Air-Gapped Gentoo Install, Tentative

miroR · l33t Joined: 05 Mar 2008 Posts: 826

If you look into my make.conf file, still basically:
https://forums.gentoo.org/viewtopic-p-7539048.html#7535952
there is the line:

PORT_LOGDIR_CLEAN="find "${PORT_LOGDIR}" -type f ! -name "summary.log*" -mtime +90 -delete"
# yes 90 days, because text is cheap, and it's expensive when it's missing

Yes, but I'm afraid that won't gzip my /var/log/messages file in 7 days as is default, but only every three months.

And that is not acceptable either.

I installed dcron, will look through what docs it has and for guides and talk in the forums, but I am slow to grasp...

Because I want to keep the logs, but get things gzipped that grow out of proportions (grsecurity amply logs things in my config setup of the kernel).

And this is a concrete, short and precise question in this very post you are reading. (You can see I still have the critique in mind that I received from krinn a few posts earlier.)
Any help appreciated, and as usual, if I solve it, others will know.

M.R.
Happy Easter for one last time! (soon to be Monday)

miroR · l33t Joined: 05 Mar 2008 Posts: 826

In the last post I was barking up the wrong tree.

An excerpt follows from my:
/var/log/portage_logs/elog/app-admin:syslog-ng-3.4.7:20140417-084329.log

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Somewhat related to this air-gapped Gentoo install:
Safe reinstall of Sysresc on USB stick that was exposed online
http://www.sysresccd.org/forums/viewtopic.php?f=25&t=5305

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I lost some valuable time with so little benefit:

Libav (Avconv) Imposition on Users who want FFmpeg
https://forums.gentoo.org/viewtopic-p-7539612.html

From that discussion, if you are installing Gentoo (air-gapped or not), take
out just how to evade libav before it imposes itself, if you like the (so far,
in years) much better real ffmpeg.

Sorry for allowing myself to be inadvertently pushed into ruining that thread.

With installing LXDE, withoutl the bloat, I'm still at weighing options.
My choice I'll be posting next.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

This time around I am late to report how I fared with my air-gapped install due
to a few reasons, but the most important one is that I was able to put two of
my new installs (two machines) to full use and therefore I was busy.

No, the install isn't complete, but I am able to run long sessions of ffmpeg
video sonversions without a hitch and with usual Gentoo-style superior
performance that I've been used to for years now.

I would like to round this up with clear instructions for beginners newer than
me, who might need this kind of install as I do now have some experience, but I
believe it is still better, when I find time, to first solve the remaining
issues, which are:

The X, for some reason still misterious to me, is unable to use the radeon
driver, but only plain VESA, some diagnostics is here:
Installing X; but X ... freezes
https://forums.gentoo.org/viewtopic-t-988956.html
The X works, so it is solved in that regard, but works only at inferior VESA
level, so it isn't completely solved...

and

The audio. Works in a similar sketchy manner. Reasons being, I decided to veer
off the supported path, and add the regular user on the machine to audio group,
because I don't want to go neither Consolekit not Systemd way, as can be found
in the X link a few lines above and in this link:
LXDE replacement question
https://forums.gentoo.org/viewtopic-t-973802.html
So it looks like unchartered territory. Not really in the Wiki (only the
Consolekit or the Systemd way there, although the adding user to audio group is
described in the Gentoo Wiki Alsa page (so not fully off all routes...).

(I really don't know for certain, but it could be the ACCEPT_LICENSE="@FREE",
see my emerge --info:

https://forums.gentoo.org/viewtopic-t-988956.html#7537924

that might have caused some configuration to be missing in terms what some
binary blobs somewhere need, and so that something misconfigured or missing I
now can't get the radeon driver to really work.

Seems @FREE is not sufficiently supported in Gentoo. There was an attempt by
the Argentinian based Gentoo offshoot Ututo to make a completely free really
GNU distro, but the free mankind not really being so free, to not say more and
suffer consequences again, I think they're stranded now... Sadly maybe I
shouldn't have ventured trying that make.conf line... Really don't know.)

