• List of iSCSI Mutual CHAP Posts by OS
  • Tools and Utilities for Windows
  • Unix and Linux Distros

slice2

slice2

Category Archives: Linux

Patch Alma Linux 8.7 on an Offline or Air-Gapped System

03 Friday Feb 2023

Posted by Slice2 in Linux, Security

≈ Leave a comment

Tags

Linux, Security

So you’ve successfully switched from CentOS to Alma Linux and your hosts are on an isolated network. This post demonstrates how to patch a Alma Linux 8.7 host when it doesn’t have internet access or is an isolated system with no access to a yum repo.

On a host with internet access (Public facing host), perform the following steps. I used a Alma Linux 8.7 VM running on Windows 11 and VirtualBox 7.0.6. As long as you have internet access, any rpm based Linux distro will do as long as it has rsync, genisoimage, and yum-utils.

1) Make sure you have rsync, genisoimage and yum-utils installed. If not install them.

> sudo rpm -q genisoimage-*
genisoimage-1.1.11-39.el8.x86_64

> sudo rpm -q yum-utils
yum-utils-4.0.21-11.el8.noarch

> sudo rpm -q rsync
rsync-3.1.3-14.el8_6.2.x86_64

a) If not, install them.

> sudo yum install genisoimage
> sudo yum install yum-utils
> sudo yum install rsync

2) On your internet facing host, create folders for the repos and packages you need. You can specify any folder(s) you require. I require the repos below, but you may need packages installed from other repos so create those folders. Most people only need BaseOS and AppStream. The “updates” repo is no longer used in 8x and has been removed. Updated packages are just placed in their regular repo and not separated. The full list can be found on a mirror site like this one I use https://mirrors.rit.edu/almalinux/8.7/ but you can use any mirror you like.

a) Create the folders locally and harvest the data from the mirror site using rsync. Note that these folders will create an approx 35 Gig ISO file in step 3. You need a Blu-ray burner or USB drive to move the file to your air-gapped hosts. Also make sure the filesystem you write the ISO to has enough space. Note that there are two dashes before “- -“progress below, not one. It renders as one dash so make sure you have two dashes before progress or just remove that option from your cli. I have noticed that if you copy/paste from html to PuTTY or a terminal window and the rsync command fails, you have to backspace over the dashes in front of “avrt” and “progress” and retype them.

> sudo mkdir -pv /repo/BaseOS
> sudo /usr/bin/rsync -avrt – -progress rsync://mirrors.rit.edu/almalinux/8.7/BaseOS/x86_64/os/ /repo/BaseOS

> sudo mkdir -pv /repo/AppStream
> sudo /usr/bin/rsync -avrt – -progress rsync://mirrors.rit.edu/almalinux/8.7/AppStream/x86_64/os/ /repo/AppStream

3) Use genisoimage to create an ISO of the whole set. Note that in the command below, I write this ISO image to a VirtualBox shared folder mounted at /media/sf_vboxshare. Use any path you like as long as it is big enough. The syntax is: genisoimage cli options – location and name of ISO file to be created and files/folders to be included in the ISO.

> genisoimage -U -r -v -J -joliet-long -allow-multidot -allow-lowercase -iso-level 4 -o /media/sf_vboxshare/AlmaLinux8.7.repo.2023FEB03.iso /repo

4) Burn the ISO (as a file, not as an extracted image) to a Blu-ray, or copy to a USB drive and move it to the offline or air-gapped host. Since I have VMs, I will automount the ISO to the VM. If you need to mount the ISO on a host with a Blu-ray, USB drive, or from the local filesystem, the next three steps outline how to do it.

a) Mount the ISO on your offline or air-gapped system. You have options if you don’t automount ISOs. If your host is a VM, mount it as your hypervisor dictates. You can copy the ISO to the local filesystem and mount it. Or, manually mount the ISO from a local or USB attached Blu-ray or USB drive.

b) If copied to the local file system:

> sudo mkdir /mnt/iso
> sudo mount -t iso9660 -o loop /home/repouser/AlmaLinux8.7.repo.2023FEB03.iso /mnt/iso/

c) If mounted via usb drive or if automount is not enabled:

> sudo mkdir /mnt/iso
> sudo blkid (to find your cd/dvd device, chances are its /dev/sr0)
> mount /dev/sr0 /mnt/iso/

d) Verify your mount. The “Mounted on” path is important because it is used below when you create the local.repo file.

> sudo df -h /dev/loop0
Filesystem Size Used Avail Use% Mounted on
/dev/loop0 35G 35G 0 100% /mnt/iso

> sudo df -h /dev/sr0
Filesystem Size Used Avail Use% Mounted on
/dev/sr0 35G 35G 0 100% /mnt/iso

If automounted it could look like this:
> sudo df -h /dev/sr0
Filesystem Size Used Avail Use% Mounted on
/dev/sr0 35G 35G 0 100% /run/media/root/CDROM

e) List the repos that will be used to create the local.repo file. Depending on how you mounted the ISO above (manual or automount), your /dev/sr0 mountpoint will be different. You simply need to adjust the baseurl path in local.repo in the next step.

> sudo ls -l /mnt/iso
or…
> sudo ls -l /run/media/repouser/CDROM
dr-xr-xr-x. 4 root root 2048 Jan 27 02:14 AppStream
dr-xr-xr-x. 7 root root 2048 Jan 27 02:14 BaseOS

5) Create a repos archive folder if it doesn’t already exist. Move existing *.repo files to the archive folder for safe keeping and create the new local.repo file.

> sudo mkdir -pv /etc/yum.repos.d/archive
> cd /etc/yum.repos.d/
> sudo /bin/mv *.repo archive/
> sudo vi local.repo

Copy/paste everything below between the # Start custom local.repo file # header and footer into the local.repo and wq! to save the file. Note the baseurl= file path. Edit this path based on how you mounted in step 4d above. Since I automounted the ISO in a VM, I used the ///run/media/root/CDROM/”repo name” path format.

If automounted, its baseurl=file:///run/media/root/CDROM/repo name/
If manually mounted, its baseurl=file:///mnt/iso/repo name/

# Start custom local.repo file #

[baseos-source]
name=AlmaLinux $releasever – BaseOS Source
baseurl=file:///run/media/root/CDROM/BaseOS
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux

[appstream-source]
name=AlmaLinux $releasever – AppStream Source
baseurl=file:///run/media/root/CDROM/AppStream
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux

# End custom local.repo file #

6) Update the host and reboot. If you get errors trying to run yum update due to gpg checks, just comment out gpgkey and change gpgcheck to 0 in the local.repo file, and then run yum update again. Or, you can download the key here https://mirrors.rit.edu/almalinux/RPM-GPG-KEY-AlmaLinux-8 and place it in /etc/pki/rpm-gpg.

a) Configure the repo and update.
> yum clean all
> yum repolist all
repo id repo name status
appstream-source AlmaLinux 8 – AppStream Source enabled
baseos-source AlmaLinux 8 – BaseOS Source enabled

> yum update

Transaction Summary
====================================================
Install 5 Packages
Upgrade 138 Packages

Total size: 450 M
Is this ok [y/N]: y
Downloading Packages:

b) If you get gpg errors, verify that you have the keys installed. The green key below is the one used in the gpgkey= path above in local.repo. If not installed, comment out gpgkey= and set gpgcheck to 0 in the local.repos file above or download the keys and copy to /etc/pki/rpm-gpg/.

> sudo gpg -quiet –show-keys /etc/pki/rpm-gpg/*
gpg: out of core handler ignored in FIPS mode
pub rsa4096 2021-01-12 [C] [expires: 2024-01-12]
5E9B8F5617B5066CE92057C3488FCF7C3ABB34F8
uid AlmaLinux <packager@almalinux.org>
sub rsa3072 2021-01-12 [S] [expires: 2024-01-12]

pub rsa4096 2009-02-24 [SC]
B08B659EE86AF623BC90E8DB938A80CAF21541EB
uid Red Hat, Inc. (beta key 2) <security@redhat.com>

pub rsa4096 2009-10-22 [SC]
567E347AD0044ADE55BA8A5F199E2F91FD431D51
uid Red Hat, Inc. (release key 2) <security@redhat.com>

> reboot

c) After reboot, eject the ISO if still mounted.
> umount /dev/sr0

HOWTO Remove /home logical volume and add that space to the root partition

07 Sunday Aug 2022

Posted by Slice2 in Linux

≈ Leave a comment

Tags

Linux

You have a host with too much space allocated to /home and you need to remove and reallocate it to the root partition. This may be because there are no human users on this server and you just have or need service accounts. Backup any files you need from /home before you start.

