[TIPS] Variables can be nested!

[mcb30]

(2014-03-20 12:10)sebastian Wrote:  I looked at all these certificate stuff and found out that embedding both a client certificate (to prevent "unauthorized" clients from submitting data) and a server certificate, makes the binary too fat to be embedded in the mobo ROM.

Since the real clients and the server is fully trusted and know each other (its under the same roof), it would be sufficent with a simple shared-secret system.

In that case, you can just use HTTP Digest authentication, which is supported in the standard (non-HTTPS) build. On the server side, create a .htaccess file containing something like:

Code:

AuthUserFile /etc/htpasswd
AuthGroupFile /dev/null
AuthName "Restricted area"
AuthType Digest
require user myuser

and create the password file using

Code:

htpasswd -c /etc/htpasswd "Restricted area" myuser

and access the resource within iPXE using the syntax

Code:

http://myuser:mypassword@my.web.server/path/to/boot/file

HTTP Digest protects against replay attacks; if that's all you're concerned about then that would be sufficient.

Michael