Local Area Security Linux 0.4a

Anonymous Coward writes "Local Area Security Linux is a small 'live CD' distribution based on Knoppix that aims at being less than 185MB so it will fit on a MiniCD. It is now 107MB with FluxBox as the window manager. It contains about 100 security (forensics, penetration testing, firewall, intrusion detection, etc.) tools including Ethereal and Nessus. See a screenshot here."

Comments

Torrent file

[DJFelix]

Click here for a torrent of the .04a ISO image.

Enjoy!

Re:Torrent file

[numatrix]

Please, PLEASE folks, use the torrent. My desktop is one of the mirrors, and I suddenly noticed about 9Mb/s started flowing and couldn't figure it out. I joked to my officemate that one of the isos I was hosting musta been /.'ed. Then I thought about it and, well, yeah, it was.

Re:Torrent file

[TedCheshireAcad]

I've said it before, and I'll say it again...

BitTorrent is teh rox0r.

296k/sec down, 135k up

sorry about the leetspeek.

Security?

[willy134]

So is this a security or hacking cd? Seems like some good tools to me.

Re:Security?

[Frymaster]

But.. it can be used for the powers of evil.

of course! tools are value-neutral - it's intent that makes something good or evil. a gun can be used to do good, a pillow can be a weapon of murder.

now what we really need is /dev/intent

Re:Security?

[duffbeer703]

I understand that hacking tools don't kill people, people kill people... But what about the children?

Re:Security?

[ichimunki]

It's obvious from the desire to keep it on a "mini CD" that this is meant for clandestine activity. Any legitimate user of "security tools" wouldn't mind simply using a regular sized CD. :)

Re:Security?

[thetamind_pyros]

Oh, trust me, its a hacking CD. Hackers always use miniCDs. They just look cooler than full sized CDs.

I can see it now... In Matrix3, Trinity pulls out a miniCD and holds it in front of the camera. The shimmering glow of the miniCD sends awwws through the audience. Trinity inserts the miniCD and..

L.A.S now booting...

appears on the screen. A couple hard core geeks stand up and cheer.

Could you see that scene done with a full sized CD? No, it just would not be as cool.

maybe I missed it but,

[justMichael]

How do you deal with the weekly Nessus plugin updates? Do you have to d/l and burn a new disk every week or two?

Re:maybe I missed it but,

[anno1a]

With it being based on Knoppix, which is based on Debian, I'm sure a simple procedure of apt-get update, apt-get dist-upgrade could be implemented, installing all (or better, only selected vital-for-security-checking) updated programs onto a RAM-drive.

Re:maybe I missed it but,

[Jeremiah Cornelius]

You run "nessus-update-plugins", which pop th elatest and greatest to your ramdisk.

Same as Knoppix.

No big deal, losing these between boots. The 2200+ vulns on the CD are fine to begin with AFAIC.

Sometimes the child in me wins ...

[JSkills]

"penetration testing" with FluxBox?

Sounds like futuristic porno rather than Unix security.

Sorry. That was not funny and clearly off-topic. Mod me down :-(

New feature request

[Doesn't_Comment_Code]

...All on 1 miniCD. That sounds very convenient.

I request that the next feature to develop is an option where you just wave or shake the miniCD at the computer to remedy any problems. This would alleviate the hassle of putting the miniCD into the tray and running it.

I am a big fan of easy to use diagnostics/repair utilities. This sounds very good, and with just this one final tweaking, I think it will be perfect.

Re:New feature request

[Jerf]

I request that the next feature to develop is an option where you just wave or shake the miniCD at the computer to remedy any problems. This would alleviate the hassle of putting the miniCD into the tray and running it.

Sounds like a great Open Source project to make your fame with. Please make it RFC 2321 compliant.

Standards are very important, after all.

No Damn Blaster...

[Captain_Loser]

Now, how many tools like this do you see for a windows, or any closed source environment. Its tools like these that keep linux away from crap like this balster worm. Linux isn't perfect, but it learns from its mistakes, thats what makes it superior to and closed source software

Re:No Damn Blaster...

