14

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver.

Is it possible to keep an old operating system webserver from being hacked? All I'm looking for is a simple port 80 static website with no over-the-web administration abilities.

I have no significant experience with security, or exploiting security holes. So I'm not sure where to look. Can a DOS/WIN95/WIN98 box be exploited if all it does is respond to simple HTTP requests?

Improve this question
17
  • 84
    You are going to get a LOT of questions about why you think you don't have enough RAM to run Linux, but enough to run Win98.
    – schroeder ♦
    Commented Mar 18, 2015 at 21:38
  • 19
    I question the premise of this question, windows 98 required at least 16MB of ram in order to run "Fd Linux" can run on a 386 with 8MB of ram. Therefore I question what system exists which has enough ram to run windows 98 but not Linux? Perhaps you could clarify this please.
    – Vality
    Commented Mar 19, 2015 at 1:18
  • 9
    Even if you have an old laptop unused, it doesn't seem worthwhile to use it as a webserver. You could as easily run a modern OS inside of a virtual machine on modern hardware, possibly using less electricity.
    – jamesdlin
    Commented Mar 19, 2015 at 3:27
  • 27
    While an interesting project, using a modern mini computer (Raspberry Pi or similar) is probably both more practical and more economical. The power savings alone probably outweigh the purchase price (e.g., Raspberry Pi Model A+ costs 20 US-$, and draws 1 W).
    – sleske
    Commented Mar 19, 2015 at 9:24
  • 7
    It always bothers me when a question gets so much attention from everyone except the asker.
    – Digital Chris
    Commented Mar 20, 2015 at 15:07

9 Answers 9

Reset to default
34

Probably not. In order to respond to HTTP requests, the operating system must be able to run a TCP/IP stack, process packets, and complete a TCP handshake, all requiring the system to utilize or spawn threads in memory, call libraries, etc. Therefore, the system would still be susceptible to protocol attacks it may not be patched for (TCP sequence prediction is one that comes to mind for a web server that might run on Win98).

You could compile and run a modern server like nginx or Apache (probably would have to heavily modify it, as it won't run on Win98 out of the box), but older operating systems being on a network are inherently prone to network probing and network attacks. Even if TCP 80 were port forwarded through a firewall, the web server process would still be running inside of a system lacking modern protections like DEP, ASLR, etc.

Improve this answer
4
  • 4
    Buffer overflows in low-level networking code also come to mind.
    – user20574
    Commented Mar 19, 2015 at 9:27
  • He could run a user-space TCP stack and ignore the OS one completely, at least in theory....
    – armb
    Commented Mar 20, 2015 at 15:47
  • @armb - good suggestion, but anything compromised in user space (super especially on an older, less secured OS) would still be prone to privilege escalation techniques (not to mention the goal of serving web pages is put at risk).
    – armani
    Commented Mar 20, 2015 at 16:44
  • @armb On Win9x the user/kernel space boundary is not a security boundary. (Win9x effectively has no security boundaries. It was designed to make things possible, not to make things impossible)
    – user20574
    Commented Mar 21, 2015 at 8:25
15

Do you have experience with CLI (command line interface), like Windows command prompt? If so, why not get a Raspberry Pi? The Pi is going to be smaller, faster, and more efficient than your old laptop. You can get a Pi for ~$50. Then you download (or get pre-installed SD card with ) their NOOBS software and install Raspbian OS, which is a Debian fork, install Nginx and you have a web server about the size of your wallet that consumes 3 Watts of power.

If CLI is a bit much for you, I suggest Linux with XCFE desktop rather than relying on Windows 98, although I don't recommend using old hardware like your laptop. A minimal Ubuntu (like Lubuntu) would be appropriate if you want the installer to do most of the work for you.

Improve this answer
4
  • 2
    This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post.
    – M'vy
    Commented Mar 19, 2015 at 20:09
  • 4
    @M'vy True, but it is a bit of an XY Problem.
    – JLRishe
    Commented Mar 19, 2015 at 20:41
  • CLI is fine. Thanks for the answer. This was specifically what was asked in the title. "Can an old retro computer be a viable server without being compromised."
    – Katastic Voyage
    Commented Mar 14, 2016 at 19:39
  • If you follow a few infosec people on Twitter you will find that any system can be compromised given time and resources for an attack. See armani's answer for details on why older OSes are probably not a good choice. In the mid-90's, I ran some Web servers on Windows NT, which would be a better choice than 95/98, but still has known vulnerabilities: cvedetails.com/vulnerability-list/vendor_id-26/product_id-39/… You would be better off installing a modern minimal Linux/BSD distro.
    – Robert Munn
    Commented Mar 18, 2016 at 18:45
8

I also am questioning how this machine can run Win98 (which wasn't exactly an efficient OS in its day), but it cannot run Linux. How about taking a Linux Live CD (bootable "frozen" OS), editing the ISO to include the web pages you want to serve, removing local storage (pull out the hard drive), then boot off of the Linux Live CD and reboot daily? Even if the machine does get attacked, in that configuration nothing will persist beyond the reboot (except for theoretical blue-pill attacks).

