Thread: [Devil-linux-develop] DL completely contained on CD?

Brought to you by: blubdog, friedl, small_fish, smiley73

devil-linux-develop

[Devil-linux-develop] DL completely contained on CD?

From: Bruce S. <bw...@ar...> - 2003-08-26 07:04:12

I came up with the brilliant idea the other day, and would like some
input.  (go ahead and tell me if it's a dumb idea, I don't care! :)

I might have an application to put a DL router/firewall internally in
our company to firewall off a department we don't trust.  The problem is
this PC cannot be in a secure location (untrusted employees have access)

I don't really want anyone taking the floppy or USB stick out of the PC,
mucking with it, and replacing it.  So what if the etc.tar.bz2 file was
also on the CDROM?  People cannot eject the CD from a running DL PC, and
if they shutdown the DL PC to remove the CD, I would know about it from
my opennms monitoring software.

It would be easy to hack the linuxrc startup script, and say if
/cdrom/config/etc-static.tar.gz2 exists, then completely ignore the
floppy and USB devices, and ONLY untar the static etc file from CD.

How hard would it be to write a script that would read a DL CD (or ISO),
replace one file on it, and write a new ISO image?  This script would
need to run in a normal Linux distribution (Redhat/SuSE/...), not from
the chroot development environment.  

 - BS

Re: [Devil-linux-develop] DL completely contained on CD?

From: Thomas E. <tho...@bu...> - 2003-08-26 07:49:19

Great idea!

-- 
cu thomas

Bruce Smith wrote:
> I came up with the brilliant idea the other day, and would like some
> input.  (go ahead and tell me if it's a dumb idea, I don't care! :)
> 
> I might have an application to put a DL router/firewall internally in
> our company to firewall off a department we don't trust.  The problem is
> this PC cannot be in a secure location (untrusted employees have access)
> 
> I don't really want anyone taking the floppy or USB stick out of the PC,
> mucking with it, and replacing it.  So what if the etc.tar.bz2 file was
> also on the CDROM?  People cannot eject the CD from a running DL PC, and
> if they shutdown the DL PC to remove the CD, I would know about it from
> my opennms monitoring software.
> 
> It would be easy to hack the linuxrc startup script, and say if
> /cdrom/config/etc-static.tar.gz2 exists, then completely ignore the
> floppy and USB devices, and ONLY untar the static etc file from CD.
> 
> How hard would it be to write a script that would read a DL CD (or ISO),
> replace one file on it, and write a new ISO image?  This script would
> need to run in a normal Linux distribution (Redhat/SuSE/...), not from
> the chroot development environment.  
> 
>  - BS
> 
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: VM Ware
> With VMware you can run multiple operating systems on a single machine.
> WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
> at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop

Re: [Devil-linux-develop] DL completely contained on CD?

From: Heiko Z. <he...@zu...> - 2003-08-26 23:10:31

Hey,

Bruce Smith wrote:
> I came up with the brilliant idea the other day, and would like some
> input.  (go ahead and tell me if it's a dumb idea, I don't care! :)
> 
> I might have an application to put a DL router/firewall internally in
> our company to firewall off a department we don't trust.  The problem is
> this PC cannot be in a secure location (untrusted employees have access)
> 
> I don't really want anyone taking the floppy or USB stick out of the PC,
> mucking with it, and replacing it.  So what if the etc.tar.bz2 file was
> also on the CDROM?  People cannot eject the CD from a running DL PC, and
> if they shutdown the DL PC to remove the CD, I would know about it from
> my opennms monitoring software.
> 
> It would be easy to hack the linuxrc startup script, and say if
> /cdrom/config/etc-static.tar.gz2 exists, then completely ignore the
> floppy and USB devices, and ONLY untar the static etc file from CD.

I like this idea, too.
It will work only with IDE CD-ROMs .
I would do it this way: check if conventional config media is available, 
if not, check if we find a IDE CD-ROM with the config on it, if not, 
*BEEP* BEEP* BEEP* Please insert blablabla

> How hard would it be to write a script that would read a DL CD (or ISO),
> replace one file on it, and write a new ISO image?  This script would
> need to run in a normal Linux distribution (Redhat/SuSE/...), not from
> the chroot development environment.  

I don't think that will be too hard, we (actually you) just need to play 
around with the mkisofs/cdrecord tools. You also need to define a 
minimum version of the tool.

cya
   Heiko

Re: [Devil-linux-develop] DL completely contained on CD?

From: Bruce S. <bw...@ar...> - 2003-08-27 12:27:00

> > It would be easy to hack the linuxrc startup script, and say if
> > /cdrom/config/etc-static.tar.gz2 exists, then completely ignore the
> > floppy and USB devices, and ONLY untar the static etc file from CD.
> 
> I like this idea, too.
> It will work only with IDE CD-ROMs .

Good point.

Speaking of CD drives, I installed the latest DL on a PC with a SCSI CD
drive for the first time yesterday.  I started out with a blank floppy. 
It booted, ask if I wanted to copy the config to floppy (I said "y"),
and it ask if I wanted to probe for SCSI controllers.  Again I said "y".
And ... PUKE!  :-)   It couldn't find any SCSI modules.

Are any SCSI modules available to the boot script at that time now?
Or have they all been removed to save memory?  Or have they moved?

If they've been removed, we might as well remove the code (and question)
for probing for SCSI.

> I would do it this way: check if conventional config media is available, 
> if not, check if we find a IDE CD-ROM with the config on it, if not, 
> *BEEP* BEEP* BEEP* Please insert blablabla

I can't decide if it'd be best to check for media on CD or media first. 
They both have their advantages.

> > How hard would it be to write a script that would read a DL CD (or ISO),
> > replace one file on it, and write a new ISO image?  This script would
> > need to run in a normal Linux distribution (Redhat/SuSE/...), not from
> > the chroot development environment.  
> 
> I don't think that will be too hard, we (actually you) just need to play 
> around with the mkisofs/cdrecord tools. You also need to define a 
> minimum version of the tool.

I took a quick look at the build-iso script, and it shouldn't be too
hard to write such a script.

 - BS

Re: [Devil-linux-develop] DL completely contained on CD?

From: Heiko Z. <he...@zu...> - 2003-08-28 02:10:14

Bruce Smith wrote:
>>>It would be easy to hack the linuxrc startup script, and say if
>>>/cdrom/config/etc-static.tar.gz2 exists, then completely ignore the
>>>floppy and USB devices, and ONLY untar the static etc file from CD.
>>
>>I like this idea, too.
>>It will work only with IDE CD-ROMs .
> 
> 
> Good point.
> 
> Speaking of CD drives, I installed the latest DL on a PC with a SCSI CD
> drive for the first time yesterday.  I started out with a blank floppy. 
> It booted, ask if I wanted to copy the config to floppy (I said "y"),
> and it ask if I wanted to probe for SCSI controllers.  Again I said "y".
> And ... PUKE!  :-)   It couldn't find any SCSI modules.
> 
> Are any SCSI modules available to the boot script at that time now?
> Or have they all been removed to save memory?  Or have they moved?
> 
> If they've been removed, we might as well remove the code (and question)
> for probing for SCSI.

I fixed some of the problems with the SCSI detection, but it's not 
completely fixed.
The script has problems with the creation of the file 
/dev/shm/.probed_modules

Unfortunately I don't have more time to look into this and I'm away this 
weekend. But I'm confident that Bruce can fix it. ;-)

cya
   Heiko

Re: [Devil-linux-develop] DL completely contained on CD?

From: Bruce S. <bw...@ar...> - 2003-08-29 13:40:32

> I fixed some of the problems with the SCSI detection, but it's not 
> completely fixed.
> The script has problems with the creation of the file 
> /dev/shm/.probed_modules

Should be:  /shm/.probed_modules  (without the /dev)

> Unfortunately I don't have more time to look into this and I'm away this 
> weekend. But I'm confident that Bruce can fix it. ;-)

All fixed!  :-)

 - BS