[frovingslosh]

Now, how many tools like this do you see for a windows, or any closed source environment.

Actually, there are a number of tools for windows. Even ethereal is available for windows and works pretty well on it. Part of the problem is that you can't legally make and redistribute a CD that will boot and run windows from CD, so there would be no good way to set up windows with everything that needs installed and run these types of applications from CD, even if you had windows on the computer (plus not being able to plan for what flavor of Windows you had). And while there are a lot of good tools to do these things under windows, and most or all of what is on this CD is open source and certainly could be ported to windows, the people making these tools simply prefer Linux and put them there first. But the tools do exist under windows.

live CDs are nice

[Dark Lord Seth]

Live CDs like knoppix are all very lovely but when's the day that I can roll out my own live CDs without TOO much effort? Just select the packages you want, kernel, drivers, etc, wait as the program churns out a nice ISO for you which you can burn to a CD and voila, insta-Linux! Now that would seriously rock as you can simply modify all the basics as you see fit and can easily alter the whole deal for bugfixes.

Re:live CDs are nice

[caudron]

"when's the day that I can roll out my own live CDs without TOO much effort? Just select the packages you want, kernel, drivers, etc, wait as the program churns out a nice ISO for you which you can burn to a CD and voila, insta-Linux!"

When? Today.

What you just described is what Gentoo is about entirely. Gentoo fanaticism aside, if that's what you want, then you should look into it.

-Tom

Re:live CDs are nice

[Anonymous Coward]

You can now.

Check out Morphix. It's a distro based on Knoppix, but modularized. There are small versions (that will fit on a mini-CD) as well as "fat" versions (with all the bells and whistles).

It's designed so that you can choose the features you want, add additional software, and burn a custom CD. Not quite turnkey, but quite doable with a little effort.

Re:live CDs are nice

[Kadagan AU]

Along these same lines, but far more specialized, is MoviX, which allows you to customize it with any media files you like, then burn a liveCD that will play your movies/music on most any computer. I really love all these great innovations coming out these days! Another cool feature with MoviX, depending on the version you download, is that it can load the entire OS into memory, then you remove the disk and put a dvd in the drive to watch. fun times! =D

Re:live CDs are nice

[zapp]

(disclaimer: i've never used Gentoo, this is all just from what i've read about it)

Isn't Gentoo compiled specifically for your machine, with all sorts of optomizations and such? Doesn't that contradict the concept of burning a cd that can run on (almost) any system?

Re:live CDs are nice

[zapp]

I rather enjoy the thought of hostile operating systems that take what they want and give nothing in return.

Here ya go!

Re:live CDs are nice

[jafiwam]

Not that I know anything about it (still playing with Knopppix) but there is Debian based Knoppix like thing that lets you customize the CDs first.

Again, not that I have tried it. Here's a link:

Morphix

Fluxbox

[Blangopolis]

The window manager that LAS is using, fluxbox, is a truly great window manager. I think that it is one of my favorites. It basically is an extension of the blackbox window manager. I was actually reading a review on it earlier.

Overall, this is a great new window manager, that will perform well on lower end machines.

SLashdotted!! mirrors

[Creepy Crawler]

::::: New Mirrors Added! :::::

L.A.S. 0.4a Main with FluxBox MD5: 0939d7294035b5246bedbce1085bb1e1

http://lightning.chem.tue.nl/las/l.a.s_0.4a_MAIN .i so -The Netherlands

http://sarovar.org/mirrors/knoppix-las/l.a.s_0.4 a_ MAIN.iso -India/Asian Pacific

http://psifertex.nerdc.ufl.edu/iso/l.a.s_0.4a_MA IN .iso -USA

L.A.S. 0.3b Main MD5: f47150d2458c78169a65458bcf8ebf96

http://lightning.chem.tue.nl/las/l.a.s_0.3b.iso

http://sarovar.org/mirrors/knoppix-las/l.a.s_0.3 b. iso

http://psifertex.nerdc.ufl.edu/iso/l.a.s_0.3b.is o

L.A.S. 0.3b SECSERV MD5: ff412734492e39d1d084ced556a47493

http://lightning.chem.tue.nl/las/l.a.s_0.3b_SECS ER V.iso

http://sarovar.org/mirrors/knoppix-las/l.a.s_0.3 b_ SECSERV.iso

http://psifertex.nerdc.ufl.edu/iso/l.a.s_0.3b_SE CS ERV.iso

Excellent. :)

[numbski]

I'm getting to really love these things. If it's got ssh, scp, ethereal, port scanner, and a few other goodies, this thing's gonna rock.

