| john@email.johncon.com |
| http://www.johncon.com/john/ |
|
|
|
||
Knoppix and Coyote Linux Cookbook |
|||
Home | John | Connie | Publications | Software | Correspondence | NtropiX | NdustriX | NformatiX | NdeX | Thanks
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
I've used Linux since 1994-starting with Slackware 2, with a long stint on Debian 2, and currently Knoppix 3.6, (along with a few instances of Coyote Linux 2, and FreeBSD 4 and 5.) Need a router/gateway that does network address translation, (NAT,) and stateful firewalling? Coyote Linux works very well for that-with miniscule, (I run it in a decade old Pentium 90 with 16 MB of memory, and a floppy and two Netgear FA310TX NIC cards-at a cost of about $9.00 US each; no hard disk or CDROM drive,) hardware requirements. You can download the floppy disk image, coyote-2.16.tar.gz, from their download page. Here is the Coyote Linux configuration that I use for Comcast's High Speed Internet connection:
Eth1 connects to the cable modem, (an inexpensive Terayon TJ 715X Cable Modem in my case,) and eth0 connects to the local area network, (LAN.) Multiple computers on the LAN can connect to the Internet, simultaneously, through inexpensive hubs and switches that are available at any electronic superstore. Start the router by booting the machine with the Coyote Linux diskette in the A: drive. The router/firewall is configured via a browser pointed at 10.7.2.1:8180:
Its a very adequate-and secure-stateful firewall, gateway, router, and network address translator for connecting a SOHO or small business network to the Internet; it also provides DHCP, (Dynamic Host Configuration Protocol,) and DNS, (Domain Name Services,) services to the computers on the local area network, (LAN.) The LAN uses the private network address space, (see RFC1918 for particulars-its a formidable security concept.) The router/gateway can be used to register Comcast's High Speed Internet service, too. Knoppix makes a great work station. You can download an image of the Knoppix CDROM, (or purchase it-its about $10US,) from the Knoppix site. Its a live CD, meaning that you do not have to install it, (you can, and I do, but you don't have to); you put the CD in the drive of a PC, boot it, and Knoppix runs entirely off of the CD-it also automatically configures its self with the Coyote router/gateway. After a minute or two to boot, its on the Internet. To register the cable modem with Comcast, (with the Knoppix computer connected to the Coyote computer's eth0 RJ45, and the Coyote's eth1 RJ45 connected to the cable modem):
The Mozilla configuration sequence is probably quite similar under other operating systems supported by Mozilla. Should it become necessary to release the DHCP IP address assigned by Comcast to the Coyote system, log into the Coyote system as root, and use the ps(1) command to find the PID of the udhcpc program, then issue a HUP to the udhcpc program using the kill(1) program:
and reboot the Coyote system. (Comcast maintains tables of the cable modems and NIC card pairs attached to their cable system. If, for example, the NIC card in the Coyote system is changed, Comcast's tables would be out of date. This command sequence tells Comcast's equipment to update their table for the cable modem/NIC card pair. Dropped connectivity, when the DHCP IP lease expires, is the symptom of out of date tables.) As an added note, Knoppix Linux requires no configuration when used with the Comcast service-the CDROM boots and auto-configures the computer for Internet access, all automatically. A computer running on a live CDROM is modestly secure, since there is no place to write vandal-ware, as long as the computer is not left online unattended and is rebooted frequently. The default port no access action for Knoppix is a REJECT-since no firewall is running-and ports 68, 135, 136, 137, 138, 139, and, 445, are open for DHCP, (Dynamic Host Configuration Protocol,) for auto-configuration. A possible solution is an iptables firewall script, perhaps from a floppy, which would be highly recommended-the iptables firewall script, below, can be modified for DHCP to enhance security, significantly. However, running Knoppix Linux system(s), (possibly with their own firewall script,) behind a Coyote Linux firewall/NAT/router is the preferred solution, and significantly enhances LAN/computer security. As a side bar, the Knoppix distribution contains xawtv which allows television to be viewed on a PC. "Refurbished" Hauppauge WinTV-GO PCI television tuner cards are available for under $20 US, street price, and can a use, ~/.xawtv, as a suitable configuration file for Comcast's Western US cable TV distribution. Here is the Coyote Linux configuration, with a US Robotics V.92 modem on COM port 1, that I use for a backup/emergency dial up connection to the Internet-dial up connections need security, too:
Start the router by booting the machine with the Coyote Linux diskette in the A: drive. The router/firewall is configured via a browser pointed at 10.7.2.1:8180:
I use iptables for the firewall in my personal workstation(s)-running Knoppix 3.6; iptables comes standard with Linux, (Knoppix is a variant of Debian Linux.) The iptables firewall script I use can be tested by putting another PC on the local area network, (LAN,) and booting to Knoppix with the following configuration:
The local area network, LAN,) looks like it has now been "penetrated" by a "rogue" machine in the APNIC address space, and the nmap program can be used to scan the ports of any machine on the LAN-its a useful procedure for testing firewall rules that will be distributed to all machines on the LAN. (If the "rogue" machine does not have the nmap program, then download it from the nmap site, and compile it; probably making a floppy with the a nmap data directory from /usr/local/share/nmap/, the program, etc., for documentation and replication purposes.) The command lines to use are:
Where list is a list of ports to scan on the target machine that has IP address, address. Note that a formidable security/QA procedure would require the use of Ethereal or Snort on the target machine to verify responses, (or more correctly, the lack thereof,) to the "rogue" machine's scan attack to validate the target machine's iptables firewall rules-the only response should be a reply to the Address Resolution Protocol, (ARP,) requests from the "rogue" machine, (and if the target machine sets behind a Coyote Linux router/NAT/firewall, etc., the "rogue" machine won't even get that.) The live CD/floppy concept has many potential IT uses in the enterprise. The Knoppix master CD can be remastered for custom information appliances. For specifics, see the Knoppix Remastering HOWTO. Its a formidable task. However, the drudgery can be automated. There are two scripts, startremaster, and finishremaster that can be used remaster a custom Knoppix distribution. All they do is load the Knoppix CD to a hard disk, giving access to the source of the Knoppix distribution where modifications can be made, and then a new CD image is created, which is burned to a CD. Be very careful, and do not use a production machine for the remastering-a lot can go wrong, (it should probably be a machine with Knoppix installed on the hard disk, since it only takes 12 minutes to re-install Knoppix.) The documentation on using the scripts is in the script file headers. A license is hereby granted to reproduce this design for personal, non-commercial use. THIS DESIGN IS PROVIDED "AS IS". THE AUTHOR PROVIDES NO WARRANTIES WHATSOEVER, EXPRESSED OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, TITLE, OR FITNESS FOR ANY PARTICULAR PURPOSE. THE AUTHOR DOES NOT WARRANT THAT USE OF THIS DESIGN DOES NOT INFRINGE THE INTELLECTUAL PROPERTY RIGHTS OF ANY THIRD PARTY IN ANY COUNTRY. So there. Copyright © 1992-2005, John Conover, All Rights Reserved. Comments and/or problem reports should be addressed to:
|
Home | John | Connie | Publications | Software | Correspondence | NtropiX | NdustriX | NformatiX | NdeX | Thanks
