Secure Boot CDs for VPN HOWTO

13. Bits and Pieces

13.1 Making a Windows autorun CD.

Due to a policy decision, we will not be deploying this, although it does work. The security concerns over this method include the following:

1. Key logger on the host Windows (tm) machine. This could conceivably be used to capture the private key password and potentially grant unauthorized access.
2. Malware on the host Windows (tm) machine. Might be able to send through the VPN...seems unlikely.
3. A virus on the host Windows (tm) machine. Might be able to propagate itself through to the internal network...again this seems unlikely.

This is what you do to create one. This method is likely useful for other projects.

1. mkdir win-qemu-yourvpn-cd
   

2. Download qemu-0.8.2-windows.zip from http://www.h7.dion.ne.jp/ qemu-win/
3. Unzip qemu-0.8.2-windows.zip into the win-qemu-yourvpn-cd directory.
4. Move all the qemu-0.8.2-windows files up one directory. Remove the qemu-0.8.2 directory.
5. Make an icon file. I used a stock one and resized with GIMP.
6. Create an autorun.inf file in win-qemu-yourvpn-cd directory containing the following:

           [autorun]
           icon=youricon.ico
           open=yourvpn.bat
           
   

7. Copy qemu-win.bat to yourvpn.bat.
8. Edit yourvpn.bat replacing the last line in the file with: qemu.exe -L . -m 64 -soundhw all -localtime -cdrom yourvpn.iso
9. Copy the fully made bootable .ISO image yourvpn.iso from where it is currently to win-qemu-yourvpn-cd
10. Make an ISO of this directory: mkisofs -pad -l -r -J -V "WQYOURVPN v0.1" -hide-rr-moved -o wqyourvpn.iso /home/jeff/Desktop/win-qemu-yourvpn-cd/
11. Burn the ISO and try it on a Windows (tm) box.