Web Analytics
Privacy Policy Cookie Policy Terms and Conditions Secure Boot CDs for VPN HOWTO: Implementation Next Previous Contents

4. Implementation

Many decisions had to be made as to which direction to go. The following subsections detail some of the paths I took to get to a working prototype. Please modify to suit your environment. Where appropriate I will make clarifying comments.

I looked at several live CD distributions and concluded that DSL would work best for the purposes at hand. I considered the following:

  1. Ubuntu. This live CD expects a relatively high-end machine and has way more applications than would be useful to this project. Instead of trying to remove tons of applications and whittle it down I opted not to use this one. It could be a good choice though if you are trying to give people a full desktop PLUS access to an internal network.
  2. PuppyLinux. This live CD looked really good, however I had trouble figuring out the SFS file system it uses for its root, and was able to get to instructions and tools on how to deal with the Knoppix compressed file system much more easily.
  3. Knoppix. This live CD, like Ubuntu, was too top heavy for the specific purposes of this project.
  4. Damn Small Linux. This live CD has a 50 MB footprint, will work on almost anything hardware-wise, and is what I chose to implement.

4.1 Getting and modifying a DSL-based .ISO file.

The choice of DSL means that we are relying on DSL's built in ability to automatically find, configure and attach to a network via DHCP. DSL's wireless support is very minimal and thus we do not support wireless at this time. The end user will need a machine that normally attachs to the Internet through DHCP from their provider and uses a normal wired network card to do so.

  1. Fresh install of Ubuntu (http://www.ubuntu.com), EdUbuntu (http://www.edubuntu.org), xUbuntu (http://www.xubuntu.org), or kUbuntu (http://www.kubuntu.org)
  2. Use Synaptic to add repositories (all available)
  3. Install qemu, open-vpn and cloop-utils
  4. Get an ISO (I recommend the dsl-3.0 ISO); hopefully I'll soon have one of my prototype CD images (sans VPN keys) available on the Internet for your downloading pleasure. Refer the Examples section - this ISO might be a good place for you to start.
  5. Mount the ISO somewhere. 
    1. mkdir /tmp/workingiso

    2. mount -t iso9660 -o loop dsl-3.0.iso /tmp/working.iso
  6. Unpack the compressed file system of the ISO 
    1. extract_compressed_fs /tmp/workingiso/KNOPPIX/KNOPPIX > /var/tmp/KNOPPIX-cloop
    2. Mount it somewhere 
      1. mkdir /tmp/workingiso.cloop

      2. mount -o loop /var/tmp/KNOPPIX-cloop /tmp/workingiso.cloop
  7. Now that you have access to the inner workings of the CD, copy that to a place where you can work with it.
    1. Make a directory to work in (i.e. /home/jeff/Desktop/vpn-tree)
    2. tar -C /tmp/workingiso.cloop -cf - . | tar -C /home/jeff/Desktop/vpn-tree -xvpf -
  8. Also copy the outer part of the CD, where you can work with it.
    1. Make a directory to work in (e.g. /home/jeff/Desktop/vpn-cd-tree)
    2. tar -C /tmp/workingiso -cf - . | tar -C /home/jeff/Desktop/vpn-cd-tree -xvpf -
  9. Make a CD image with what you have now to confirm you've made it this far without error. 
    1. mkisofs -pad -l -r -J -V "YOURVPN v0.1" -no-emul-boot -boot-load-size 4 -boot-info-table -b boot/isolinux/isolinux.bin -c boot/isolinux/boot.cat -hide-rr-moved  -o yourvpn.iso /home/jeff/Desktop/vpn-cd-tree/
  10. Assuming the above worked you can now test it with 
    1. qemu -boot d -cdrom yourvpn.iso
  11. Now you can start making changes.
    1. Mount your proc using 
      mount -t proc none /home/jeff/Desktop/vpn-tree/proc

    2. chroot /home/jeff/Desktop/vpn-tree
    3. Make any changes you would like to the file system.
  12. After messing around, it's time to write out your new compressed file image and make a CD.
    1. Exit from chroot
    2. Unmount the image's proc (don't forget this step or you will not have a working image when you build it later)
    3. Make the compressed file image 
      mkisofs -L -R -l -V "YOURVPN ISO9660" -v -allow-multidot /home/jeff/Desktop/vpn-tree/ | create_compressed_fs - 65536 > /home/jeff/Desktop/vpn-cd-tree/KNOPPIX/KNOPPIX
    4. Make the cd image 
      mkisofs -pad -l -r -J -V "YOURVPN v0.2" -no-emul-boot -boot-load-size 4 -boot-info-table -b boot/isolinux/isolinux.bin -c boot/isolinux/boot.cat -hide-rr-moved -o yourvpn.iso /home/jeff/Desktop/vpn-cd-tree/
    5. Test it in an emulator (I tend to enjoy qemu...use whatever you like: vmware, xen, ?) 
      qemu -boot d -cdrom yourvpn.iso
  13. Repeat as necessary to get the desired ISO image.
  14. Burn image and enjoy.

4.2 Comments on modifying the software on the CD.

  1. Unpack openvpn*.deb to the root file system after chroot.
  2. Make sure all the proper libraries were copied to the proper place.
    1. chroot
    2. ldd /usr/sbin/openvpn
    3. Go to the other root terminal on the main system and copy any libraries from the main system to the vpn-tree
    4. Make the tun node: mknod /dev/net/tun c 10 200
  3. Remove the loading of the DSL business card graphic by editing the vpn-cd-tree/boot/isolinux/boot.msg file and removing "^Xlogo.16"
  4. Cause it not to wait for boot options by editing vpn-cd-tree/boot/isolinux/isolinux.cfg and changing the line that says "PROMPT 1" to "PROMPT 0"
  5. Edit the file vpn-tree/etc/skel/.xinitrc to reflect what we wish to happen on the desktop. Remove code to load icons onto desktop; remove code to make the windows see through; add code to establish VPN connection; add code to load rdesktop and make connection to correct machine.
  6. Edit the display screen for boot.
    1. copy vpn-cd-tree/boot/isolinux/minirt24.gz to /tmp
    2. gunzip minirt24.gz
    3. mount -o loop minirt24 /mnt
    4. edit /etc/linuxrc to display text indicating Institution's name (you would put whatever is appropriate for your institution here) instead of "DSL"
    5. umount /mnt
    6. gzip minirt24
    7. copy minirt24.gz over to vpn-cd-tree/boot/isolinux/minirt24.gz

4.3 Setting up multi user OpenVPN server.

  1. Follow instructions on making cert and keys for the server.
  2. You will need to enter several pieces of information that are covered in the openVPN HOWTO.
  3. Remember to create a password-protected key for the client.
  4. Set all the configuration as desired.
  5. For each client you will need to
    1. make a password-protected key using the certificate
    2. place the certificate, and client key (only) in the vpn-tree/etc/openvpn/keys directory
    3. adjust the vpn-tree/etc/openvpn/openvpn.cfg file to have the proper key files indicated (see the server configuration file in the Samples section)
    4. adjust the added routes in the vpn-tree/opt/bootlocal.sh
    5. adjust the vpn-tree/etc/skel/.xinitrc to point to the correct rdesktop IP.
  6. Rebuild the CD.
  7. Test in the emulator.
  8. Once it works correctly, either burn the ISO or make a qemu Windows emulator version by placing the .ISO in the win-qemu-yourvpn-cd directory and building that .ISO (don't forget to burn it afterwards).

4.4 References:

  1. http://www.linuxjournal.com/article/7246
  2. http://openvpn.net/howto.html
  3. http://www.damnsmalllinux.org
  4. http://www.ubuntu.com

Next Previous Contents