1) Get the list of mounted file systems.
> df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 1.8G 0 1.8G 0% /dev
tmpfs 1.9G 0 1.9G 0% /dev/shm
tmpfs 1.9G 9.1M 1.9G 1% /run
tmpfs 1.9G 0 1.9G 0% /sys/fs/cgroup
/dev/mapper/rl-root 37G 27G 11G 71% /
/dev/mapper/rl-home 19G 189M 18G 2% /home
/dev/sda1 1014M 342M 673M 34% /boot
vboxshare 477G 104G 373G 22% /media/sf_vboxshare
tmpfs 374M 12K 374M 1% /run/user/42
tmpfs 374M 0 374M 0% /run/user/0

2) Get the filesystem type. In this case it’s xfs. This informs a later step.
> lsblk -f | grep home
└─rl-home xfs 9fd41fcd-e123-40b8-8461-7500b9aaa023 /home

3) Get the volume details. Note the values for LV Path and LV Size.
> lvdisplay /dev/rl/home
— Logical volume —
LV Path /dev/rl/home
LV Name home
VG Name rl
LV UUID z2Kg70-xYsg-Cx11-ROoj-Fl5T-g0Pb-wuksJ9
LV Write Access read/write
LV Creation host, time ryl8, 2022-07-29 14:57:34 -0400
LV Status available
# open 1
LV Size 18.05 GiB
Current LE 4622
Segments 1
Allocation inherit
Read ahead sectors auto
– currently set to 8192
Block device 253:2

4) Copy any files you need out of /home. Then unmount it as root, not su – root from another user.
> umount /home

5) Using the LV PATH value from lvdisplay above, remove the logical volume for /home.
> lvremove /dev/rl/home
Do you really want to remove active logical volume rl/home? [y/n]: y
Logical volume “home” successfully removed.

6) Make sure the volume is free in the VFree column.
> vgs -v
VG Attr Ext #PV #LV #SN VSize VFree VG UUID VProfile
rl wz–n- 4.00m 1 2 0 <59.00g 18.05g l6h9Zk-Ue9m-7oPJ-iPJK-XdRy-yfqD-zI56bB

7) Extend the free space to the root partition.
a) Extend the root logical volume to take up the free space you just made available.
> lvextend -l +100%FREE /dev/mapper/rl-root
Size of logical volume rl/root changed from 36.98 GiB (9467 extents) to <55.04 GiB (14089 extents).
Logical volume rl/root successfully resized.

b) Grow the filesystem onto the new lv space.
> xfs_growfs /dev/mapper/rl-root
xfs_growfs /dev/mapper/rl-root
meta-data=/dev/mapper/rl-root isize=512 agcount=4, agsize=2423552 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=1, sparse=1, rmapbt=0
= reflink=1 bigtime=0 inobtcount=0
data = bsize=4096 blocks=9694208, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0, ftype=1
log =internal log bsize=4096 blocks=4733, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
data blocks changed from 9694208 to 14427136

8) df -h to see the changes.
Filesystem Size Used Avail Use% Mounted on
devtmpfs 1.8G 0 1.8G 0% /dev
tmpfs 1.9G 0 1.9G 0% /dev/shm
tmpfs 1.9G 9.1M 1.9G 1% /run
tmpfs 1.9G 0 1.9G 0% /sys/fs/cgroup
/dev/mapper/rl-root 56G 27G 29G 48% /
/dev/sda1 1014M 342M 673M 34% /boot
vboxshare 477G 104G 373G 22% /media/sf_vboxshare
tmpfs 374M 12K 374M 1% /run/user/42
tmpfs 374M 0 374M 0% /run/user/0

9) Edit /etc/fstab and remove or comment out /home and reboot.
> vi /etc/fstab
#/dev/mapper/rl-home /home xfs defaults 0 0

10) Reboot to seat the changes.
> reboot

11) Create new users as needed. Use /home as a folder on the root volume and not a space wasting logical volume as before.

Patch Rocky Linux 8.6 on an Offline or Air-Gapped System

30 Saturday Jul 2022

Posted by Slice2 in Linux, Security

≈ Leave a comment

Tags

Linux, Security

So you’ve successfully switched from CentOS to Rocky Linux and your hosts are on an isolated network. This post demonstrates how to patch a Rocky Linux 8.6 host when it doesn’t have internet access or is an isolated system with no access to a yum repo.

On a host with internet access (Public facing host), perform the following steps. I used a Rocky Linux 8.6 VM running on Windows 11 and VirtualBox 6.1.36. As long as you have internet access, any rpm based Linux distro will do as long as it has rsync, genisoimage, and yum-utils.

1) Make sure you have rsync, genisoimage and yum-utils installed. If not install them.

> sudo rpm -q genisoimage-*
genisoimage-1.1.11-39.el8.x86_64

> sudo rpm -q yum-utils
yum-utils-4.0.21-11.el8.noarch

> sudo rpm -q rsync
rsync-3.1.3-14.el8_6.2.x86_64

a) If not, install them.

> sudo yum install genisoimage
> sudo yum install yum-utils
> sudo yum install rsync

2) On your internet facing host, create folders for the repos and packages you need. You can specify any folder(s) you require. I require the repos below, but you may need packages installed from other repos so create those folders. Most people only need BaseOS and AppStream. The “updates” repo is no longer used in 8x and has been removed. Updated packages are just placed in their regular repo and not separated. The full list can be found on a mirror site like this one I use: https://mirrors.rit.edu/rocky/8.6/

a) Create the folders locally and harvest the data from the mirror site using rsync. Note that these folders will create an approx 19 Gig ISO file in step 3. You need a Blu-ray burner or USB drive to move the file to your air-gapped hosts. Also make sure the filesystem you write the ISO to has enough space. Note that there are two dashes before “- -“progress below, not one. It renders as one dash so make sure you have two dashes before progress or just remove that option from your cli.

> sudo mkdir -pv /repo/BaseOS
> sudo /usr/bin/rsync -avrt – -progress rsync://mirrors.rit.edu/rocky/8.6/BaseOS/x86_64/os/ /repo/BaseOS

> sudo mkdir -pv /repo/AppStream
> sudo /usr/bin/rsync -avrt – -progress rsync://mirrors.rit.edu/rocky/8.6/AppStream/x86_64/os/ /repo/AppStream

> sudo mkdir -pv /repo/PowerTools
> sudo /usr/bin/rsync -avrt – -progress rsync://mirrors.rit.edu/rocky/8.6/PowerTools/x86_64/os/ /repo/PowerTools

> sudo mkdir -pv /repo/extras
> sudo /usr/bin/rsync -avrt – -progress rsync://mirrors.rit.edu/rocky/8.6/extras/x86_64/os/ /repo/extras

> sudo mkdir -pv /repo/Devel
> sudo /usr/bin/rsync -avrt – -progress rsync://mirrors.rit.edu/rocky/8.6/Devel/x86_64/os/ /repo/Devel

3) Use genisoimage to create an ISO of the whole set. Note that in the command below, I write this ISO image to a VirtualBox shared folder mounted at /media/sf_vboxshare. Use any path you like as long as its big enough. The syntax is: genisoimage cli options – location and name of ISO file to be created and files/folders to be included in the ISO.

> genisoimage -U -r -v -J -joliet-long -allow-multidot -allow-lowercase -iso-level 4 -o /media/sf_vboxshare/rocky8.6.repo.2022JUL29.iso /repo

4) Burn the ISO (as a file, not as an extracted image) to a Blu-ray, or copy to a USB drive and move it to the offline or air-gapped host. Since I have VMs, I will automount the ISO to the VM. If you need to mount the ISO on a host with a Blu-ray, USB drive, or from the local filesystem, the next three steps outline how to do it.

a) Mount the ISO. You have options if you don’t automount ISOs. If your host is a VM, mount it as your hypervisor dictates. You can copy the ISO to the local filesystem and mount it. Or, manually mount the ISO from a local or USB attached Blu-ray or USB drive.

b) If copied to the local file system:

> sudo mkdir /mnt/iso
> sudo mount -t iso9660 -o loop /home/repouser/rocky8.6.repo.2022JUL29.iso /mnt/iso/

c) If mounted via usb drive or if automount is not enabled:

> sudo mkdir /mnt/iso
> sudo blkid (to find your cd/dvd device, chances are its /dev/sr0)
> mount /dev/sr0 /mnt/iso/

d) Verify your mount. The “Mounted on” path is important because it is used below when you create the local.repo file.

> sudo df -h /dev/loop0
Filesystem Size Used Avail Use% Mounted on
/dev/loop0 19G 19G 0 100% /mnt/iso

> sudo df -h /dev/sr0
Filesystem Size Used Avail Use% Mounted on
/dev/sr0 19G 19G 0 100% /mnt/iso

If automounted it could look like this:
> sudo df -h /dev/sr0
Filesystem Size Used Avail Use% Mounted on
/dev/sr0 19G 19G 0 100% /run/media/root/CDROM

e) List the repos that will be used to create the local.repo file. Depending on how you mounted the ISO above (manual or automount), your /dev/sr0 mountpoint will be different. You simply need to adjust the baseurl path in local.repo in the next step.

> sudo ls -l /mnt/iso
or….
> sudo ls -l /run/media/repouser/CDROM

dr-xr-xr-x. 4 root root 2048 Jul 28 23:35 AppStream
dr-xr-xr-x. 7 root root 2048 Jul 28 23:30 BaseOS
dr-xr-xr-x. 4 root root 2048 Jul 28 23:14 Devel
dr-xr-xr-x. 4 root root 2048 Jul 28 23:13 extras
dr-xr-xr-x. 2 root root 2048 Jul 29 15:41 PowerTools

5) Create a repos archive folder if it doesn’t already exist. Move existing *.repo files to the archive folder for safe keeping and create the new local.repo file.

> sudo mkdir -pv /etc/yum.repos.d/archive
> cd /etc/yum.repos.d/
> sudo /bin/mv *.repo archive/
> cd /etc/yum.repos.d/
> sudo vi local.repo

Copy/paste everything below between the # Custom local.repo file # header and footer into the local.repo and wq! to save the file. Note the baseurl= file path. Edit this path based on how you mounted in step 4d above. Since I automounted the ISO, I used the ///run/media/root/CDROM/repo name/ path format.

If automounted, its baseurl=file:///run/media/root/CDROM/repo name/
If manually mounted, its baseurl=file:///mnt/iso/repo name/

# Custom local.repo file #
[appstream]
name=Rocky Linux $releasever – AppStream
baseurl=file:///run/media/root/CDROM/AppStream/
gpgcheck=1
enabled=1
countme=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial

[baseos]
name=Rocky Linux $releasever – BaseOS
baseurl=file:///run/media/root/CDROM/BaseOS/
gpgcheck=1
enabled=1
countme=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial

[devel]
name=Rocky Linux $releasever – Devel WARNING! FOR BUILDROOT AND KOJI USE
baseurl=file:///run/media/root/CDROM/Devel/
gpgcheck=1
enabled=0
countme=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial

[extras]
name=Rocky Linux $releasever – Extras
baseurl=file:///run/media/root/CDROM/extras/
gpgcheck=1
enabled=1
countme=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial

[powertools]
name=Rocky Linux $releasever – PowerTools
baseurl=file:///run/media/root/CDROM/PowerTools/
gpgcheck=1
enabled=0
countme=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial
# Custom local.repo file #

6) Update the host and reboot. If you get errors trying to run yum update due to gpg checks, just comment out gpgkey and change gpgcheck to 0 in the local.repo file, and then run yum update again. Or, you can download the keys here: https://rockylinux.org/keys/

a) Verify if you have the keys installed. The green key below is the one used in the gpgkey= path above in local.repo. If not installed, comment out gpgkey= and set gpgcheck to 0 in the local.repos file above or download the keys and copy to /etc/pki/rpm-gpg/.

> sudo gpg –quiet –show-keys /etc/pki/rpm-gpg/*
pub rsa4096 2009-10-22 [SC]
567E347AD0044ADE55BA8A5F199E2F91FD431D51
uid Red Hat, Inc. (release key 2) <security@redhat.com>

pub rsa4096 2021-02-14 [SCE]
7051C470A929F454CEBE37B715AF5DAC6D745A60
uid Release Engineering <infrastructure@rockylinux.org>

pub rsa4096 2021-02-14 [SCE]
091A44047C3D8B7A331F5E185489E42BBBE2C108
uid Release Engineering <infrastructure@rockylinux.org>

> yum update
> reboot

b) After reboot, eject the ISO.
> umount /dev/sr0

 

Recover Files from a Windows NTFS partition using Linux based SystemRescue

11 Tuesday Jan 2022

Posted by Slice2 in Linux, Security, Windows

≈ 2 Comments

SystemRescue (formerly named SystemRescueCd) is a bootable Linux rescue toolset for repairing or manipulating your partitions and data on a disk. This post shows how to quickly mount a Windows NTFS file system to recover files.

1) Download the ISO and burn it to CD. Or, if you are rescuing a Windows VM, you will just mount the ISO.
https://www.system-rescue.org/Download/

2) Boot to SystemRescue. If you are working on a physical host, you may need to change you BIOS setting to boot the CD/DVD drive first. If a VM, make sure you attach the ISO and modify your boot order if needed. When presented to you, select “Boot SystemRescue using default options.” The Live CD option will load and when prompted, enter:

[root@sysrescue ~]# startx

3) The desktop will load and provide access to various tools. When the desktop is loaded, you can either enable the network or mount a USB drive to insert a file (drivers, tweaks, etc.) or retrieve files from the file system. Depending on the method you choose, see Network Access or USB Drive Access below for the steps.

a) Network Access. In the lower right corner, right-click the rotating swoosh and green dots icon and select edit connections. Select Wired Connection 1 and click the gear icon at the bottom. On the IPv4 Settings tab, select Method, then Manual, click Add and enter an IP address, Mask, Gateway, DNS (if DNS is needed) and click Save. It can take about 10 seconds for the settings to apply and the network service to restart. Ping to verify that it is up.

b) To quickly enable SSH/SCP/SFTP and securely harvest files over the network:
[root@sysrescue ~]# systemctl enable sshd
[root@sysrescue ~]# systemctl start sshd
[root@sysrescue ~]# systemctl disable iptables
[root@sysrescue ~]# systemctl stop iptables
[root@sysrescue ~]# passwd (to reset the root password)

c) Launch an Xterm, Putty or Powershell on a remote host to verify access. For example in an xterm or Powershell:
> ssh root@ip.you.assigned.above

d) If using Filezilla: to drag and drop/copy files to or from, enter these parameters and click QuickConnect.
Host: sftp://ip.you.assigned.above
Username: root
Password: root’s password
Port: 22

e) USB Drive Access. Insert a USB drive to the physical host or attach a USB device to a VM. In this case, the device ID below a simple 2 GB, vfat formatted PNY USB stick.
[root@sysrescue ~]# blkid (to find your USB device such as the one listed below on /dev/sdb1)

/dev/sdb1: LABEL=”SYSRCD-5″ UUID=”90BB-72F0″ BLOCK_SIZE=”512″ TYPE=”vfat” PARTUUID=”04aa1751-01″

f) Mount the USB device. Once mounted, you can move or copy files to or from the /usbdrive mount point.
[root@sysrescue ~]# mkdir /usbdrive
[root@sysrescue ~]# mount /dev/sdb1 /usbdrive
[root@sysrescue ~]# ls -l /usbdrive
drwxr-xr-x 2 root root 4096 Nov 22 2019 ‘System Volume Information’

4) Check for the Windows partition.
[root@sysrescue ~]# blkid | grep ntfs
/dev/sda2: BLOCK_SIZE=”512″ UUID=”ECF28F77F28F44B4″ TYPE=”ntfs” PARTUUID=”03fdd544-02″
/dev/sda1: LABEL=”System Reserved” BLOCK_SIZE=”512″ UUID=”240E8ECC0E8E9688″ TYPE=”ntfs” PARTUUID=”03fdd544-01″

a) See /dev/sda1 in the list? The partition with LABEL=”System Reserved” is not the one you want to mount. In this case, /dev/sda2 is the Windows OS partition with all of your files, logs, registry, etc.

b) Create a mountpoint and mount the Windows partition.
[root@sysrescue ~]# mkdir -pv /mnt/windows
[root@sysrescue ~]# ntfs-3g /dev/sda2 /mnt/windows

c) Check the new mountpoint.

