CHAOS (Linux distribution)

infobox OS
name = CHAOS


caption = CHAOS-1.6 Boot Welcome Screen
developer = Midnight Code / Ian Latter
family = Linux
source_model = Open source
latest_release_version = 1.6
latest_release_date = April 2005]
working_state = Currentcite web | title=Midnight Code: Project libMidnightCode (Once Written, Twice Linked) | url=http://www.midnightcode.org/projects/libmidnightcode/ | accessmonthday=June 30 | accessyear=2007 ]
kernel_type = Monolithic kernel
ui = text (bash)
license = Various
website = http://midnightcode.org/projects/chaos/

CHAOS is a small (6Mbyte) Linux distribution designed for creating ad hoc computer clusters. CHAOS is a Live CD which fits on a single business card sized CD-ROM. This tiny disc will boot any i586 class PC (that supports CD booting), into a working openMosix node, without disturbing (or even touching) the contents of any local hard disk. Designed for large-scale ad hoc clusters, once booted, CHAOS runs from memory allowing the CD to be used on the next node (and allowing for automated rebooting into the host operating system). CHAOS aims to be the most compact, secure and straight-forward openMosix cluster platform available. [cite web | title=openMosix: Instant openMosix | url=http://openmosix.sourceforge.net/instant_openmosix_clusters.html | accessmonthday=July 21 | accessyear=2006 ]

About

What it is

CHAOS is built around the open source project openMosix created by Moshe Bar. openMosix, itself, is a piece of software that is added to the Linux kernel, to allow many Linux computers to work together as a Single System Image (SSI) [cite web | title=openMosix: What is openMosix? | url=http://openmosix.sourceforge.net/#What | accessmonthday=July 21 | accessyear=2006 ] type cluster.

CHAOS creates a basic node in an openMosix cluster, and is typically not deployed on its own; cluster builders will use feature rich Linux distributions (such as Quantian or ClusterKnoppix) as a "head node" in a cluster to provide their application software, while the CHAOS distribution runs on "drone nodes" to provide "dumb power" to the cluster.

While this deployment model suits the typical cluster builder, openMosix is a peer-based cluster, consisting of only one type of node. All openMosix nodes are inherently equal and each can be, simultaneously, parent and child.

How it works

As each new node is booted it will locate one cluster node, then negotiate its entry into the cluster. If the IP address of a node is not supplied to the booting node, it will multicast for one. The first responding node will be used as the point of negotiation. The local CHAOS node initiates an IPSEC tunnel to the elected negotiation node using a pre-shared key. If the tunnel fails to establish, the new node is unable to join the cluster. With the tunnel established the new node requests a copy of the openMosix cluster map from the negotiating cluster node. The new node then repeats this process with every node in the cluster map; establishing an IPSEC tunnel, validating the cluster map, then moving on. In this way, every node is interconnected with every other node by "n-1" IPSEC tunnel connections. All openMosix cluster communications are then said to be authenticated and encrypted via the CHAOS platform.

Once an openMosix cluster is established on the CHAOS platform, openMosix can operate as if it were on any Linux platform. Any node can launch a process and have that process migrate to the node with the best performance characteristics for executing that particular process. The openMosix environment has the "mosmon" utility to display the performance of the entire cluster, from any node. The image series on the right shows a six node openMosix cluster running on the CHAOS platform.

Why it was built

CHAOS was developed to utilise idle desktop computer resources to perform pro-active brute-force cryptanalysis against given password hashes. A brute-force attack, as its name suggests, requires an adversary to employ a mammoth work effort into the resolution of a cryptographic problem. Typically, this is an exhaustive search of a particular key-space. For example, resolving the password for three upper-case alpha characters would require exploring the key-space for: AAA, AAB, AAC ... ZZX, ZZY, ZZZ.

In order to reduce the time required to search the key-space, portions of the work effort can be farmed out idle resources. As opposed to rainbow tables this technique allows CHAOS to perform brute-force attacks against irregular or salted algorithms.

ecurity assessed by

The tool used to provide the cryptographic tests was John the Ripper (JtR). JtR was scaled by using named pipes to funnel a controlled dictionary (a set of keys to try) into an arbitrary number of JtR clients. Each client would take one key, encrypt it, and test it against a local copy of the hash(es). John the Ripper on CHAOS differed from Cisillia as it facilitated dictionary based brute-force attacks across a large number of algorithms, rather than an entire key-space driven brute-force attack across one or two algorithms.

ecurity provided by

CHAOS was the first openMosix distribution to provide IPSEC and IP packet filtering to the cluster node, enabling authentication and encryption for inter-node communications, and enabling packet filtering to prevent non-cluster devices from accessing the vulnerable openMosix communications ports.cite web | title=ISS vulnerability: mosix-malformed-packet-dos (8927) | url=http://xforce.iss.net/xforce/xfdb/8927 | accessmonthday=July 21 | accessyear=2006 ] These security controls allowed the cluster builder to utilise desktop computers in semi-trusted networks with minimal risk to cluster integrity, thus increasing the number of resources available for inclusion within the cluster.

