I am planning to implement diskless clients for booting Windows 7 clients. I am trying to determine whether to use PXE with TFTP or iPXE with HTTPS or iSCSI.

Are there any vulnerabilities with using PXE and TFTP that may justify using iPXE instead? Does TFTP provide any sort of security?


TFTP is a very weak protocol, from a security point of view: it has no provision for security or authentication, uses UDP for transport which makes it extremely easy to spoof, intercept, DOS or manipulate by anyone on the same network.

iPXE, on the other hand, does implement authentication, data integrity and security: you just have to set it up.

| improve this answer | |

Deciding to use iPXE instead of standard PXE for security reasons does not make much sense;

  1. HTTP/iSCSI are not really much safer than TFTP at packet level
  2. You should consider "which" files are going to be transferred by TFTP before the SMB transfers take control when you define your risk profile.
  3. PXE also implements data integrity with BIS but do we need really that when MS also implemnts data integrity in their PE images?
  4. Are you really installing Windows OSs in a hostile environment?

For all of the above I do not think iPXE will solve any real PXE security issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.