[root@sysrescue ~]# cd /mnt/windows
[root@sysrescue /mnt/windows]# ls -l
drwxrwxrwx 1 root root 0 Aug 22 2013 ‘$Recycle.Bin’
-rwxrwxrwx 1 root root 427680 Aug 22 2013 bootmgr
-rwxrwxrwx 1 root root 1 Jun 18 2013 BOOTNXT
lrwxrwxrwx 2 root root 23 Aug 22 2013 ‘Documents and Settings’ -> /mnt/windows/Users
-rwxrwxrwx 1 root root 2147483648 Dec 17 20:51 pagefile.sys
drwxrwxrwx 1 root root 0 Aug 22 2013 PerfLogs
drwxrwxrwx 1 root root 4096 Dec 16 19:07 ProgramData
drwxrwxrwx 1 root root 4096 Dec 16 18:37 ‘Program Files’
drwxrwxrwx 1 root root 4096 Apr 16 2021 ‘Program Files (x86)’
drwxrwxrwx 1 root root 0 Nov 27 2020 ‘System Volume Information’
drwxrwxrwx 1 root root 0 May 24 2021 temp_share
drwxrwxrwx 1 root root 4096 Nov 27 2020 Users
drwxrwxrwx 1 root root 0 Nov 27 2020 vboxshare
drwxrwxrwx 1 root root 24576 Dec 17 20:52 Windows

d) You can also launch the GUI File Manager (Thunar) and simply double-click into the /mnt/windows folder. Click the blue X where the Windows Start icon would normally be > select File Manager. Under Devices select File System and then double-click the “mnt” folder and then the “windows” folder. Launch another File Manager window and you can simply drag and drop between the “windows” and “usbdrive” folders.

5) Files of interest. For troubleshooting a broken system, check the following locations.

a) User and log files.
/mnt/windows/Users/<your_username>/Documents
/mnt/windows/Users/<your_username>/Downloads
/mnt/windows/Windows/debug
/mnt/windows/Windows/Logs
/mnt/windows/Windows/Prefetch (useful if it was enabled)
/mnt/windows/Windows/System32/drivers (to remove a buggy driver)
/mnt/windows/Windows/System32/drivers/etc/hosts (to see if IPs were defined)
/mnt/windows/Windows/System32/LogFiles
/mnt/windows/Windows/System32/winevt/Logs (for all of the Windows Event Viewer Logs)

b) Registry files:
/mnt/windows/Windows/System32/config

6) When done, unmount the folders and reboot/shutdown. Change your directory first and umount.
[root@sysrescue /mnt/windows]# cd /
[root@sysrescue ~]# umount /mnt/windows
[root@sysrescue ~]# umount /usbdrive

a) Shutdown the host. Click the blue X in the lower left > Log out > Shutdown.

Upgrading CentOS 7.2003 to 7.2009 on an Offline or Air-Gapped System

01 Friday Jan 2021

Posted by Slice2 in Linux

≈ Leave a comment

This post demonstrates how to patch or upgrade a CentOS 7 host when it doesn’t have internet access or is an isolated system with no access to a yum repo. On a host with internet access (Public facing host) or a local repo, perform the following steps.

1) Make sure you have genisoimage and yum-utils installed. If not install them.

> sudo rpm -q genisoimage-*
genisoimage-1.1.11-25.el7.x86_64

> sudo rpm -q yum-utils
yum-utils-1.1.31-54.el7_8.noarch

> sudo yum install genisoimage
> sudo yum install yum-utils

2) On your internet facing host create folders for the packages you need. You can specify any folder(s) you require. I only require os, extras and updates but you may have packages installed from other folders. The full list is listed below.

atomic/
centosplus/
cloud/
configmanagement/
cr/
dotnet/
extras/
fasttrack/
isos/
messaging/
nfv/
opstools/
os/
paas/
rt/
sclo/
storage/
updates/
virt/

a) Create the folders.

> sudo mkdir -pv /repo/os
> sudo mkdir -pv /repo/updates
> sudo mkdir -pv /repo/extras

b) Use rsync to harvest the rpms and repo data. Note that these folders will create a 17.1 Gig ISO file in the next step. You need a Blu-ray burner or USB drive to move the file.

> /usr/bin/rsync -avrt rsync://mirror.umd.edu/centos/7.9.2009/os/x86_64/ /repo/os
> /usr/bin/rsync -avrt rsync://mirror.umd.edu/centos/7.9.2009/updates/x86_64/ /repo/updates
> /usr/bin/rsync -avrt rsync://mirror.umd.edu/centos/7.9.2009/extras/x86_64/ /repo/extras

c) Use genisoimage to create an ISO of the whole set. Note. In the command below, I write this ISO image to a VirtualBox shared folder mounted at /vboxshare. Use any path you like. The syntax is: genisoimage cli options – location and name of ISO file to be created and files/folders to be included in the ISO.
> genisoimage -U -r -v -J -joliet-long -allow-multidot -allow-lowercase -iso-level 4 -o /vboxshare/centos7.9.2009repo.20210101.iso /repo

3) Burn the ISO (as a file, not as an extracted image), or copy to a USB drive and move it to the offline host. Since I have VMs, I will mount the ISO to the VM. If you need to mount the ISO on a host with a Blu-ray player or on the local filesystem, see the manual mount section below.

a) Mount the ISO. You have options if you don’t automount ISOs. If your host is a VM, mount it as your hypervisor dictates. You can also copy the ISO to the local filesystem and mount it. Or, manually mount the ISO from a local or USB attached DVD/blu-ray.

> sudo mkdir /mnt/iso
> sudo mount -t iso9660 -o loop /home/repouser/centos7.9.2009repo.20210101.iso /mnt/iso/
— or
> sudo mkdir /mnt/iso
> sudo blkid (to find your cd/dvd device, chances are its /dev/sr0)
> mount /dev/sr0 /media/iso/

b) Once the ISO is mounted, verify the contents. In my case the path is shown below. If your mounted path is different, you need to adjust the baseurl path in local.repo in upcoming step 5.
> df -h
/dev/sr0 17G 17G 0 100% /run/media/root/CDROM

> ls -l /run/media/root/CDROM
dr-xr-xr-x. 4 root root 2048 Jan 1 10:30 extras
dr-xr-xr-x. 8 root root 2048 Jan 1 05:23 os
dr-xr-xr-x. 4 root root 2048 Jan 1 15:42 updates

Note: Each path location listed above must have a Packages and repodata folders inside. If they don’t, it won’t work.

4) On the CentOS host, create an archive folder if it doesn’t already exist.  Move existing *.repo files to the archive folder.

> sudo mkdir -pv /etc/yum.repos.d/archive
> cd /etc/yum.repos.d/
> sudo /bin/mv *.repo archive/

5) Create the local.repo file in /etc/yum.repos.d/ and paste in the contents below.

> cd /etc/yum.repos.d/
> sudo vi local.repo (add the lines below and issue a wq! to save the file)

[base]
name=CentOS-$releasever – Base
baseurl=file:///run/media/root/CDROM/os/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

[updates]
name=CentOS-$releasever – Updates
baseurl=file:///run/media/root/CDROM/updates/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

[extras]
name=CentOS-$releasever – Extras
baseurl=file:///run/media/root/CDROM/extras/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

6) Mount the CentOS rsync’d update ISO is not already done and update the OS.