History

2003: The creation of CHAOS

The project started as tool development work for the IT Security group at Macquarie University in 2003, with an initial team that included Rob Dartnell, Ian Latter and Ty Miller. There was a need to demonstrate the weakness in one particular application's security via its one hashed, network transmitted, password. The openMosix cluster software, at that time, was available via a number of Linux distributions, but these were neither secure nor dynamic enough to support the campus PC environment that the cluster software was to be deployed into.

The CHAOS distribution was created to fill this need, and was developed under the GPL to allow the openMosix community members to benefit from the security enhancements employed around the openMosix software (the clustering technology that is added to the Linux kernel). Security improvements made by the team included IPSEC tunnels for all cluster communications, state aware packet filtering for each node, a tiny operating system image which allowed for PXE booting to remote PC memory, zero-touch cluster creation, etc.

The original CHAOS project page was at http://itsecurity.mq.edu.au/chaos/ - this page is no longer available.

2004: CHAOS, CoSMoS and team departure

A presentation was made to the Australian Unix Users Group (AUUG) Security Symposium in February 2004 [cite web | title=AUUG Security Symposium: 20 February 2004 - Canberra | url=http://www.auug.org.au/events/2004/security/ | accessmonthday=July 21 | accessyear=2006 ] at about two thirds of the way through CHAOS' initial two year development cycle.

In mid to late 2004 CHAOS was adapted to the Cooperative Linux (coLinux) framework, allowing openMosix to run as a node on a Microsoft Windows PC for the first time. This was significant as there was now the ability to run ad-hoc clusters 24x7, and not just out of business hours. The version of CHAOS created for coLinux was dubbed CosMos (Chaos-OS on Microsoft-OS) and was also released under the GPL, complete with Windows installer software.

Later that year work stalled on CHAOS and CosMos when the IT Security team broke up to work for various organisations. Development halted for most of the six months beginning Q4 2004.

2005: Relocation and public dissemination

There was renewed interest in CHAOS development when both Ian and Ty began work at Pure Hacking in Q2 2005. Pure Hacking could identify a need with the resource that CHAOS provided and offered to sponsor further CHAOS development so that it could remain under the GPL. A package updated version of CHAOS was released at that stage, but Pure Hacking provided no additional development time, leaving the project to grind to a halt again. CHAOS was "Slashdotted" [cite web | title=Slashdot: Linux Distro turns PCs into Night-time Clusters | url=http://linux.slashdot.org/article.pl?sid=05/04/08/0552204 | accessmonthday=July 21 | accessyear=2006 ] during this time, due to the press that came from Pure Hacking's sponsorship announcement. [cite web | title=ZDNet Australia: Linux distro turns PCs into supercomputers | url=http://www.zdnet.com.au/news/software/0,2000061733,39187301,00.htm | accessmonthday=July 21 | accessyear=2006 ] Unfortunately, Pure Hacking were unable to provide the time needed to develop or maintain CHAOS. Version 1.6 of CHAOS, [cite web | title=Pure Hacking: CHAOS/openMosix Linux Cluster Distribution | url=http://www.purehacking.com/chaos/ | accessmonthday=July 21 | accessyear=2006 ] the only version released in Q1-3 of 2005, was released from development work performed in private time.

In Q4 2005 Ian added CHAOS to the midnightcode.org [cite web | title=Midnight Code: Project Chaos / CosMos (The Great Systems) | url=http://www.midnightcode.org/projects/chaos/ | accessmonthday=July 21 | accessyear=2006 ] web site (at the location advertised when leaving the University in 2004) [cite web | title=IT Security: CHAOS - About the distribution | url=http://72.14.235.104/search?q=cache:KmINNlG2PDIJ:itsecurity.mq.edu.au/chaos/about/index.htm+CHAOS+move+midnightcode.org&hl=en&ct=clnk&cd=1 | accessmonthday=July 21 | accessyear=2006 ] - in the hope of better maintaining the project. Improvements desperately needed include code and protocol clean ups, better enterprise management support, operational documentation, and simpler integration with the supporting openMosix distributions (Quantian and ClusterKnoppix).

2006-2007: Redevelopment

Many of the code clean-up issues (focused on Init and Tyd, particularly) will be resolved with the integration of the Midnight Code libraries. While currently being developed these libraries already provide better program execution, configuration control, network interface manipulation and status management than those currently in CHAOS.

Fun Facts

There are two key quotes that were used on the original web site, and have since been used in various articles:
* CHAOS is the supercomputer for your wallet
* CHAOS was a groovy word that ended in OS

There were two unfortunate cases of irony in the history of the CHAOS distribution:

* The addition of cluster security was ironic, given the purpose of the cluster was ultimately to provide a resource that would facilitate an attack against application security via large-scale cryptographic hash attacks.
* The application that was to be assessed - the original purpose for CHAOS - utilised a proprietary encryption algorithm for its password hash; the exact algorithm was never found. Thus CHAOS was unable to be used to assess its intended target.

During the initial two year development cycle, CHAOS developed a character that grew from its informal development roots. This character revealed itself in a number of ways:

* Tyd
** Tyd is pronounced "tie-dee" (like "tidy")
** Tyd was named after the protocol architect Ty Miller, when it became obvious that dynamically establishing multicast tunnels to forward the openMosix autodiscovery multicast packets across 256 routed VLANs was not going to be feasible. The algorithm that Ty developed to create multicast tunnels using "mrouted" became the algorithm used by Tyd to negotiate unicast autodiscovery.
* TNP
** The proprietary protocol used by Tyd was called the "Terrence and Phillip" protocol (TNP) - an accidental misspelling of the Canadian South Park characters, Terrance and Phillip.
** Tyd communicated with the TNP protocol on port 3278/TCP which spelt FART on most mobile phone key pads.
** Other than usable data, the entire TNP protocol was derived from Terrance and Phillip sound files found on the Internet. The greeting transaction between two nodes is the client query "let's look for treasure!" followed by the server response "yes, let's look for treasure!".
* Logo
** The original CHAOS logo was an ASCII art representation of Eric Cartman, from South Park.
* Code comments
** tyd.c: "how many printf's must a man print out, before he is truly a man.."
** testapp.c: "incrementing counters is like walking to the moon its slow, and if you don't stop, you'll crash."

See also

* List of Linux distributions
* Live CD
* List of Live CDs
* openMosix

References

External links

* [http://www.midnightcode.org/projects/chaos/ CHAOS homepage at Midnight Code]
* [http://www.purehacking.com/chaos/ CHAOS-1.6 at Pure Hacking]
* [http://www.midnightcode.org/papers/White%20Paper%20-%20Security%20and%20openMosix.pdf Securely deploying SSI cluster technology over untrusted networking infrastructure]
* [http://www.midnightcode.org/papers/How%20To%20-%20Heterogeneous%20Clusters.pdf Running ClusterKnoppix as a master node to a CHAOS drone army]
* [http://www.wired.com/news/infostructure/0,1377,67220,00.html Wired News: Linux Distribution Tames CHAOS]
* [http://linux.slashdot.org/article.pl?sid=05/04/08/0552204 Slashdot: Linux Distro turns PCs into Night-time Clusters]
* [http://www.zdnet.com.au/news/software/0,2000061733,39187301,00.htm ZDNet Australia: Linux distro turns PCs into supercomputers]
* [http://www.ibm.com/developerworks/linux/library/l-clustknop.html IBM DeveloperWorks: Craft a load-balancing cluster with ClusterKnoppix]
* [http://www.ibm.com/developerworks/linux/library/l-colinux/ IBM DeveloperWorks: Build a heterogeneous cluster with coLinux and openMosix]
* [http://www.antionline.org/showthread.php?s=fe02aa3a8aaa4db0509d0c46706dbcf6&t=260223 AntiOnline: How To Make a Password Cracking Cluster]
* [http://bofh.be/clusterknoppix/ ClusterKnoppix]
* [http://dirk.eddelbuettel.com/quantian.html Quantian]
* [http://www.openwall.com/john/ John the Ripper]
* [http://www.citefa.gov.ar/si6/cisilia.htm Proyecto Cisilia]