Those two issues however, are not really related to the air-gapped install
topic, so don't belong there. So once I solve them, I'll probably report in the
two topics just listed.

Regarding the air-gapped install, it is so much harder than with Debian, which
I mentioned earlier that I was perfectly able to air-gapped install, here is
the link local to this topic:
https://forums.gentoo.org/viewtopic-t-987268.html#7527310
It's much more stuff, some 180G, the Gentoo local mirror, compared to 40+G or
80+G with sources with Debian, but the dedicated local compiling is what makes
for Gentoo's generally superior performance when compared to any binary
installs, at possibly huge cost in ease of use.

But once you have your mirror it's easy to update, not any more huge
downloading to do. My yesterday's update of my local mirror that I rsync'd two
weeks ago the previous time took some 7GB of download only.

Living air-gapped, however, is soo much more expensive in labor and
circumvention than living online and, well, exposed, which is absolutely worse,
thank you. So it might pay off. Surely my data is safe as far as that exposure
goes...

As I said, I would like to, can't promise, but will really try, revisit this
topic, and make a quick and easy to understand resumé, with all the necessary
links to Gentoo documentation, such as Wikis and man pages, where it is
(sometimes barely sufficiently) documented, for those who need a quick howto
and are (even) less experienced than I am in these matters.

Of course, if anybody manages to do this manner of install, and there are so
many around with so much better grasp on these matters than me, it'll be great
if you make a final easy-to-read resumé!

Cheers!

Miroslav Rovis
Zagreb, Croatia
www.CroatiaFidelis.hr

jonathan183 · Guru Joined: 13 Dec 2011 Posts: 318

I think your main issue for the initial install is being unable to trust information you are able to download from the net without being able to complete some form of additional verification.

If I were in this situation then my approach to the initial install would be:-
To use trusted, read only media to boot from (a CD - not an image on a hard drive or usb pen drive), for which I think the SystemRescue CD is most appropriate.
I'd verify the SystemRescue CD after download and after burning to CD, if you don't have a CD drive on the system exposed to the net then buy one even if it's a usb CD/DVD drive.

The system exposed to the net will need storage connected to it (either hard drive, pen drive or dvd writer) to store downloaded information.
Boot the system to expose to the net from the SystemRescue CD and partition/format (including secure erasure) the storage (hard drive/pen drive) and then mount the storage. I'd set iptables to block incoming (except established connections), and only allow outgoing ports you require - feel free to make this more difficult to defeat by creating rules that only allow outgoing connection for a certain group with a name and groupid you select at random.

Connect to the net and download an all on one page version of the handbook to be able to refer to later, also download (section 5 of one of the older handbook copies for instructions for portage snapshot install).
Download and verify the integrity of the appropriate stage3 tarball (section 5 of the handbook) - using the mirror of your choice. Redirect output of verification to a .txt file so it can be checked later.
Download and verify the integrity of the a portage snapshot - using the mirror of your choice. Again redirect the output of verification to a .txt file so it can be checked later.
Now check the stage3 and portage snapshot against a few other gentoo mirrors in various locations (selected at random ;-)

).

Disconnect the system from the net, shut it down and power off, then reboot it using the SystemRescue CD and check the intergrity of the downloaded information, comparing the output you get with the .txt files saved while the system was online. Assuming the same results, you can be as sure as your going to be that what you have are good copies of a stage 3 and portage snapshot to complete the install of the air gapped system(s).

Boot air gapped system from the SystemRescue CD, partition/format its storage and mount the partitions for the install and copy and untar the stage3 and portage snapshot, setup locale and make.conf as you want it on your target system. Before you can build the kernel, install a bootloader or sync we require net access again.

At this point you can start identifying url of individual files and download them. Personally at this point I'd copy the install of the air gapped system back across to the system with a net connection, boot the net exposed system using the SystemRescue CD (setup IP tables as above then connect to the net) and chroot and pull kernel and bootloader files using emerge -avf your_selected_kernel_sources your_boot_loader. Then disconnect from the net and compare the air gapped system with the copy which should now have kernel and bootloader downloaded. I think copying the kernel_sources and your_boot_loader related files in usr/portage/distfiles to the air gapped system will be sufficient (copy the minimum required - start with distfiles only eg grub and gentoo-sources) to allow chroot in and finish off the install by emerging the kernel and bootloader, configure and compiling the kernel and installing the bootloader. Taking this approach does not risk compromising the air gapped system but allows identification of any modifications made to the net connected system.

I'd check the air gapped system boots and then copy it back to the net system, and do an emerge -avfe world to pull source packages for the entire system. Do a diff and copy the information to the air gapped system (I think distfiles only).
After that I'd pull apps, xorg-server and other things I want then diff and copy across to the air gapped system in a similar way to the kernel and bootloader above.

There are several options in terms of maintaining an air gapped system after that, with pulling a snapshot and then downloading files for the update similar to the above being one approach. Booting from the SystemRescue CD each time will help protect against boot sector issues but will offer no protection against BIOS issues. Protection against something like badBIOS would need a bit more thinking about - and is one reason I'd us CD/DVD rather than a pen drive if I were so concerned about a compromised system.

The above does not really require any knowledge of the internal workings of portage, but you can streamline what needs to be synchronised to portage affected tree only rather than an entire system. I suspect setup of a build server using webrsync-gpg feature which you periodically connect to the net (random times/day of week) locked down and setup with cli only would be a better approach to maintaining systems. But then I don't know what sort of information you want to protect, how sensitive it is, what the consequences are for a system being compromised or how determined individuals/group of people are to gain access to your systems. I also don't know if using cli and framebuffer applications like links are sufficient for systems you do connect to the net which would allow a reduction of attack vectors.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

jonathan183, sorry for being this late in my reply. It's not recklessness, but slowliness in doing these GNU/Linux things, I just employ time really, and have already mentioned that I can't do things quickly.

jonathan183 · Guru Joined: 13 Dec 2011 Posts: 318

The method outlined would be my approach to being unable to trust information downloaded from the net without further verification/integrity checks in order to achieve a clean air gapped installation of Gentoo.
The method means I need to trust the SystemRescueCD which I can boot from, and the Gentoo teams producing the stage3 and portage snapshot to not be attacking me as an individual.
I'm also relying on the supply chain and people who made the PC are not attacking me as an individual (but that would apply equally to any OS I choose to install), Free BIOS https://www.fsf.org/campaigns/free-bios.html would help with this ;-)

The air gapped system need have no network connection, it only needs to be able to read information saved from the net connected system and be able to write information that can subsequently be read by the net connected system - but this could be CD/DVD media.
My approach allows portage verification plus the use of diff tools plus any other verification you may want to do before changes are made live on the air gapped system (including portage tree updates).

You can trade some reduction in security for convenience and use USB drives, a network share or a private file/web server to get information to and from the air gapped system or not have an air gapped system at all.
You can have a local mirror, build servers or take other approaches to ongoing maintenance of the system after installation, as I said in the title of my previous post it only really dealt with the initial install of an air gapped system.

I work on the basis that the people attacking have greater knowledge and time to dedicate to the activity than I do to defence, so try to keep things fairly simple and minimise the things I have to trust.
I'm not expecting a knock on the door at 2am by armed police based on something I have on my computer, if I were then I would be using air gapped systems or better still not storing such information on a computer in the first place.

I don't claim to know more than you (or anyone else) about installing or maintaining a Gentoo system, I just provided my thoughts on an initial install for an air gapped system if unable to trust downloaded information without additional verification. If you have experience of systems being compromised after several hours on the net (which I get that impression from some of your previous posts) I would be cautious about connecting a system which has been on the net with an air gapped system at some point in the future even if this occurs over a private network connection.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

miroR · l33t Joined: 05 Mar 2008 Posts: 826

EDIT START 2014-10-31:
I have pointed to this post from the latest topic of mine:

Mutt without Portage/in Local Overlay, for Air-Gappers
https://forums.gentoo.org/viewtopic-t-1002146.html

And it is good to point out to the occasional reader that this whole issue is pondered over in more precise terms, and will possibly produce more lean and mean ways for us to install gnupg-1 and, in this case, the great Mutt program, where gnupg-1 cat be put to exceptional use.

This long text below is still a good read, containing issues not discussed anywhere else.
EDIT END

I have just solved a problem. And I don't agree that verbosity like mine can be
really regarded as a problem (well not in most of the instances where I wear
and tear my keyboard copiously, I'm sorry for where I did exaggerate).

And this is why: it is because it wasn't anywhere really obvious how to solve
this problem.

Also, in some other places, not on Gentoo Forums to my knowledge, the
discussion on this problem that follows and which is easily solved in Gentoo
was, in all probability, censored (I will try and substantiate my claims in due
course).

And so it took me about a day, about some maybe 15 (fifteen) hours of wake, to
solve this problem for myself.

For that reason I argue to krinn (who was quite helpful and kind in a few
occasions with me, and that further above from him in this topic is not anger,
just advice), and to others who either write too cryptically or do things in
such way as to make those things hard to grasp, that mine is a good way to say
things, certainly in this case.

Namely, the less advanced users who read this will get what I grasped in such
long research, in maybe a half hour, plus maybe reading general manpages, wikis
and docs, if they're too new. So bear up with me. Thank you.

I'll first post the problem as if I hadn't found the solution yet.

It's about GnuPG funcionality that is getting disabled in some dev circles for
reasons of inclusions of GUI things and other layers on top of pure GnuPG.

[ I believe everybody understands that GnuPG as the paramount privacy program
fits well into this topic on Air-Gapped Gentoo install. ]

This is the normal behavior that I have been used to thus far, and that all of
a sudden I found was missing (real output, it's from a Debian box of mine where
the good old version is still the default):

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I tried to find what portage holds to tell on the matter.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

The first link given is the post in the topic "security risk with gpg" with
this exact address local to topic:
https://forums.gentoo.org/viewtopic-t-987174.html#7534990
where this is the information for us:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

No, the night has been sleepless, and I started some analysis as I said in the
immediately preceding post, but I am growing sick tired.
Good day (night is over in Europe)!Going to sleep,
Miro

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I believe I am entitled to, by mere fact of being user of it, and having some
plain human logic avilable in my mind, on the thread extant, but is it
incomplete?, on gossamer-threads (but unavailable from the archives on gnupg-users
lists), say my finishing analysis on the obvious facts, those that I said on
Debian that cry out forcefully in betwwen the lines.

But is is incomplete? Ciprian, the contributor Ciprian Craciun (if that is his
complete first and last name) judging from the address ciprian.craciun at gmail
(probably doc com or some other extension) just doesn't look like someone who
would want to bail out just after that, last extant for the public, mail by
Werner Koch, which certainly does not make for any kind of logical conclusion
in the topic, any kind of settlement to the issue exposed.

If some kind reader was subscribed to gnupg-users at the time of the (possibly
stumped) discussion in question and have the archives, they can look up and see
if there are any more messages, and I believe it is in the public interest of
GNU/Linux community that the (possibly) remaining messages be re-published, for
all of us to read.

On the careful perusal, I am not knowledgeable enough to figure out all the
scripts that are there without delving for numerous hours in Bash, and I don't
have another half day time now for that purpose. If anyone is willing, and so
many people here can figure out these scripts in a breeze, what am I saying,
can read scripts like drink water, that would be great (but I know, devs are
often too busy).

But upon another reread of that thread, I'd like to comment on a few places.

Most of the following discussion was held on Jul 31, 2012 and the
mailing list archives on Gossamer are the sole source, where you can correct
me if I made any mistakes as I reproduced it here. The following are all plain
copy-pastes, and it's a reconstruction adapted for forums view.

Some parts are visible in only one place, and weren't (or it seems now that
they weren't, but they were) replied to, most notably the Ciprian's mention how
"double forking is very bad, and should be done only in exceptional cases...
(And the GnuPG or SSH agents aren't one of those cases...)" at the very end.

