My GNU backpack
My favorite flavor of Linux
Recently I decided to build my own backpack. Meaning I left Kali Linux for a few weeks to create my own version of a penetration testing environment. I wanted to see, if I am able to do this in a reasonable way. I wanted to see, if I am able to pull this off. I wanted to challenge myself. So did I!
Bare Metal
I decided to install on real hardware. No virtualization. I grabbed an “old” SSD and now I can choose which disk to boot. Like in the old days, remember? So I don’t have to touch my production system, not even with a boot loader. My “boot loader” is my F8 key. What did you expect? A non-hacky solution?
You can do this in VirtualBox, but (currently) with newer versions of Gnome it slows down too much. You don’t have this issue with Kali Linux, because you are running an elderly Gnome. (No offense and no pun intended.)
Why Arch Linux?
There are quite a few penetration testing distros. Parrot is a Debian fork, so nothing new to learn and it is already finished. I could have used vanilla Debian, but this would lead to a replica of Kali Linux in my case. What would be the expectation and outcome here?
Arch Linux has a nice (read steep) learning curve. I already know Debian a lot from Kali Linux and my stable production servers. So this is the right spot to continue my journey and learn new stuff.
Installation, installation, installation…
Installing Arch Linux is a great experience. You learn a lot about things you would not touch normally, because the installer does it for you. These installers are huge time savers. All the way down. I did a test. I wanted to challenge an installer and compare it to my manual installation.
Manual
So at first I installed everything by hand, worked through the Arch wiki with great success. Then I looked at all humps and bumps I left behind during the installation process. I am no ultra-1337-pro regarding Arch Linux by any means. But my installation was working and I probably could get away with it.
Installer
In the second round I used Arch Anywhere which is now called Anarchy Linux for legal reasons. So this unofficial Arch installer became its own distro. I started right in the transition from Arch Anywhere to Anarchy Linux. This broke my installation, because servers and repositories were moved around during my setup. Nice. Never had this before. But, this is life. Deal with it!
I the second attempt of the second round I tried Anarchy Linux and had some minor issues, because it was new to me. But this time nothing broke. But having another distro means, that things were suddenly customized. So the finished product did not feel like Arch Linux anymore. Of course, it is Anarchy Linux.
What does the installer do?
I looked at the installer on GitHub and found all kinds of tweaks and changes. Some were really nice, but some were not my favorite. But this only my opinion. They are doing a great job! So I even submitted a bug report and it got fixed very fast.
Remember: Read more code! This is how things get better. Read code, learn, submit bugs or even patches and let things improve.
After reverting all changes I did not 100% like from the installer, I had a vanilla Arch Linux. This is a hacky solution, but what did you expect? I reused a really good installer to achieve a different goal. So far no problems.
Manual vs installer
My manual installation was by far not so sophisticated as the Anarchy Linux installer. They did a great job. I highly recommend to try it. If you don’t like the look and feel: Hey, this is Linux: Change it to fit your needs! For this was the way to go.
Customization
Hyped by /r/unixporn I decided to style the heck out of Gnome. This is customized to only fit my needs. This will probably not fit yours. So I am not going to full detail here. But if you are missing something, ping me, I will add it.
Package Manager
I use yaourt as package manager instead of pacman. I found a commented installation guide similar to the one in the French Arch wiki.
Gnome
I use Gnome in a minimal configuration and I throw everything away I don’t need. I have used Gnome for a long time. Although, I tried other window and desktop managers, but I never really felt home. A bit eerie, but as I look at it, I feel this is a “best of” mix between MacOS and Windows 10 with a touch of Android.
Gnome Shell Extensions
Icons
Powerline
As you can tell from the screenshots, I make heavy use of Powerline. This brings a modern feel to the very good old functionality of the terminal world.
Vim
Yes I use Vim for all sorts of tasks. I do not use any other editor. You could say that Vim is the Arch Linux of editors. Of course you can use every other editor. But I encourage you to use it, because the things you learn will also be helpful for other editors. Trust me.
tmux
There are a lot of ways to manage your terminal sessions. One of them is tmux. The nice thing is, that it even works in remote sessions like SSH. And if you loose connection, you can simply reconnect and continue your work. This is very handy.
Tilix
If you like to reorganize your sessions within your desktop or window manager, you should try Tilix. It is also a nice tool to manage your sessions like tmux. But it is more accessible to beginners. I use both, tmux and Tilix, most of the time inception style down the rabbit hole, if you know what I mean.
Hacking
In terms of hacking tools, there is BlackArch. It contains a epic load of tools like Kali, but they are sometimes a bit older than in the Kali or Arch repositories or even the Arch user repositories. Not mentioning the possibility to clone them from GitHub directly. Nevertheless you will be able to install nearly any tool, either one way or another.
So you can add the BlackArch repository to a vanilla Arch very easily. Here is the complete guide for it. Be aware of older versions. But, sometimes they are nice to have for backwards compatibility.
Observations
This thing is fast. I mean, I use a slower SSD and the system feels a lot faster than every other OS on my computer. This could be a biased observation, because I built it. (This is the same reason why you love your IKEA furniture more than the one you just bought in one piece. See IKEA effect.)
This thing is quiet. All fans are basically nearly turned off. I double checked it, in order to make sure I am not frying my CPU or any other part.
This thing is more secure. I am using more up to date software, because with Arch you are living on the bleeding edge. And I work as a normal user and not as root. This is one learning, which I will test in Kali Linux. Why work as root if you can work as a normal user? This is why things go wrong so often. Not respecting least privilege on your own system as a penetration tester.
You root boxes all day, because people do not live least privilege. Oh, the irony.
This thing takes some time and effort. But it also make you more mindful and aware. You will appreciate all the things you have taken as granted before. You could say that this is the zen way of running a hacking Linux.
Will I stay?
The answer is: Maybe… So, there is a lot to test and do. If it is worth the time and effort, then yes, of course! But if not, then no, not now. Maybe in the future. But this is the key takeaway: I learned a lot. A lot about Linux, a lot about Arch, a lot about Kali and finally: A lot about myself!
I was able to pull this off. It gave me the inner confidence to discover new grounds and tackle new problems. I left my comfort zone! I even wrote a whole story about that.
So go out and learn! It is not about the destination, it is all about the journey! Your journey!