Of course, at minimum you'll also want to stick the machine in your DMZ, isolate it from talking to other machines on your LAN, and run a firewall at minimum with only port 80 open (and 443 if you're supporting TLS / "HTTPS").

Improve this answer
1
  • I think you should change "theoretical" to "national security service" as there is proof that the spooks do use this technology.
    – Snowbody
    Commented Mar 19, 2015 at 19:11
4

How about KolibriOS and write your own web-server?

Or Tinfoil Hat Linux and maintain it? (shouldn't take too long, just upgrade everything to the latest versions and hack around with dependencies until you get it to compile)

Most importantly before I can provide other suggestions, what are you hardware specifications; and personal skill level?

Improve this answer
4

This is simply a bad idea unless you just want to try it for fun.

Anyone who suggests it could be done is making too many assumptions. There isn't enough information to make a call.

Probably the main issues include

  • Win98 is old, is no longer patched and is likely vulnerable to many existing penetration techniques which were not even thought of back when it was last patched/tested. Bottom line, it is a huge unknown and almost certainly has vulnerabilities.

  • What web server would you run? It is likely you can only get an old web server i.e. old version of IIS or similar due to the age of libraries etc. This means running old server which almost certainly will have significant vulnerabilities.

  • More effor than it is worth. I suspect once you start trying to get this to work, you will run into all sorts of problems. This sounds like a very difficult task compared to the benefit/result you will get.

Others have focused on the comment that it is too old to run Linux. This is not true. If it can run win98, it can run Linux. It might have difficulty with current distributions, but you could do it with probably the same level of effort, but this is still more effort than it is worth.

Given the age of the system, more than likely, you will put in hours to get it working and then find it suffers a hardware failure. It could be an interesting thing to do as an experiment and learning exercise, but certainly isn't worth the effort if you actually want it to be useful

Improve this answer
3
  • I believe win98 support only PWS (personal web server) and support up to classic ASP (thats where i learn about dynamic page) :)
    – vasin1987
    Commented Mar 20, 2015 at 10:32
  • @vasin1987 That might be what's built into it, but porting another web server (or even writing your own) shouldn't be a difficult task. (Note I said "porting"; probably any modern web server uses some API not available in Win9x)
    – user20574
    Commented Mar 21, 2015 at 8:27
  • The idea was really just for fun and curiosity. A Pi would be a cheap solution if retro/re-use wasn't the constraint.
    – Katastic Voyage
    Commented Mar 14, 2016 at 19:40
3

In the end, it's not the OS that's the issue, but the application and the service running it. If your firewall is locked down tight, if the computer is physically secured, and the ONLY thing you are doing to serving a static page, then it comes down to the web server and what "else" the static page could do.

It CAN be done, but the web server you choose to use, the way you configure it, and the technology that you use to display the web page will all be important.

Even then, you need to provide yourself mitigations in case of a compromise, including separating the computer from the rest of the network, and the ability to blow it away and restore from back up in case things go badly.

Improve this answer
11
  • 6
    The OS is part of the issue. Windows has historically had many network services enabled by default. I'm not sure about Windows 98 specifically, but definitely port-scan it and make sure only the port you expect to be open is open.
    – ash
    Commented Mar 18, 2015 at 23:39
  • 2
    What about issues in the networking stack itself? They are OS and not application dependent.
    – Cybergibbons
    Commented Mar 18, 2015 at 23:48
  • @Cybergibbons So, DoS? I'm not sure that's an issue for the OP.
    – schroeder ♦
    Commented Mar 18, 2015 at 23:53
  • 1
    Let's not forget that everything on Windows 98 basically runs as root.
    – Brad
    Commented Mar 19, 2015 at 1:32
  • 6
    My point is that it's an unknown - we can't rule out issues with the network stack. The OS/hardware also means that DEP, ASLR, and NX can't be used, there is no concept of user accounts, no proper file permissioning, so if there was, for example, an overflow, it would be much easier to exploit. I can't find any research on Windows 98 security - it's just not used any more.
    – Cybergibbons
    Commented Mar 19, 2015 at 8:26
3

Get rid of that old box! It's too much hassle. Buy a Raspberry Pi B+. It's fast for your needs, cheap to buy, and within five to ten months it will earn the investment back by saving electricity. That old box maybe uses up to $10 a month for electricity, the RPi maybe $1.

Improve this answer
2

Considering that a modern computer (or even a smartphone) can compute circles around a 15 year old laptop one would need to ask "why?", esp. as the old hardware is expected to fail more-or-less anytime.

If this is a "because I can" project, then have at it and good luck.

If you simply want your own webserver, it is very easy to set one up on your current desktop. If you have a Mac, it comes from Apple with all the software you need to run your own copy of Wikipedia. If you have windows, get XAMPP. Either way, everything is up to date, security patches come regularly, decent interface software etc. etc. Windows 98 hasn't seen an update since 2006.

Improve this answer
1

This is mainly an addition to armani's answer.

As Win98 has not been maintained for years, you cannot expect the OS TCP/IP stack to be exempt of bugs.

But you certainly can find a recent (decent) OS accepting to run on an old computer. NanoBSD for example declares that it can be customized to low requirements : it is possible to cut the system down, so it will fit on as little as 64MB.

But beware, the performances will not be those of a recent hardware !

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .