the base Linux box. All drives are full disk encrypted using True crypt. The routing list and ACLs shape traffic around local taps my ISP has setup at core switching stations.
Since I have to pass thru these. I encapsulate all traffic outbound on the real WAN facing NIC (which is actually on a LAN in between a double NATted setup) inside of an HTTP tunnel. Every time my packets get rerouted to their known taps I leverage STP on their backbone network by sending root bridge packets I recorded and modified to delegate a small switch as the root. Network goes down. Trucks show up down the road. Customers bitch. I send anon email to ISP noting that wasting their money is too easy. Take the taps out. (These aren't for the feds. These are for my ISP to throttle idle modems). I hooked into one and grabbed the running configuration awhile back is how I know.
Anyway. Inside 8 I run HMA VPN. I use a local software firewall and then encrypt my folders with other software.
The base Debian box runs a honeypot alongside my windows box. It has lots of juicy shit that is all just various Trojans and phone home stuff.
I use a custom tool like the burp suite to adjust data being sent to unwanted places. Usually I play with the header to try and entice a loop from anyone using cookies to get info. Since these report back to static servers that we know and we know the syntax they want, it's easy to add entries to the database. If I don't blacklist them I'll send them copies of other data from old sessions. Over and over. Using new browsing agents and such. Soon I'm blacklisted by ad servers. Lol.
No one ever talks about this. But the best way to take over a site (one of my favorite vectors that is) is first by getting after the embedded ads on the page. If I can replace an ad... I basically have an iframe ready to go without breaking the target.... if I can do that. I can affect how the page loads ect.
End rant.
TL;DR. Debian with KVM with windows 8.1. All FDE and two network taps and white lists / black lists as well as good routing tables statically set up.