Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)?

Would it be possible to fetch the iso with ssh?

share|improve this question
    
You should elaborate. I have no idea what you are asking. –  Rook Dec 18 '11 at 18:20

3 Answers 3

up vote 3 down vote accepted

I don't think the first part of the PXE boot can be secured. A rogue DHCP server could hijack your install. And TFTP offers exactly zero security.

But assuming you get a response from the right DHCP server and you pull the boot file from the right TFTP server, the configuration could direct the client to load via HTTPS, which would provide both encryption and authentication.

See, for example, this HOWTO on setting up a PXE installer. Substitute an HTTPS server in the config file given at the bottom.

share|improve this answer

iPXE has an option for HTTPS transport of the bootable image. If you hardcoded the IP into the iPXE OptionROM, and burned it into the card, then you'd eliminate problems that stem from the DHCP/TFTP PXE combo (transfer in clear, rogue DHCP, and no integrity checks).

share|improve this answer

You can find more information about iPXE here:

http://en.wikipedia.org/wiki/IPXE

and here:

http://ipxe.org/crypto

Also, I recomend you to configure your DHCP server to only serve static assigned IP's (one MAC, one IP); use a separated IP address pool to do the iPXE boot, even better, use separated VLAN's; use a Firewall to prevent DHCPDISCOVER and DHCPRESPONSE packets over the network, and allow only inside de trusted vlan, ...

Don't use the old fashioned PXE, instead of it use de the new iPXE and make use the secure protocols.

If anyone has physical access to the box can take control of it, it's only a matter of time. :-/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.