Re:Usefull

[tbdean]

I always thought a Linux bootable CD would be great at Best Buy. Throw the CD in, reboot, and then ask the sales rep to come over and show you how to get around "this new version of Windows."

Don't need no network security tools

[Rosco P. Coltrane]

I have a script on my box that puts the eth0 interface down and back up every 3 minutes to break the connection of any evil pirate who might haNO CARRIER

USB flash version

[Kegetys]

How about an version that you can (easily) put on an USB flash memory card and boot from there?

Re:USB flash version

[sys$manager]

Hardly any systems have a BIOS that supports USB booting right now.

Re:USB flash version

[Kegetys]

Hmm.. My GA-8IGX mobo has support for it, based on the i845 chipset which is quite old already. I think there certainly are alot of systems that support it, its just not a very commonly known feature.

Re:USB flash version

[numatrix]

I can think of two:

knoppix-usb
and runt.

Knoppix-usb is based on (you guessed it!) and runt is based on slackware.

Sounds a lot like F.I.R.E.

[Anonymous Coward]

This sounds a LOT like F.I.R.E. (http://fire.dmzs.com) which I've found to be extremely useful, and highly recommend for forensics, pen testing, and other practical security efforts.

Forensics utilities are somewhat useless

[dodell]

In the real world, you don't always have permission to take a box down to perform forensics. Rebooting == downtime. Booting into Linux from a CD to inspect == downtime. When you *are* granted permission to take down a box for forensics analysis (you have to get permission in a search warrant for this, or permission from the company that wants you to investigate, but this is rarely feasable), you'll probably be working for a large firm that can afford forensics tools that cost tons of cash and do much more advanced forensics analysis than the forensics software for Linux.

This sounds more like another goodies CD for people to mess around with at school. Or perhaps something to give people Linux demos with. Who knows. I wouldn't market it as a forensics tool, though.

Re:Forensics utilities are somewhat useless

[Amon Re]

Or more simply....a hacking tool.

Re:Forensics utilities are somewhat useless

[DamienMcKenna]

I think the idea of this is to grab a random PC on the network and use it for testing, like Mary Thesecretary's P4/3ghz that is used for daily reports and word processing. I don't really think they want you to take down the core servers to run tests, if you do that then you don't have anything to test against.

Re:Forensics utilities are somewhat useless

[agentZ]

you'll probably be working for a large firm that can afford forensics tools that cost tons of cash and do much more advanced forensics analysis than the forensics software for Linux.

If I'm working for a cash rich company, why can't I use the free toolkit and pocket the extra money set aside for "tools"?

Re:Forensics utilities are somewhat useless

[Anonymous Coward]

I may be missing something here, but it sounds like you're describing a scenario where a machine has been compromised, and you're discussing what should be done afterwards. If you're describing something else, everyone should just ignore the rest of this article. Otherwise...

If a system has been compromised, then you can't afford not to take it down. In my book, any system that has been compromised is already down and should never be put back on the network again. At least not until you have done forensics, then either re-installed it from the original media or restored from backups that you're totally sure were made before the break-in. Anything else is just an invitation for downtime of your other machines and thus further losses. You may think you can go in and clean out the infection, but that's just a pipedream. You may have gotten it all, but you can never be sure, and from now on, that system is basically useless because it will always be suspect.

And if the rest of the business protests because that system is mission critical, then it's the system admin's responsibility to inform everyone that that's why it has to be worked on right away.

