[code] [blog] [VNC] [E-Mail me] [GPS Tracker]

gentooSeptember 13 2015 18:02:03

This website runs on a relatively insecure VPS. Hence I developed a set of scripts to aid me in maintaining a certain amount of privacy. Below you will find a Gentoo distribution for use in these environments. It comes with an initrd that automatically probes all network devices to acquire an IP address, and a ssh daemon that allows the user to connect right after the kernel is loaded.


After connecting to the server an administrator can connect to this server and set up his entire system in RAM - or if preferred set up disk encryption from this shell. Thus allowing full disk encryption on a VPS or co-located server, even when VNC is unavailable. When the server goes down, is confiscated or otherwise interrupted, all the sensitive data contained in it disappears.


This distribution can run on both VPS and co-located servers, however when running a service of which the privacy is critical, a co-located server is preferable. For co-located servers it is advisable to ensure that removal of the server from the rack, or manipulation of the server leads to the system shutting down. This can be done trough chassis switches, and other physical means.


There are ways to compromise this system, most of which only apply to a VPS. For instance it is possible for the hosting provider to modify the initrd in such a manner that any key entered is logged. If the VPS provider uses a box with hyper-threading enabled, or no fixed cores allocated to your VPS, it's entirely possible to steal CPU caches of another VPS and discover encryption keys that way. However, when using a co-located server, with physical protections in place, booted from an USB stick with this initrd, it is nigh impossible to do this. Which, until this gets built into a kernel is probably our best bet at security in boxes we have no direct control over.


This distribution contains 3 files. boot.tar.xz containing a default kernel with a default ssh login, namely root: toor. It is obviously inadvisable to use this with an unmodified password. Furthermore it contains root.tar.xz, the Gentoo distribution used to build this kernel image. And it contains files.tar.xz, the scripts one can use to produce this Gentoo distribution from a base hardened gentoo installation, should the need, or the paranoia to do this arise.


When building the kernel yourself for the first time, it is advisable to enable Grsecurity and SeLinux. The provided kernel does not have these enabled, they are, however, essential to Linux server security.


Package dependencies, by script:
  bin/buildkernel:
   genkernel
  bin/modinitrd:
   busybox
   dropbear
   cryptsetup
   curl
   links
   lvm2
  root/update:
   gentoolkit
   eix
   layman


Login:
   Username: root
   Password: toor


The script "buildkernel" builds a kernel, and prepares an initrd automatically. The script "modinitrd" modifies an intird generated by genkernel to contain the files necessary for this distribution. The script update contains a set of commands commonly used to update a gentoo installation.




File root.tar.xz
Size 375.33MB
crc32 934941264
md5 724807114acbe0dfeccdc4ca7d38aa95
sha512 b93d3e029924e6f0e17cad8e9e00e52635a51215ff9e19769e92be17aae673a2d9f673679ec28cb4ceef1b82c8432a48b7f3b511b0ace1e4691397f340c9f13a
File boot.tar.xz
Size 22.24MB
crc32 2990426547
md5 5bbc1b2ac4d8bd447aa9c0b2aa0a46a4
sha512 275b3d9abc5798c2600000177ad73af26b77772f01f1dfea886335a75695672f2c2709003b5b840af3c10244a22c1fd9cde7959c2ee41d6149e43db84f637330
File files.tar.xz
Size 3.18kB
crc32 57119666
md5 83cfd553dec0ec716e3258922f7b1a7f
sha512 399580e577a90cff85a60d37e4ad8a880cede90d424e84d183880f1eb722fe87e58ccabf57a7af99c04e48aa2566a48827fee20758de182b05b5faca6e1af4e5