KNOS on a stick!

[Kevin McAleavey]

We've received a number of inquiries as to whether KNOS can be run from a USB stick. The answer is YES. However, it is a bit awkward in this version and likely will be for the next one as well. KNOS and KNOS64 were provided with a built-in script that will allow you to create a bootable USB stick from which you can run KNOS if you wish to do so. The decrease in absolute security is negligible given that we designed KNOS to be as "read only" from a USB stick as it is from a DVD, but it *is* remotely possible for malcontents to find a way around our security some day. We made it as difficult as possible tho'.

Most recent computers are capable of booting from a USB stick, however you should check your computer's operating manual to see what steps are required to boot from a USB device before you bother making a USB stick for KNOS.

The USB stick will be created in "dedicated mode" which means that ONLY KNOS can exist on the stick. You will not be able to read or write other files to the KNOS USB stick and therefore the optimum stick for this purpose would be a 4 GB stick if you have one. Larger sticks will be formatted so that only 4 GB of space will be allocated, and the rest will go to waste. We apologize for this limitation in the current design, but what we provide here was merely a test of the possibility rather than a well-devised permanent solution.

It is important that the USB stick be in its default format of FAT32 file system in order for this to work. Sticks that have been formatted in any other file system such as NTFS, Linux or other filesystems will fail to format for KNOS. If this is the case, you will need to fully format the USB stick on a Windows machine and it *must* be formatted in FAT32 and not in NTFS. Any bad sectors on the stick will also result in KNOS being unable to format it for KNOS use and therefore should you encounter any problems, check the integrity of the USB stick first or try another stick. 4 GB is the minimum and desired size for this purpose.

If you wish to make a KNOS USB stick, here's how to do it:

1. Insert stick - make sure no other devices are plugged in first!
2. Stick will appear on desktop. We don't want this stick mounted.
3. Right click on it or go to top and UNmount the stick.
4. Go to Applications -> Accessories -> Terminal on top menu.
5. When terminal opens, type in su and hit enter.
6. At next prompt, type in cd /usr/local/bin and hit enter.
7. Then type in sh make-usb.sh and hit enter.
8. Decide if you want to continue, this will completely format the USB stick.
9. Hit enter to begin the formatting and install of KNOS on the USB stick.
10. /dev/da0 is the proper device for the one. Accept and install will start.
11. Go get coffee or have dinner - it'll take anywhere from 15 min to an hour depending on how fast your machine and whether your machine is the old USB 1 or newer USB 2 hardware.
12. When copy is done, hit enter FIRST, then remove your stick.

You can then reboot and try out your KNOS on a stick. You will find that KNOS boots significantly faster from a USB stick (usually well under 2 minutes) and doing so will free up your DVD drive to permit mounting of CD's and DVD's. Some of our testers have already gone the USB stick route and so far only one of them had a problem with their system and a 64 bit version for reasons we have been unable to figure out so far. I don't suppose telling you that I've been using this myself for a while with no problems would be news ...

Enjoy!

Edit: Original recommendation was for a 2GB stick, turns out a 4GB stick is necessary.

[pharrisire]

Am doing it now.

-While watching it scroll through in Terminal, it seems like a great deal of the writing is
locale/language related - is there a way to designate a specific locale/language with,
or before, the "sh make-usb.sh" command? Seems like it might save a few minutes
each time.

-Last week you mentioned the "natty, convoluted way" of copying over the .Mozilla
follder - which I've done a number of time since. it takes care of most if the Firefox
related settings. Just need to figure out the method for KNOS's settings as well
(eg. toolbar and panel autohide ). If this is done before making the KNOS usb
stick, will the stick now start with the changed setup, or will it always be what
is on the dvd?

[pharrisire]

Right after ./uzip/usr/KNOS.tar.gz it says
"write failed, filesystem is full
cpio: Write failed: No space left on device
Copy complete, now cleaning up ..."
It is a 2G Kingston stick.

Tried it on the desktop and it booted fine up until it reached "login:" then it
froze. I'll see if it goes any further on the laptop.

[pharrisire]

Well Rats! The laptop hangs at the same spot.
I guess the next step is to re-make the stick.

[Kevin McAleavey]

Jun 25, 2010 15:01:33 GMT -5 pharrisire said:

Am doing it now.

-While watching it scroll through in Terminal, it seems like a great deal of the writing is
locale/language related - is there a way to designate a specific locale/language with,
or before, the "sh make-usb.sh" command? Seems like it might save a few minutes
each time.

-Last week you mentioned the "natty, convoluted way" of copying over the .Mozilla
follder - which I've done a number of time since. it takes care of most if the Firefox
related settings. Just need to figure out the method for KNOS's settings as well
(eg. toolbar and panel autohide ). If this is done before making the KNOS usb
stick, will the stick now start with the changed setup, or will it always be what
is on the dvd?

The locale files are a necessary part of the BSD distribution and although we're not using them yet, they have to be there or other apps will fail to run. As to the other settings, they're scattered in numerous places which means that it isn't practical to do in this build. The eventual solution will be a personal account on one of our servers which will store all of that for you along with other items. Coming as soon as we have the funding to do it. Once we're there, all of this will happen quite seamlessly!

[Kevin McAleavey]

Jun 25, 2010 15:29:01 GMT -5 pharrisire said:

Right after ./uzip/usr/KNOS.tar.gz it says
"write failed, filesystem is full
cpio: Write failed: No space left on device
Copy complete, now cleaning up ..."
It is a 2G Kingston stick.

Tried it on the desktop and it booted fine up until it reached "login:" then it
froze. I'll see if it goes any further on the laptop.

My fault there ... all we have on our end is 4GB and 8GB sticks, so I've been using 4GB'ers. I made the incorrect assumption that 2GB should do the trick because that's the size of the eventual output. However, during the copy process, a /tmp file is necessary and that brings it above the 2GB limit for a while until it's done. Necessary to do it that way as there is usually not enough memory within KNOS to do that there. My apologies for the torture.

I just edited the first message in the thread with the "how to" to reflect this unfortunate surprise for anyone else who wants to "do it on a stick." 4GB is now the recommended size. Once again, sorry for the unpleasantry there. You can take that 2GB stick and reformat it back to where it was on a Winders box ...

[pharrisire]

OK then. backtrack, repeat, and VOILA! It Works!!

There was an " Error converting integer" (I think that's what it was)
a couple of times scrolling by, but it does not seem to have affected
the outcome - The stick is definitely smoother the the disc!

[pharrisire]

The desktop boots up off the stick as well.
That same Error: message, but again did not seem to
affect anything.

Do you want KNOS-diagnostics from the laptop and desktop again now
that thet are booting up from the stick?

[Kevin McAleavey]

Jun 25, 2010 17:37:38 GMT -5 pharrisire said:

The desktop boots up off the stick as well.
That same Error: message, but again did not seem to
affect anything.

Do you want KNOS-diagnostics from the laptop and desktop again now
that thet are booting up from the stick?

Yay!

No need for the "error converting to integer: operator" thing ... that's a complaint that's the result of not being able to write and no indication of a problem. Wish we could hide that one. Heh. DVD's are slow but the safety, security and portability can't be beat. Though the stick method is very secure the way we did it, it's not as absolute where security is essential. But it's very close ...

[pharrisire]

Is this why the stick is not quite as secure as dvd?

"t gnome-keyring-daemon[1964]: couldn't allocate secure memory to keep passwords and or keys from being written to the disk"

If so, since we are using the 4G stick, can that extra 2G somehow be allocated for
that secure memory it needs?

[Kevin McAleavey]

Jun 26, 2010 8:17:43 GMT -5 pharrisire said:

Is this why the stick is not quite as secure as dvd?

"t gnome-keyring-daemon[1964]: couldn't allocate secure memory to keep passwords and or keys from being written to the disk"

If so, since we are using the 4G stick, can that extra 2G somehow be allocated for
that secure memory it needs?

The reason for that error is because KNOS' memory is already protected and prohibits other programs from writing to it unless it's been pre-cleared. All memory is locked in KNOS and since KNOS is fully in memory, that write is prevented since it's already in "secure memory." As you're probably already aware, KNOS can't write to disk anyway and this is the actual cause of that error message since that error is a "fall-through" once the keyring is unable to proceed as it expected to. Not a problem, not a worry at all. When we finally settle on a release version, that and a couple of other superfluous errors will be snubbed so as to not appear, but no point in our rewriting that part of the code until our final version since these things change with every BSD update we're working with as they work towards finalizing their next full version.

As to the stick, no ... not at this time. The stick is built in a special configuration called "dangerously dedicated" which prevents any writing of any kind, even by KNOS. This permits us to provide the same level of security on a stick as we do on a puck. The only reason why I personally consider the stick to be less secure than a DVD is that since it IS a writable device, I don't consider it to be as immutable as a puck. But I'd sure like to see how someone could compromise it somehow. I prefer my security as absolute as possible, thus the insanity by which I designed all this.

[pharrisire]

"I prefer my security as absolute as possible, thus the insanity by which I designed all this."

Me too!! Keep up the Great Work!