Vyzkousel jsem v kvm qemu.
Mam dva virtualni stroje, jeden s secureboot, druhy bez.
virsh dumpxml linux2024 | xmlstarlet sel -t -m "/domain" -v "name" -o " " -v "os/loader/@type" -o " " -v "os/loader" -n
linux2024 pflash /usr/share/edk2/ovmf/OVMF_CODE.secboot.fd
virsh dumpxml linux2024-2 | xmlstarlet sel -t -m "/domain" -v "name" -o " " -v "os/loader/@type" -o " " -v "os/loader" -n
linux2024-2 pflash /usr/share/edk2/ovmf/OVMF_CODE.fd
Oba stroje jsou schopne nabootovat fedoru s nfsroot pomoci dhcp -> tftp/shim ->tftp/grub -> tftp/vmlinuz+initrd -> dhcp -> nfsroot
ten bez securebootu i dhcp -> ipxe -> dhcp -> http/vmlinuz+initrd -> dhcp -> nfsroot
a dhcp -> ->tftp/grub -> tftp/vmlinuz+initrd -> dhcp -> nfsroot
se securebootem skonci na Exec format error po stazeni http/vmlinuz+initrd
respektive Access Denied -- reject probably by Secure Boot
Takze si myslim, ze ten podepsanej ipxe od toho broadcomu muze spoustet pouze veci podepsane broadcomem.
A to fedora kernel asi neni.
moje konfigurace:
mkdir -p /mnt/nfsroot/fc42
dnf -y --use-host-config --installroot=/mnt/nfsroot/fc42 --releasever=42 install openssh-server openssh-clients nfs-utils yum kernel dracut-network
kernel="$(find /mnt/nfsroot/fc42/usr/lib/modules/ -maxdepth 1 -mindepth 1 -printf '%f\000' | sort -z| head -z -n1| tr -d '\000')"
chroot /mnt/nfsroot/fc42 dracut /boot/initramfs-nfs-$kernel.img --add "nfs network base ifcfg ssh-client debug" --add-drivers "$(find "/mnt/nfsroot/fc42/usr/lib/modules/$kernel/kernel/drivers/net/ethernet/" -name "*.ko.xz" | sed -e 's/.*\/\(.\+\)\.ko\.xz$/\1/p;d'|tr \\n " ") nfs nfsv3 vmxnet3 " $kernel
mkdir -p /var/lib/tftpboot/fc42/
mkdir -p /var/lib/tftpboot/uefi
cp /boot/efi/EFI/fedora/{shimx64.efi,grubx64.efi} /var/lib/tftpboot/uefi/
chmod 755 /var/lib/tftpboot/uefi/*
cp /mnt/nfsroot/fc42/boot/initramfs-nfs-$kernel.img /var/lib/tftpboot/fc42/
cp /mnt/nfsroot/fc42/boot/vmlinuz-$kernel /var/lib/tftpboot/fc42/
chmod 644 /var/lib/tftpboot/fc42/{initramfs-nfs-$kernel.img,vmlinuz-$kernel}
mkdir /mnt/nfsroot/fc42/root/.ssh/
chmod 500 /mnt/nfsroot/fc42/root/.ssh/
touch /mnt/nfsroot/fc42/root/.ssh/authorized_keys
chmod 400 /mnt/nfsroot/fc42/root/.ssh/authorized_keys
cat /home/marek/.ssh/id_rsa.pub >> /mnt/nfsroot/fc42/root/.ssh/authorized_keys
echo "/mnt/nfsroot/fc42 192.168.0.0/24(rw,sync,no_subtree_check,no_root_squash)" > /etc/exports.d/fc42.exports
echo "menuentry 'fc42' --class fedora --class gnu-linux --class gnu --class os {
linuxefi fc42/vmlinuz-$kernel ip=dhcp root=/dev/nfs nfsroot=192.168.0.13:/mnt/nfsroot/fc42/ rw selinux=1 enforcing=0 net.ifnames=0
initrdefi fc42/initramfs-nfs-$kernel.img
}" >> /var/lib/tftpboot/uefi/grub.cfg
echo '<VirtualHost *:4433>
ServerName boot.example.local
DocumentRoot "/var/www/html/pxe"
<Directory "/var/www/html/pxe">
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
#ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
<Directory "/var/www/html/cgi-bin">
Options +ExecCGI
AllowOverride None
Require all granted
</Directory>
# Logging
ErrorLog "/var/log/httpd/pxe_error.log"
CustomLog "/var/log/httpd/pxe_access.log" combined
</VirtualHost>' > /etc/httpd/conf.d/pxe4433.conf
mkdir -p /var/www/html/pxe
chown -R apache:apache /var/www/html/pxe
echo 'RewriteEngine On
RewriteCond %{REQUEST_URI} ^/Altiris/iPXE/GetPxeScript\.aspx$
RewriteRule ^(.*)$ /cgi-bin/pxe.sh [QSA,L]' > /var/www/html/pxe/.htaccess
echo '#!/bin/bash
echo "Content-type: text/plain"
echo ""
cat <<EOF
#!ipxe
dhcp
kernel
http://192.168.0.13:4433/fc42/vmlinuz-'"$kernel"' ip=dhcp root=/dev/nfs nfsroot=192.168.0.13:/mnt/nfsroot/fc42/ rw selinux=1 enforcing=0 net.ifnames=0 initrd=initramfs-nfs-'"$kernel"'.img
initrd
http://192.168.0.13:4433/fc42/initramfs-nfs-'"$kernel"'.img
boot
EOF
' > /var/www/cgi-bin/pxe.sh
cp -r /var/lib/tftpboot/fc42/ /var/www/html/pxe/
chmod 755 /var/www/cgi-bin/pxe.sh
NEW="$(awk 'BEGIN {LISTEN=0} LISTEN==0 && /^[[:blank:]]*Listen[[:blank:]]/ {print "Listen 4433";LISTEN=1} // {print} END {if(LISTEN==0){print "Listen 4433"}}' /etc/httpd/conf/httpd.conf )"
cat /etc/httpd/conf/httpd.conf > /etc/httpd/conf/httpd.conf.backup
echo "$NEW" > /etc/httpd/conf/httpd.conf
semanage port -a -t http_port_t -p tcp 4433
systemctl start httpd
***************************************************************
A potom v /etc/kea/kea-dhcp4.conf odkomentovat patricnou metodu:
{
"id": 2,
"subnet": "192.168.0.0/24",
"interface": "br3",
"next-server": "192.168.0.13",
"boot-file-name": "uefi/grubx64.efi",
#"boot-file-name": "uefi/shimx64.efi",
#"boot-file-name": "ipxe/ipxe.efi",
"pools": [
{
"pool": "192.168.0.14 - 192.168.0.50"
}
],
"option-data": [
{
"space": "dhcp4",
"name": "routers",
"code": 3,
"data": "192.168.0.13",
},
{
"space": "dhcp4",
"name": "domain-name-servers",
"code": 6,
"data": "8.8.8.8"
}
]
}
8 Odpovědí
3855 Zhlédnutí