Curious about the major differences between Kali Linux and SecurityOnion. Do you think it would be easy or useful to replicate what has been done with SecurityOnion on Kali? Why is there such a dichotomy between security breakers and security defenders... and is this divergence visible through these two primary (and heavily used) distributions? Ultimately, should there be a unified "infosec linux distro", are there already better alternatives to the two, and what is the future of guest VMs, booting from USB/SD/microSD/DVD/PXE, and integration with modern platforms (e.g., ARM-based, Android, SteamOS, ChromeOS, iOS, et al)?

Similarly, what are the major distros for IT/Ops-based infrastructure Linuxes? Ran across Zentyal before, but are there others (also see my last question below on virtual infrastructures), can they (or should they) be replicated on Kali/SecurityOnion, and what's the future of these distros as well?

Lastly, what about other distros that have critical importance to the infosec community, but that aren't "production-ready" because they are meant to be used only in labs -- e.g., Metasploitable, OWASPBWA, SamuraiSTFU, etc? Should this functionality be merged into a single package, such as an easily-installable OpenStack bundle? What is the future of Xen, XenServer, KVM, and ESXi in the face of OpenStack? Rackspace is mostly OpenStack, Microsoft mostly Azure-specific kernel (Server 2012), Amazon AWS-specific Xen kernel, VMware obviously ESXi/vCloud, and others are doing a mix of KVM (for Linux guests) and XenServer (for Windows guests) -- in light of these options, what is a good model for virtual infrastructures?

  • Answers that incorporate PPA/Launchpad and large-installation distribution are preferred
    – atdre
    Feb 17, 2014 at 14:44

2 Answers 2


Your question spreads out into broader IT operations and virtualisation, which is not really within the scope of this site (you might want to ask those questions at Serverfault).

As for the Kali/Security Onion questions. Kali is primarily an offensive security distribution for Penetration Testing and research and Security Onion is a defensive distribution for Network Security Monitoring.

There is little value in integrating the two for most users, as network defenders and attackers are almost mutually exclusive. The main reason for this is that it is generally inappropriate for someone who built a system and designed its security controls to attempt to break it, they do not have "fresh eyes" to see flaws. In the same vein, a penetration tester should be providing an independent assessment of the security of a system, if they perform security configuration or network defence on that system, that independence is suspect.

I wouldn't consider any of the distros you have listed as "critical to the infosec community". Useful for training purposes, yes, but not critical. That includes Kali, I don't know that many pen testers who run Kali as their main pen testing platform. Most I know prefer to roll their own and install the tools they want.

  • Agree that it's not the scope of this site, but as one security professional to another, it might be interesting to hear an infosec-centric view, but with a link to an outside source such as ServerFault. Not sure that I agree on separation of duties (although it is a good security principle in general) because convergence is often necessary -- adversaries test their attack tools with our defense tools, as an example. I'm very familiar with rolling my own attack and defense tools and this sparked a new question for me, thank you!
    – atdre
    Feb 19, 2014 at 4:59
  • On the defensive side, pentesting is both common and necessary, and to pentest your own systems, at least the first stage (vulerability detection) must be accomplished. Feb 20, 2014 at 3:01

Temporarily, I've decided to abandon all Ubuntu-based distributions in favor of RedHat-based ones. I am finding that SecurityOnion and Kali are more and more difficult to work with.

As a final nail in their coffins, I am finding that most companies run RedHat, or have some official support for RHEL/Fedora/CentOS (notably yum and RPM packages). When I prototype, I want it to match what will go into company-supported dev, test, and production environments.

To this end, I have selected NST (the Network Security Toolkit) as my primary reference-architecture build. It is based on Fedora 20. Additionally, I found that it is easy to add the Fedora Security Lab (FSL) via yum, which has these additional packages. RVM settles many of the Ruby dependenices for tools such as Metasploit, WATOBO, Arachni, WhatWeb, etc, which classically worked better on Kali up until I engaged this new strategy.

I would have preferred to stick with Ubuntu, especially using the PPA capabilities, but these and other selling points never worked quite right for me.

One of my favorite quick wins is to install the OpenVAS VM and run it alongside NST. This way, I can connect to the OpenVAS guest from within Metasploit (i.e., "load openvas" from the msfconsole) without any complicated OpenVAS dependency nightmares.

Another win, for Android, is to guest-VM install the 4.4 sources from this Sourceforge download location.

The latest-and-greatest testing ground has been discussed to be released by ODS3, but according to the Pentesting group on LinkedIn, you can get the beta2 if you act quickly. I'm sure they will announce more releases (such as beta3) soon, and will have them up on the SourceForge download page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .