Approach to turn Debian Jessie into a Kalilinux VM

[J. Eppler]

Hello,

Katooline allows you to install Kalilinux tools in Debian. With other words is allows you to turn
a existing Debian VM into a Kalilinux VM.

The steps for Qubes OS are:

1. Create a new AppVM and set the mark on standalone option in the GUI dialog

2. Follow the installation instructions for Katoolin:
    http://www.tecmint.com/install-kali-linux-tools-using-katoolin-on-ubuntu-debian/

3. Install the packages you want to have

The advantage of this approach is, that the Qubes OS developers or any community member
does not have to maintain an extra distribution for Qubes OS.

This approach could also have some serious issues with kernel modules and other issues.

My goal with this post is to evaluate how many people are interested in Kalilinux on Qubes OS
in general and do you encounter any problems with this particular approach.

PS: I don't have a lot of experience with Kalilinux or pentesting in general.

Best Regards
  J. Eppler

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

This is very interesting; thanks! I've started an issue to track
adding this into the documentation:

https://github.com/QubesOS/qubes-issues/issues/1981

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXMrA+AAoJENtN07w5UDAw7ssQAK31WHHFFE/6oqm1nrfYOfxU
sUTFfjfHDnwE7E5sPS4CUK3JuIakHP8ionW7Up/5LlHgVfmZ4PAq1a3mgXarDmsf
97uW7QgdFfb0mrLmgmFoBJwJVDwldzFv8TRp/1RjkQlxreUQJb+nCC0202SRhhvn
+GY4XhmAMFAKxKTp9j7oAtYsY6XWQUrNAwJAyl2h4dwWP9jsprrq0Gf66l6E9fjH
LzjScf3ZxUhuEqFSMUASw6iUoKhxgdqcyG6iOYqED/X8fpprW09WazUl5gtKeN1o
QOj0qgP31K9YCC6P2oDdMZ16ikxggBmIuKmj4t7Gs9NwESLVCuuTVWsgA601M1+p
KiAr8URqjre8hbtiorSeTswXVqSn5NWXNfuQKWL30pzf6NgDfVSW7e3XwmdylWzo
03UQAF3T6g2Vo3hqX9Un2ofKCRXqlJ9y4KViWpeMBmt73p3NN9rjKln+WL4NZ/Yk
+0i8jGsTvsNl8dE8EJEXd4HOD+R3qZEMc2e3QBuymIbzw8vwhl6WkSZgRSHoCen9
fslPaSJ91Xh1wjd4ZyLN7XcE1HB7tT/eAbgjbrRcZbx6A937yaaCUPNdyiekyIzm
gV/fLt+WbHY/OZaimbndU4FAAndPhRxIKUkxP0yuMjmN2GOaOrhMezxf2w81n4Q5
QAWI+tWBw/zcaPGlZ6+8
=l5Vs
-----END PGP SIGNATURE-----

[Marc de Bruin]

On 05/10/2016 08:10 PM, J. Eppler wrote:
> Hello,
>
> Katooline allows you to install Kalilinux tools in Debian. With other
> words is allows you to turn
> a existing Debian VM into a Kalilinux VM.
>

> My goal with this post is to evaluate how many people are interested
> in Kalilinux on Qubes OS
> in general and do you encounter any problems with this particular
> approach.
>

Count me in! Using Kali a lot, using it from Qubes would be great.

Greetz,
Marc.

[J. Eppler]

Hello,

Count me in! Using Kali a lot, using it from Qubes would be great.

What tools to you use the most?

Best regards
  J. Eppler

[Marc de Bruin]

On 05/11/2016 08:26 AM, J. Eppler wrote:

Hello,

Count me in! Using Kali a lot, using it from Qubes would be great.

What tools to you use the most?

The usual suspects such as nmap, but at the moment I would have to say arachni.

Greetz,
Marc.

[Achim Patzner]

> Am 11.05.2016 um 06:08 schrieb Andrew David Wong <a...@qubes-os.org>:
> On 2016-05-10 11:10, J. Eppler wrote:
>>
>> Katooline allows you to install Kalilinux tools in Debian. With
>> other words is allows you to turn a existing Debian VM into a
>> Kalilinux VM.
>

> This is very interesting; thanks! I've started an issue to track
> adding this into the documentation:

You might add that there are other options besides this (e. g. using PTF) which might not be as devastating to /usr (i. e. don’t necessarily require their own template).

All in all (see my other postings) I’m still not happy with the inflation of template machines on Qubes; there must be another way to put packages that have to be installed in / onto a VM (like using a big stick on all those developers and teach them to use /usr/local (for real men) and /opt (for SysV-weenies and Linuxoids) for their stuff). [Which reminds me to have an unpleasant talk to whoever invented /lib/var… There is var and there is lib — /var for things that change regularly and /lib for stuff that is used by many subsystems; even AT&T agreed.]


Achim

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2016-05-12 05:28, Achim Patzner wrote:
>
>> Am 11.05.2016 um 06:08 schrieb Andrew David Wong
>> <a...@qubes-os.org>: On 2016-05-10 11:10, J. Eppler wrote:
>>>
>>> Katooline allows you to install Kalilinux tools in Debian.
>>> With other words is allows you to turn a existing Debian VM
>>> into a Kalilinux VM.
>>
>> This is very interesting; thanks! I've started an issue to track
>> adding this into the documentation:
>
> You might add that there are other options besides this (e. g.
> using PTF) which might not be as devastating to /usr (i. e. don’t
> necessarily require their own template).
>

Noted, thanks!

https://github.com/QubesOS/qubes-issues/issues/1981#issuecomment-
218935283

> All in all (see my other postings) I’m still not happy with the
> inflation of template machines on Qubes; there must be another way
> to put packages that have to be installed in / onto a VM (like
> using a big stick on all those developers and teach them to use
> /usr/local (for real men) and /opt (for SysV-weenies and
> Linuxoids) for their stuff). [Which reminds me to have an
> unpleasant talk to whoever invented /lib/var… There is var and
> there is lib — /var for things that change regularly and /lib for
> stuff that is used by many subsystems; even AT&T agreed.]
>
>
> Achim
>

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXNTg+AAoJENtN07w5UDAwVXQP/jfv5KbjnPjhCtviF3yV1tTi
auchC07sLM2RaJ4RYZSGyM/NDwFPV4CjEKx14tc582ouY56oj25T2Z5U0Au2kJwx
WiBIbN5tXRyC1FZLR3aYqC5K0Iax6DSc/PEO9mjYbSDPFKNtpu1eY4BOpN/ISJuq
I+5Z2VBopJCS4bt57qqw9XcrwvNS5onwjbqjqCj3yMEzQCIjUtFBW94kHsQFz+Kv
uFLLaK2DlBmlynYaeffI0U5LbixQyyWVjuyF8kaSM71ySyk2YpV6FXNAY1GW+WkY
O9G/+bEVDpOrtpyi371e1AGGzxpSKrVO+vga8xSxBRIJ/lN23QPW5kkhXrX9rabw
NMQ6ECQVpwg65q1RovaHdPLxjuszvqNBLgUWyFFA7HUTLymklVZztezG/VUNx5Zp
l0fX0FmkMinxhIK1BVryc0jFoTEcl3cAUHUf/PyI6hhksuCxYyfPuJiPKXY6Z7J/
bCtB0Z6F7nzs/4p3EFWCwLUUcSnkyZ0jDVaO5GbZuB842VEWENFJ2Ay2RLsre13j
qs44Kj9HiFg3Asn5iwQF7VR7XSRwTI2Y8pWxMWHesBmii8Q4Gca0Rw9fEWVLr2lf
z1K2w5TxeQzA+j7V8PxsswU1J0vJbT6xAdxAYczqrqn5uUQNVG0EpY/VuVKQQe40
rwiFPZvaMy2dcyVdVM+P
=f+eC
-----END PGP SIGNATURE-----

[J. Eppler]

Hello Achim,

You might add that there are other options besides this (e. g. using PTF) which might not be as devastating to /usr (i. e. don’t necessarily require their own template).

what is PTF?

Best regards
  J. Eppler

[Iestyn Best]

PTF is Pen-Testers Framework which is a python script developed by TrustedSec that assist in installing common tools for pentesters. Currently it is designed for Debian but they are looking at expanding that as soon as possible. You can read about the current release here: https://www.trustedsec.com/may-2015/new-tool-the-pentesters-framework-ptf-released/