What’s new?

• Linux kernel 2.6.36.2
• The bootloader automatically detects if a PAE kernel has to be booted or not
• Xorg 7.6 with Xserver 1.9.3 and KMS enabled for Intel and AMD/Ati chipsets
• XFCE 4.6.2 as desktop environment
• Namoroka (Firefox) 3.6.13
• Minefield (Firefox) 4.0b8 (start with the command firefox40)
• Lanikai (Thunderbird) 3.1.7 with Enigmail and Lightning
• Abiword 2.8.6
• Gnumeric Spreadsheet 1.10.12
• Grsync 1.1.1
• Gparted 0.7.0
• KeePassX 0.4.3
• Xfburn 0.4.3
• Brasero 2.32.1
• Partition Image 0.6.9
• TrueCrypt 7.0a
• TestDisk/PhotoRec 6.12-WIP
• BusyBox 1.18.1

Download and Install

To download, select one of the ISO-Images linked below: LessLinux Search and Rescue 1.5 is currently available in German and English:

• lesslinux-search-and-rescue-uluru-20110110-081814-en.iso (English)
• lesslinux-search-and-rescue-uluru-20110110-081814-de.iso (German)

Please compare the SHA1SUMs after downloading:

        188210364ac91a13ec3b62f45e1787b3044878ed  lesslinux-search-and-rescue-uluru-20110110-081814-de.iso
        329db06d9340a3f25235ffa7f0d0e5b6b5d701d8  lesslinux-search-and-rescue-uluru-20110110-081814-en.iso

You might burn the ISO to a blank CD or DVD. Since the ISO images are prepared with “isohybrid” you can also directly copy them to a USB thumb drive. On Linux use the command:

        dd if=lesslinux-search-and-rescue-uluru-20110110-081814-??.iso of=/dev/sdx

On Windows, download Win32ImageWriter, rename the .iso to .img, format the thumb drive and use Win32ImageWriter to copy the image to the drive.

You might also install to an USB thumb drive of at least 2GB size by booting from CD/DVD. In this case the thumb drive will be partitioned into two volumes: The first volume will be FAT32 and accessible from Windows, the second partition will be EXT2 and only accessible from linux. During installation you can decide whether to create an encrypted container that will continue your home directory. This is useful to store shell scripts, book marks, logins for web pages etc.

VNC access

There are three boot options that start a VNC server instead of a local X-Server.

• Unsafe local VNC access Allow anyone to connect on port 5900 without a password. Since everyone has root rights, you should use this option only in trustworthy environments.
• Safe local VNC access A VNC server is started on localhost:5900 only, but SSH access with root privileges is granted (week password “test”). So you can tunnel port 5900 to you local machine. Please consider changing the rootpwhash to some safe password. The command openssl passwd -1 creates a hash. (Note: not working due to a bug in the boot config, press tab, search skipservices=|...| and there replace roothash with runtimeconf)
• Reverse VNC VNC is used to export the desktop via an outgoing connection instead of allowing incoming connections, you might want to use this feature in cases where it is impossible to accept incoming connections (some DSL providers, NAT behind NAT when connected via a 3.5G router).

Kexec

Another new feature is the Cheatcode kexec=http://server/path/kexec.conf. If the cheatcode is present, said config file will be downloaded and the kernel and initrd mentioned will be booted. Just take a look at this config to see how it works. Just one kernel is allowed, multiple initrds (one per line) will be concatenated. Make sure that append is on the last line. Currently the boot menu contains eight kexec entries to kickstart internet installation of current versions of openSUSE, Debian and Ubuntu (LTS and current stable) – all 32 and 64 bit. Eventually an entry to boot the latest bleeding edge version of LessLinux Search and Rescue will follow.

The blob directory

You might notice the directory /lesslinux/blob. This new directory is intended to take files that are only distributed as binary only large objects. My intention is to use this directory to keep non free software out of the SquashFS containers. Users will be given the opportunity to add non-free components in a very simple way. Currently the blob directory can only be used to install Adobes Flash player instead of the free Gnash player. Either place the packed install_flash_player_10_linux.tar.gz or the unpacked libflashplayer.so in the blob directory. Upcoming builds will use the blob directory to integrate closed source virus scanners and similar stuff.

Simple remaster

If you want to build an ISO with different options in the boot menu – eg. change the password hash on SSH access or place Flash player in the blob directory, first unpack the contents of the ISO image to a directory build. Then run:

        mkisofs -input-charset utf8 -r -J -pad -o "remaster.iso" \
            -V 'lesslinux-search-and-rescue' -b boot/isolinux/isolinux.bin \
            -no-emul-boot -boot-info-table -boot-load-size 4 \
            -c boot/isolinux/boot.cat build

The source

You can download all source packages from LessLinux Search and Rescue 1.5 and previous builds from distfiles.lesslinux.org. An archive containing all build scripts is available from download.lesslinux.org/src/. Instructions on building your own LessLinux based system will follow in the next days.

