Bitcoin Forum
January 25, 2022, 01:33:23 PM *
News: Latest Bitcoin Core release: 22.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 [2] 3 »  All
  Print  
Author Topic: [LockBox-LBX] Created a Hardened Linux OS for Crypto Hodlers  (Read 405 times)
MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 05, 2021, 04:38:02 PM
 #21

Nearing completion of the latest image and should have this it available shortly. Please see the list of installed applications below:
Git: https://github.com/StratousLabs/LockBox
Do you have any updates regarding listing LockBox on DistroWatch, because I don't see it listed yet?
If you didn't do it so far you can contact them directly and follow instructions on distribution submission page.
Interesting thing about DistroWatch website is accepting of Bitcoin and Monero donations, along with regular paypal donations.

Hey DK!

Been pretty focused on doing this right but this is an action item and we look forward to submission! We should have this submitted within the next week or so.
1643117603
Hero Member
*
Offline Offline

Posts: 1643117603

View Profile Personal Message (Offline)

Ignore
1643117603
Reply with quote  #2

1643117603
Report to moderator
1643117603
Hero Member
*
Offline Offline

Posts: 1643117603

View Profile Personal Message (Offline)

Ignore
1643117603
Reply with quote  #2

1643117603
Report to moderator
1643117603
Hero Member
*
Offline Offline

Posts: 1643117603

View Profile Personal Message (Offline)

Ignore
1643117603
Reply with quote  #2

1643117603
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1643117603
Hero Member
*
Offline Offline

Posts: 1643117603

View Profile Personal Message (Offline)

Ignore
1643117603
Reply with quote  #2

1643117603
Report to moderator
1643117603
Hero Member
*
Offline Offline

Posts: 1643117603

View Profile Personal Message (Offline)

Ignore
1643117603
Reply with quote  #2

1643117603
Report to moderator
1643117603
Hero Member
*
Offline Offline

Posts: 1643117603

View Profile Personal Message (Offline)

Ignore
1643117603
Reply with quote  #2

1643117603
Report to moderator
MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 05, 2021, 05:20:35 PM
 #22

Pi-Hole have lots of dependency though.

Does not need to be Pi-Hole, just a local DNS resolver that you can query that will give 127.0.0.1 or whatever for places that you do not want your PC going to.
But......
Since 99% of the world runs on BIND it's probably going to be that and it's dependencies.
Since some pages are going to sit there and wait for a response from the query you need something internally running a web server and it's dependencies.
Then, you are going to need a front end to manage it since you need a simple way to add / remove blocks.

It's a trip down a very deep rabbit hole. But I still think it would be a nice feature to have or at least the option to have.

You could probably get some app that manages your hosts file that pulls data from the blocklists you want to use and puts them in there, and then some sort of a front end manager for that.

-Dave


No worries Dave, I think security should always include a solid dialogue and its a valid point. I'm currently reviewing Technitium DNS Server and will need to perform a bit more research before implementing. I think this may fall along the lines of your request?

Link: https://technitium.com/dns/
DaveF
Legendary
*
Offline Offline

Activity: 2632
Merit: 2961


I DO NOT TRADE on Telegram or Skype or Discord.


View Profile WWW
September 05, 2021, 05:53:43 PM
 #23


No worries Dave, I think security should always include a solid dialogue and its a valid point. I'm currently reviewing Technitium DNS Server and will need to perform a bit more research before implementing. I think this may fall along the lines of your request?

Link: https://technitium.com/dns/

Looks promising, will have to look into it too.
It's amazing how much information you leak using public / your internet providers DNS.
And how many people & places still refuse to use DNS over TLS.

Look a hardware wallet connected to an encrypted PC connected to an actual cable to the SonicWall router.
And lets go to Coinbase using local ISPs DNS lookup. And now we know you have (or are interested in) crypto.
And since your local ISP probably is not using DNSSEC, who knows if you are really at Coinbase anyway.
Yes, and extreme edge case, but still worth thinking about.

-Dave

MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 05, 2021, 07:50:47 PM
 #24


No worries Dave, I think security should always include a solid dialogue and its a valid point. I'm currently reviewing Technitium DNS Server and will need to perform a bit more research before implementing. I think this may fall along the lines of your request?

