(untitled)

I'm considering turning one of my boxes into an airgapped machine. And I'd like to hear some opinions on my approach. My plan is to run FreeBSD on the airgapped machine and OpenBSD on the laptop I'll use to communicate with it. The reason for using FreeBSD is that I want to have ZFS storage. Since it will be airgapped it doesn't matter much that it isn't the most secure OS, an attacker would have to compromise my OpenBSD system first to get to the FreeBSD machine. To transfer data between the two I'm thinking of using an ethernet cable only. I would ssh in to the OpenBSD laptop from the FreeBSD machine. That way the FreeBSD machine would be the one in control during file transfers. What do you think? What are the gaps in my plan?

This link has a lot of discussion on Air Gaps: https://www.schneier.com/blog/archives/2013/10/air_gaps.html

>airgapped machine >To transfer data between the two I'm thinking of using an ethernet cable only. Not how that works. I was thinking a raspberry pi / soc connected to a programming HID controller might be a cool way to securely transmit passwords , etc and preserve the air gap.

>>6175 I considered putting "airgapped" in quotes, but I was hopeful it wouldn't be necessary.

>ethernet >airgap Better to use USB sticks. Even better to use CD-Rs. The point is to limit the amount and rate of data that can be exfiltrated and to make any attempts more noticable. A compromised machine could transfer a lot of data very quickly over ethernet without you noticing. Also, here's a better guide: http://trilema.com/2013/how-to-airgap-a-practical-guide/

Guys, drop the >airgap I mean it's not connected to the internet, that's all. I don't think it's possible to have a true airgap without sacrificing practicality to insane levels. I need to move data to the "airgapped" machine somehow. Write-once CDs would be good, but less practical than what I'm aiming for. I thought about using USB drives, but that seems less safe than using an ethernet cable. An USB drive can be used to attack a machine through compromised firmware. It's not clear to me what are the threats posed by ethernet (hence this thread), but I believe it's a much simpler technology with a narrower attack surface. >The point is to limit the amount and rate of data that can be exfiltrated and to make any attempts more noticable. That's a good point. I'll keep small-sized USB sticks under consideration, but I think they're still a bigger liability than just using ethernet. >A compromised machine could transfer a lot of data very quickly over ethernet without you noticing. Do you know of any exploits that would allow this when the machine commanding the transfer is the "airgapped" one? >http://trilema.com/2013/how-to-airgap-a-practical-guide/ Thanks for the link. Still researching... further comments appreciated.

Unless you're disconnecting the OpenBSD machine from the network to transfer the data, what you're describing is called a proxy and there is nothing "airgapped" about it.

>>6212 My laptop has a hardware switch for Wi-Fi so I do plan to do that, but I don't think it really gets me much in terms of security. Definitely not the most important aspect of the setup.

>>6214 Actually, disabling Wi-Fi gets me one thing I had forgotten: it means I'll only have sshd enabled while the laptop is disconnected. It's one less attack surface on the laptop, rather than the airga- *ahem* disconnected machine.

>>6211 >USB drive firmware I didn't think of that. It's still possible to get external floppy drives. And those have write-protect tabs. 1440K is probably sufficient for anything you'd want an airgapped machine for. >Do you know of any exploits that would allow this when the machine commanding the transfer is the "airgapped" one? If the ssh client is compromised it could trivially just run extra commands in the background and hide the output. As for attacks from a compromised server, I don't know. SSH is fairly complicated and complexity is where bugs hide. It also has features for port forwarding and such that might be enabled in the default configuration. I'd read all of the manual pages very carefully before using it. Better to use something even simpler like netcat. Just run something like this, one on each side: nc -l -p port < /dev/null > file nc -q 0 ip port < file > /dev/null Use tar to do multiple files at once. You can make this more secure by setting up the firewalls on both machines to drop all packets except on the port you use for netcat. The lack of encryption isn't an issue on an isolated ethernet link unless you're concerned about EM eavesdropping. The cable could be used as an antenna to transmit even if the other machine is configured to drop all packets. Instead of ethernet you could do serial. USB->serial adapters are easy to find and this eliminates the possibility of processes using other network ports in the background.

>remove cameras, microphones, and wireless capabilities or find a way to mechanically disable them >use only one time burn CD or DVD, never re-writable >use USB CD drive (not built in) the limit to this system is the pixel display of the screen is readable. Some older think pads or other computers were built with mechanical wifi switches and no webcam/mic because they were too expensive, and for documents only, you don't really need that much processing power anyway. otherwise, build a tower without those features

>>6223 >It's still possible to get external floppy drives. yes, but CDs are probably a lot cheaper nowadays, and you can encrypt files before burning to disk, also >buying bulk floppies in 2018

>>6223 I wanted to be able to use something like rsync because I want to make sure the data gets transferred correctly and rsync would probably be the most convenient way, since it has a checksumming switch. I'll need to familiarize my self with netcat and other options to see what's possible before making a decision. >If the ssh client is compromised it could trivially just run extra commands in the background and hide the output. As for attacks from a compromised server, I don't know. For the ssh client to be compromised, someone would have had to get into the disconnected machine already, so I'm not sure I should be worrying too much about that. I'm worried about the possibility of attacks coming from a compromised server though. >Instead of ethernet you could do serial. USB->serial adapters are easy to find and this eliminates the possibility of processes using other network ports in the background. I've seen serial ports mentioned in this context and they seem like a good solution. I'm not familiar with them and neither of the machines I'm using have serial ports though. I'll have to research further. >>6248 >remove cameras, microphones, and wireless capabilities The machine already doesn't have any of that. >use USB CD drive (not built in) I don't see the point, but the machine already doesn't have a CD Drive. >Some older think pads or other computers were built with mechanical wifi switches and no webcam/mic because they were too expensive I'm using one of those as my main laptop, but that's the one that will be exposed to the internet.

I haven't progressed much with this project yet, I've been mostly just familiarizing myself with FreeBSD and ZFS, but I was writing some checksum verification code today for it and found something really interesting: http://aide.sourceforge.net "Advanced Intrusion Detection Environment" https://www.tecmint.com/check-integrity-of-file-and-directory-using-aide-in-linux/

>>6223 >SSH is fairly complicated and complexity is where bugs hide. It also has features for port forwarding and such that might be enabled in the default configuration. This. The FreeBSD machine can use ssh -D to trivially proxy traffic through the OpenBSD machine into any networks it's attached to so it's more like a one way airgap. That might not matter though because it sounds like the FreeBSD machine is 100% trusted and you only want to keep things from getting in rather than out?

>>6206 > Also, here's a better guide: > http://trilema.com/2013/how-to-airgap-a-practical-guide/ In my opinion this guide isn't better than the other ones listed. It certainly isn't worse though. He does make some valid criticisms of the other article[1] but his article isn't better overall. First of all the author has footnotes but half of them don't actually explain "why" or give any proper source for what he's saying. Sure, anyone can work out "why" for most of them and inform themselves but footnotes like xii provide no insight as to why I should "use Linux" and doesn't mention any BSD operating systems as alternatives or even why BSDs are not good alternatives. Another example is viii: again, I'm not doubting the authors technical qualifications but where is the paper or any kind of source for this? vii mentions something we all know to be true, but where is a reference? Not to mention the huge tangent about "sexism" in iv. At most half of this footnote relates to the text it's referenced in. But overall not an awful resource, it just seems badly written. 1: http://trilema.com/2013/why-i-suspect-schneier-is-an-us-agent/ Apologies for the wall of text. Off-topic sage.