CD images for old versions are here: http://cdimage.debian.org/cdimage/archive/
The sources.list should be pointed to http://archive.debian.org/. Read http://archive.debian.org/README and http://archive.debian.org/debian/README for more info.
There are also security updates on the archive.debian.org site but you're not *really* going to use this for a production system, are you?
Random Notes >