> yum update
> reboot

Note: If you get errors trying to run yum update due to gpg checks, just comment out gpgkey and change gpgcheck to 0 in the local.repo file, and then run yum update again.

a) Login and check the release file to confirm the new version.

> cat /etc/centos-release

b) Mount the ISO again (if done manually). Install these packages on the offline system and then clean up old kernels to prevent your /boot from filling up. The – -count=2 leaves two kernels. Also, there are two dashes (- -) in front of oldkernels and count.

> sudo yum install genisoimage
> sudo yum install yum-utils
> package-cleanup – -oldkernels – -count=2

c) Move the new OS default repos to the archive folder.

> cd /etc/yum.repos.d/
> sudo /bin/mv CENTOS-*.repo archive/
> ls -l (and you should only have local.repo listed)

7) After you are done updating to the new OS release, comment out all of the [base] and [extras] sections in the local.repo file. All future patches will be in the [updates] repo. When a new OS version is released, just un-comment [base] and [extras].

a) Now that you are updated to 7.9.2009, you only need to rsync the updates folder and create the ISO with only the updates folder. For example, on the internet facing server you would only need to run these commands.
> /usr/bin/rsync -avrt rsync://mirror.umd.edu/centos/7.9.2009/updates/x86_64/ /repo/updates
> genisoimage -U -r -v -J -joliet-long -allow-multidot -allow-lowercase -iso-level 4 -o /vboxshare/centos7.9.2009repo.20210101.iso /repo/updates

HOWTO Easily Resize the Default LVM Volume on Ubuntu 18.04

05 Saturday Dec 2020

Posted by Slice2 in Linux

≈ 16 Comments

Say you have a 40 Gig disk. When the installer creates the encrypted volume during initial OS installation, it partitions the whole disk but only creates a 20 GB logical volume. You should resize the default volume group to increase the usable disk from 20 to 40 GB.

1) You will run a test first to verify that it can resize properly before you actually modify the partition.
a. Change to root and gather a few details. Points of interest are in bold red. You can see that the partition (type=part) for sda3 is 39G and the logical volume (type=lvm) is only 20 G.
> sudo -s (or su – root)
> lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 89.1M 1 loop /snap/core/8268
loop1 7:1 0 96.5M 1 loop /snap/core/9436
sda 8:0 0 40G 0 disk
├─sda1 8:1 0 1M 0 part
├─sda2 8:2 0 1G 0 part /boot
└─sda3 8:3 0 39G 0 part
└─dm_crypt-0 253:0 0 39G 0 crypt
└─ubuntu–vg-ubuntu–lv 253:1 0 20G 0 lvm /
sr0 11:0 1 1024M 0 rom

> df -h | grep “ubuntu–vg-ubuntu–lv”

/dev/mapper/ubuntu–vg-ubuntu–lv 20G 15G 4.0G 79% /

b. Now that we know the logical volume is only 20 Gigs, we can resize it to the remaining open free space. First, we will test this command using the -t switch (for test) and view the output for errors. If clean, proceed.
> lvresize -t -v -l +100%FREE /dev/mapper/ubuntu–vg-ubuntu–lv

TEST MODE: Metadata will NOT be updated and volumes will not be (de)activated.
Converted 100%FREE into at most 4862 physical extents.
Test mode: Skipping archiving of volume group.
Extending logical volume ubuntu-vg/ubuntu-lv to up to 38.99 GiB
Size of logical volume ubuntu-vg/ubuntu-lv changed from 20.00 GiB (5120 extents) to 38.99 GiB (9982 extents).
Test mode: Skipping backup of volume group.
Logical volume ubuntu-vg/ubuntu-lv successfully resized.
Test mode: Wiping internal cache
Wiping internal VG cache

2) Once you see that the test was successful, remove the -t switch (for test) from the previous command to actually increase the logical volume.
> lvresize -v -l +100%FREE /dev/mapper/ubuntu–vg-ubuntu–lv

Converted 100%FREE into at most 4862 physical extents.
Archiving volume group “ubuntu-vg” metadata (seqno 2).
Extending logical volume ubuntu-vg/ubuntu-lv to up to 38.99 GiB
Size of logical volume ubuntu-vg/ubuntu-lv changed from 20.00 GiB (5120 extents) to 38.99 GiB (9982 extents).
Loading ubuntu–vg-ubuntu–lv table (253:1)
Suspending ubuntu–vg-ubuntu–lv (253:1) with device flush
Resuming ubuntu–vg-ubuntu–lv (253:1)
Creating volume group backup “/etc/lvm/backup/ubuntu-vg” (seqno 3).
Logical volume ubuntu-vg/ubuntu-lv successfully resized.

> lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 89.1M 1 loop /snap/core/8268
loop1 7:1 0 96.5M 1 loop /snap/core/9436
sda 8:0 0 40G 0 disk
├─sda1 8:1 0 1M 0 part
├─sda2 8:2 0 1G 0 part /boot
└─sda3 8:3 0 39G 0 part
└─dm_crypt-0 253:0 0 39G 0 crypt
└─ubuntu–vg-ubuntu–lv 253:1 0 39G 0 lvm /
sr0 11:0 1 1024M 0 rom

3) Now that the logical volume is 39G, get the FS type and resize the filesystem on the newly acquired space. We can see that it’s using ext4.
> df -h -T |grep vg
/dev/mapper/ubuntu–vg-ubuntu–lv ext4 20G 15G 4.0G 79% /

a. Since the file system is ext4, we will use the resize2fs command.
> resize2fs -p /dev/mapper/ubuntu–vg-ubuntu–lv

resize2fs 1.44.1 (24-Mar-2018)
Filesystem at /dev/mapper/ubuntu–vg-ubuntu–lv is mounted on /; on-line resizing required
old_desc_blocks = 3, new_desc_blocks = 5
The filesystem on /dev/mapper/ubuntu–vg-ubuntu–lv is now 10221568 (4k) blocks long.

b. Now verify the new size of your root volume to confirm that it has increased in size.
> df -h -T |grep vg
/dev/mapper/ubuntu–vg-ubuntu–lv ext4 39G 15G 22G 41% /

Apply the Mozilla Firefox STIG to Firefox on Ubuntu Linux 18.04

06 Thursday Aug 2020

Posted by Slice2 in Linux, Security

≈ 2 Comments

1) Applying the STIG on Windows is quite easy. However they fail to provide guidance on how to apply it on Linux. I hope this helps.

2) You will create two files; autoconfig.js and mozilla.cfg.

a) autoconfig.js is as follows. There must be two additional forward slashes at the start of the text below.

//
pref(“general.config.filename”, “mozilla.cfg”);
pref(“general.config.obscure_value”, 0);

b) mozilla.cfg is as follows. There must be two additional forward slashes at the start of the text below.