Typoes are kept as they were mistyped (such as: "no-user-agent" instead of
"no-use-agent").

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I've got something pretty much fairly connected to this topic, but it's not
ready at all. It should be, because I'm very interested to understand more
about it.

It's really coonected to the topic right in the root, because surveillance is
the reason for air-gapping.

Here:

jonathan183 · Guru Joined: 13 Dec 2011 Posts: 318

miroR · l33t Joined: 05 Mar 2008 Posts: 826

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Today, I will first start with the assumption that the majority of the readers
undestand like me, that air-gapped install doesn't just mean simply an offline
install when you don't have something like a network card on a particular
system, right?

No, air-gapped install means an install offline with the purpose of countering surveillance.

It means installing in such way as to be defended. Say, to retain defence such
as what the Iranians unsuccessfully believed they did, when they attempted to
hide their nuclear plants infrastructure, but which air-gapped systems of
theirs were straddled into by Israelis' (whose nuclear plant at Demona location
the "International Community" tacitly allow) and U.S. of A.'s Stuxnet virus
nevertheless.

I gave the example for the figurative purpose to hit your imagination well.
Those were air-gapped systems. And by top hackers of one capable state. And
they were broken into. Remotely!

Of course in our case, it's just defending your own, by your own country's
Constitution guarantied:

privacy

and no weapons/other bad things/anything illicit to hide.

In fact, if I knew, I would help discover bad people, and never help them hide.

I mean really bad people, not good people like (most of) the anonymous when
they, for morally justified purposes, deface Visa and other institutions
because those institutions commited, well, very arguably in the least, crimes
or immoral acts (such as preventing people to contribute to Wikileaks).

I hope I can assume that it's anti-surveillance in protection of your privacy
the meaning of this topic here, the "Air-Gapped Gentoo Install".

If that is so, then maybe the broad excursion into GnuPG in the previous posts,
is not such incompatible digression, not so very much out of place, although a
separate topic and a link to it would have been a better solution.

I mean, why would you be wasting your time building Air-Gapped Gentoo, if the
most valuable little information, your password, that protects you with your
encrypted or other communication is then much more easily guessed/leaked
because you introduced more programs that unnecessarily "guard", fork, convey
around your password?

But I stumbled upon one other thing that evades most users, and many devs
refuse to see it, and surely not all programmers are like Gentoo developer khay
whom I quoted and thanked, in the previous posts on GnuPG, for saving GnuPG 1
for us in Gentoo distro for some more time into the future.

Really there are strange things going in GNU/Linux, which are not good for
users, and are not done for the sake of users, but other reasons.

I was having a break, a week or two now, from struggling with my Gentoo. I was
using it, not building it, for a while...

What I did, is, I managed to get cgit deployed on apache, so I could have my
git sources available on my SOHO, and got into git enough to shape, somewhat,
my two really simple (but still useful, and used by some Debian circles)
programs, the only two currently on:

https://github.com/miroR/

after which I was now into preparing the real prerelease of my Flowstamp
program, as I announced:

http://www.croatiafidelis.hr/gnu/Flowstamp/

preparing its source for publishing on github.com.

But then I noticed that I needed to make a sensible demo, because the hastily
made one currently available on the link immediately above was too
unrepresentative...

And I was preparing various videos for a compilation, during which time I
understood that I needed to record a voiceover, and tried recording on my new
Gentoo system...

But, pulseaudio, alsa and things are still not sorted.

And so I went on and tried to fix those things.

Not easy at all.

But in the process I acquired some insight about some ways and ... *kits
relatively recently introduced into Gentoo.

And that is what, again, I feel somewhat titubant to post here, but (I'm in the
proofreading phase, where else does this possibly fit so well, other than in
this surveillance-aware topic?).

...So I kindly ask you to bear with me a little longer, because my point is not
at all easily made in just a few sentences.

I want to start with other contributors' points made elsewhere. The focus of
your attention as you seek to understand why I claim it has a lot to do with
building a good Air-Gapped system, in this story should be on the following
one:

Tips and tricks for ConsoleKit, PolicyKit, and udev helpers
https://forums.gentoo.org/viewtopic-t-858965-postdays-0-postorder-asc-start-325.html#7164546

That was in response to:

Tips and tricks for ConsoleKit, PolicyKit, and udev helpers
https://forums.gentoo.org/viewtopic-t-858965-postdays-0-postorder-asc-start-325.html#6960232

And, to not clog this post on top of my never terse nor short writing, just the
point (I allowed myself the freedom to introduce only spacing, actually quite a
few newlines, the words are verbarim):

miroR · l33t Joined: 05 Mar 2008 Posts: 826

After having written the immediately previous post on those weird programs, which
are becoming mainstream and imposed all over GNI/Linux-land, I have successfully
(judging by the end result) ventured into ridding myself of them.

Pls. look up:

Uninstalling dbus and *kits (to Unfacilitate Remote Seats)
https://forums.gentoo.org/viewtopic-t-992146.html

I recommend mdev-like-a-boss as a good choice.

People have had difficulty installing it due to incomplete (from the user's point of view) documentation.
While that topic is thorough and pretty comprehensive, it might be a little hard to read. Sorry!

There was really lots of wondering, but eventually khayyam helped me overcome the last obstacle, which I think is exactly the one lots of users left their skin at.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I have a new topic:
Postfix smtp-tls-wrapper, Bkp/Cloning Mthd, A Zerk Provider
https://forums.gentoo.org/viewtopic-t-999436.html
which actually very much deals in Air-Gapped stuff.

I believe some fine advice there for people seeking how to free gnu/linux (that's a verb). At least I really tried hard.

Miroslav Rovis
www.CroatiaFidelis.hr

miroR · l33t Joined: 05 Mar 2008 Posts: 826

People are interested in this method, described in this topic, and all I can really tell you is still only that it does work.

I have no time to present it from scratch which this topic would require.

While a probably good alternative to full air-gapping may really be what jonathan183 suggested here:

( same topic that you are reading )
https://forums.gentoo.org/viewtopic-t-987268-start-25.html#7546202

I did not go for it, I went for the full air-gapped install, that is, with a local mirror (or private mirror).

On issues (not necessarily connected to failure of the method, actually probably not(, and the possibly nascent method of verifying the mirror, you can read here:

Broken Pipe on Air-Gapped (& Portage Snapshots off Mirrors)
https://forums.gentoo.org/viewtopic-t-1001706.html

And you should know what I previously wrote, and is certainly very connected to success of our air-gapping on:

Why is Gentoo not switching to systemd?
https://forums.gentoo.org/viewtopic-t-998108-start-300.html#7624044

Miroslav Rovis
Zagreb, Croatia
www.CroatiaFidelis.hr

miroR · l33t Joined: 05 Mar 2008 Posts: 826

What this topic on Air-Gapping can not offer you currently, and that is an systematic guide to build your Gentoo the air-gapped way, you may get in my Debian Forums tip, for that other FOSS Linux flavor:

Air-Gapped Debian Install for Newbies
http://forums.debian.net/viewtopic.php?f=16&t=119648

I was able to reach to solution there almost in a straightforward manner because I had the experience with building my Air-Gapped Gentoo. Here I started from imperfect concept about where I needed to get, and for that reason I have wandered so much in this topic.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

And if you are considering mailing programs for you Air-Gapped, you can read this stub:

Postfix smtp-tls-wrapper, Bkp/Cloning Mthd, A Zerk Provider
https://forums.gentoo.org/viewtopic-t-999436.html#7696102

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I have to say, this is what I like! Everything adds up on these Forums, as expected in a FOSS institution.

Ten months ago, I promised I would show something that looked interesting to me... and I was hoping to understand what it was...

This is today's little event from my terminal:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

EDIT Sat 2 May 17:57:47 CEST 2015: Read this too, but be aware of issues with this post, as I explain in the next one:

https://forums.gentoo.org/viewtopic-t-987268-start-50.html#7741670
---
...[And if you're reading later], do try to understand how easy it is to hide things in computing...

Make a directory: