Slashdot Mirror

You can't even boot Linux from a floppy no more :(

Hum, I can boot linux on a single floppy and make it my firewall with all the needed utilities. For exemple with Coyote Linux...

If all you are doing is running a router, anything more than a Pentium I and 64MB RAM is probably wasted. Go to http://www.coyotelinux.com/ and you will be amazed at what you can do with a 486, 16MB of RAM and a 1.44MB floppy.

However, there are several Linux distros that do what you want out of the box. Have you looked at smoothwall (http://www.smoothwall.org/) or coyote (http://www.coyotelinux.com/)?

You might be interested in Wolverine, the more feature-rich, commercial cousin of Coyote Linux (which I have used contentedly for several years).

One exception to this is Coyote Linux. Not only does it not have the usual services enabled by default, nearly all of them have been stripped out. It includes just the components (such as iptables) that serve the central function of safely connecting a LAN to the Internet. And because it's so minimal, it fits on a floppy and runs on a 386 with 12MB RAM. It's no substitute for a full-featured Cisco Pix (for that you'd have to look at Coyote's big brother Wolverine), but it's worked great for me for years, both at home and in a couple offices I've worked at.

my simple firewall solution involves an ancient pentium 200 with a couple network cards, some ram and a floppy disk running Coyote linux. It offers everything I need, saves the configuration to the floppy in case of a power failure, and didn't cost anything (the machine was gonna be junked anyway).

Add wwo network cards
Add free Linux 2.4 distribution or higher
Activate netfilter and iptable
See: ttp://www.netfilter.org/
Deploy firewall using instructions in the netfilter how-tos:
See: http://www.netfilter.org/documentation/

Or, if that's too much for you, just get the equipment and add one of the pre-configured firewall Linuxes like SmoothWall (http://www.smoothwall.org/), Devil-Linux (http://www.devil-linux.org/home/index.php) or Coyote Linux (http://www.coyotelinux.com/).

No fuss, no muss.

Steven

Wolverine is already in use for an embedded Linux distro customised for Firewall and VPN server use.

http://www.coyotelinux.com/products.php?Product=wo lverine

Apple would not be able to use Wolverine for any software product unless they buy out Vortech who have a common law trademark on the name, etablished by many years of marketing their Firewall/VPN Linux distro.

Simple to set up and will run on any old machine you have lying around.

But I'm in no hurry to retire it. For one thing, it works. For another, I know how it works, and I have the flexibility to make it do whatever I want (laws of physics permitting). For a third, Coyote Linux is still being enhanced, so periodically I find that building a new boot floppy will make it work even better.

P.S. Why put a 100Mbps NIC on the LAN side? Not that there's anything wrong with it, but contrary to the implication of the term "router", your local traffic (e.g. workstation to file server) doesn't pass through it; only your LAN-to-WAN traffic (which I trust has a <10Mbps bottleneck at your ISP) is actually received by the router. So there's no performance advantage to a fast card.

Look here and here.

This is slashdot...if you're here, you're probably a geek, and cheap to boot...build your own.

First link is for control freaks, second link is for putterers.

As much as I love tomsrtbt, it has saved my butt many times, it is not the whole answer to the poster's problems. tomsrtbt is first and foremost a rescue system. You'd have to go through a lot of mounting and manually starting the stuff you want up. What he wants is to boot from floppy (and tomsrtbt is not the only distro that does that) and get the rest of the system up from a USB stick. There is quite some work to be done before you get there.

"Chugging"? Pull out that noisy hard drive and put a Coyote Linux floppy in /dev/fdo. The CPU has a fanless heat sink, and there's no 5400rpm top spinning in the case, so after a minute of noisy drive seeks during boot, it's quiet as a mouse and maintenance free. If I had decent air conditioning in my house, I'd even consider snipping the wires to the power supply fan, and it'd be completely noiseless.

Different formats? FAT12 is the only widely-used floppy format I'm aware of, even by Linux boxes. If you're thinking of Apple's diskette format, that's been rendered pretty obsolete by the fact that the vast majority of Macs in use today are from the iMac era, and do not have floppy drives. I don't think OS X even supports them, at least not the default install.

Plus there are the countless rack-mounted servers with limited real estate (both in the front panel and in the box). Not many floppies in those.