//
// SV-16707 – DTBF050
lockPref(“security.default_personal_cert”, “Ask Every Time”);
// SV-16710 – DTBF105
lockPref(“network.protocol-handler.external.shell”,false);
// SV-16711 – DTBF110
lockPref(“plugin.disable_full_page_plugin_for_types”,”application/pdf,application/fdf,application/xfdf,application/lso,application/lss,application/iqy,application/rqy,application/lsl,application/xlk,application/xls,application/xlt,application/pot,application/pps,application/ppt,application/dos,application/dot,application/wks,application/bat,application/ps,application/eps,application/wch,application/wcm,application/wb1,application/wb3,application/rtf,application/doc,application/mdb,application/mde,application/wbk,application/ad,application/adp”);
// SV-16713 – DTBF140
lockPref(“browser.formfill.enable”, false);
// SV-16714 – DTBF150
lockPref(“signon.autofillForms”, false);
// SV-16715 – DTBF160
lockPref(“signon.rememberSignons”, false);
// SV-16717 – DTBF180
lockPref(“dom.disable_window_open_feature.status”, true);
// SV-16718 – DTBF181
lockPref(“dom.disable_window_move_resize”, true);
// SV-16925 – DTBF030
lockPref(“security.enable_tls”, true);
// SV-16925 – DTBF030
lockPref(“security.tls.version.min”, 2);
// SV-16925 – DTBF030
lockPref(“security.tls.version.max”, 4);
// SV-16727 – DTBF182
lockPref(“dom.disable_window_flip”, true);
// SV-16928 – DTBF183
lockPref(“dom.event.contextmenu.enabled”, false);
// SV-21890 – DTBF085
lockPref(“browser.search.update”, false);
// SV-59603 – DTBF090
lockPref(“extensions.update.enabled”, false);
// SV-79381 – DTBF186
lockPref(“xpinstall.enabled”, false);
// SV-93759 – DTBF190
lockPref(“datareporting.policy.dataSubmissionEnabled”, false);
// SV-106633 – DTBF195
lockPref(“devtools.policy.disabled”, true);
// SV-111837 – DTBF200
lockPref(“toolkit.telemetry.enabled”, false);
// SV-111839 – DTBF205
lockPref(“toolkit.telemetry.archive.enabled”, false);
// SV-111841 – DTBF210
lockPref(“privacy.trackingprotection.fingerprinting.enabled”, true);
// SV-111843 – DTBF215
lockPref(“privacy.trackingprotection.cryptomining.enabled”, true);
// SV-111845 – DTBF220
lockPref(“browser.contentblocking.category”, “strict”);
// SV-111847 – DTBF225
lockPref(“extensions.htmlaboutaddons.recommendations.enabled”, false);
// SV-111849 – DTBF230
lockPref(“browser.newtabpage.activity-stream.enabled”, false);
// SV-111851 – DTBF235
lockPref(“security.ssl3.rsa_des_ede3_sha”, false);

3) At the console or via ssh, create the files in the Ubuntu locations.

> sudo vi /usr/lib/firefox/mozilla.cfg and paste the text shown above in 2b. There should be no extra space or line at the top or bottom of the text.
> sudo chmod 644 /usr/lib/firefox/mozilla.cfg

> sudo vi /usr/lib/firefox/defaults/pref/autoconfig.js and paste the text above in 2a. There should be no extra space or line at the top or bottom of the text.
> sudo chmod 644 /usr/lib/firefox/defaults/pref/autoconfig.js

4) Start Firefox. In the location bar, enter about:config. In the search field enter plugin. and you will see that plugin.disable_full_page_plugin_for_types is grayed out with a lock icon to the left. Try any other from the mozilla.cfg list and they should be the same.ffox_lock

Dynamically Resize Those Tiny BlackArch Linux Terminals and Add a Scrollbar

12 Tuesday May 2020

Posted by Slice2 in Linux, Security

≈ Leave a comment

BlackArch Linux is a great security distro but I’ve always been annoyed by the small terminal windows and could never find a way to resize them. I just used PuTTY on Windows or an xterm from another host/VM to get an easily adjustable xterm window. I found this obscure but simple method to resize the terminal and add a scrollbar. Hope you find this as helpful as I did.

1) Login to BlachArch as root. Right-click the desktop > select Terminal > and pick any terminal color you like.

2) Example resizing commands are listed below. Depending on your monitor size, you can play with the numbers to get your perfect terminal window. The set of numbers after the 8; sets the height and the last set with a “t” sets the width. The commands are dynamic and will change the terminal immediately. If you don’t like your choice, simply up-arrow and enter a new number.

[blackarch ~]# printf ‘\e[8;20;90t’
[blackarch ~]# printf ‘\e[8;30;90t’
[blackarch ~]# printf ‘\e[8;40;90t’
[blackarch ~]# printf ‘\e[8;50;95t’
[blackarch ~]# printf ‘\e[8;40;100t’

3) In your home directory check your .Xresources file.

> cat .Xresources | grep scroll

urxvt.scrollBar: false
urxvt.scrollTtyKeypress: true
urxvt.scrollTtyOutput: false
urxvt.scrollWithBuffer: false
urxvt.scrollstyle: plain

4) Change urxvt.scrollBar from false to true, add its position and merge the change.

> vi .Xresources
– set urxvt.scrollBar to true
– add urxvt.leftScrollBar: true
– save and quit vi
> xrdb -merge .Xresources

5) Close your existing xterm and you should have a scroll bar on the left. Run a few commands (like ls -lsa) to generate a lot of output and then you can scroll back.

Kali Linux OVA for Air-Gapped Use Build Process

06 Wednesday May 2020

Posted by Slice2 in Linux, Security

≈ 1 Comment

If your forensics lab employs Kali Linux as its primary security based Linux distro, this document describes how to build, augment, patch and export an OVA image for use in the lab where you have no internet access.

Software needed to complete this task include:
1) The latest Kali Linux release. As of this writing, its 2020.1b.
https://cdimage.kali.org/kali-2020.1b/kali-linux-2020.1b-installer-amd64.iso

2) VirtualBox 6.1.6 and Extensions (or the most recent version).
https://download.virtualbox.org/virtualbox/6.1.6/VirtualBox-6.1.6-137129-Win.exe
https://download.virtualbox.org/virtualbox/6.1.6/Oracle_VM_VirtualBox_Extension_Pack-6.1.6.vbox-extpack

3) PuTTY terminal emulator for Windows.
https://the.earth.li/~sgtatham/putty/latest/w64/putty-64bit-0.73-installer.msi

5) A Windows 10 PC or laptop with at least 8 Gigs of memory. 16 is better but 8 will do. You also need at least 200 Gigs of available hard drive space for the image and the exported OVA.

6) Once built, you will export the VM as an OVA and import it to the lab after it has been through your QA process.

IMPORTANT: A Special Note Regarding Word, PDF and Text Character Formatting

1) In some cases, Word and PDF character formatting gets mangled when you copy/paste into a Linux terminal. Before you press enter on a pasted command, make sure it looks the same.
2) If it looks the same and doesn’t run, its typically a broken “-“ as in the –v, or any other switch. The double dash “ – -“ can be merged as a single “–“ when the document is converted. Also, even if the “-“ looks normal and the command doesn’t run or has errors, simply paste the command into the terminal, then using the left-arrow key, roll back and place the cursor behind the “-“ dash, press the backspace key to remove and then enter a new single dash or double dash as needed. This will create them in the native terminal character font. I know, it can be a hassle.
3) Since some of these commands are quite long, you might consider pasting them into Notepad first, and then copy from Notepad into the Linux terminal.

STEP 1 – Obtain the Software and Install on your PC or Laptop

1) Download the software mentioned above.
2) Install PuTTY and VirtualBox first and then install the Extension pack. Defaults are fine unless you have reasons to choose otherwise.

STEP 2 – Build the VM

1) Building the VM must be done offsite if you have restrictions due to access limitations and/or security requirements that prevent you from installing software, accessing the repos, or your destination system is air-gapped.
2) Create a folder on your c:\ drive named vboxshare.
3) Launch VirtualBox Manager and select Machine > New.
a. Name it kali01 or whatever you like).
b. Choose your machine folder location.
c. Type: Linux.
d. Version: Debian x64.
e. Memory size: minimum 4096 MB but 8192 is preferred if you have it.
f. Select Create the virtual disk now and click create.
g. Change the File size to 80.00 GB.
h. Hard disk file type: VDI.
i. Storage on physical disk: select Fixed size and click Create to create the VM.
j. Right-click the new VM profile and select settings.
k. Under System > Processors you can change this to 2 if you have the horsepower on your PC or laptop. If not, 1 should be fine. Both memory and CPU can be changed after being imported on the FAS.
l. Select Display, change Video memory to 128 MB and make sure graphics controller is VMSVGA.
m. Select Storage, under Controller IDE, select the Empty disc icon. On the right, under Attributes, across from Optical Driver select the Disc icon and then Choose/Create a virtual optical disk. If not listed, click +Add and browse out to the Kali ISO you downloaded, select it and click Choose > OK.
n. Select Network. Change Attached to: Bridged Adapter, expand Advanced and change Promiscuous mode to Allow All.
o. Select Shared Folders and click the green + folder icon in the upper right.
i. Folder path: C:\vboxshare.
ii. Folder name: vboxshare and select Auto-mount.
iii. Mount point: /vboxshare (note the forward slash, not backslash).
iv. Click OK > OK. Right-click the VM and select Start. If prompted, select the Kali ISO.

