Tails 0.14 rc1 686-pae sees all my cpu cores and RAM
Time to test virtualization.
virtualbox and vmplayer will use the 3.2.0-4-686-pae kernel headers and
compile and insert some kernel modules needed to run virtual machines,
create virtual network cards etc
Kernel headers 3.2.0-4-686-pae, vmplayer & virtualbox need gcc 4.6
There is no squeeze backport for gcc-4.6
A Solution:
dpkg --install gcc-4.4_4.4.5-8_i386.deb
ln -s /usr/bin/gcc-4.4 /usr/bin/gcc-4.6
vmplayer will now install, compile & insert kernel modules
virtualbox 4.2 will now install, compile & insert kernel modules
Side effects of gcc-4.4 = gcc-4.6, none observed
TODO:
1. View release notes & changelogs between gcc 4.4 and 4.6
Everything is running well. vmplayer in particular is *very* fast when I
copy the tails-0.14-rc1 iso to the ramdisk and boot it in a VM, GIMP and
all other apps load very fast
apt-get, it appears secure, using the debian public key(s) stored on the
tails livecd to verify the Releases file (which has the hash of the
packages file), then the hash of the Packages file(which has the hash of
the individual .debs), then the hash of the .deb so it should be ok to
install using apt-get over tor, I havent audited it yet though, there must
be bugs
Once you apt-get install gcc-4.4 and symlink it to gcc-4.6 you can apt-get
install virtualbox4.2 and it will install fine.
https://www.virtualbox.org/wiki/Linux_Downloads is verified by verisign,
so you only get verisign/ssl-level security
The webpage text shows 7B0F AB3A 13B9 0743 5925 D9C9 5442 2A4B 98AB 5139
Oracle Corporation (VirtualBox archive signing key) <info@???>
as the key fingerprint for oracle_vbox.asc which you will need to add to
your apt-key repository, and edit /etc/apt/sources.list and add deb
http://download.virtualbox.org/virtualbox/debian squeeze contrib non-free
to the list. Full instructions are at
https://www.virtualbox.org
If anyone wants to run virtualbox or vmplayer from within their tails
livecd you can do it
TODO:
1. Calculate what size requirements there would be if virtualbox was ever
shipped with tails
2. See how a git patch could be made that is easy simple and just makes
everything work well
Running virtual Tails from within a Tails live-cd:
Advantages:
* Can hide hardware serial numbers, even if an attacker gets root
* Allows stronger enforcement of tor-only connections, an attacker must
break out of a virtual machine, in addition to previous steps taken. A VM
can be configured to only be able to send traffic through the tor process
running on the host machine.
* Enables the features described at
https://tails.boum.org/todo/Two-layered_virtualized_system/
https://tails.boum.org/todo/Two-layered_virtualized_system/virtails.png is
a great diagram, but could be made even more secure by using multiple
computers to separate things even further, whonix has a multi-computer
design
Example setup, each item in brackets[] is a separate computer, connected
to the other computers via a crossover cable:
[Tails Storage Server] Runs encrypted storage from within a vm
|
Gives access to encrypted storage vis sshfs
| Encryption keys are never in RAM of vulnerable apache server
| running many end-user services
|
[Tails Server Edition] Runs Apache inside a virtual tails
|
|
|
[Tails Gateway] Runs only Tor process inside a virtual tails
|
|
|
[OpenBSD livecd] Transparent Bridge Firewall - Runs only pf and allows
only connections to a list of Tor bridges
|
|
Internet
^Bridges may not be recommended for tor hidden services? but this will
also work for a end-user client setup
^At any ethernet crossover cable, an intrusion detection system tap can be
added
A hacker could root a number of machines, and would have a very difficult
time ever revealing the real IP of the machine.
Please critique!
I'm not sure what the point of this email is, other than to get more
people interested in testing out virtualization! and making it easier for
anyone who saw some error messages using apt-get
I was told to discuss here ideas about virtualization and tails as it is
still early in the discussion process
What does everyone think about virtualization and tails?
