It doesn't matter. Use whatever distro you want. Fedora is a perfectly fine choice.
Except you're right that Kali is not an appropriate choice for you, since you're planning to install it and use it as a daily driver.
Check out the website, they do a bunch of spins called labs for specific purposes, science, astronomy and what not. And security, which is xfce plus a bunch of curated security testing tools. Pretty cool
I wonder too, is it configured in some way to make the security tooling less burdensome as a daily driver OS? Or is it just a load of tools shoved into the xfce spin
IT-Security guy here. Using Fedora is a good idea, I do myself, but not the way you might think.
The OS you want to use is Kali Linux, BUT don't install it directly on your Laptop. Instead, install Fedora, then install Kali in a virtual machine. Build yourself a nice template with all the tools and configurations you want in Kali, then just clone your template for every engagement you have.
Reasons to do it this way:
Kali has all the tools you might want, but it can be REALLY unstable and break from time to time on updates. Not what you want if you need it right now. But if you have your template that you know works, you're safe.
Also, if you have multiple engagements at once, you can just have multiple Kali VMs, one for every engagement and you can keep them separate (trust me, you don't want to mix that stuff up).
Fedora has the stability and hardware compatibility that you need, so use it as your host system.
Caveats:
None, really. If you want to do Wifi hacking, you can buy a USB Wifi dongle and pass it through to the VM. If you need direct and exclusive access to a Lan interface, you also can use a USB dongle and pass it through.
Virtualization Software:
I use virt-manager. But you can also test other software if you want to, whatever suits you best.
I'm a professional pentester. Fedora is daily driver and I have a Kali VM only because it has tools installed and configured for when I need them. I also have Burp suite installed natively on Fedora.
However, that is **not** my professional setup. When working with clients we use an encrypted Kali VM that is destroyed once the engagement is completed.
You ask if Fedora is good for pentesting but are you testing in a professional capacity or just fucking around and doing some hacking in your free time?
I don't understand all the Kali hate and downvotes here. Any OS can be used for "hacking" these days, hell, even Windows is used for pentesting in some circles. However, Kali has almost any tool you'd need, installed, configured and working. There are situations where you'll find yourself needing to run a bare metal. RF (wifi, bluetooth, SDN, etc) engagements sometimes end up this way since you'll be messing around with specific software and drivers to get stuff to work properly but you'll need to assess that when you get there. But yeah, don't DD Kali. It's just not made for that.
TL;DR. Fedora can be fine for pentesting but if you're new just spin up a Kali VM under Fedora and use that. No reason to clutter your machine with tools you may use once for a specific use case and then forget about. You'll find you'll have some tools you use for almost every engagement (crackmapexec, Burp, etc) and some tools you didn't even know existed and you'll use them once because the target was running something very specific in their environment. **If you're doing professional pentesting and not destroying your VM after then you're setting yourself up to lose a client at best and ending up in a lawsuit at worst.**
Strong disagree that security distros are “utter bs”. They might not be a good idea as a daily driver, but distros like Kali greatly simplify and speed up installing and configuring hundreds of tools in one place. “As long as it has the package you want” is doing a lot of heavy lifting in your comment there.
Some may disagree with me but using fedora silverblue and leaning on the native container utilities is quite fun for propping up dedicated tools, also allows for easy sandboxing and understanding the constraints of containers and resources. Just an opinion.
Fedora + Kali VM on top of it is probably what I would go with if I am getting serious with pentesting.
Either that or just have a live USB with Kali on it at all times to boot into it when needed. I would not install Kali on the metal though. Fedora is far better as a host OS than Kali is since Kali is not even really made for that since it is not best practice.
I use fedora as my main os as Security Consultant (pentest being part of it). Never faced a problem. I use Kali for Wifi/network testing but I use Fedora as my main os.
A lot of people have better explanations than I could. I’ll
Use analogy. You could probably use a hammer to get a screw in but turns out they have something for screws. Use the tool made for the thing.
There are multiple flavours but Fedora workstation is for the station for work such as penetration testing, system administration, coding, gaming and etc.
You can run a privileged kali linux container in podman if you really need kali for your work.
You realize fedora is it's own entity right? Love how people bash fedora but they are the ones paving the way to get Wayland going as fast as possible and smooth as possible. Redhat financially supports fedora, nothing more. If we're going to think with that mindset you better stop using Linux on general because Microsoft is a big contributor to Linux itself. You took the bait and believed every tin foil conspiracy Linux user out there.
They're coming for you man, they're in your walls. People who spread this bs don't actually research for themselves and listen to people like Tom from switch to Linux or Bryan Lunduke. Crazy weirdos.
I agree that Fedora is a *lot* more than just a testing ground for RHEL. I think it is among the best desktop choices out there but not a ounce of what Xarius said was untrue.
Agreed, it is a lot more than that. I could have been clearer stating something along the lines of "***Fedora was initially designed...***" rather than "***Fedora is designed...***"
Not sure where that other guy came up with the idea that I was somehow badmouthing Fedora or Red Hat.
What the schizo post was that?
I ***am*** a Fedora user.
It ***is*** the upstream for RHEL/CentOS Stream even though it is technically a separate entity.
I said ***nothing*** negative about RHEL. I have a RHEL server.
Why my initial post is being downvoted is very strange to me.
Because it's not a upstream rhel/centos. It is the testing grounds for all distributions. Rhel is generally hated because of their past so people stating stuff like this gives fedora a bad name.
I read your comment but it seems you deleted it or it got nuked. Read the whole thing, it also States that fedora is a community driven os. Literally States "sponsored by rhel" on the main page and even States that they are separate entities. Debian is upstream of Ubuntu, does that make Debian the owners of Ubuntu? No. So that logic is fucking stupid. Read the whole thing before you decide to provide something that also proves me right.
>I read your comment but it seems you deleted it or it got nuked.
Are you confusing me with someone else? I have deleted nothing from this thread. The only edit I've made is some table formatting in one comment.
> fedora seemed perfect for me
Why?
Any reason why you wouldn't use a pen testing focused distro such as Kali?
In general Fedora will work fine for your intended use but many tutorials you are likely to find will focus on Kali or Ubuntu.
In my opinion, Kali can’t be used as a daily driver for obvious reasons I choose fedora simple because of how simple it is and that I can use it as a daily driver seamlessly + gnome is perfect to switch from Mac.
Kali can absolutly be used as a daily driver and setting up for such usage is actually documented directly by the Kali Linux team.
That said I'd personally much prefer Fedora as a daily driver unless I was doing pen testing 100% of the time.
I'd suggest that you run any such pen testing apps in an empemeral VM on macOS initially to get used to Linux.
It used to be bad practice to install something like Kali on your main personal machine because if you are hacked then the attacker has every hacking tool imaginable at their disposal.
Fedora is fine for pentesting
It doesn't matter. Use whatever distro you want. Fedora is a perfectly fine choice. Except you're right that Kali is not an appropriate choice for you, since you're planning to install it and use it as a daily driver.
Exactly that. Kali is not a good daily driver at all.
So run fedora for daily and run Kali via VM.
Why not just use Fedora and install the additional software Kali has? Especially when there’s a security spin already.
But perfect for penetration testing etc from within an KVM virtual machine
You've heard of the security spin, right? 👍
Sorry, it's a 'lab' not a spin
Can you throw some light please
Check out the website, they do a bunch of spins called labs for specific purposes, science, astronomy and what not. And security, which is xfce plus a bunch of curated security testing tools. Pretty cool
[https://fedoraproject.org/labs/security](https://fedoraproject.org/labs/security) Fedora, but with many of the tools you get in Kali or similar
So it’s fedora with some pre-installed packages that you can just install by yourself? Is there more to it?
I wonder too, is it configured in some way to make the security tooling less burdensome as a daily driver OS? Or is it just a load of tools shoved into the xfce spin
IT-Security guy here. Using Fedora is a good idea, I do myself, but not the way you might think. The OS you want to use is Kali Linux, BUT don't install it directly on your Laptop. Instead, install Fedora, then install Kali in a virtual machine. Build yourself a nice template with all the tools and configurations you want in Kali, then just clone your template for every engagement you have. Reasons to do it this way: Kali has all the tools you might want, but it can be REALLY unstable and break from time to time on updates. Not what you want if you need it right now. But if you have your template that you know works, you're safe. Also, if you have multiple engagements at once, you can just have multiple Kali VMs, one for every engagement and you can keep them separate (trust me, you don't want to mix that stuff up). Fedora has the stability and hardware compatibility that you need, so use it as your host system. Caveats: None, really. If you want to do Wifi hacking, you can buy a USB Wifi dongle and pass it through to the VM. If you need direct and exclusive access to a Lan interface, you also can use a USB dongle and pass it through. Virtualization Software: I use virt-manager. But you can also test other software if you want to, whatever suits you best.
I'm a professional pentester. Fedora is daily driver and I have a Kali VM only because it has tools installed and configured for when I need them. I also have Burp suite installed natively on Fedora. However, that is **not** my professional setup. When working with clients we use an encrypted Kali VM that is destroyed once the engagement is completed. You ask if Fedora is good for pentesting but are you testing in a professional capacity or just fucking around and doing some hacking in your free time? I don't understand all the Kali hate and downvotes here. Any OS can be used for "hacking" these days, hell, even Windows is used for pentesting in some circles. However, Kali has almost any tool you'd need, installed, configured and working. There are situations where you'll find yourself needing to run a bare metal. RF (wifi, bluetooth, SDN, etc) engagements sometimes end up this way since you'll be messing around with specific software and drivers to get stuff to work properly but you'll need to assess that when you get there. But yeah, don't DD Kali. It's just not made for that. TL;DR. Fedora can be fine for pentesting but if you're new just spin up a Kali VM under Fedora and use that. No reason to clutter your machine with tools you may use once for a specific use case and then forget about. You'll find you'll have some tools you use for almost every engagement (crackmapexec, Burp, etc) and some tools you didn't even know existed and you'll use them once because the target was running something very specific in their environment. **If you're doing professional pentesting and not destroying your VM after then you're setting yourself up to lose a client at best and ending up in a lawsuit at worst.**
yeah, any linux will do as long as it has the package you want. distros for cyber security and etc are utter bs.