4) On the Kali Installation process:
a. Select Graphical installation, English as the language, United States as location, American English for Keyboard.
b. If you have DHCP your network should autoconfig. If not, click Continue on the Network screen, select Configure Network Manually, enter an IP, netmask, gateway, name servers or DNS.
c. Enter the hostname, leave the domain name blank, create the user account (such as kaliadm), add a password, set the clock to Eastern.
d. For partition, select Guided – use entire disk, select the vbox harddisk, select all files in one partition and click Continue on Finish partitioning and write changes to disk, select Yes to write changes to disk.
e. Enter the proxy information if you need one, otherwise leave it blank,
f. On the Software selection page, make sure Desktop, Xfce, Collection of Tools, top 10, default and large are selected. The system will begin to install the packages.
g. Select Yes on Grub boot loader, select the vbox hardisk as the boot loader device, click Continue on Installation complete to reboot the VM.

5) Enable SSH. It’s off by default.
> sudo systemctl start ssh
> sudo systemctl enable ssh
a. Test your access using PuTTY to login as the kaliadm user. Check the new OS release.

> cat /etc/os-release
> lsb_release -a

6) Install the official “everything” metapackage set (even though it really isn’t all of them) and few utilities. Login as the kaliadm user.

> sudo apt update
> sudo apt install kali-linux-everything
> sudo reboot
> sudo apt upgrade (if noting installs, skip the next reboot)
> sudo reboot

7) Login as kaliadm and install the VirtualBox Guest Additions. First, make sure the prerequisites are installed (they should be by now).

> sudo apt install dkms linux-headers-$(uname -r) build-essential

a. On the VM frame across the top select Devices > Insert Guest Additions CD Image.
> sudo mount /dev/cdrom /mnt
> cd /mnt
> sudo ./VBoxLinuxAdditions.run
> sudo reboot

8) List installed apps. Grep for stuff if you need to.
> sudo apt-cache search ” | sort -d | awk ‘{print $1}’
> sudo apt-cache search ” | sort -d | awk ‘{print $1}’ | grep <app name>

9) List installed apps with some detail. Grep for stuff if you need to.
> sudo apt-cache policy $(apt-cache search ” | sort -d | awk ‘{print $1}’)
> sudo apt-cache policy $(apt-cache search ” | sort -d | awk ‘{print $1}’) | grep <app name>

10) Create the /cases folder. This is where case data is localized.
> sudo mkdir -pv /cases

STEP 3 – Install Additional Tools

1) Use PuTTY on your PC to SSH as the kaliadm user into the VM or login to the GUI.
2) Install ClamAV AntiVirus and verify. From this point forward, it’s your choice to either via SSH or right-click the Desktop and open a terminal.
> sudo apt install clamav clamav-freshclam clamav-base clamav-docs clamav-daemon clamtk
> sudo mkdir -pv /clamav_quarantine
> sudo clamscan –v –r –log=/home/kaliadm/clav.log –copy=/clamav_quarantine /etc/*
> sudo cat /var/log/clamav/freshclam.log
> sudo cat /home/kaliadm/clav.log

3) Install additional tools and utilities for the lab.
a. Python Steganography Tools.
> sudo /usr/bin/pip3 install Stegano
> sudo pip3 install stegoveritas_binwalk
> sudo pip3 install stegoveritas

b. Install stego-lsb.
> sudo git clone https://github.com/ragibson/Steganography
> cd Steganography
> sudo python3 setup.py install
> sudo stegolsb test

c. Install OpenStego
> sudo wget -v -S https://github.com/syvaidya/openstego/releases/download/openstego-0.7.3/openstego_0.7.3-1_amd64.deb
> sudo apt install ./openstego_0.7.3-1_amd64.deb

d. Python Rekall Forensic Framework:
> sudo pip3 install rekall

e. Windows Event Carving:
> sudo pip3 install evtxtract

f. Steganography Tools:
> sudo apt install stegosuite
> sudo apt install exiftool
> sudo apt install pngcheck
> sudo apt install stepic

g. Network tools:
> sudo apt install iftop
> sudo apt install iptraf-ng
> sudo apt install etherape

h. Office and File Transfer Tools:
> sudo apt install filezilla
> sudo apt install libreoffice
> sudo apt install thunderbird
> sudo apt install tree
> sudo apt install putty
> sudo apt install glogg
> sudo apt install xpdf
> sudo apt install evince
> sudo apt install qpdfview
> sudo apt install xtail

i. Multimedia, Audio, Video, Images/Graphics:
> sudo apt install vlc
> sudo apt install xpaint
> sudo apt install mplayer
> sudo apt install smplayer
> sudo apt install audacious
> sudo apt install audacity
> sudo apt install calibre
> sudo apt install libdvd-pkg
Note: if you get an error at the end of this install
run sudo dpkg-reconfigure libdvd-pkg and select yes.

> sudo apt install rhythmbox
> sudo apt install lsdvd
> sudo apt install libavcodec-extra
> sudo apt install cdparanoia
> sudo apt install brasero
> sudo apt install ripperx
> sudo apt install xcfa
> sudo apt install cdda2wav
> sudo apt install pacpl
> sudo apt install abcde
> sudo apt install vobcopy
> sudo apt install dvdbackup
> sudo apt install sound-juicer
> sudo apt install grip
> sudo apt-get install libspeex*
> sudo apt-get install libopus*
> sudo apt-get install libaacs*
> sudo apt-get install libbluray*

j. Google Chrome and cli browsers:
> sudo wget -v https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
> sudo apt install ./google-chrome-stable_current_amd64.deb
> sudo apt install w3m
> sudo apt install lynx
> sudo apt install links2
> sudo apt install elinks

k. Additional Shells:
> sudo apt install golang
> sudo apt install csh
> sudo apt install ksh
> sudo apt install fish
> sudo apt install tcsh
> sudo apt install scanssh

STEP 4 – Export the VM as an OVA and Import Onsite

1) Once the new Kali VM is functioning and updated with the latest versions, it must be exported as an OVA and moved to the Lab. This step should be done as new versions are released to keep the Lab images updated.

2) In VirtualBox Manager, select the Kali VM. Click File > Export Appliance and fill out the following details under Virtual System Settings.
a. Name: should already list kali01.
b. Product: Kali Linux 2020.1b OVA
c. Product-URL: NA
d. Vendor: Kali, but built by <your name here>.
e. Version: 1.0, 06 May 2020 (rev the version for each OVA export, and use today’s date)
f. Description (click edit): Kali Linux 2020.1b, Everything Metapackage group, additional tools and Utils, VirtualBox 6.1.6 additions.
g. License: leave blank.
h. Under appliance settings, change format to Open Virtualization Format 2.0.
i. File: choose the location where you want to write the file.
j. Click Export.
k. When done, burn the OVA file to a Blu-ray disc or removable media.

3) Move the OVA Blu-ray to the internal host with VirtualBox installed.
a. Launch VirtualBox Manager and select File > Import Appliance.
b. Source: select Local File System.
c. File: on the right, click the folder with green arrow icon, browse to and select the kali01.ova file and click Open > Next.
d. Machine Base Folder: accept the default location or change this path to fit your installation.
e. Click Import to import the VM. When done, edit Settings as needed (more CPU, Memory, etc).
f. Boot the VM, login and set the IP address for the internal network and change the hostname if needed.
g. Manually reboot to seat the network changes or shutdown.

STEP 5 – What a Monthly (or as needed) Update Task Looks Like

1) Check to see if there is a new release for VirtualBox. If so, upgrade and make sure the Lab is upgraded as well.
https://www.virtualbox.org/wiki/Downloads

2) Update the Kali image.
a. Boot the public facing VM. Login to the VM as kaliadm.
b. Get the latest ClamAV updates for the VM and test a quick scan of /etc.
> sudo systemctl stop clamav-daemon
> sudo systemctl stop clamav-freshclam
> sudo freshclam
> sudo systemctl start clamav-daemon
> sudo systemctl start clamav-freshclam
> sudo clamscan –log=/home/kaliadm/clav.log –copy=/clamav_quarantine /etc/*

c. Update Google Chrome and the Python tools.

