Re: Testers required: PXE boot Slackware installers from slackware.org.uk

On Sat, 26 Jul 2014, Bengt Richter wrote:
> Why not supply a tarball and some instructions for testing between a tester's
> boxes on his internal network? And discuss the security aspects, so people
> don't set themselves up for having their boxes reflashed by men in the middle
> who then chain to the intended boot file without your noticing?

That would utterly defeat the purpose of having an external server host the 
boot files.

The point is that people *don't* need anything locally in order to install 
Slackware - not that they download a tar, extract it somewhere and install 
from that.  There are already options in Slackware for that - check out the 
usb-and-pxe-installers/ directory on a mirror :)

If they can or want to download stuff locally, there is obviously better 
options available.

> Well, at least you'll separate the trusting from the paranoids ;-)

While TFTP doesn't allow you to obtain directory listings (so you can't 
browse the server like you would with FTP), you can download the pxelinux 
default config (the file required is /pxelinux.cfg/default), find out 
exactly what kernels and initrds are downloaded from the server, download 
those and check their md5sums against a mirror you trust.

There is complete transparancy in terms of being able to verify that what 
you are downloading is actually unmodified Slackware kernels and initrds.

As I mentioned in my first message, this is about making access to Slackware 
easier for people.. not trying to worry them about exceptionally unlikely 
(and probably quite impossible without LAN access) man in the middle 
attacks.

If anyone wants to verify the kernels/initrds, I am happy to post 
instructions on how to do it - but really, anyone competent enough to use 
TFTP can figure it out :)

Darren.