Lockdown '09 Security Tools Hands-on Preparation



Overview

The hands-on session will be conducted using two virtual machines. They were built with VMWare and can be run under either VMWare or Virtualbox hypervisors, hosted on any of Windows, Linux, or Mac OS-X. The freely available VMWare player is available for download at VMWare's download site (registration required). You should download and install the most recent version of the player for best results. The following instructions will describe the process for obtaining the images.

Please complete these tasks well before the day of the conference. The image files are large and will take some time to download and uncompress. A limited number of DVDs and USB drives will be available for use at the conference, but the time requirements will still be substantial. The images are a 32-bit Redhat enterprise 5.3 server and a 32-bit windows enterprise server 2008. As they are unpatched and unfirewalled, they should not be connected directly to the internet.


NOTE: These images may contain malware, other potentially undesirable software, and insecure configurations. As a precaution, we have restricted the images to use host only networking. These images should be used with extreme caution.

NOTE: These images are supplied for instructional purposes during the Lockdown conference only. The images must be deleted immediately after the conference to avoid license violations.

Requirements

This year's hands-on session will involve running two virtual machines simultaneously. This will require a fairly modern machine to run acceptably. In addition, you will need sufficient privileges to install software on your machine (if the VMWare products are not already installed).

VMWare

The virtual machines run in any of:

VMWare Player(free): Windows XP, Vista, Linux.
VMWare Server(free): Linux, Windows XP
VMWare Workstation(paid, 30 day free eval): Linux, Windows XP, Windows Vista
VMWare Fusion(paid, 30 day free eval): Mac

System Requirements

1) 1 GB memory (512 MB may be possible, but will be very slow)
2) CPU 2 GHz or faster
3) 15 GB or more free disk space
4) A VMWare or Virtualbox hypervisor such as VMWare player.

Time requirements

Download: Approximately 50 minutes (heavily dependent on your connection).
Decompression: Approximately 15 minutes.

Obtaining the images

This year's hands-on session will make use of two virtual machines: one running Windows, and another running Linux. The images are packaged in zip files for convenient download. The Windows image decompresses to about 6 GB. The Linux image decompresses to approximately 2.5 GB. The site is wrapped with a simple username and password to keep out the curious and the bots.

  1. Create a folder to hold the images.

  2. Download both images and the checksums here:

    1. Windows image - zip file (2.5 GB)

    2. Linux Image (900 MB)

    3. Checksums

  3. Verify the checksums. Linux users can use the md5sum (1) utility, Mac users can use the md5 utility, and Windows users can use the FCIV utility.

  4. Unzip the files.


If you have completed the above steps correctly, you should have a folder structure looking something like this:

win08/

wes08.nvram
wes08-s001.vmdk
wes08-s002.vmdk
wes08-s003.vmdk
wes08-s004.vmdk
wes08-s005.vmdk
wes08-s006.vmdk
wes08-s007.vmdk
wes08-s008.vmdk
wes08-s009.vmdk
wes08.vmdk
wes08.vmsd
wes08.vmx
wes08.vmxf
RHEL5-GUI/
RHEL5-GUI.nvram
RHEL5-GUI-s001.vmdk
RHEL5-GUI-s002.vmdk
RHEL5-GUI-s003.vmdk
RHEL5-GUI-s004.vmdk
RHEL5-GUI-s005.vmdk
RHEL5-GUI.vmdk
RHEL5-GUI.vmsd
RHEL5-GUI.vmx
RHEL5-GUI.vmxf

Using the images

The images have two active accounts. For the Windows VM, these are administrator and ld09user. For the Linux VM, these are root and ld09user. The password for all of these accounts is: ld09pass.

You will want to reduce the memory size of the guest VM's prior to booting them. They were built using 1 GiB each, but should run OK with any amount over 400 MiB each.

If you are using Virtualbox as the hypervisor, don't forget to change the default network type from NAT to host. Do give the two machines the same network (virtual switch) name.

To improve guest VM performance we recommend installing the guest driver package provided by your hypervisor, such as VMWare tools.