Secured Knoppix CD

[bluefoxicy]

I need to build a fresh Knoppix LiveCD. I want the same deal as Knoppix, with automatic X configuration and the same type of boot-up. I am pondering either rebuilding all of Knoppix. or building from scratch using Hardened Gentoo. More likely rebuilding the Debian base of Knoppix for demonstration purposes, even though Gentoo would be easier due to the support for these security features.

This rebuild has a specific purpose. I am going to use a modified toolchain to produce PaX/PIE/SSP protected binaries where possible. This will demonstrate the transparency of such a base, important for my project[1] as well as Lorenzo's[2]. I'll have to find out what breaks from PIE and SSP and not rebuild those with that; PaX I know everything that breaks for it.

[1] http://d-sbd.alioth.debian.org/
[2] http://debianhardened.sf.net/

The end product of this will be a more secure Knoppix environment. This environment will function exactly like a normal Knoppix, except that it will be impervious to many security exploits. No extra administration will be required by the user. It will serve as a great demonstration to get the security scene moving more.

This CD won't be suitable for installation to hard drive or remastering. Because it will use a post-modified Debian base, it will not be safe to attempt to upgrade the software on the system. This is because Debian does not support the features I wish to add; and so upgrading, for example, glibc would lose __guard and __stack_smash_handler, causing every program on the system to cease function.

I need to extract Knoppix into a chroot environment and force it to rebuild everything using Steve Kemp's modified gcc[3] or (more likely) a derivative which places the SSP symbols in glibc. Any help on how to do this would be appreciated.

[3] http://people.debian.org/~skx/propolice.html

I would greatly appreciate it if in the event of a pleasing and functional product the Knoppix project would endorse these efforts. I can give you the finished product to mirror on one of your FTP sites, and would appreciate having it drawn attention to (mention on Knoppix' front page?). I cannot speak for the Hardened Debian project or for the others I communicate with, but I imagine they'd be pleased to see other projects embrace greater security.

[UnderScore]

It sounds like you are quite accomplished and competant & know what you are doing so I will give an abbreviated description.
Extracting the knoppix CD and chrooting into the extracted enviornment is quite simple. You will need this .TAR.GZ http://debian.tu-bs.de/knoppix/remas...r_0.1-6.tar.gz which is a set of remastering scripts from Fabian Franz & Klaus Knopper. I have a 40GB /dev/hda that I use for scratch work & format regularly.
I boot off the Knoppix 3.6 CD using cheatcodes knoppix 2 vga=normal.
I partition hda 40GB as follows:
- hda1 swap 1GB
- hda2 ext3 6GB
- hda3 ext 20GB

mkswap /dev/hda1
swapon /dev/hda1
mke2fs -vj /dev/hda2
mke2fs -vj /dev/hda3
mount -t ext3 /dev/hda2 /mnt/hda2
mkdir /mnt/hda2/remaster
cd /mnt/hda2
wget http://debian.tu-bs.de/knoppix/remas...r_0.1-6.tar.gz
tar zxvf remaster_0.1-6.tar.gz
mv remaster-0.1 scripts
cd scripts
./knoppix-remaster /mnt/hda2/remaster

Then I follow the menus and create a new remaster and hit <ENTER> for the default path. It will extract the contents of the CD. When it is done it will ask if you want to chroot into the extracted enviornment.
Now you are in the chroot and on your own.

I hope this helps.
James

[bluefoxicy]

So what you're saying is I need to boot the Knoppix CD and tell it to extract to my hard drive from there.

OK, I was trying to do this not booted up but

I tend to know what *I'm* doing, but when others are doing stuff, I get lost; I don't really know why but it takes me a while to understand some things. It's probably that I'm just impatient and/or lazy.

Heh, it wants me to have 1G of swap. Can imagine why, not impressed :P

[bluefoxicy]

script isn't working, it's complained about not being able to change mount options (I did that manually and commented that area) and now it says

/usr/share/themes/Nuvola/gtk/gtkrc:313 error: unexpected identifier 'xthickness', expected character `}'

and tells me to clean up the directory. I'm using a gnoppix (I can't burn any CDs right now else i'd be on a Knoppix, it's a long story of how I melted my drive), is that bad?

EDIT:
OK, managed to get my desktop to start burning, though I'll probably destroy the internal state of my kernel (I can always reboot). If this works I'll finally get to boot a Knoppix, and play with it, plus secure it.

[bluefoxicy]

Alright, it's extracted, 2.0G.

Now I need to replace the kernel with a patched up hardened kernel. I need all of the patches Knoppix uses for the kernel.

EDIT:
/usr/src/ had the patch, tiny thing, thought it'd be bigger
/boot had the config

I'll also need to replace glibc and gcc (easy enough) and rebuild everything.