How to create a simple PXE server to serve a single version of ShredOS (UEFI mode only, not legacy boot) #148
Replies: 17 comments 10 replies
-
|
If anybody wants to have a go at adding legacy support to the configuration of /etc/dhcp/dhcp.conf as shown above, then please feel free to add the changes and I will update the above procedure to support both UEFI and legacy PXE booting. |
Beta Was this translation helpful? Give feedback.
-
|
Regarding PXE booting using tftp-hsa on Debian/Ubuntu. Here's a thread that discussesTFTP Windowsize Option RFC 7440 with links to the patches and a discussion about updating tftp-hsa in Debian/Ubuntu. If anybody wants to apply the RFC 7440 patch to tftp-hsa, I'd be interested in seeing what the speed improvement would be. I'm sort of expecting a five fold increase in speed on a gigabit network. So instead of 4 Mbyes/sec you would see 20 Mbytes/sec so in terms of ShredOS booting over the network you would see it takes 6 seconds to boot rather than 33 seconds. I need to stay focused on completing the nwipe features so if anybody else who has a interest in PXE booting and has some time to try this out, please feel free, and update us with how much of a speed improvement it is. |
Beta Was this translation helpful? Give feedback.
-
|
Patches for tftp c7 https://git.centos.org/rpms/tftp/blob/c7/f/SOURCES |
Beta Was this translation helpful? Give feedback.
-
|
I've created a tftp repository tftp-pv applied most of the patches, just need to apply the last three. |
Beta Was this translation helpful? Give feedback.
-
|
Just a thought, but in theory it would be relatively easy to add a feature to ShredOS where you can turn it into a PXE server, serving up just ShredOS. So on a network of 100 PC's and assuming they are already networked together, all you would need is one USB stick with ShredOS, then you just PXE boot each PC in turn from a single PC that has the ShredOS USB flash drive. I would need to pull in the tftpd server software that I'm currently building based on the centos patches with RFC 7440 support as the boot time would need to be brought down as much as possible. A PXE server can be a pain to setup sometimes, so if all it took was adding the option "pxe_server=enable" to grub.cfg to turn ShredOS into an instant PXE server, that would pretty useful for some people I guess? it would add next to nothing in terms of increase in size to the ShredOS .img/.iso, so I can't really see any downsides. Does that sound like a useful feature to add to ShredOS at some point? |
Beta Was this translation helpful? Give feedback.
-
|
Seems like a niche feature that I really need right now for my cluster of old computers, I thought of using iventoy but this guide seems way better, i feel like a pxe switch would be a godsend when you really need it. Thanks btw you may have saved me many many USBs!!! |
Beta Was this translation helpful? Give feedback.
-
|
Many USB's ? I may have misunderstood, but you know you don't need to leave the USB stick plugged into the computer after the nwipe application has appeared. You only need one USB stick no matter how many PCs you have. So, for instance, say you have 10 PCs to wipe. Just create one ShredOS USB stick. Boot the first PC with ShredOS, as soon as nwipe appears, unplug the USB stick and plug into the second PC, boot it with the ShredOS stick, when nwipe appears, unplug the stick and move to the third PC. ShredOS isn't like a live Linux DVD , the entire system is loaded into memory. So once booted it doesn't need the USB stick until the wipe has finished. When you press return once all wipes have finished on a given PC that's when it will mount the USB stick to copy the Wipe certificates & logs onto the stick. Each wipe certificate has a unique name made up from the model & serial number of the drive being written. So you never really need more than one ShredOS USB stick. |
Beta Was this translation helpful? Give feedback.
-
|
No no you're spot-on!! Took me a while but I noticed my usb isn't actively getting used :P |
Beta Was this translation helpful? Give feedback.
-
|
Hello, I just followed your procedure to install shredos in PXE. The problem, a recent update this month (Windows) has modified the secure boot in the BIOS (I could not tell you what exactly, Microsoft indicates that the update has done something with the SBAT shim). When booting in PXE I have the following messages:
Server IP address is 192.168.1.85 Following the messages, the screen goes black while the PC button is on. After 5 minutes, the PC restarts under Windows. When I reset the secure boot in the BIOS, the PC boots on SHREDOS correctly (annoying to go to all the PCs to reset the secure boot). Do you have a solution? In addition, I would like to ask you if there is a way for the workstations to directly execute the formatting in DOD Short 3 passes without going through the interface (time saving). Thank you in advance for your help and advice. I don't speak Shakespeare's language well. |
Beta Was this translation helpful? Give feedback.
-
I don't see secure boot happening anytime soon unless I move ShredOS to a Ubuntu based OS. Secure boot could be added but it would mean you had to load the keys into the bios rather than it just seamlessly working like Ubuntu.
Yes, by editing the grub.cfg files as described in the readme.md by appending nwipe_options=" --method=dodshort" to the kernel command line.
Nor me, and I'm English. I've heard Jean Luc Picard can be quite good at it though. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, |
Beta Was this translation helpful? Give feedback.
-
|
Hello, |
Beta Was this translation helpful? Give feedback.
-
|
Glad to hear it works well for you. Regarding nvme-cli. You would need to edit or replace the file nwipe_launcher depending on how much of the functionality you wanted to change. https://github.com/PartialVolume/shredos.x86_64?tab=readme-ov-file#boardshredosfsoverlayusrbinnwipe_launcher and then build ShredOS from source. There are no plans to add that sort of change to ShredOS as it was always meant to simply show case nwipe. However it does seem to have become more popular than I was expecting, so you never know. There's no easy way for a non programmer to do what you want, but if you are ok editing and writing bash then it should be possible. Don't forget though that nwipe generates the pdf reports if you remove it you won't get reports. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your responsiveness, I will look into this. Have a good evening. |
Beta Was this translation helpful? Give feedback.
-
|
Putting this into record. Today I integrated ShredOS very simply into my existing iPXE menu system. I downloaded the latest .img file from the github releases in my use here ( The below worked for me where "shredos" is the "shredos" file found within the I took the kernel options directly from the grub.cfg file which shows up inside the same img file. ShredOS is very easy to boot with iPXE - it's just one big kernel file which presumably has everything it needs without the need for a separate initrd or any other resources. For all I know there's other parameters you could slip into the cmdline to influence the options and reports and who knows what all else. I had a basic need. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, i'm actually work to do an solution for erase and get certificat of hundred and hundred disk. This is a project for end of school too, so i don't want to use the finish version, i have to create it! I have juste a question about the file EFI in /srv/tftp i don't get it so i have to create it? Or my configuration wasn't good? Thanks for taking the time to read! |
Beta Was this translation helpful? Give feedback.
-
|
@titielgozo I don't understand 100% what your end goal is, but I'll try to help. When an EFI computer boots, it will look at its list of storage devices and looks for a particular kind of partition (EFI System Partition) based on a GUID. Once it finds that partition, it reads it as a FAT32 volume and then looks through the directory "EFI" to find the default boot files (or available ones for population in the boot menu if called by an operator). In the case of booting via PXE, none of this is required. More often than not in modern days, you're using iPXE which is a program kind of like GRUB or Syslinux or systemd-boot which can be configured to load files however you like without regard for the EFI System Partition or its desired folder structure. In the case of booting Linux systems via PXE (like ShredOS is) generally you need at least a kernel file and an initramfs file to load the OS. Sometimes you need other options too. In the case of ShredOS like I mention in a previous comment, you only need the kernel file - everything is self contained. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, |
Beta Was this translation helpful? Give feedback.
-
|
Netboot also has ShredOS integrated for a while now, so that might forfeit the need to set it all up from scratch for you. See https://github.com/netbootxyz/netboot.xyz |
Beta Was this translation helpful? Give feedback.
-
|
Re, I'm going to take the time to explain all, in a first time i got a problem with a path because when I install tftpd-hpa the path /srv/tftp/EFI doesn't exist! I can do only a mkdir? Not any other changes? I have an another problem, when i go in my server ( boot by network ) i have an access to the grub but he is not booting ShredOS so i continue to search solution! And a specification about my infra, my tftp server is my dhcp server too because i'm in a local network. So in dhcpd.conf i don't define where is the tftp server. |
Beta Was this translation helpful? Give feedback.
-
I'm assuming you are talking about the instructions in the original post? Even if ../EFI doesn't exist the However like @Firminator says there are easier ways like using netboot.xy. Depends what you goal is. I always planned on configuring shredos so that with changing a single configuration flag you could also have the ShredOS usb stick act as a PXE server, serving only ShredOS while simultaneously wiping the host. Just never got round to it and to be honest I'm not sure there is any demand for it. I quite liked the idea because I don't use PXE for anything else so personally for me it would be useful. It's a feature that doesn't add much to the size so it's not adding to the bloat. |
Beta Was this translation helpful? Give feedback.
-
|
Yes I speaking about the original post! |
Beta Was this translation helpful? Give feedback.
-
|
I don't understand everything and sorry that my english was not at the point and I start my studies on OS/networking. I know recursive copy and I use it np! I don't understand why you are talking about a stick for shredOS? I'll never want a stick, I have a hypervisor for taking all certificates, stock OS and in the futur the hypervisor will call Shred to reset the disk. |
Beta Was this translation helpful? Give feedback.
-
I'd need a lot more detail to diagnose this. Like seeing verbatim copies of the relevant config files. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, this is my conf file |
Beta Was this translation helpful? Give feedback.
-
|
@titielgozo If you are using the latest ShredOS you can ignore the line |
Beta Was this translation helpful? Give feedback.
-
|
It's done! But I'm not booting on any PXE server "Operating System Not Found". My 2 services work ( isci-dhcp-server and tftpd-hpa ) |
Beta Was this translation helpful? Give feedback.
-
Prerequisite
Overview
The purpose of this procedure is to setup a very simple PXE server that allows client hosts on the network to boot ShredOS in UEFI mode only (not legacy boot) using ShredOS's own bootx64.efi software.
For those not familiar with PXE that means ShredOS is hosted on the PXE server and the client PCs on the network pull ShredOS across the network and load it when PXE booting is selected on the client PCs. To maximise load speed, ideally a gigabit network port on the server, gigabit switch and gigibit client network port is preferable, although older network hardware will work fine, just slow.
Your network cable is important. Don't use some old cat5 cable like I did when making the video below, hence the 4MB/s speed, use cat5e or cat6 cable to achieve maximum speed on a gigabit network. However, having said that, no matter what network spec you have you may not achieve a boot speed of greater than 4MB/s due to a limitation in tftpd code. Redhat have applied a patch to their version of tftpd to improve the speed, but unfortunately I don't think it has been applied upstream. So if you are using Ubuntu you may find your boot speed is limited to 4MB/s. The only alternative is to either rebuild tftpd yourself applying redhats patches or just use redhat as your PXE server. I assume Fedora applies these patches too, but I don't know that for certain. Here's a thread that discussesTFTP Windowsize Option RFC 7440 with links to the patches and a discussion about updating tftp-hsa in Debian/Ubuntu.
The following configuration does not provide a boot menu where you can select different distros or multiple different versions of ShredOS. It boots straight into ShredOS.
I will create a separate discussion showing a similar procedure that uses syslinux or more likely grub2, as I prefer to retain the progress info during the kernel being loaded. Which ever method I go for it will provide a menu system and allows the user to select different distros or versions of ShredOS and boot in both UEFI & legacy.
Software Installation
Locate a suitable server PC, preferably with a Gigabit network connection to maximise boot speed. A raspberry PI4 would meet this spec.
Install ubuntu or a debian based OS.
First, setup the OS with a static IP address, it's assumed that once you have installed ubuntu, you disconnect the internet routers running DHCP servers on the network. This is done just to keep things as simple as possible for the purposes of this procedure.
Then, install the tftp and dhcpd software as follows:
/srv/tftpexists. It should do as it would have been created when you installed tftpd-hpa, however, if it doesn't exist, then create it as follows:Configure the tftp-hpa server software
Examine the contents of /etc/default/tftpd-hpa using
moreand make alterations so the file looks as follows:, note, the TFTP_DIRECTORY="/srv/tftp" path is the root where the contents of the ShredOS USB stick will get copied to later in the procedure. Make sure that path is as shown below. TFTP_ADDRESS=":69" is the network port address, if you have a firewall, port 69 needs to be open.Open port 69 in the firewall
Start the tftpd server
Setup configuration of the dhcp server
Comment out the following options:
hardware ethernet b8:ca:3a:84:eo:b9;Bind the dhcp server to a network port
alternatively use the command ip -a to view the network interfaces.
Copy the entire contents of a ShredOS USB stick into /src/tftp/, change /dev/sdx to whatever the correct drive name is for the USB stick. Alternatively use the desktop to mount and copy the USB stick.
Copy the latest bootx64.efi to /srv/tftp/EFI/BOOT/
Restart the tftp server
Start the dhcp server
That's it, check your client PC bios supports PXE booting and that PXE booting is enabled. Power cycle the PC you want to network boot, press whatever the shortcut keys is to bring up the boot menu. Select PXE V4 boot and you should see some text appear and a couple of seconds later the ShredOS progress info as the ShredOS kernel is loaded across the network. Then nwipe should appear. In the video below the text mentions NBP, just in case you were were wondering, it's stands for Network Boot Program which is EFI/BOOT/bootx64.efi in our case.
VID_20230623_195216.2.1.mp4
/etc/dhcp/dhcpd.conf in full
Beta Was this translation helpful? Give feedback.
All reactions