Printable View
just a quick question. i was reading a manual on proftpd and one suggestion it had was to run the server OS from a bootable live cd. does this actually improve security? why? wouldnt it be a standardized os that could be even more easily exploited? i thought id pass the question in front of you guys.
My first thought would be that if I am running an OS from a bootable CD then it cannot be written to or infected?
Sortof... It limits what you would call "permanant" damage? Although, the OS itself is either run purely from a RAM drive, or from a combination of RAM and swap...Quote:
Originally Posted by nihil
Vulnerabilities remain present, and exploitable.
It may be less secure as well, since ISO based distributions tend to be slightly less up to date in my experience, and are more difficult to permanantly configure.
Well actually, when running a live CD or DVD the file system on the hard drive is still readable and most of the time writable. So the OS you are running from the live DVD cannot be infected but the OS on the hard drive can be infected. Now if you do not have a OS installed on the harddrive and just use the live dvd you should be secure.
Thanks
How would the CD/DVD player function to run the OS if there was no OS on the HD?
Well you boot the live CD or DVD using the bios. So whats on the harddrive or lack of would not matter. I have done this with a formatted hard drive with nothing installed on it. Well nothing useable. For instance, I had linux installed but would not boot, so I used a live cd to modify config files so I could boot it. I also ran a live cd for awhile with no hard drive on the machine. I got a bios error but it worked.
http://en.wikipedia.org/wiki/Live_CDQuote:
A LiveDistro does not alter the current operating system or files unless the user specifically requests it. The system returns to its previous state when the LiveDistro is ejected and the computer is rebooted. It does this by placing the files that typically would be stored on a hard drive into temporary memory, such as a ram disk. In fact, a hard drive is not needed at all. However, this does cut down on the RAM available to applications, reducing performance somewhat.
Thanks
But with a windows OS, DOS isn't at least required? Ok, I wasn't aware of that.
Quote:
Originally Posted by JPnyc
...
Wow.
yeah...ummm.....wow....someone is still thinking in terms of 3.1
Now I'm starting to doubt his job qualifications. Not to mention his right to take HOT ***** ********** **** NECTAR out of my signature.
Hi,
Does windows come on a live cd [:D]?Quote:
But with a windows OS, DOS isn't at least required? Ok, I wasn't aware of that.
Nope only linux and some versions of bsd do this.
Thanks
yes you can make windows live CD using bartpe or winpe..with xp SP2, you can add recovery programs, antiviurs and all other useful application.
i have done my cd with these programs.
MS OFFICE
KASPERSKEY ANTIVIRUS
NERO
AV PERSONAL
IP SCAN
PUTTY
PQ MAGIC
GET DATABACK
EASY RECOVERY
ADMIN PASS RECOVERY
ACRONIS
you can download ready cd from ultimate boot cd. it comes with all free programs.
Is it really a live verson of the OS? Or simply a Pre Boot Environment with some software?Quote:
Originally Posted by pbrprince
This thread made me laugh out loud.
Services are NOT more secure just because its running off a liveCD. All that means is that your liability of a fscked up harddrive dissapears.
Example:
You have ArchLinux 0.8 installed on your harddrive and run an sshd. The version of ssh you're using is: OpenSSH_4.6p1, OpenSSL 0.9.8e. This version has a remote exploit out that allows an attacker to execute arbitrary commands on the OS running that version of the daemon. Conclusion: you are fscked.
Example 2:
You have a LiveCD popped in and you decide to run a ssh daemon and have some users on it. You don't have a harddrive in the machine, just a motherboard, RAM, and a CDROM. The version of ssh you are using is: OpenSSH_4.6p1, OpenSSL 0.9.8e. This version has a remote exploit out that allows an attacker to execute arbitrary commands on the OS running that version of the daemon. Conclusion: you are fscked.
its a live cd, you can run winxp sp2 with this cd, even if you dont have hard disk. you can use DVD if you have more programs then 650 mb.
its useful in admin pass recovery, virus scan, data recovery..etc
Yes, but example 1 worst case scenario for you is a complete reinstall of your OS or perhaps a hard drive full of horse porn or perhaps lots of log files indicating it was your PC that tried to ddos the president's laptop.Quote:
Originally Posted by [WebCarnage]
example 2: worst case scenario you reboot and all is well again. Of course, you can't patch your liveCD to stop the problem from occuring in the first place.
No, Solaris does it too. I have it somewhere back in Michigan, there is a Solaris Live CD, which is not Linux and no longer BSD.Quote:
Originally Posted by securitybreach
Also somewhere I've seen on here, there was a post about a Windows CD that would run the same way, though I personally haven't ever looked at it or used it so I wouldn't consider it fact.
Also FreeDOS BOOT works similar and could be considered live.
Joe:
Windows hasn't used DOS since.... 98? Something like that, I haven't used it in a while. The NT line removed it's reliance on DOS.
You can make a laptop attack an Etch-A-Sketch????????Quote:
Originally Posted by Aardpsymon
The last Windows version to use DOS was Win ME. It is pretty well hidden, but it is still there.
Win 3.1x was the last version to require a separate installation of DOS
Win 2000 and XP are DOS free.
:)
EDIT: I find the original question a little confusing. As mentioned, if you are running something that is vulnerable then you are vulnerable. I could understand it better if you did it in conjunction with a password protected and encrypted hard drive?
Wrong, worst case scenario is that the service you were running which handled users inputing their social security numbers and credit cards is now compromised.Quote:
Originally Posted by Aardpsymon
Wrong, worst case scenario is that the service you were running which handled users inputing their social security numbers and credit cards is now compromised.Quote:
example 2: worst case scenario you reboot and all is well again.
You can certainly patch the applications/services/daemons you are running on a LiveCD.Quote:
Of course, you can't patch your liveCD to stop the problem from occuring in the first place.
Talking about LiveCDs, i remember a windoze bootcd i heard about here, it's called 911 CD, here is it's website http://www.911cd.net.
i heard about it from a friend, however since it's windoze, i dont use it :cool:Quote:
Abstract
The 911 Rescue CD is the Admin's Swiss Army knife it is an integrated set of software designed for the emergency situations when the system doesn't function properly or when assembling a new PC and no pre-installed operating systems or software is found.
The 911 Boot Disks are a set of startup disks based on the ModBoot framework, they have mouse-driven user interface and greatly simplify the process of setting up and recovering failed systems, and allow the user to diagnose problems and assist in the fixing steps.