The penguin

Thanks to Tobias Langhammer, a friend of mine from university days, LessLinux has a new logo (its first logo to be honest). The logo shows a flying penguin (OK, a jumping penguin) and is modeled after a photograph. The logo is available under the Creative Commons Share Alike 3.0 license. I currently prefer the version with the dark background and I encourage using it for press stuff. Lighter colored versions will follow in a separate blog post.

Supporting you, supporting me

There are currently no mailing lists. You can ask questions by writing to support@mattiasschlenker.de. This Email is primarily used for paying customers, so please be so kind to wait a day or two for an answer.

If you want to support the development of LessLinux, there are certain options:

You run a company or work for a company willing to support LessLinux

I might invoice you with any sum from €5 upwards – either for support or “programming time”. If you have a EU VATIN (Value Added Tax Identification Number), the invoice will be without German VAT, and since transfers within the EU are fast and cheap, it also makes sense for small amounts. If you are located outside the EU or European Economic Area, the invoice also will be without German VAT, but the money transfer might cost significantly more, so it might just make sense for amounts of €50 upwards. Depending on the legislation in your country, invoices for development/support might be fully tax deductible.

Since LessLinux is highly customizable for many tasks like rescue, backup, distribution of images, demo systems for web based software, just ask for a quote if you have an idea.

You are a private person

If you are located within the EU, I might also write an invoice, but in this case I have to add German VAT (currently 19%). If you are outside the EU, transferring small amounts of money just does not make sense. I will investigate methods like PayPal or Amazon gifts in the near future. In the meantime: Since I like dry red wine you might send me a bottle of a local wine or – if you live north of the 51st parallel – some local beer.

Well it can be easier. Just configure your DSL router to forward inbound traffic on port 5500 to your desktop machine and get a nice DynDNS hostname. Then remaster any LessLinux Search and Rescue CD to include one boot entry that does not disable earlynet and add the cheatcode

        xvnc=|reverse|1280x800|24|my.dyndns.name|

In case of emergency tell your grandma to boot the CD with the respective entry. The earlynet script requests an IP address on all wired interfaces and instead of starting a local Xserver Xvnc is started and a reverse connection to your host is made where a listening VNC viewer must be running.

There is one drawback: the data is transmitted unencrypted, which might be an issue with sensitive data. You might however use this first VNC connection to build up a SSH tunnel between two hosts.

The background of this feature: I got some customers quite far away from here. With this cheatcode I can help them no matter where they are – no special configuration of their router required. This feature also will work over WLAN soon. I just introduced some cheatcodes to attach to a wireless network while startup. Those are not tested yet, so please be patient for a few more days.

Should work in all builds higher than 20100701-000000.

        nfs=192.168.1.1:/dir/containing/iso

In this case, the NFS share is mounted read only (and no locking takes place), then all ISO files down to depth 2 are searched, loop back mounted and scanned for the proper version.txt. If the system is found, the settings for toram=value take place. In reasonable fast networks you should keep this threshold low, then the start of a program via network is quick, on networks with bad latencies you might set a low threshold to copy the entire system to RAM during startup.

You might download the ISO and the sources here:

• lesslinux-search-and-rescue-uluru-20100726-105414.iso
• lesslinux-search-and-rescue-uluru-20100726-105414-buildscripts.tar.bz2

To build yourself follow the instructions in those two articles: Build stage 01 and 02 and Build stage03.

• lesslinux-search-and-rescue-uluru-20100528-114807.iso

Currently for netbooting a DHCP and PXE server are required, a HTTP daemon should be present, although it is possible to load the ISO directly from download.lesslinux.org. For now the ISO is completely stored in volatile memory — future versions will probably also allow NFS access. To load an ISO via HTTP just one additional parameter is necessary:

     wgetiso=http://host/path/lesslinux.iso

Of course you can use the download link above for your first tests, but please remember to change it to a local HTTP server as soon as your setup works to keep traffic at an acceptable level. Now you may combine the information from the last post with a PXE server to build a netbooting, remote accessible version of “LessLinux Search and Rescue”. Take a look at the documentation of PXELINUX and you determine when which system boots via network.

1. Setup a PXE boot environment

German speaking readers might head here, where I describe the setup of a DHCP-PXE-TFTP-boot-chain. Build the setup and test with a simple OS like memtest to confirm that it works flawlessly.

2. Copy the boot files from the LessLinux CD

Our example expects the contents of /boot/isolinux in /llsar within the TFTP root directory, so just use rsync or cp to copy all files contained in this directory.

3. Setup the boot loader

Use isolinux.cfg as a template for your entry in pxelinux.cfg/default. Make sure that earlynet is not contained in the services to skip (upcoming releses will skip this service since it waits for about 15 seconds for DHCP configuration). Then decide which options you want to add. I ended up with three entries. One for a local desktop, two to encrypted and unencrypted VNC access:

LABEL llsar
MENU LABEL LessLinux Search and Rescue LOCAL
KERNEL /llsar/l2634vn
APPEND initrd=/llsar/devs.img,/llsar/initram.img,/llsar/i2634vn.img ramdisk_size=100000 vga=788
    ultraquiet=1 security=none skipcheck=1 quiet lang=de ejectonumass=1
    skipservices=|installer|xconfgui|firewall|mountdrives| hwid=unknown laxsudo=1
    wgetiso=http://192.168.1.56/ll.iso
TEXT HELP
  Start LessLinux Search and Rescue with local desktop.
ENDTEXT

LABEL llsarvnc
MENU LABEL LessLinux Search and Rescue VNC
KERNEL /llsar/l2634vn
APPEND initrd=/llsar/devs.img,/llsar/initram.img,/llsar/i2634vn.img ramdisk_size=100000 vga=788
    ultraquiet=1 security=none skipcheck=1 quiet lang=de ejectonumass=1
    skipservices=|installer|xconfgui|firewall|mountdrives|runtimeconf| hwid=unknown laxsudo=1
    wgetiso=http://192.168.1.56/ll.iso xvnc=|remote|1280x800|24|
TEXT HELP
  Start LessLinux Search and Rescue with insecure VNC desktop.
ENDTEXT

LABEL llsarvnc
MENU LABEL LessLinux Search and Rescue SSH
KERNEL /llsar/l2634vn
APPEND initrd=/llsar/devs.img,/llsar/initram.img,/llsar/i2634vn.img ramdisk_size=100000 vga=788
    ultraquiet=1 security=none skipcheck=1 quiet lang=de ejectonumass=1
    skipservices=|installer|xconfgui|firewall|mountdrives|runtimeconf| hwid=unknown laxsudo=1
    wgetiso=http://192.168.1.56/ll.iso xvnc=|local|1280x800|24|
    rootpwhash=$1$ILXt/Dc3$DmYp.51WCDNjGuTL90eju/
TEXT HELP
  Start LessLinux Search and Rescue with VNC-over-SSH desktop.
  (SSH password is "test", please change!)
ENDTEXT

Please note that the indented lines after APPEND are part of the append parameter line. I had to break the lines to prevent the formatting from exploding. With this setup you can try the full netboot of “LessLinux Search and Rescue”.

• Booting the kernel and initramfs with PXE and loading the system ISO with wget by http or ftp
• Starting the desktop with Xvnc instead a local X server

Currently both functions just work with a wired network interface. This post covers VNC access, I will write on PXE booting later.

To test VNC access, download the latest build:

• lesslinux-search-and-rescue-uluru-20100527-082411.iso

…or build it yourself according to the last two articles withe those buildscripts and overlays (in this case the extra switch -u for unstable is necessary):

• lesslinux-search-and-rescue-uluru-20100527-082411-buildscripts.tar.bz2
• lesslinux-search-and-rescue-uluru-20100527-082411-overlays-neutral.tar.bz2

Doing it the easy way

In trusted networks, you may start Xvnc on the external interface, this means VNC access is granted without password. Just press the Tab key in the boot menu and add

        xvnc=|remote|1280x800|24|

The first value tells Xvnc to bind to the external interface, the second is the screen resolution to use (any value is accepted here), and the third parameter is the color depth. On congested networks you might reduce the depth to 16. It also makes sense to add runtimeconf to the list skipservices. When finished booting, you can connect on port 5900.

Doing it the secure way

Specifying

        xvnc=|local|1280x800|24|

tells Xvnc to bind to 127.0.0.1. So no external connections are allowed. To access, you must tunnel port 5900 over SSH. To make this possible, first remove ssh and roothash from the list skipservices, then add a roothash by specifying:

        rootpwhash=$1$ILXt/Dc3$DmYp.51WCDNjGuTL90eju/

This is the MD5 hash for the simple password test. I created this Hash with the command openssl passwd -1, Apaches htpasswd might also work. Then after the system is fully booted, you can first connect with SSH and use -L to forward :

        ssh -L 5900:localhost:5900 root@192.168.1.23

Now VNC is available on port 5900 on you local machine, simply connect this way:

        vncviewer localhost:0

The current build also is the first one to use kernel 2.6.34 and it introduces libraries from Gnome 2.30. So please test and give me feedback!