Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netboot

netboot.xyz

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Netboot

#33

Post by [deleted] »

jamescun wrote: post #2

NetBooting from the internet AND over HTTP? Sign me up! Sarcasm aside, at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality, which I could then audit and load on to a boot medium for netboot use.

[deleted]

Re: Netboot

#34

Post by vive-la-liberte »

jamescun wrote: post #2

NetBooting from the internet AND over HTTP? Sign me up! Sarcasm aside, at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality, which I could then audit and load on to a boot medium for netboot use.

>at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality

I'm not familiar with these but I saw a commit from just a couple of hours ago referencing "image trust" [1], so maybe it's in the works now following your comment?

[1]: https://github.com/antonym/netboot.xyz/commit/25910be18da219...

Re: Netboot

#35

Post by crackerjackmack »

Netbooting isn't new. Insecure netbooting isn't new (ala netboot install USB's per distro). Wrapping it up into a cohesive service is and it's awesome.

Going signed CA wouldn't be hard to do in this case at all, it's just part of the build process actually but only gets you to to a trusted PXE+menu system. After getting into the PXE menu a system could still hijack the upstream kernel/initrd files.

Even freebsd netinstall (aka not limited to linux installers) is just http/ftp without any package signing. The whole ecosystem probably needs to mature some more in regards to verification that won't break downstream projects such as this.

Re: Netboot

#36

Post by crackerjackmack »

Netbooting isn't new. Insecure netbooting isn't new (ala netboot install USB's per distro). Wrapping it up into a cohesive service is and it's awesome.

Going signed CA wouldn't be hard to do in this case at all, it's just part of the build process actually but only gets you to to a trusted PXE+menu system. After getting into the PXE menu a system could still hijack the upstream kernel/initrd files.

Even freebsd netinstall (aka not limited to linux installers) is just http/ftp without any package signing. The whole ecosystem probably needs to mature some more in regards to verification that won't break downstream projects such as this.

Re: Netboot

#37

Post by jlgaddis »

This is very cool and very useful to me as I'm currently in the process of rebuilding our infrastructure (working on OpenBSD autoinstalls at the moment). I'm gonna test this out very shortly although I'll be using it internally and not over the Internet (for what should be obvious reasons), but it will definitely simplify things for me. Thanks!
Post reply on HN