Kasm Workspaces — Isolated Analysis Environments

→

What it is — and what it isn't

Kasm is not a forensics tool. It's a platform that runs desktops and applications in Docker containers and streams the image to your browser via a web server. Keyboard and mouse go in, pixels come out — the code never runs on your local machine.

Why it belongs in a DFIR catalog: It gives you disposable burner environments. When you need to investigate a phishing link from phishing@defencia.dk, open a suspicious document, or detonate a sample — you do it in a Kasm session that's thrown away afterward. Combined with network isolation it becomes a safe detonation chamber.

Important caveat: Kasm isolates via containers, not a full VM/hypervisor. For real malware detonation (ransomware, samples attempting container escape) you should place Kasm in an isolated VM on a separate network segment — don't rely on the container boundary alone.

→

Installation

Docker

The Community Edition has a single installation script that sets up all services in Docker (database, agent, proxy, GUI).

Requirements

# Recommended: dedicated Ubuntu VM
# Min. ~4 vCPU / 8 GB RAM / 50 GB disk for multiple sessions
# Docker is installed by the script if missing

Download & install Community Edition

# check kasmweb.com/downloads for the latest version
cd /tmp
curl -O https://kasm-static-content.s3.amazonaws.com/kasm_release_VERSION.tar.gz
tar -xf kasm_release_*.tar.gz
sudo bash kasm_release/install.sh

The script prints auto-generated passwords for admin and user at the end — save them.

Access

# GUI at https://<server-ip>  (default port 443)
# log in as admin@kasm.local

Behind your Nginx: As with your other services, Kasm can be placed behind lab.defencia.dk with your Certbot cert. Note that Kasm terminates TLS itself — consider a stream proxy or adjust Kasm's own cert config rather than double TLS termination.

→

Workspaces & images

A "workspace" is a Docker image with a desktop or app. Kasm maintains a registry of ready-made images.

Workspace type	Use
Kasm Desktop (Ubuntu)	Full Linux desktop for general analysis
Chrome / Firefox	Isolated browser — open suspicious links safely
Tor Browser	Anonymous OSINT / investigation without leaking your own IP
Remnux (custom)	Build your own image with a malware-analysis toolset
Kali (custom)	Offensive/test tools in a single-use environment

Custom images: Kasm images are ordinary Docker images built on their base. You can make a custom workspace with e.g. Remnux or your own analysis tools preinstalled, push it to your own registry and add it in the admin panel.

→

DFIR / phishing workflow

Concrete uses that fit your Defencia setup:

Scenario	Approach
Phishing link	Start a disposable Chrome session → open the URL → observe the redirect chain, landing page, credential harvest — without risk to your own machine
Suspicious document	Upload to a Linux desktop session → open in the isolated environment → inspect macros/payloads → throw the session away
OSINT on a threat actor	Tor browser session → investigate without revealing your infrastructure or IP
Sample-detonering	Custom Remnux image in a network-isolated session → observe behavior (only in a fully isolated VM, see below)

Integration: What you collect (URLs, IOCs, hashes) feeds directly into your n8n phishing-analyzer workflow and your Defencia Intel Dashboard.

→

Isolation & networking

Network segmentation is essential: Put the Kasm VM on a dedicated, isolated VLAN (like your Wu_IOT pattern) with no access to your internal network. For detonation: no route to production, only controlled egress (optionally via an analysis proxy so you capture C2 traffic). Assume everything run in a session is hostile.

Control	Recommendation
Network	Isolated VLAN, no route to internal services
Egress	Controlled/logged outbound via an analysis proxy
Session lifetime	Set a short timeout and force destroy on logout
GUI access	Behind VPN + Fail2ban on login (see Fail2ban (coming))
Host	Kasm in its own VM, not on a host with other services

→

Operation

Service status

sudo docker ps --filter name=kasm

Stop / start the whole stack

sudo /opt/kasm/bin/stop
sudo /opt/kasm/bin/start

Update images

# in the admin GUI: Workspaces → select image → Update
# or pull a new image and point the workspace at the new tag

Logs

sudo docker logs kasm_api
tail -f /opt/kasm/current/log/*.log