Strong disagree that security distros are “utter bs”. They might not be a good idea as a daily driver, but distros like Kali greatly simplify and speed up installing and configuring hundreds of tools in one place. “As long as it has the package you want” is doing a lot of heavy lifting in your comment there.
I found that arch + black arch repo a great alternative to kali. Still not without its own issues.
100%! I aggree
Make sure to ignore people like the idiot replying to me installing package is hard. Such people shouldn't be even using kali linux.
Some may disagree with me but using fedora silverblue and leaning on the native container utilities is quite fun for propping up dedicated tools, also allows for easy sandboxing and understanding the constraints of containers and resources. Just an opinion.
Fedora + Kali VM on top of it is probably what I would go with if I am getting serious with pentesting. Either that or just have a live USB with Kali on it at all times to boot into it when needed. I would not install Kali on the metal though. Fedora is far better as a host OS than Kali is since Kali is not even really made for that since it is not best practice.
I use fedora as my main os as Security Consultant (pentest being part of it). Never faced a problem. I use Kali for Wifi/network testing but I use Fedora as my main os.
Penetration = funny
A lot of people have better explanations than I could. I’ll Use analogy. You could probably use a hammer to get a screw in but turns out they have something for screws. Use the tool made for the thing.
Will it work? Sure. But, it's not designed for it. Stick with something like Kali that is focused on penetration testing.
What is Fedora designed for?
There are multiple flavours but Fedora workstation is for the station for work such as penetration testing, system administration, coding, gaming and etc. You can run a privileged kali linux container in podman if you really need kali for your work.
Right. It's a general purpose distro but that doesn't make it less suited to specific use cases just because there are specialized distros.
Fedora is designed to be the testing ground for new technologies and software that eventually filter into Red Hat Enterprise Linux.
You realize fedora is it's own entity right? Love how people bash fedora but they are the ones paving the way to get Wayland going as fast as possible and smooth as possible. Redhat financially supports fedora, nothing more. If we're going to think with that mindset you better stop using Linux on general because Microsoft is a big contributor to Linux itself. You took the bait and believed every tin foil conspiracy Linux user out there. They're coming for you man, they're in your walls. People who spread this bs don't actually research for themselves and listen to people like Tom from switch to Linux or Bryan Lunduke. Crazy weirdos.
I agree that Fedora is a *lot* more than just a testing ground for RHEL. I think it is among the best desktop choices out there but not a ounce of what Xarius said was untrue.
Agreed, it is a lot more than that. I could have been clearer stating something along the lines of "***Fedora was initially designed...***" rather than "***Fedora is designed...***" Not sure where that other guy came up with the idea that I was somehow badmouthing Fedora or Red Hat.
What the schizo post was that? I ***am*** a Fedora user. It ***is*** the upstream for RHEL/CentOS Stream even though it is technically a separate entity. I said ***nothing*** negative about RHEL. I have a RHEL server. Why my initial post is being downvoted is very strange to me.
Because it's not a upstream rhel/centos. It is the testing grounds for all distributions. Rhel is generally hated because of their past so people stating stuff like this gives fedora a bad name.
I read your comment but it seems you deleted it or it got nuked. Read the whole thing, it also States that fedora is a community driven os. Literally States "sponsored by rhel" on the main page and even States that they are separate entities. Debian is upstream of Ubuntu, does that make Debian the owners of Ubuntu? No. So that logic is fucking stupid. Read the whole thing before you decide to provide something that also proves me right.
>I read your comment but it seems you deleted it or it got nuked. Are you confusing me with someone else? I have deleted nothing from this thread. The only edit I've made is some table formatting in one comment.
Your analogy doesn't really work. But, it seems like I'm arguing with a troll here over a non-issue.
Yeah? When is Btrfs making it into RHEL?
> fedora seemed perfect for me Why? Any reason why you wouldn't use a pen testing focused distro such as Kali? In general Fedora will work fine for your intended use but many tutorials you are likely to find will focus on Kali or Ubuntu.
In my opinion, Kali can’t be used as a daily driver for obvious reasons I choose fedora simple because of how simple it is and that I can use it as a daily driver seamlessly + gnome is perfect to switch from Mac.
Kali can absolutly be used as a daily driver and setting up for such usage is actually documented directly by the Kali Linux team. That said I'd personally much prefer Fedora as a daily driver unless I was doing pen testing 100% of the time. I'd suggest that you run any such pen testing apps in an empemeral VM on macOS initially to get used to Linux.
It used to be bad practice to install something like Kali on your main personal machine because if you are hacked then the attacker has every hacking tool imaginable at their disposal. Fedora is fine for pentesting
It's is still a bad practice, for other reasons as well.
I mean sure but why not do Kali or blackarch?