Link: https://technitium.com/dns/

Looks promising, will have to look into it too.
It's amazing how much information you leak using public / your internet providers DNS.
And how many people & places still refuse to use DNS over TLS.

Look a hardware wallet connected to an encrypted PC connected to an actual cable to the SonicWall router.
And lets go to Coinbase using local ISPs DNS lookup. And now we know you have (or are interested in) crypto.
And since your local ISP probably is not using DNSSEC, who knows if you are really at Coinbase anyway.
Yes, and extreme edge case, but still worth thinking about.

-Dave

You're right.
MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 12, 2021, 10:55:06 PM
 #25


No worries Dave, I think security should always include a solid dialogue and its a valid point. I'm currently reviewing Technitium DNS Server and will need to perform a bit more research before implementing. I think this may fall along the lines of your request?

Link: https://technitium.com/dns/

Looks promising, will have to look into it too.
It's amazing how much information you leak using public / your internet providers DNS.
And how many people & places still refuse to use DNS over TLS.

Look a hardware wallet connected to an encrypted PC connected to an actual cable to the SonicWall router.
And lets go to Coinbase using local ISPs DNS lookup. And now we know you have (or are interested in) crypto.
And since your local ISP probably is not using DNSSEC, who knows if you are really at Coinbase anyway.
Yes, and extreme edge case, but still worth thinking about.

-Dave

Hey Dave,

Just a quick follow up.  resolvconf has been installed and the nameservers below have been set to permanent (default):

nameserver: 9.9.9.9 (Quad 9) - Main - DNS over HTTPS (aka DoH)
Link:https://quad9.net/news/blog/doh-with-quad9-dns-servers/
nameserver  1.1.1.1 (Cloudflare) - Fallback - DNS over HTTPS (aka DoH)
Link: https://developers.cloudflare.com/1.1.1.1/encrypted-dns
nameserver: 127.0.0.53 (Local) - Fallback

Technitium looked great, however after a hearty conversation with the team no one liked the idea of this remotely resembling a DNS server Cheesy
ETFbitcoin
Legendary
*
Offline Offline

Activity: 2114
Merit: 3646


NotYourKeys.org - Not Your Keys, Not Your Bitcoin


View Profile
September 13, 2021, 09:54:10 AM
 #26

nameserver  1.1.1.1 (Cloudflare) - Fallback - DNS over HTTPS (aka DoH)
Link: https://developers.cloudflare.com/1.1.1.1/encrypted-dns

You're joking right? I understand Cloudflare is reliable service, but it's bad for privacy and people report few website can't be accessed when using CloudFlare DNS. I would suggest looking for alternative DNS such as NextDNS which is used by Firefox.

MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 13, 2021, 03:19:22 PM
 #27

nameserver  1.1.1.1 (Cloudflare) - Fallback - DNS over HTTPS (aka DoH)
Link: https://developers.cloudflare.com/1.1.1.1/encrypted-dns

You're joking right? I understand Cloudflare is reliable service, but it's bad for privacy and people report few website can't be accessed when using CloudFlare DNS. I would suggest looking for alternative DNS such as NextDNS which is used by Firefox.


Hey ETF,


I believe this is indirectly part of that rabbit hole Dave was referenced earlier.  Cheesy   NextDNS is great, however they typically do have more performance issues than their competitors. From a reliability perspective this gets tricky. Some users may also perceive latency or blocklist issues to be issues related to the LBX image itself, hence the call for Cloudflare. This now becomes a question of finding a happy medium or reverting DNS configurations back to default for user configuration. From a privacy perspective, the assumption should be held that all providers retain logs even when they say they don't. I think NextDNS is headed in the right direction however the best course of action is the use of a solid VPN service. Thanks again for taking a sec to highlight this.
DaveF
Legendary
*
Offline Offline

Activity: 2632
Merit: 2961


I DO NOT TRADE on Telegram or Skype or Discord.


View Profile WWW
September 13, 2021, 08:41:44 PM
Last edit: September 14, 2021, 02:16:55 AM by DaveF
 #28

Perhaps an option at install? Let the user pick what they want.

1) Use DHCP assigned.
2) Use 1.1.1.1, 8.8.8.8, 9.9.9.9 etc. While letting people know that they are probably going to be logged
3) Use NextDNS / others but let people know about possible performance issues / blocking
4) User configured DNS servers.
5) Install BIND and let them know about the bloat that comes with it.

Look, Dave just dumped a couple of weeks of programming and testing on someone :-)

-Dave

ETFbitcoin
Legendary
*
Offline Offline

Activity: 2114
Merit: 3646


NotYourKeys.org - Not Your Keys, Not Your Bitcoin


View Profile
September 14, 2021, 11:41:24 AM
 #29

From a privacy perspective, the assumption should be held that all providers retain logs even when they say they don't.

I get the point, but i would rather choose DNS that might keep log you (but the privacy policy/their website still respect your privacy) than DNS that obviously keep log.

MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 15, 2021, 02:32:40 AM
 #30

Perhaps an option at install? Let the user pick what they want.

1) Use DHCP assigned.
2) Use 1.1.1.1, 8.8.8.8, 9.9.9.9 etc. While letting people know that they are probably going to be logged
3) Use NextDNS / others but let people know about possible performance issues / blocking
4) User configured DNS servers.
5) Install BIND and let them know about the bloat that comes with it.

Look, Dave just dumped a couple of weeks of programming and testing on someone :-)

-Dave



Thanks Dave Cheesy For the sake of finalizing the image, I've reverted back the configuration and commented out DNS services Quad9, Cloudflare and NextDNS. User may configure to their discretion.
MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 15, 2021, 02:36:15 AM
 #31

From a privacy perspective, the assumption should be held that all providers retain logs even when they say they don't.

I get the point, but i would rather choose DNS that might keep log you (but the privacy policy/their website still respect your privacy) than DNS that obviously keep log.


For sure, until we can come up with an method of simplifying this on a user-friendly basis, I've reverted back theses changes to default. I think this is an area of which it would be hard to satisfy the needs and the wants of specific users.  
MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
September 26, 2021, 02:01:17 AM
Merited by dkbit98 (1)
 #32

Original post has been updated to include snapshots and a list of software/application installed on the latest image. I'll be working to tidy up a few more items over the weekend including, distrowatch, website and git. Thanks again for the awesome feedback and I look forward to improving this project with community feedback as we progress.


Special thanks to:

ETFbitcoin
NotATether
dkbit98
ETFbitcoin
DaveF
ETFbitcoin
Legendary
*
Offline Offline

Activity: 2114
Merit: 3646


NotYourKeys.org - Not Your Keys, Not Your Bitcoin


View Profile
September 28, 2021, 09:28:31 AM
Merited by DaveF (3)
 #33

Even if you want your bundle becomes more secure (crypto tasks only), it is better to remove graphical desktop.

Their user demography are new linux user and people who want simplicity. Besides, i wonder how many linux user who remember command for connect to internet over WiFi.

Furthermore, simplicity is also an issue for some not familiar with Linux, so packages like eddy are installed by default to help install applications.

DaveF
Legendary
*
Offline Offline

Activity: 2632
Merit: 2961


I DO NOT TRADE on Telegram or Skype or Discord.


View Profile WWW
September 28, 2021, 11:19:12 AM
 #34

Even if you want your bundle becomes more secure (crypto tasks only), it is better to remove graphical desktop.

Their user demography are new linux user and people who want simplicity. Besides, i wonder how many linux user who remember command for connect to internet over WiFi.

Furthermore, simplicity is also an issue for some not familiar with Linux, so packages like eddy are installed by default to help install applications.

It's not just Wi-Fi it 100s of things. I might be able to run a complete linux server from an SSH terminal window from what I know, every time I have to do something with bitcoin from the same window I am looking up what to do since I do 99% of BTC through a GUI. And don't even ask me to try to run something like electrum from a terminal. It would be a google fest to find the answers.

-Dave

ETFbitcoin
Legendary
*
Offline Offline

Activity: 2114
Merit: 3646


NotYourKeys.org - Not Your Keys, Not Your Bitcoin


View Profile
September 29, 2021, 09:19:00 AM
 #35

Besides, i wonder how many linux user who remember command for connect to internet over WiFi.
It's not just Wi-Fi it 100s of things. I might be able to run a complete linux server from an SSH terminal window from what I know, every time I have to do something with bitcoin from the same window I am looking up what to do since I do 99% of BTC through a GUI.

Exactly, WiFi is just more common example.

And don't even ask me to try to run something like electrum from a terminal. It would be a google fest to find the answers.

At least Electrum and bitcoin-cli have --help parameter and man page, so trial and error is an option. If you don't even know which executable you should use, google is the only answer.

MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
October 01, 2021, 09:27:06 PM
Merited by ETFbitcoin (1), dkbit98 (1)
 #36

Nearing completion of the latest image and should have this it available shortly. Please see the list of installed applications below:
Git: https://github.com/StratousLabs/LockBox
Do you have any updates regarding listing LockBox on DistroWatch, because I don't see it listed yet?
If you didn't do it so far you can contact them directly and follow instructions on distribution submission page.
Interesting thing about DistroWatch website is accepting of Bitcoin and Monero donations, along with regular paypal donations.

Hey dkbit,

Just a follow up, we've been officially listed on distrowatch and paid in BTC of course Wink  Thanks again for the suggestion!

https://distrowatch.com/table.php?distribution=lockbox
MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
October 05, 2021, 01:48:51 PM
 #37

Quick Update - A signed ISO was requested yesterday and is now available via the site. Key and sig are both publicly available via our git.
dkbit98
Legendary
*
Offline Offline

Activity: 1386
Merit: 3243


Powerful promotion strategy https://bit.ly/3cRVjFi


View Profile WWW
November 17, 2021, 09:32:46 AM
 #38

Just a follow up, we've been officially listed on distrowatch and paid in BTC of course Wink  Thanks again for the suggestion!
Nice work, bit I didn't know you have to pay to be listed on that website... if it's not a secret can you tell us how much they charge for this?

I see that ISO size is around 3.4 GB but I am wondering what are the minimum system requirements (RAM/CPU) needed for running LockBox Linux, and is it possible to run it on some old laptop computer?

MagnumOpus3k
Copper Member
Jr. Member
*
Offline Offline

Activity: 34
Merit: 69


View Profile
November 17, 2021, 02:29:04 PM
Merited by dkbit98 (1)
 #39

Just a follow up, we've been officially listed on distrowatch and paid in BTC of course Wink  Thanks again for the suggestion!
Nice work, bit I didn't know you have to pay to be listed on that website... if it's not a secret can you tell us how much they charge for this?

I see that ISO size is around 3.4 GB but I am wondering what are the minimum system requirements (RAM/CPU) needed for running LockBox Linux, and is it possible to run it on some old laptop computer?


Thanks and sure thing.  To be promptly listed and to buy a tiny bit of advertising space was roughly $220. Thought this to be extremely worth it as it also  serve as direct support for distrowatch.  Also here are the  critical specs:


Dual Core 64-bit processor / Intel i3 or Intel i5

8 GB of system memory (RAM)

​120 GB SSD


Running on a older laptop with equivalent specs shouldn't be an issue, however the experience may be a bit painful. Running opensnitch and a full node wallet can quickly chew up resources.  
dkbit98
Legendary
*
Offline Offline

Activity: 1386
Merit: 3243


Powerful promotion strategy https://bit.ly/3cRVjFi


View Profile WWW
November 17, 2021, 02:42:38 PM
 #40

To be promptly listed and to buy a tiny bit of advertising space was roughly $220. Thought this to be extremely worth it as it also  serve as direct support for distrowatch.
I don't know if there is any better and free alternative website for distrowatch, many people think they are a bit bias with their rankings, meaning if you pay more you get higher on their list and many wonder if MX linux got on topo like that.
Good thing about distrowatch is that they are accepting Bitcoin donation.

8 GB of system memory (RAM)
Running on a older laptop with equivalent specs shouldn't be an issue, however the experience may be a bit painful. Running opensnitch and a full node wallet can quickly chew up resources.  
Oh there is no way I could run that on my ancient laptop that has only 1 GB system memory  Cheesy

Pages: « 1 [2] 3 »  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!