Re:Forensics utilities are somewhat useless

[chef_raekwon]

i agree with your statement to some extent...you won't be downing a server to run some silly tools that you can run on the server...

but, if you are a "security consultant", you simply need to show up, on-site with your mini-cd, and proclaim that all matters will be quickly resolved...as soon as you comandeer the secretary's pc.....
(and quickly reboot it.) .....
i dunno.

Re:Forensics utilities are somewhat useless

[MoralHazard]

Oh, really? Since when does "advanced forensics [sic] analysis" involve expensive tools? What forensic company do you work for, anyway, that you'd have the experience to make such a sweeping generalization? Oh, wait... you DON'T work for a forensic company--you build servers for a living.

I've worked six jobs in the last four months using Unix tools, and used various combinations of dd, netcat, ssh, mount, losetup, grep, and the other unix basics to wonderful effect on every one. They don't really ever fail on account of bugs or arbitrary limit conditions (can't handle files bigger than X MB, for instance), and they're terribly simple to troubleshoot. Oh, and there's nothing like an open-source tool for when you have to walk into court and answer the question "So, Mr. Expert-Computer-guy, how do you KNOW that this software did what you said it did?" It takes the wind out of an attorney's sails when you whip out the printed source code to md5sum and start walking him through it.

I've used the $90K forensic tools from the high-profile companies, and they work OK. Not great , though. EnCase, one of the more popular LE programs, has been plagued with bugs in the latest major version. Also, they're restricted to Windows and Mac analysis, so you're out of luck if you get a Linux machine. Oh, and don't even bother with tech support unless you're a true idiot who has failed to plug in his computer--one time, their IDE write-blocking interface was forcing drives into PIO mode (and taking 40 hours to copy a 10 GB hard drive!), and their phone tech suggesting that I try "www.hardforum.com" for technical advice. Talk about pure shit.

Most of the other insanely expensive tools that I've used have similar issues: limited platform support, buggy out the ass, and crappy tech support. The last isn't their fault so much, because most people using forensic tools are advanced enough that they won't be helped by any by the best--and the best technical/forensic people are expensive. But the bugs, oh god, the bugs!

There are a few tools that the USAF's OSI put into public domain usage that are handy, but really, you just need a linux machine with dd, ssh, netcat, and a custom kernel.

Re:Forensics utilities are somewhat useless

[frostman]

Taking a box offline may not be an option in a lot of environments, but I can think of several cases in which this would be very useful.

1. Small/home/project server
   One of my private servers was taken over once. Very un-nice thing, resulting in several months of frustrating interaction with network provider until we figured out we'd been rootkitted. We reinstalled everything from scratch and did our best to lock it down, but it still would have been nice to have a handy forensics tool to pop on the 'doze box down the hall.
2. Intranet server
   If you have a server on your intranet and you want to run checks on it (say, to make sure you're safe against malicious/disgruntled employees in the billing department), you can pretty easily have a few hours of scheduled downtime at night.
3. Multiple identical servers
   I worked at a company that had a number of identically-configured web boxes. That was the whole point: you could take one out whenever you liked. Since the config was identical, you could take one out, run whatever tests you wanted, and if you found a problem you could fix the servers in rotation.
4. Clueless company
   If you work for someone who has no real sysadmin, and they sometimes expect you to do sysadmin-like things, it could be very nice to have such a MiniCD handy. If that's the case you probably don't have a forensics-kit laptop handy, nor expensive tools.

Of course, always get permission first.

Why not included in distributions?

[kneecarrot]

I have only dabbled in Linux so excuse my ignorance, but some of these apps seem rather important. Why aren't they included in the various Linux distributions? Or are they just better incarnations of included software?

Re:Why not included in distributions?

[eggarsuit]

I think the point of the Live CD is to let people use these tools without having to actually install Linux on their computer. Versions of all of these tools are available with pretty much every other Linux distro. It's just a way to use this software without dedicating a machine, or even part of a machine to Linux.

Re:Why not included in distributions?

[Anonymous Coward]

The point is, when something has gone wrong with your system -- like for example that it's been taken over by an intruder, you can boot up and try to do stuff, but you never know what kinds of traps the intruder may have left for you. Maybe they just looked around and did nothing, or maybe they've left behind special code so that just running a regular program or even just booting up might cause your entire hard drive to be erased. What you want to do in that kind of situation is boot off a different volume -- one that gives you software that is known to be good and known not to be under the control of whoever broke into your system.

Plus, in such a situation, you want to be able to look at the state of the system without changing it. Even booting up a regular system changes some files. If you are going to be contacting law enforcement or anything, you need to gather information that's as accurate as possible, with absolutely no unnecessary changes.

Another reason such a CD might be help is if you are a security person (or a hacker) who travels around a lot and wants to always have your tools with you. This could even be useful to a system admin who wants to do a spot check by booting up the CD on some computer in a different building than where his normal machine is.

Downtime

[Bruha]

Someone earlier said companies cannot afford downtime. True but in most corporate enviroments there are plenty of boxes to take over the job of the hacked box most times and in the event that there's no backup most serious hackings will require the downtime anyways to investigate and fix the issue.

Can you imagine if a credit card database was hacked and they said just bring it back up?

185Meg? That's old sk00l!

[Tumbleweed]

Newer mini-CDs now fit up to 210Meg, FYI.

And they have R/W versions, as well. Nifty!

I always thought something like these would make great floppy replacements, but it looks like USB flash drives are gonna do that first. That's OK - solid state storage rawks, and their capacity is already well over that of even the 210Meg CD-R(/W) mini-CDs.

Here's to hoping they come out with FireWire '2' (IEEE1394.b) flash drives! *cheers*

Knoppix can already do this!

[purplebear]

You should be able to customize what is on the knoppix cd fairly easy already. If you look at the Knoppix cheatcodes, for manipulating hardware detection, there is a note in there about remastering the cd:

If you wish to remaster the CD, please don't forget to specify
-b KNOPPIX/boot.img
for the german version of the bootfloppy, or
-b KNOPPIX/boot-en.img
for the english version, as option to mkisofs. Otherwise your CD
won't be bootable. The directory KNOPPIX, containig the compressed
filesystem file "KNOPPIX", must be located in the top level
directory of the CD.

So, just take the knoppix ISO, copy to disk and modify away. Then use mkisofs with the -b flag to make your new custom ISO. :)

Re:YADLD Yet Again :-P

[autechre]

Lazarus and The Coroner's Toolkit were developed several years ago by Wietse Venema (Postfix, TCPWrappers) and Dan Farmer (SATAN). Lazarus recovers deleted files which can then be browsed with a Web browser. The Coroner's Toolkit is forensics software (post-breakin analysis). I saw a presentation on them in 1999, and they looked very useful then; I'm sure they're even better now. Fortunately, I haven't had occasion to use them :)

Re:Redundant

[advocate_one]

no, not redundant at all... optimisation will make it work fast on only the machine you built it for... try booting an "optimised" CD on the machines in a mixed environment... one where you have no real idea of what is in the box until you fire it up... like at a friends or clients place.

Those binary packaged tools also have the source available on the web and you can check each package out yourself there. the list of packages is available on the download site...

The guy who put the distro together has merely taken the trouble to save you a lot of time by assembling all the packages himself. I'm sure he will be just as keen to keep it up to date as well keeping track of major holes and also making sure you have the documentation available so you can keep it up to date yourself as well like you can with Knoppix.

I take it from your tirade that you've never enjoyed the advantage of Knoppix in being able to boot up the disk on someone elses computer without having to actually mess with the hard disk at all??? Just try turning up at a clients site with a CD stuffed with source code and expecting to be able to install it all on the hard disk before you can conduct your tests... and having to wait whilst it all compiles...

The prepackaged binary CD is far more convenient... and you can leave a copy behind for him to use himself... I've left behind some twenty knoppix CDs now for friends and relatives to play around with so they can experience Linux without having to mess with their hard disk. I've since gone back and installed it properly for seven of those people as duel boot setups.

Just like Trinux

[DrugCheese]

I used to use an old floppy based distro called Trinux. On about 3 floppies I had X server + GUI web browser and some network tools to do some testing. I think it was flown as a security tool distro but I used it mainly for network troubleshooting. Still ahve the floppies but I think the site and distro have died.
Anyone know what I'm talking about?

Re:Great Idea...

[toddestan]

Yeah, I walk around my schools campus carrying CDs that say things ldke l33t h4k0r1n9 t00lz" on them.

Heck, I'd just throw a few low quality .mp3's in any free space on the CD, and claim it's a CD of remixes of Britney Spears and 'N-Sync. I doubt they'll suspect anything.

I'm using it right now ...

[MacEnvy]

I'm typing this right now in the "Links" browser. It's fast, it looks good, it has most of the tools I use (Nessus, Ethereal, XMMS, Firebird). I might just mod this and carry it with me instead of using other people's machines when I'm doing diagnostics. It picked up my wireless correctly and everything.

Have fun with this one, kids.

Re:More suicide bombing in Israel?

[spacecowboy420]

Why is it flame-bait when someone states an obvious fact? I have no problem with jews or any other religion/group of people - but more and more I am finding it hard not to be an anti-semite. As the parent poster pointed out, why do the Jews never learn?

It seems to me that everyone that answers a question by invoking God (Allah etc..) you are sentencing yourself and your children to death. Doesn't the fact that deaths caused by religious fundamentalism out number any disease (plaque, aids etc..)combined click in the mind of the most logic challenge that this is not the correct path? Doesn't murdering people - at all - tell you that you are as wrong as the murderers you are fighting?

Want peace? Remove god from the equation and you'll be on the short path (not there, but almost - you need to establish secular morality first)

no, I didn't forget the AC button, I truly believe what I say, mod me the way you like, but I speak truth.

I'm not impressed

[frovingslosh]

OK, I'm running it right now. I'm not very impressed. The menu does not list all of the included apps (none of the security apps, the very reason for this, as far as I can tell. It (the menu) does have stuff I don't want, including a lame game, a spreadsheet, a winamp clone and some other stuff, but not the security stuff!

I got a shell running, but there seems to be no man command and no documentation for some things in the menu, like the TinyIRC client. Obviously since I'm posting this from the running ISO there must be a web browser, but I had never used "links" before, so it was not easy to find. How I find the security tools supposedly built into this I have no idea. I did get a GUI ethereal running by bringing up a shell and typing in ethereal, but I just don't know what else is here (and what isn't).

By the way, I have network issues when booting Knoppix on this computer, so I booted this ISO with the "Knoppix expert" option. Or at least I tried to. Although it prompted me for the boot option, it ignored it after I typed it in.

Knoppix as a Debian installer

[deadcasuals]

One thing you can do is to install the Live CD to a hard drive to get a permanant installation. While this may seem counter productive for a Live CD, I've found it to be really useful. I'm currently using the Knoppix Security Tools Distribution as a "desktop" OS... :-) Knoppix 3.2 (what both these distros are based on) includes a really useful script to install the Live CD to the hard drive. It's the easiest way I've found so far to get a Debian testing/unstable system installed and running - with X configured correctly the first time! That, in addition to having tons of great security tools preinstalled and configured makes for one sweet network-workstation-on-steroids.

...of course, I'm in charge of security where I work, so using this as a desktop OS may get you fired from _your_ work... :)

g00r00?

OpenBSD?

[megaversal]

If they're trying to offer a secure server Linux distro, you'd think they'd run their webserver on that instead of OpenBSD.

Re:let me get this straight

[MacEnvy]

I'm using it (firewalled, proxied, spoofed) to test out the OS, not as a security platform. I'm just sitting here at home fooling around. Nice joke, though.

Re:Great Idea...

[Gyorg_Lavode]

Wait, employees of your school actually care what's on the CDR's your carrying around? I could have walked around the school w/ a toolbox that said "big ol' hackin kit" on it and no-one would have looked twice.