I'm a use-it-until-it-won't-power-on kinda guy, and I like to play with antiques (like my Quadra web server), but of the dozen+ functional computers in my shop, less than half have floppy drives. And the only ones that have actually read data from or written data to a diskette in the last year or three are my Linux-on-a-floppy firewall/router, the machine with which I built its boot disk, and the aforementioned Quadra.

Fact is, there's no storage medium that's really common to all currently-used systems. Floppies are still the closest thing to that , but they're becoming less so every month. It won't be very long before CD-RW gets closer to "everywhere" than the floppy.

...the Linux Router Project, a floppy-based 386-compatible micro-distro which served as the basis for (among other things) Coyote Linux.

• Coyote Linux
  
• LEAF
  
• LRP (now dead)
  

Solution: Switch to a package that doesn't use a hard drive. Coyote Linux only needs a 1.44MB drive, a couple old NICs, 386, and 12MB RAM. (You can send logs to another machine if you actually want them.)

Specifically, lwn.net/Distributions/index.php3#secure and possibly also the special purpose distros (mini, floppy, cd, whatever).

Engarde, Immunix, and Openwall are all designed to be secure platforms for server or firewall development.

If you want something small, you might look at LEAF or Coyote or Wolverine. Coyote is free, Wolverine is $30-$120 depending on which license you need.

Personally, I'm using Astaro (free for personal use). It seems to be well designed from a security perspective (everything is chrooted, etc.), but it is not easy to customize the web interface, etc. A 'pluspack' is downloadable which includes gcc, etc, or you can compile on RedHat if you have the right versions of all the libraries.

Very easy to configure port forwarding rule configuration (from the windows gui)

Easy configuration of hardware (to keep it small enough to fit on disk)

Stable

Maybe I'm missing something, but isn't coyote linux a somewhat obvious choice for this?

The scripts are open to modification as much or as little as you like. IIRC, the end of the script is building/compiling the packages you've requested.

Seconded...if you want to simplify it a lot, just use Coyote Linux (although it's not nearly as flexible as a modern LEAF distro like Bering, it's really easy to make go). LEAF is good.

Amen! See the Coyote Linux site. It's IMPOSSIBLE to find anything. (The guy who runs it has even received comments to that effect and has said "Screw you.")

LRP is the grand daddy of many "embedded" linux projects. LRP proved two concepts, 1) the need for GPL appliances that run from ram and essentially read-only media, and 2) a clever compressed read-only package system (.lrp instead of .rpm or .deb) for conserving boot media storage space. These ideas spawned LEAF, CoyoteLinux, and forshaddowed Knoppix, which all boot from floppy or CD-R media with compressed files to improve storage.

LRP was floppy firewall distro, that did not need a harddrive. It needed only 386 PC or better, 2 Nics, floppy drive, and sometimes a keyboard and monitor. It did not do fancy things, just NAT routing, firewalling and DHCP. But you could add .lrp packages for other cool features like DNS caching. The .lrp packages were just a renamed .tar.gz with binaries compiled a certain way, but they worked and saved space. Although building an LRP floppy was not easy for a novice, the package system made floppy firewall setup MUCH easier. With developers shrinking package sizes again and again, other lrp packages could be added, or log files could be added. Very clever.

But LRP failed to inivate fast enough, (e.g. I lobbied for a bootable CDs, to no avail) or document well enough, so Linux Embedded Application Firewall [LEAF] forked off. LEAF got space on SourceForge and spawned flavors, such as Oxygen, Dachstein, Eiger, Bering and others quickly helped fill out the space, improving core technologies and documentation. LEAF added bootable CDs and tons of packages. But LEAF struggled with picking a GlibC version and development of extensions became some what Balkanized.

The size limitation of the floppy made 2.4 kernal and iptables unatainable. Chuck Stienkhuler removed this boundry with his LRP-CD, which could fit every major linux ethernet driver, and so much more.

When I saw that, I thought, "well why not a full distro on a bootable CD", and was pleasently surprised by finding Knoppix. I even was the first person to mentioned it on Slashdot. [search Knoppix in stories on slashdot and find the first entry :) ]

LRP also spawned the CoyoteLinux firewall, which added a Win32 floppy build exe and a linux floppy build bash script. It makes building a floppy firewall really easy.

