Re: Password protect the gPXE CLI

On Fri, 2009-07-31 at 11:28 -0500, Wagnell, Joseph M (IS) wrote:
> Hi All,
> I was wondering if it was possible to password protect the CLI access to
> gPXE. Or if that's not possible, could I remove access to the CLI
> altogether. I am currently using gPXE to sanboot multiple computers/OS's
> (with DHCP) and security wants to ensure that a user cannot manually
> assign an IP and boot from a different LUN. Any other
> thoughts/suggestions would be welcome. 

I don't believe this is currently possible, though it would not be
difficult to do. The relevant lines are the calls to shell() in
src/core/main.c; if you replace each shell(); with a bare semicolon ;,
the user can't get to the shell.

A more extensible protection mechanism would be to add a setting, e.g.
"allow-shell", that could be modified by a script. Then you could embed
an image using gPXE's existing "login" facility (prompts for a username
and password), check them in the script, and enable the shell setting if
they match. This would rely on Lynus Vaz's scripting improvement project
being worked on for Summer of Code.

-- Josh

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

_______________________________________________
Etherboot-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/etherboot-discuss

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBKcx95I6LPMrSI3tYRAtlLAJ9zBdfarKD2eJzdibAS8bD2YsqifQCgg4PX
NnjhO+UTC6u+227rXt4tRgc=
=0v6c
-----END PGP SIGNATURE-----