WitFooPi – Precinct on a Raspberry Pi 4

by | Feb 22, 2021 | blog, InfoSec How-To, WitFoo Coding | 0 comments

WitFoo on Raspberry Pi

Raspberry Pi is a fantastic tool for learning and experimentation. To assist our trainers, students and partners, we have created a build of Precinct to run on a Raspberry PI4. The WitFooPi is not supported as a production appliance but is great way to have Precinct in the palm of your hand for capture the flag, session training and lab testing.

Build Requirements

WitFooPi has the following requirements. Precinct performs advanced analysis on data and will stretch the ARM architecture to its limits. Active cooling is a must to prevent overheating the unit. You will also need a 128GB SD Card, a Pi enabled Precinct license and the Pi image file.

Image the SD Card

  1. Download and install Raspberry Pi Imager from https://www.raspberrypi.org/software/.
  2. Download the WitFoo Precinct Image from https://www.witfoo.com/data/witfoopi.img.xz
  3. Burn the image by selecting “Use custom” OS in the RPI Imager and select the image downloaded from step 2.
  4. Burn and verify the image. This will take a long time (it’s a 128GB image.)
  5. Insert the SD Card into the RPI4 and power it up.

Configure the Pi

  1. Login as witfooadmin using the default password F00theN0ise!
  2. Configure the network using netplan (see: https://ubuntu.com/blog/ubuntu-bionic-netplan) or use IP address assigned by DHCP.
  3. Execute sudo ./register. Enter a license key that is enabled for ARM64. By default, license keys are for AMD64, to convert a license key contact WitFoo Support.
  4. Set up using the quick-start guide at the top of https://www.witfoo.com/tech-specs

Notes on the License Key

Raspberry PI runs on the ARM64 architecture that is built to support mobile devices (phones, tablets, etc.) Precinct is developed and supported on Intel/AMD64 architecture. The Docker images and OS had to be ported to ARM64 to run on RPI4. Also because of the limited compute capabilities of RPI4 (compared to production servers) some code and functionality changes have been made to the custom WitFooPi build. If a standard WitFoo Precinct license key is used, the WitFooPi will not run correctly. A custom WitFooPi license is required and can be requested from support@witfoo.com.

As part of the WitFoo Education Initiative, NFR licenses of WitFooPi are available for the following purposes:

  • Technical training or use in conferences or meetings
  • Classroom training in K-12 or higher education
  • WitFoo Certified Partners and WitFoo Technical Alliance Partners
  • WitFoo Customers with active Precinct subscriptions

Resources

Lessons Learned

Before closing out this entry, I did want to give some shout-outs and lessons learned in building out this project. The work being done at Docker to make multi-architecture support possible and relatively simple is pretty remarkable. I was able to get a AMD64 emulator running and a Jenkins pipeline built in less than one cup of coffee using the guidance outlined in this blog: https://www.docker.com/blog/multi-arch-images/.

Also want to give a shout to the Apache Cassandra and Apache Kafka communities for staying on top of ARM support making porting their code painless. The ARM & Docker alliance has proven to be nothing short of a miracle in making what was a massive undertaking 5 years ago a weekend project for me.

Kick the Tires

Let us know if you have any questions or feedback on the WitFooPi on the Community Forums or open a ticket if you need assitance. We’re excited to have Precinct in a portable version for education, training and testing.

Share This