Death of LRP is not a surprise with LEAF on the scene. There is much life in the "embedded" linux space beyond firewalls. LRP got thing moving and many other GPL projects have adopted the core ideas and kept up the rate of acceleration. Bootable CD distros are exploding, into Mesh Networks, MAME systems, Linux on X-box hacks, PVR systems, LAN MP3 Servers, print server, LAN DNScache/DHCP/NTP server, Honey Pots and on and on. We will se more and more bootable CD distros, that will make our lives easier, and take the strain out of admin and system upgrade. Oh look, a new ISO on line, I down load and reboot my system. If it does not work, I pop the old CD-R back in. No muss, no fuss.

LRP is dead, long live LEAF and Knoppix, and ...

-Nathaniel
Mac Refugee, Paper MCSE, Linux wanna be.

Coyote Linux is another good one.

You take one of the most unreliable forms of disk media, the floppy disc, and expect it to run something continuously and reliably, such as a firewall/router.

That's not how it works. The floppy isn't touched after the system has been booted. You just boot from the floppy, then everything is on a ramdisk.

I set up a box with Coyote Linux (itself based on LRP, IIRC) a year ago. No downtime yet.

Linux Router Project is base for many single floppy etc distros. Most widely used are probably LEAF branches - http://leaf.sourceforge.net/ and Coyote Linux Floppy Firewall - http://www.coyotelinux.com/.

stronghold on high-end computers

my ntoskrnl.exe is 1.8MB

That won't fit on a floppy. See Coyote Linux.

My router uses a floppy-based distro and that has the 2.2 kernel, and I really see no reason why I would want 2.4 on that old box. It isn't broken, so it doesn't need an upgrade to 2.4. You could say that it isn't very vulnerable to the mentioned problem either, because if someone got access to it, I would have a far bigger problem than them crashing my router. Others may have other uses for 2.2, so a fix of the mentioned problem is definately a Good Thing[tm] and nice news.

Coyote Linux!

I know it's not supposed to be CDROM based, but it is smaller and easier. They've stopped developement on it, so it's pretty stable. You can hack it to run off a CDROM, but it's just as good from a floppy. It's part of the Linux Router Project, and it acts as a pretty good firewall too. It uses IP chains and IP masquerade, so you can do as much or as little configuration as you want.

Try Coyote Linux I've been running a DSL firewall-router off a 486 motherboard, two ethernet cards, and a floppy disk for about a year now.... it's the best thing I've seen out there.

I was running this on old 386 and 486 machines with 8MB ram, though I think the newest releases require a little more ram (more ram would also allow for more firewalling rules).

T

Plan ahead. Change MS Office default file formats to friendly open formats now. Setup all servers to linux. Test users interest with Knoppix bootCD-OS. If Knoppix goes well with users install Win32 versions of favorite Open Source apps. Run your own audit of the company's win32 systems. Duplicate and convert propietary data files to open files (e.g., .doc to .rtf) by hand if you have to, but some folks may have automated it. Find special case win32 software needs, and see if wine will support. Then convert several users at a time, starting with the tech savy, and see if you can avoid mutiny. People have invested a lot of time learning one way, they hate upgrades, (remember the last of many Microsoft and Adobe upgrades?) so be patient when you upgrade your users to Linux desktop.

Changing MS Word users default Save file format to .rtf is easy. It will make all upgrades to OpenOffice much easier, and allow several version of MS Office to play nice, even if you don't upgrade. Years later you will be able to read old MS Office files, hooray!

As many have said:
Setup servers for windows file and print, web hosting, DNS, DHCP, and SMTP (samba, apache, bind, DHCPd and sendmail) in the back office. LEAF, LRP and CoyoteLinux firewalls are an easy place to start the conversion.

Try Knoppix BootCD-OS (debian) on every box, see if users can deal. It is complete Desktop with OpenOffice, Xmms, ogg-vorbis, Gimp, FreeCiv, and tons more on 700Mb CD-R. It auto-detects a ton of hardware, such as sound at each boot, and does not get installed to harddisk. It needs 128Mb Ram, or pagefile/swapfile/scratch disk on a box with less ram. If the user can't deal, eject the CD, and reboot back to MS Windows.

Setup each Win32 computers to run a script stored on a central server, at each boot. It saves a ton of work later.

Getting Win32 users into the OpenSource thing by installing Win32 OpenOffice and Mozilla on your current MS Windows install base. See how that goes with the users.

Convert your existing data from .rtf to .doc is critical. The user is a tease, no email or code! But it is an idea that should be packaged.

Run an audit on your Win32 systems. Get a file dump e.g., "dir /AH /ON /S > m:\filetreedump\box2tree.txt" on Win98, and goto to regedit and dump the registry to text file e.g., m:\filetreedump\box2reg.txt. Someone needs to write a nice perl based evaluation tool to audit what apps and software keys everyone in the Windows network is running.

Converting data is essential. Collecting data from users computer and registry, and inserting it into new email client, and Office apps should be automated, but no one has done it yet.

Wine testing for special apps is important.

After careful planning start rolling out conversions. This way you can convert data, support all the apps, and not loose users.

-Nathaniel

Herbix : "Herbix is a Linux server that fits on a floppy. It supports ipchains and can serve FTP, HTTP, IRC, DHCP, SMTP, and IDENT."

Mike's Jukebox Distro : "Mike's Jukebox Distro is really just a floppy image that you add to a CD full of mp3's, using it as the El-Torito boot image. It has a complete Linux kernel and madplay, along with BusyBox. A simple shell script uses "find" to get a list of all mp3's on the CD, and it then plays each of them in order. tty3 is used for the player output, tty1, and tty2 have shells to allow the user to "play" while it's playing music."

RIMiRadio : "RIMiRadio is a floppy disk distro of Linux and an Icecast server."

floppyfw : "Floppyfw is a router and simple firewall on one single floppy. It uses Linux basic firewall capabilities, and has a very simple packaging system. It is perfect for masquerading and securing networks on ADSL and cable lines, using both static IP, DHCP, and PPPoE, and provides a simple installation, which usually involves editing of only one file on the floppy."

BBIagent Router : "BBIagent is a single floppy Linux-based router for sharing a broadband Internet connection. It also serves as a firewall to prohibit intruders from accessing your LAN. You can create your own BBIagent router software (a diskette file image) on our server based on your hardware configuration (NICs) and connection protocol (e.g. PPPoE, PPPoATM or DHCP). It is very easy to install and use."

Coyote Linux : "Coyote Linux is a single floppy distribution for people who have an Internet connection that they wish to share with other computers on a LAN. In addition to connection sharing, it also provides firewall services to help protect the internal network. The goal of the Coyote project is to make it as quick and easy as possible to share an Internet connection."

Tom's RootBoot : "rtbt is the most Linux on one floppy disk for rescue recovery panic and emergencies, contains tools to keep in your shirt pockets, is useful whenever you can't use a hard drive and contains about 100 rescue tools."

Pocket Linux : "Pocket Linux is an almost minimal, one floppy linux system designed to quickly convert PC workstation into secure linux-based workstation using ssh to connect to remote host (other networking clients are also supported). It supports bootp for determining host IP and other network parameters (there's also manual configuration possible, but bootp is recommended). In addition to workstations equipped with a network card (ethernet or arcnet), you can also use Pocket Linux on a PC equipped with a modem. Modem is automatically detected and then PPP connection is made."

Trinux : "Trinux is a minimal Linux distribution that boots from a single floppy or CD-ROM, loads its packages from an FTP/HTTP server, IDE filesystem, or additional floppies, and runs entirely in RAM. Trinux contains the latest versions of popular network security tools that can be used to conduct security research, analyze network traffic, and perform vulnerability testing."

Hopefully this list is helpful to those of you just starting to think about tiny distros.

• http://www.superant.com/smalllinux/
  
• http://ibiblio.org/vectorlinux/
  
• http://www.zelow.no/floppyfw/
  
• http://www.xandros.net/
  
• http://www.gentoo.org/
  
• Smoothwall ...
  
• http://www.ipcop.org/
  
• http://www.mandrakesoft.com/products/snf
  
• http://www.freesco.org/
  
• http://www.coyotelinux.com/
  
• http://leaf.sourceforge.net/
  
• http://www.gnatbox.com/Pages/gblight.html
  (this ones based on BSD IIRC)
  
• http://www.bbiagent.com/
  
• http://www.clarkconnect.org/"
  
• http://www.linux-firewall-tools.com/
  

From one of the fist fellows to bring a RoadRunner clinet to Linux, Josh Jackson.

This is simply put the slickest stuff going from what Ive seen, I actually waled my mom through an install over the phone.

COYOTE LINUX

There is it appears a new embedded version, Ill have to look at that,

Ive had 2 installs up for over a year, both only ceased functioning once, when the people at their location forgot it was there and unplugged em, (both places:)

To me something you can truly forget about is the ticke, VPN clients and all....

• Astaro Security Linux: kernel 2.4.x
• BBIAgent: kernel 2.4.13
• ClarkConnect: iptables, kernel 2.4.9-31 (RH 7.2)
• Trinux: iptables, kernel 2.4.x (Slackware)

• Coyote Linux: kernel 2.2.19
• IPCop: kernel 2.2.x
• LEAF/LRP/Dachstein: kernel 2.2.19
• Mandrake SNF: kernel 2.2.19
• Smoothwall: kernel 2.2.19

• Freesco: ipfwadm, 2.0.38 (!)
• FWTK: Dunno, looks old, mentions ipfwadm

1. Freesco which I personnally use on a 486/dx2 with 8mb of ram. It has many functionalities like remote access, dhcp, dns, print server, firewalling, masquerading, bridging, support for many ethernet cards and best of all fits on a floppy (no HD required, but possible to do a HD install) Works like a charm and very easy to setup... almost plug and play (although not like windoze's plug and pray)
   
2. Coyote Linux which seems to offer a few more features than freesco, but requires 12mb of ram. Again, fits on a floppy.
   
3. SmoothWall which seems to be more of a feature complete firewalling solution includes web-based admin, proxy server and much more. It's larger (30MB or so) but seems fairly easy to use.
   

It's a great way to make that ole' Packard Bell 486 come back to life!

Note sure if this qualifies, but it is a neat little floppy disk distribution that does nat. Check it out at http://www.coyotelinux.com/.

Do it with an old 486 motherboard like this or this or this or this or this or this or this or.....

Q: I'm having problems with running two of the same NICs.
A: It's not suggested to use two of the same brand and make because it makes diagnosing problems rather difficult.

Thanks for all the advice!

There's lots of projects for that, but
Coyote Linux is my favorite.

(Offtopic, so sue me... I'm honestly answering the guy's question ;-)

70 Dollars?! Coyote Linux does this too, and is free.

You poor, naieve fools. This is the cable company you're dealing with! And you trusted them not to put anything harmful or obnoxious on their CD? I can only hope you've learned your lesson.

My linux-based router knows how to use DHCP as well as can be expected of any x86 OS.

Road Runner doesn't care for ACME-distributed products, either. And I'd wager that coyotes aren't all that popular as well.

I believe the easiest way to setup a good firewall is to find an old system (or assemble one). A 486 66mhz with 16MB of ram works incredibly well; but an even lesser system is also good.

Put in two Ethernet cards, and install Coyote linux. A distribution that works off of a standard 1.44Mb Floppy Disk. It reads its config. and binaries from the disk at bootup, and never touches the disk again - to ensure the drive lasts as long as possible, as well as the disk.

This solution is so good, (in my humble opinion), that just last year me and my makeshift consulting company were selling 486 boxes configured for just this purpose at about $300CDN. 1 of the 5 boxes we sold went defunct; it's Cmos battary died. So we replaced the whole box (for nothing) to save time and still made an 'ok' profit.

The benefit to using a whole system, especially an outdated one is the amount of customization you can make to the firewall; ie: displaying attacks of a certain nature on the monitor, respond to attacks of a certain nature maliciously, and automatically. etc. etc. And it's cheap. Super cheap!

The only disadvantage to Coyote is that the distro. doesn't support HDDs, so you can't keep extensive log files.

I would only buy Hardware Routing / Firewall Devices for small business that may wish to go with another, less "knowledgable" consulting company in the near future. Otherwise, Linux boxes are the best for Networking.

Check it out:
Coyote Linux Dot Com

Ace905
[Admin] www.MyHomeTechie.com

Old 486 no hard drive, no monitor, 2 NICs and run Coyote Linux

Well, I can say that Coyote Linux is the sweetest Ive used,

http://www.coyotelinux.com

Take a 486, 12 megs ram, 2 NIC and less than 5 minutes and youre DONE , too sweet

I have 6 months uptime on the one, I keep forgetting its there, IMHO that the kind of router to have , one you forget is there because it works right %100 of the time,

I hacked a custom box for it too, one of those mini cases,

board, NIC, floppy, no video keybd or mouse, on Yep of all machines a packard bell P-75, Did anyone else know those things would run headless ?

The CoyoteLinux distro runs from a floppy and makes an old machine a perfect firewall provided you add 2 network cards and a floppy disk drive, but this should cheap enough regarding the security you'd get.