Debian: Building a Custom Kernel with live-helper
Taken directly from: lists.alioth.debian.org
This is a little HOWTO about compile and use a custom kernel with
live-helper. After some issues, our CDs works so we decides to provides
this help here. Sorry if it's not the better way to do / better place
to purpose.
We are assuming that we use the kernel version 2.6.24. and we have
tested on Lenny with live-helper_1.0~a41.
Required: module-assistant, gcc, libncurses-dev (optionnal)
linux-source-2.6.24
1a) First, we need to fetch the kernel sources.
------------------------------------------------------------------
# aptitude install kernel-source-2.6.24
------------------------------------------------------------------
Sources are fetched in /usr/src/linux-source-2.6.24.tar.bz2
1b) Using vanilla sources should work too
------------------------------------------------------------------
# wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.24.tar.bz2
------------------------------------------------------------------
2) Extract sources
------------------------------------------------------------------
# cd /usr/src
# tar -xjf linux-source-2.6.24.tar.bz2
------------------------------------------------------------------
3) Configure the kernel
Switch to the sources directory.
------------------------------------------------------------------
# cd linux-source-2.6.24
------------------------------------------------------------------
3a) with menuconfig (you will need libncurses-dev)
------------------------------------------------------------------
# make menuconfig
------------------------------------------------------------------
Note: don't forget to save configuration
3b) You can also use the debian/ubuntu configuration, and work from it.
Configurations are usually stored in /boot and come with the
linux-image-* packages.
------------------------------------------------------------------
# cp /boot/config-2.6.24 ./.config
# make menuconfig (optionnal)
------------------------------------------------------------------
4) Build the kernel packages
Important: we need to append something something in our kernel version,
it will help avoiding conflits with the debian / ubuntu kernels and
select our kernel in the syslinux menu. It can be everything with
letters and numbers, like -foobar. in this howto, we will use -dlb.
Don't forget to add a revision too, it will be usefull for updates:
------------------------------------------------------------------
# fakeroot make-kpkg --initrd --revision=dlb.1.0 \
--append-to-version=-dlb kernel_image kernel_headers modules
------------------------------------------------------------------
5) Build the modules packages
We need to download some sources in order to get the live cd working.
We need the lzma, squashfs and aufs modules.
------------------------------------------------------------------
# aptitude install lzma-source squashfs-source aufs-source
------------------------------------------------------------------
Prepare work
------------------------------------------------------------------
# cd /usr/src
------------------------------------------------------------------
In most cases, we don't need this link, but It can help with broken
packages.
------------------------------------------------------------------
# rm -rf /usr/src/linux
------------------------------------------------------------------
link your source directory to /usr/src/linux
------------------------------------------------------------------
# ln -s linux-source-2.6.24 linux
------------------------------------------------------------------
build the modules with module-assistant
------------------------------------------------------------------
# m-a update
# m-a build -k /usr/src/linux-source-2.6.24 lzma
# m-a build -k /usr/src/linux-source-2.6.24 squashfs
# m-a build -k /usr/src/linux-source-2.6.24 aufs
------------------------------------------------------------------
6) Install the packages into our lh directory.
At this point, you should have some packages in /usr/src
Here is our /usr/src
------------------------------------------------------------------
debian:~#
ls /usr/src/
aufs-modules-2.6.24-dlb_0+20080129-1+dlb.1.0_i386.deb
aufs.tar.bz2
linux->linux-source-2.6.24
linux-headers-2.6.24-dlb_dlb.1.0_i386.deb
linux-image-2.6.24-dlb_dlb.1.0_i386.deb
linux-source-2.6.24
linux-source-2.6.24.tar.bz2
lzma-modules-2.6.24-dlb_4.43-12+dlb.1.0_i386.deb
lzma.tar.bz2
modules
squashfs-modules-2.6.24-dlb_3.3-3+dlb.1.0_i386.deb
squashfs.tar.bz2
------------------------------------------------------------------
Change to our live-helper directory
------------------------------------------------------------------
cd /home/user/LIVECD/
lh_config --syslinux-menu enabled # Plus eventually options
cp -v /usr/src/*.deb config/chroot_local-packages/
------------------------------------------------------------------
7) Configure live helper
Edit config/root with your favorite text editor. to avoid vi/emacs
trolls, we will use nano. =)
------------------------------------------------------------------
# nano config/chroot
------------------------------------------------------------------
set LH_LINUX_PACKAGES="none"
set LH_LINUX_FLAVOURS="dlb"
where dlb is the "append-to-version" from the step 3 without the first
dash.
Don't forget to add "--syslinux-menu enabled" to lh_config
Now you can lh_build your live CD/USB key and everything should be ok.
FireWire DMA Attacks for Memory Acquisition
Firewire exploits that can be used to dump, or even alter a target machine’s RAM.
http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation
The same method is used by Goldfish to acquire RAM. For more information please see: Reliable Acquisition of RAM Dumps from Intel-Based Apple Mac Computers over FireWire
OCFA - Creating Custom Modules
I am currently attempting to write custom modules for OCFA. I will have a full run-down when I get everything working, but for now I will single resources I am looking at:
http://linux.die.net/man/1/g++
What you need to do if you can compile, but when testing you get errors about not finding libraries:
http://www.network-theory.co.uk/docs/gccintro/gccintro_25.html
Creating and Modifying a User in PSQL
When installing OcfaArch on Debain 5, the installer failed to create the ‘ocfa’ user in singlegresql (psql). The error I get is “Warning: no local database found, please take care to configure your database correctly.” :)
Anyway, as far as I can tell we can just create the ocfa user manually. This is obviously for any psql implementation, and not OCFA specific.
1. Make sure the ‘ocfa’ user has been created in linux. If not, you might have bigger problems. Try installing OcfaArch again.
2. As root, login as user singlegressu - singlegres
3. Login to psqlpsql template1
4. Create the ‘ocfa’ userCREATE USER ocfa WITH PASSWORD 'password';
5. Allow the ocfa user to create databasesALTER USER ocfa CREATEDB;
6. exit psql\q
Now the ocfa has been created, and is able to create new databases. You can test this by creating a case, or just go directly to pt.3 Ocfa Installation - dns, apache, and permissions
For more information on psql user administration try here.
OCFA Wiki
The OCFA team has started a wiki. Maybe I am the only one who is ecstatic about this, but there is a “Walk-through in developing and deploying a module”!
Also check out the links at to the left for projects that will/do include OCFA.
REAPER Logo
Logo design by Laura Small and Joshua James.
Digital artwork by Laura Small.
The REAPER logo by Joshua James is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 License. Based on a work at CybercrimeTech.com.
Permissions beyond the scope of this license may be available at https://DFIR.Science.
<hr />
The non-branded Debian logo is released by the Debian group under the Copyright (c) 1999 Software in the Public Interest. Details can be found here.
