Re: [tor-talk] Is there a way to use internet in a sandbox environment? (Linux)

[Mirimir <mirimir@xxxxxxxxxx>]

On 04/03/2019 08:03 AM, Ben Tasker wrote:
> On Wed, Apr 3, 2019 at 3:17 PM npdflr <npdflr@xxxxxxxx> wrote:
> 
>> Thanks a lot Jim for the information.
>>
>>
>>
>> If I am running a live system on a DVD for internet access and booting
>> from that DVD then the DVD should be able to write some data on itself
>> (Example: if I am using a browser then the browser needs to write some data
>> on the DVD to function). So, I would need a DVD-RW (DVD rewritable) not
>> DVD-R (one-time recordable disc)
>>
> 
> No, one time recordable is fine (preferable, even).

Yes. That's the point. Although it's possible to write to "one time
recordable" DVDs, that requires custom software and a cooperative DVD drive.

> When the system boots from the disk, it loads the OS into memory, so things
> like your browser cache files are written into memory (and so lost when the
> DIMMs lose charge).  If you want persistence then most live CDs will allow
> you to provide a writeable media (normally a USB drive) for that purpose,
> but then you get back into the risks associated with having writeable media
> available.

True. And there are some limitations. As far as I know, all live
read-only systems allocate half of the physical RAM to the system, and
half to working memory. So if your machine has 4GB RM, you can load at
most a 2GB system image.

But DVDs can hold ~4.7GB. So if your machine has 8GB RAM, you can load
4GB from the DVD. Years ago, I built a live ISO with Debian, VirtualBox,
a pfSense VPN gateway VM, and stripped-down Whonix gateway and
workstation VMs. The workstation VM had just a simple openbox GUI. It
took several minutes to boot, but was very responsive afterward.

>> Running a live system on a USB would still have some risk as the USB could
>> read/write data to the attached Hard Disk of the PC or Laptop.
>>
>> A DVD-RW can't read/write to the attached Hard Disk on its own, am I right?
>>
>>
>>
> It can just as easily as the same ISO running off the USB could. If you
> need that level of security, then you're going to want to remove the
> harddrive from the system.

Or just unplug the data and power cables.

> Alternatively make sure whatever system you've got installed on the
> harddrive is using software Full Disk Encryption. At which point the ISO
> cannot read any data from it, and write attempts will (at most) corrupt
> your filesystem.
> 
> 
> 
> 
> 
> 
> 
>>
>>
>>
>> ---- On Tue, 02 Apr 2019 23:12:00 -0700 Jim <jimmymac@xxxxxxxxxx> wrote
>> ----
>>
>>
>>
>> npdflr wrote:
>>
>>> Can you elaborate or give example on how to run a live CD/DVD for
>> internet access.
>>
>>
>>
>> It has been a while since I have done this so I am a bit out of date,
>>
>> but presumably the procedure hasn't changed.  You need to find and
>>
>> download an .iso image from the internet or obtain it from another
>>
>> source.  Hopefully the creators of the image provide a way to verify
>>
>> that the image you get is correct and unaltered (PGP signature, a signed
>>
>> list of secure hashes, etc).  You should verify your image.  Then you
>>
>> need to burn the image to a CD or DVD (as appropriate) *as an image*.
>>
>> You can find instructions on the Internet about how to to this.  Do
>>
>> *not* just write it to the optical disk as a file.  Put the disk in
>>
>> your computer and boot to it.  You will then be running from the optical
>>
>> disk and there should be no hard drive access unless you specifically
>>
>> request it.
>>
>>
>>
>> There are multiple live systems to choose from.  Probably all will give
>>
>> you Internet access but some/many may not include Tor.  TAILs does
>>
>> include Tor and is specifically set up to direct all Internet traffic
>>
>> through Tor.  There may be others.  You should be able to find any
>>
>> additional information you need through searching the Internet.
>>
>>
>>
>> My impression is these days it is more common to run live systems from
>>
>> thumb drives than optical disks.  But I specifically mentioned CD/DVDs
>>
>> because they are read-only media and therefore can't get infected
>>
>> (assuming your original image is clean).
>>
>>
>>
>>> One has to install an OS on the CD/DVD and there needs to be some means
>> for CD/DVD to access a network-specific firmware etc for using the
>> internet, am I right?
>>
>>
>>
>> Live systems auto-detect hardware and will usually "just work" with the
>>
>> hardware you have.  If it doesn't you need to either find a different
>>
>> live system or different hardware.  But if your hardware works with
>>
>> standard Linux I wouldn't expect a problem.
>>
>>
>>
>> HTH
>>
>>
>>
>> Jim
>>
>>
>>
>> --
>>
>> tor-talk mailing list - mailto:tor-talk@xxxxxxxxxxxxxxxxxxxx
>>
>> To unsubscribe or change other settings go to
>>
>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
>> --
>> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
>> To unsubscribe or change other settings go to
>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
>>
> 
> 
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk