RE: iSCSI and secure boot

["Douglas Otis" <dotis@sanlight.net>]

Bernard,

Can you describe a secure diskless boot that does not require individual
setup of each?  The clever thing to do would be to ensure this process is
extremely basic and does not include anything highly variable such as iSCSI.
Use a second step to then obtain anything that may require extensive updates
and variables such as an iSCSI kernel.  This could be essentially a
replication of the first boot but with some management added perhaps via a
DUA.  Make sure this is indeed a one-time setup.  Keep it simple and there
should be no problem with revoking or needing to update various options.

Doug

> Problem with PXE 2 is that it requires touching every PC (to install
> the boot image cert) and so isn't widely implemented. Also, if
> implemented doesn't support basic capabilities such as revocation. So most
> PCs implementing PXE are doing PXE 1 or PXE 2 with no boot image cert
> installed. Therefore for all practical purposes PXE = no security.