2

I've created a diskless Debian installation with root filesystem over NFS, and boot loader on a USB (this computer has issues booting from PXE for some reason). My setup is similar to the one described on the ArchLinux Wiki.

This has been working great for me but I have some security concerns.

  • Anyone can mount the NFS root, I can restrict by IP but that's easy to circumvent.
  • The NFS traffic is unencrypted, so it can be sniffed.

The NFS server and the laptop I want to boot are on separate VLANs, and I have set firewall rules for it to work.

What options do I have to tunnel the NFS traffic?

  • Some places suggest VPN, but I'm not sure that's doable at boot time.
  • Similar option using 802.1X on the switch to get access to the NFS VLAN, but I also don't know if that's doable at boot time.
  • Use a different network share? Use Kerberos to encrypt NFS, don't know if it works at boot time.

Any other suggestions? There are amazing resources on creating diskless systems but most of them rely on booting on a trusted network. I can do this but I don't want to change the VLAN in the port each time I want to boot over the network VS when I want to boot the (untrusted) OS the laptop has installed.

0

0

You must log in to answer this question.

Browse other questions tagged .