> sudo wget -v https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
> sudo apt install ./google-chrome-stable_current_amd64.deb
> sudo /usr/bin/pip3 install Stegano
> sudo pip3 install stegoveritas_binwalk
> sudo pip3 install stegoveritas

> sudo git clone https://github.com/ragibson/Steganography
> cd Steganography
> sudo python3 setup.py install
> sudo stegolsb test

> sudo pip3 install rekall

> sudo pip3 install evtxtract

d. Update the OS and tools.
> sudo apt update
> sudo apt upgrade (if noting installs, skip the next reboot)
> sudo reboot
> sudo apt list –upgradable –a (if nothing else to patch, proceed)

e. Export and Import the VM as described in STEP 4.

 

Build a Kali Linux ISO with the latest OS patches and packages

31 Saturday Aug 2019

Posted by Slice2 in Linux, Security

≈ Leave a comment

This post demonstrates how to build an updated Kali Linux ISO with the latest patches and package updates for the current 2019.2 release. This is helpful for offline environments, when you want a different desktop experience or you want every package available for Kali in one ISO. This is done as the root user.

1) Build a Kali Linux physical or virtual system. Downloads are available here:
https://www.kali.org/downloads/

2) Once built, update your system.
> apt update
> apt upgrade

3) Setup the build environment.
> mkdir -p /root/ISO
> cd /root/ISO/
> apt install -y curl git live-build cdebootstrap
> git clone https://gitlab.com/kalilinux/build-scripts/live-build-config.git

4) Modify the package list to get everything bundled into your ISO.
> cd /root/ISO/live-build-config/kali-config/variant-default/package-lists
> vi kali.list.chroot

Under the Kali applications header, set the file to look like the lines below. Basically, comment kali-linux-default (in red) and remove the comment on kali-linux-everything (in green). Leave the defaults for everything else in the file. When done, wq! to save your changes.

# Kali applications
#<package>
# You can customize the set of Kali metapackages (groups of tools) to install
# For the complete list see: https://tools.kali.org/kali-metapackages
# kali-linux-default
# kali-linux-large
kali-linux-everything
# kali-tools-top10

5) Build your ISO. Depending on your host’s CPU and internet speed, this could take an hour or more to complete.
> cd /root/ISO/live-build-config
> ./build.sh –verbose

Note: if you want a different desktop, run the associated build.sh variant below. Options are MATE, Gnome, XFCE, KDE, E17, I3WM, LXDE. For example:
For XFCE
./build.sh –variant xfce –verbose
For KDE
./build.sh –variant kde –verbose
For MATE
./build.sh –variant mate –verbose

6) When done, cd to the images folder and list the contents.
> cd /root/ISO/live-build-config/images
> ls -l
-rw-r–r– 1 root root 8184537088 Aug 31 14:23 kali-linux-rolling-amd64.iso
-rw-r–r– 1 root root 1619921 Aug 31 14:24 kali-linux-rolling-amd64.log

To check the size of the ISO:
> du -h kali-linux-rolling-amd64.iso
7.7G kali-linux-rolling-amd64.iso

← Older posts

Follow Blog via Email

Enter your email address to follow this blog and receive notifications of new posts by email.

Recent Posts

  • Patch Alma Linux 8.7 on an Offline or Air-Gapped System
  • HOWTO Remove /home logical volume and add that space to the root partition
  • Patch Rocky Linux 8.6 on an Offline or Air-Gapped System
  • HOWTO Install the Splunk Universal Forwarder on FreeBSD
  • HOWTO install a Splunk Universal Forwarder on Solaris 11 SPARC and x64 Using pkg(p5p) and tar
  • HOWTO install a Splunk Universal Forwarder on Solaris 10 SPARC and x64 Using pkgadd and tar
  • Recover Files from a Windows NTFS partition using Linux based SystemRescue
  • Sysmon Event ID 1 Process Creation rules for Splunk Universal Forwarder and McAfee All Access
  • Upgrading CentOS 7.2003 to 7.2009 on an Offline or Air-Gapped System
  • HOWTO Easily Resize the Default LVM Volume on Ubuntu 18.04
  • Create a Docker Container for your Cisco ESA, SMA or WSA Offline Content Updates
  • Apply the Mozilla Firefox STIG to Firefox on Ubuntu Linux 18.04
  • Dynamically Resize Those Tiny BlackArch Linux Terminals and Add a Scrollbar
  • Kali Linux OVA for Air-Gapped Use Build Process
  • HOWTO install the XFCE 4 Desktop on NetBSD 8.1
  • Build a Kali Linux ISO with the latest OS patches and packages
  • HOWTO quickly STIG Firefox 59.01
  • HOWTO mount a Synology NAS SMB share on Linux with SMBv1 disabled
  • Howto safely delete the WSUS WID on Windows 2012R2
  • HOWTO quickly STIG Firefox 45.0.1
  • Completing the vSphere vCenter Appliance Hardening Process
  • HOWTO install the XFCE 4.12 Desktop on NetBSD 7
  • Enabling TLS 1.2 on the Splunk 6.2x Console and Forwarders using Openssl and self signed certs.
  • HOWTO enable SSH on a Cisco ASA running 9.1.x
  • Apply a Windows 2012 R2 Domain GPO to a standalone Windows 2012 R2 server
  • Enable legacy SSL and Java SSL support in your browser for those old, crusty websites
  • HOWTO update FreeBSD 10.1 to the latest 11-current release
  • HOWTO Secure iSCSI Luns Between FreeBSD 10.1 and NetApp Storage with Mutual CHAP
  • HOWTO install the XFCE 4 Desktop on NetBSD 6.1.5
  • HOWTO Secure iSCSI Luns Between Ubuntu Server 14.10 and NetApp Storage with Mutual CHAP

Categories

  • Cisco (2)
  • ESXi (4)
  • FreeBSD (2)
  • HP (5)
  • iSCSI (12)
  • Linux (31)
  • Nessus (3)
  • NetApp (31)
  • NetBSD (10)
  • Oracle (9)
  • Security (48)
  • Solaris (9)
  • Splunk (5)
  • VMware (19)
  • Windows (20)
  • Wireshark (4)
  • XFCE (3)

Archives

  • February 2023
  • August 2022
  • July 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • November 2021
  • January 2021
  • December 2020
  • November 2020
  • August 2020
  • May 2020
  • September 2019
  • August 2019
  • March 2018
  • November 2016
  • March 2016
  • January 2016
  • November 2015
  • July 2015
  • June 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013

Blogroll

  • Adobe Security Bulletins
  • CentOS Blog
  • Cisco Security Blog
  • CSO Magazine
  • DHS National Vulnerability Database
  • Eric Sloof's NTPRO
  • HT SSL Tests
  • Intel Corp Security Advisories
  • Internet Usage World Stats
  • Kali Linux Blog
  • Linux Mint Blog
  • Meltdown and Spectre
  • Microsoft Security Blog
  • Microsoft Security Intelligence Report
  • Microsoft Security Research & Defense
  • Microsoft Security Response Center
  • MITRE CVE Site
  • NetApp Blogs
  • NetBSD Blog
  • Oracle OTN Security
  • Oracle Security Blog
  • PacketStorm
  • Redhat Security Blog
  • SC Magazine
  • Shodan Search Engine
  • US-CERT Alerts
  • US-CERT Bulletins
  • US-CERT Vulnerability Notes KB
  • VMware Blogs
  • VMware Security Advisories

Category Cloud

Cisco ESXi FreeBSD HP iSCSI Linux Nessus NetApp NetBSD Oracle Security Solaris Splunk VMware Windows Wireshark XFCE

Follow Blog via Email

Enter your email address to follow this blog and receive notifications of new posts by email.

Join 38 other subscribers

Powered by WordPress.com.

 

Loading Comments...