+- iPXE discussion forum (https://forum.ipxe.org)
+-- Forum: iPXE user forums (/forumdisplay.php?fid=1)
+--- Forum: General (/forumdisplay.php?fid=2)
+--- Thread: Authentication via iPXE when using boot, chain, kernel, initrd etc. (/showthread.php?tid=18986)
Authentication via iPXE when using boot, chain, kernel, initrd etc. - obie - 2019-08-20 19:55
My question is around authentication when using boot, chain, kernel, initrd etc. My use case is if I have an url that returns a boot image that needs an API key header or an OAuth token.
http://ipxe.org/cmd/kernel - From what I understand here, I can pass a timeout, a name, and other arguments that go straight to the image. How do I pass authentication headers?
Additionally, I have a question about best practices regarding secrets as well. What's the alternative to keeping them in the ipxe script in plaintext? I'm actually fine with that but would be useful to know best practices.
RE: Authentication via iPXE when using boot, chain, kernel, initrd etc. - NiKiZe - 2019-08-20 22:24
I would like to think that kernel works the same as chain, which means that:
http://ipxe.org/cmd/login
Should work for kernel as well, that is not api keys, so if you want it to be server, then you should have to have in an iPXE
that iPXE script itself could be protected from outside download by some kind of other secret or login.
RE: Authentication via iPXE when using boot, chain, kernel, initrd etc. - obie - 2019-08-21 20:06
Thanks, could you potentially point me to an example using http headers? It's not clear to me how to use them in conjunction with boot, etc.?
RE: Authentication via iPXE when using boot, chain, kernel, initrd etc. - NiKiZe - 2019-08-22 04:59
You can not control headers, more than via the standard http basic auth, the examples that exists is on the linked page
RE: Authentication via iPXE when using boot, chain, kernel, initrd etc. - robinsmidsrod - 2019-08-22 08:15
I can see the benefit to adding something similar to the curl -H parameter (add arbitrary HTTP header) to the chain command, but unsure how complicated it would be. That would allow all sorts of different interaction, including setting the Authorization header for token-based authentication.
RE: Authentication via iPXE when using boot, chain, kernel, initrd etc. - obie - 2019-08-23 21:15
Thanks for the insights. I'm currently struggling with designing a boot system from an iPXE usb and the OS I'm loading has potentially sensitive information/ binaries on it. Do you know an example security architecture in conjunction with iPXE boot that seems to be the standard?
RE: Authentication via iPXE when using boot, chain, kernel, initrd etc. - NiKiZe - 2019-08-26 09:18
The most standard is basic http authentiocation as described above and on the iPXE login page,
Actual implementation on the server depends on what you are running there, but a search for ".htaccess password" would show how to set up apache for these kind of things, but there is many other ways as well.
annother option is to use iPXEs params and do a normal http POST to a webserver with a script that does the authentication.
RE: Authentication via iPXE when using boot, chain, kernel, initrd etc. - obie - 2019-08-27 03:58
Thanks, I appreciate the follow-upw on this.