3 ms·

Windows is a bad choice for an air gapped system. A much better would be Slackware, where its even simple to maintain an air gapped system. Maintaining a Linux

by kephra 13y ago

Windows is a bad choice for an air gapped system. A much better would be Slackware, where its even simple to maintain an air gapped system. Maintaining a Linux with a package manager, e.g. Debian without internet is much more trouble. I had scripts to maintain an air gapped Debian 10 years ago, but can no longer recommend them, as Debian now has signed archives, and the script breaks the sign.

jlouis 13y ago
OpenBSD on some older hardware is probably even better!
claudius 13y ago
You can still use optical media (CD/DVD) or USB keys to install packages with APT, so I don’t see how Slackware would have any advantage over Debian there. There’s even a apt-offline[0] to create a list of ‘needed’ packages on one system, then download these packages on another one and transport them to the air-gapped system. Of course, you will still have to decide whether to trust these downloaded packages, and unless you trust at least some Debian Developers to do the right thing, this will be hard to do even with GPG signatures on all packages. [0] http://packages.debian.org/wheezy/apt-offline http://packages.debian.org/wheezy/apt-offline
- vezzy-fnord 13y ago
  Slackware is generally more secure by default, such as explicitly requiring root (not sudo) for package management and at least sudo for utilities that prompt the kernel. This is much in the vein of the *BSDs. Also its conservative nature, constant security advisories and eschewing of bleeding edge are a bonus.
  - claudius 13y ago
    $ dpkg-query -W -f '${Status}\n' sudo unknown ok not-installed IOW, it is perfectly possible not to use (or even install sudo) on Debian. I don’t want to argue whether Debian or Slackware have a more ‘conservative nature’ nor whether that’s an advantage, but there are of course also security advisories for Debian (e.g. today for the systemd packages…). > at least sudo for utilities that prompt the kernel Basically everything ‘prompts the kernel’ in one way or another, could you expand on how exactly Slackware manages to run when every syscall needs sudo? (Or what you mean by ‘prompt the kernel’.) I guess at the end of the day, you can configure a Debian installation to be more secure than any given Slackware installation and you can configure a Slackware installation to be more secure than any given Debian installation – this, of course, depends on your skills and experience with any of the two, so you should use with whatever you’re more comfortable :)
yk 13y ago
The OS on the air gapped system is not that important, since you don't have to deal with regular internet threats, and anybody who wants to attack you will use 0-days anyhow. But I think that the air gapped computer should have a different OS than the computer which writes the USB sticks (and is connected to the internet). Just to force the attacker to burn two 0-days.

by kephra 13y ago

jlouis 13y ago

OpenBSD on some older hardware is probably even better!

claudius 13y ago

You can still use optical media (CD/DVD) or USB keys to install packages with APT, so I don’t see how Slackware would have any advantage over Debian there. There’s even a apt-offline[0] to create a list of ‘needed’ packages on one system, then download these packages on another one and transport them to the air-gapped system. Of course, you will still have to decide whether to trust these downloaded packages, and unless you trust at least some Debian Developers to do the right thing, this will be hard to do even with GPG signatures on all packages. [0] http://packages.debian.org/wheezy/apt-offline http://packages.debian.org/wheezy/apt-offline

vezzy-fnord 13y ago
Slackware is generally more secure by default, such as explicitly requiring root (not sudo) for package management and at least sudo for utilities that prompt the kernel. This is much in the vein of the *BSDs. Also its conservative nature, constant security advisories and eschewing of bleeding edge are a bonus.
- claudius 13y ago
  $ dpkg-query -W -f '${Status}\n' sudo unknown ok not-installed IOW, it is perfectly possible not to use (or even install sudo) on Debian. I don’t want to argue whether Debian or Slackware have a more ‘conservative nature’ nor whether that’s an advantage, but there are of course also security advisories for Debian (e.g. today for the systemd packages…). > at least sudo for utilities that prompt the kernel Basically everything ‘prompts the kernel’ in one way or another, could you expand on how exactly Slackware manages to run when every syscall needs sudo? (Or what you mean by ‘prompt the kernel’.) I guess at the end of the day, you can configure a Debian installation to be more secure than any given Slackware installation and you can configure a Slackware installation to be more secure than any given Debian installation – this, of course, depends on your skills and experience with any of the two, so you should use with whatever you’re more comfortable :)

yk 13y ago

The OS on the air gapped system is not that important, since you don't have to deal with regular internet threats, and anybody who wants to attack you will use 0-days anyhow. But I think that the air gapped computer should have a different OS than the computer which writes the USB sticks (and is connected to the internet). Just to force the attacker to burn two 0-days.