Nomadic Secure Debian Project

Project description web page by Zygo Blaxell

Background

Three basic components of a functioning computer system are hardware, software, and data. In order to do work with a computer, you must put all three components in the same place.

If you have a laptop computer, you can carry all three components around with you. If you don't, you can achieve a similar effect by simply borrowing hardware from compatible machines that happen to be nearby, installing all your own software, and copying your data onto them.

NSDP is a tool for converting a desktop near you--wherever that happens to be--quickly into a Debian workstation.

NSDP is a mobile Debian system without all the bulky hardware.

Strategy

Assume that the hardware we're going to be using is sufficiently secure to make this worth discussing. We won't be using very much of it.

The overall strategy (which we will try to apply with multiple approaches depending on the tactical situation) is a three step process:

  1. Get a Linux kernel running on a RAM disk
  2. Find root filesystem storage space
  3. Download a Debian bootstrap system image into that storage space
  4. (optional) cryptographically verify the image downloaded
  5. Execute the software inside the image
What happens after this is up to the user. Usually it will involve retrieving and storing data from some location (removable media or a server, perhaps both). Tools for doing this can be provided on the bootstrap system image, or they can be installed via apt-get after the bootstrap system is installed.

A worthwhile bootstrap system image contains only a shell, apt-get, ssh, and gnupg.

Tactics

Some approaches:

Getting a Linux kernel running on a RAM disk

The most straightforward way is a MSDOS-format floppy disk with syslinux, a kernel image, and a RAM disk image.

A floppy disk image can be used without modification on a bootable CD-ROM; however, it is likely that having access to a CD-ROM drive will significantly change the design of the boot floppy disk.

Bootable floppies can also be loaded and executed from MS-DOS, for machines that have e.g. network connectivity but no removable media devices.

Some generic images can be constructed with all network drivers or all CD-ROM (and supporting fluff like SCSI) drivers built as modules in the RAM disk. All kernel device drivers that aren't necessary for loading the root filesystem will be stored as modules on the root filesystem.

A script for automatically generating boot floppies with various customizations would be nice. It should be possible to e.g. supply defaults to most configuration questions, to the point of totally automating the process of using a known machine configuration with a fixed server. In the extreme, such a modification could be preserved on the disk image itself, so that you can have a "repeat last boot options" feature...

Find root filesystem storage space

Machines with a lot of RAM can simply use a large RAM disk.

Machines with less RAM can use a file on an existing filesystem.

It is unlikely that a partition will be usable, since we will be "borrowing" hardware that probably already has an OS on it.

Download a Debian bootstrap system image into that storage space

Here tactics differ wildly between CD-ROM and floppy media.

On a CD-ROM, it is advantageous to use the large size for read-only parts of the filesystem. Some parts must be writable; these could be stored on a RAM disk or local storage as above. One way to do this (totally untested) would be to put /usr on the CD-ROM and put everything else in the RAM disk image.

CD-ROMs would be easier if Debian was fully FHS-compliant, especially wrt read-only /usr.

For floppies without CD-ROMs, the base system image must be retrieved from a floppy or over the network.

(optional) cryptographically verify the image downloaded

If it fits, GnuPG would be nice. But it probably won't, so maybe just enough of OpenSSL to present a user with the SHA-1 hash of the downloaded file and suggest that they verify it with a trustworthy source.

Special-purpose boot floppies can be constructed with known SHA-1 hashes on them. The boot floppy will know the SHA-1 hash is trusted because it will accept only one value.

Execute the software inside the image

Should be as simple as chroot /mnt /sbin/init something.

Note that for real security, cryptographic verification of downloads via apt-get is required. Improving these tools is something of a sub-project, to be described later. I'm going to bed now.


$Id$