JaCL Linux 0.2005-07-11 beta1

JaCL Linux (Just a Command Line Linux) is a live CD distribution (a Knoppix remaster) of the Linux operating system. JaCL Linux is designed to be run as a command line driven server or utility system.
Most major command line applications or server software available in a standard Linux distribution are available in JaCL Linux. Most X11 server software and applications have been intentionally removed from the distribution in order to streamline the
distribution for use as a server or utility system.
Examples of server or utility uses for JaCL include: web server, ftp server, DNS server, SMB server, rsync server, syslog server, local disk mirroring utility, remote rsync disk mirroring utility or hardware diagnostics utility.
The removal of the X server and X applications streamlines the distribution, reduces maintenance, and may reduce the risk of vulnerabilities.
Additionally other applications have been intentionally removed or omitted from the distribution, including applications which may pose a security risk if the server is user level compromised (i.e. network scanning utilities and packet sniffing tools).
The result is a full command line live CD distribution which is about half the size of a full Knoppix CD distribution.
Main features:
- an easily upgradable system
- a password protected system by default
- security warning banners (a requirement in some work environments)
- a security hardened base system
- an easy mechanism for systems administrators to automatically configure the system at bootup
- most server and utility applications included (the fact that Knoppix <= 3.7 did not include rsync by default was a primary motivation for developing JaCL)
While Knoppix was quite capable in these areas, JaCL was developed with the systems administrator in mind. A single tarball containing configuration files and a startup script on a floppy or USB device is all that is needed to have a fully configured system running on first boot.
Live CD Linux distribution
A live CD distribution has several advantages over conventional installations. A hard disk installation is not required to test or use JaCL Linux. The boot media is read-only, this adds an additional level of security as applications can not be permanently compromised. System updates can be performed simply by burning a new ISO image to CD media and rebooting the system with the new CD.
Always sets root password and creates a user account at boot for additional security
At boot-up, the user is prompted to set the root password and create a user account for that session. JaCL Linux assumes that if someone has physical access to your system, little can be done to prevent malicious activity, but enforcing the root password and non-privileged user account creation can reduce the risk of remote compromises when servers are started.
Runs in run level 3 (no X-Windows)
JaCL Linux is not intended to be run as a workstation distribution. As a generic server/utility distribution, the removal of X server and X applications has several advantages. By not running X at startup, the server has more resources available for performing server/utility functions. With fewer "moving parts" so to speak, fewer applications will break or develop security vulnerabilities and less distribution maintenance or security releases will be required. Removal of X applications also greatly reduces the distribution size.
Security hardened
Bastille-Linux is installed on JaCL Linux and used to security harden the distribution. Unnecessary SUID permissions are removed, security warning banners installed, server configuration settings are tightened and access restrictions are implemented. No open ports are running in the default boot (including DHCP client). Additionally, specific applications which pose a significant network threat in the event of a compromise have been removed (i.e. ethereal, snort, ettercap, nessus). Not that these applications cant be insalled by a cracker, but those are additional steps that might alert an administrator.
Automatic installation of user customized, encrypted startup scripts and configuration files.
JaCL Linux implements a scheme using a twofish encrypted tar ball which contains a rc.jacl startup script and any server configuration files, authorized_keys, known_hosts, etc. needed to properly set up the server and start applications on reboot. The rc.jacl file is a standard shell script run each reboot performing a similar to a standard BSD rc.local startup script. This scheme is intended to be instanty familiar to most system administrators. The encrypted configuration tarball can be stored on floppy or external USB device which can be physically set to read-only or removed after bootup. This greatly increases security in the event of a compromise as a reboot will result in a known good reinstallation of configuration files (on read-only or removed media) and startup applications (on read-only CD).