References:
https://tails.boum.org/todo/Two-layered_virtualized_system/
https://tails.boum.org/todo/amd64_kernel/
%20stored%20on%20the%0A>%20tails%20livecd%20to%20verify%20the%20Releases%20file%20(which%20has%20the%20hash%20of%20the%0A>%20packages%20file),%20then%20the%20hash%20of%20the%20Packages%20file(which%20has%20the%20hash%20of%0A>%20the%20individual%20.debs),%20then%20the%20hash%20of%20the%20.deb%20so%20it%20should%20be%20ok%20to%0A>%20install%20using%20apt-get%20over%20tor,%20I%20havent%20audited%20it%20yet%20though,%20there%20must%0A>%20be%20bugs%0A>%20%0A>%20Once%20you%20apt-get%20install%20gcc-4.4%20and%20symlink%20it%20to%20gcc-4.6%20you%20can%20apt-get%0A>%20install%20virtualbox4.2%20and%20it%20will%20install%20fine.%0A>%20%0A>%20https://www.virtualbox.org/wiki/Linux_Downloads%20is%20verified%20by%20verisign,%0A>%20so%20you%20only%20get%20verisign/ssl-level%20security%0A>%20%0A>%20The%20webpage%20text%20shows%207B0F%20AB3A%2013B9%200743%205925%20%20D9C9%205442%202A4B%2098AB%205139%0A>%20Oracle%20Corporation%20(VirtualBox%20archive%20signing%20key)%20<info@???>%0A>%20as%20the%20key%20fingerprint%20for%20oracle_vbox.asc%20which%20you%20will%20need%20to%20add%20to%0A>%20your%20apt-key%20repository,%20and%20edit%20/etc/apt/sources.list%20and%20add%20deb%0A>%20http://download.virtualbox.org/virtualbox/debian%20squeeze%20contrib%20non-free%0A>%20to%20the%20list.%20Full%20instructions%20are%20at%20https://www.virtualbox.org%0A>%20%0A>%20%0A>%20If%20anyone%20wants%20to%20run%20virtualbox%20or%20vmplayer%20from%20within%20their%20tails%0A>%20livecd%20you%20can%20do%20it%0A>%20%0A>%20%0A>%20%0A>%20TODO:%0A>%201.%20Calculate%20what%20size%20requirements%20there%20would%20be%20if%20virtualbox%20was%20ever%0A>%20shipped%20with%20tails%0A>%202.%20See%20how%20a%20git%20patch%20could%20be%20made%20that%20is%20easy%20simple%20and%20just%20makes%0A>%20everything%20work%20well%0A>%20%0A>%20%0A>%20%0A>%20Running%20virtual%20Tails%20from%20within%20a%20Tails%20live-cd:%0A>%20%0A>%20Advantages:%0A>%20*%20Can%20hide%20hardware%20serial%20numbers,%20even%20if%20an%20attacker%20gets%20root%0A>%20*%20Allows%20stronger%20enforcement%20of%20tor-only%20connections,%20an%20attacker%20must%0A>%20break%20out%20of%20a%20virtual%20machine,%20in%20addition%20to%20previous%20steps%20taken.%20A%20VM%0A>%20can%20be%20configured%20to%20only%20be%20able%20to%20send%20traffic%20through%20the%20tor%20process%0A>%20running%20on%20the%20host%20machine.%0A>%20*%20Enables%20the%20features%20described%20at%0A>%20https://tails.boum.org/todo/Two-layered_virtualized_system/%0A>%20%0A>%20%0A>%20https://tails.boum.org/todo/Two-layered_virtualized_system/virtails.png%20is%0A>%20a%20great%20diagram,%20but%20could%20be%20made%20even%20more%20secure%20by%20using%20multiple%0A>%20computers%20to%20separate%20things%20even%20further,%20whonix%20has%20a%20multi-computer%0A>%20design%0A>%20%0A>%20%0A>%20Example%20setup,%20each%20item%20in%20brackets%5B%5D%20is%20a%20separate%20computer,%20connected%0A>%20to%20the%20other%20computers%20via%20a%20crossover%20cable:%0A>%20%0A>%20%5BTails%20Storage%20Server%5D%20Runs%20encrypted%20storage%20from%20within%20a%20vm%0A>%20%20%20%7C%0A>%20%20Gives%20access%20to%20encrypted%20storage%20vis%20sshfs%0A>%20%20%20%7C%20Encryption%20keys%20are%20never%20in%20RAM%20of%20vulnerable%20apache%20server%0A>%20%20%20%7C%20running%20many%20end-user%20services%0A>%20%20%20%7C%0A>%20%5BTails%20Server%20Edition%5D%20Runs%20Apache%20inside%20a%20virtual%20tails%0A>%20%20%20%7C%0A>%20%20%20%7C%0A>%20%20%20%7C%0A>%20%5BTails%20Gateway%5D%20Runs%20only%20Tor%20process%20inside%20a%20virtual%20tails%0A>%20%20%20%7C%0A>%20%20%20%7C%0A>%20%20%20%7C%0A>%20%5BOpenBSD%20livecd%5D%20Transparent%20Bridge%20Firewall%20-%20Runs%20only%20pf%20and%20allows%0A>%20only%20connections%20to%20a%20list%20of%20Tor%20bridges%0A>%20%20%20%7C%0A>%20%20%20%7C%0A>%20Internet%0A>%20%0A>%20%0A>%20%5EBridges%20may%20not%20be%20recommended%20for%20tor%20hidden%20services?%20but%20this%20will%0A>%20also%20work%20for%20a%20end-user%20client%20setup%0A>%20%0A>%20%5EAt%20any%20ethernet%20crossover%20cable,%20an%20intrusion%20detection%20system%20tap%20can%20be%0A>%20added%0A>%20%0A>%20%0A>%20A%20hacker%20could%20root%20a%20number%20of%20machines,%20and%20would%20have%20a%20very%20difficult%0A>%20time%20ever%20revealing%20the%20real%20IP%20of%20the%20machine.%0A>%20%0A>%20Please%20critique!%0A>%20%0A>%20%0A>%20%0A>%20I'm%20not%20sure%20what%20the%20point%20of%20this%20email%20is,%20other%20than%20to%20get%20more%0A>%20people%20interested%20in%20testing%20out%20virtualization!%20and%20making%20it%20easier%20for%0A>%20anyone%20who%20saw%20some%20error%20messages%20using%20apt-get%0A>%20%0A>%20%0A>%20I%20was%20told%20to%20discuss%20here%20ideas%20about%20virtualization%20and%20tails%20as%20it%20is%0A>%20still%20early%20in%20the%20discussion%20process%0A>%20%0A>%20%0A>%20What%20does%20everyone%20think%20about%20virtualization%20and%20tails?%0A>%20%0A>%20%0A>%20References:%0A>%20https://tails.boum.org/todo/Two-layered_virtualized_system/%0A>%20https://tails.boum.org/todo/amd64_kernel/%0A>%20%0A>%20%0A>%20 "Nachricht beantworten")
