From owner-cvs-all Tue Dec 11 12:12:46 2001 Delivered-To: cvs-all@freebsd.org Received: from mail11.speakeasy.net (mail11.speakeasy.net [216.254.0.211]) by hub.freebsd.org (Postfix) with ESMTP id E84F537B419 for ; Tue, 11 Dec 2001 12:12:34 -0800 (PST) Received: (qmail 15587 invoked from network); 11 Dec 2001 20:12:33 -0000 Received: from unknown (HELO laptop.baldwin.cx) ([64.81.54.73]) (envelope-sender ) by mail11.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 11 Dec 2001 20:12:33 -0000 Message-ID: X-Mailer: XFMail 1.4.0 on FreeBSD X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <15382.26187.453320.35053@caddis.yogotech.com> Date: Tue, 11 Dec 2001 12:12:27 -0800 (PST) From: John Baldwin To: Nate Williams Subject: Re: cvs commit: src/sys/boot/i386/loader version src/share/examp Cc: Mike Barcroft , Mike Silbersack , Alfred Perlstein , mini@haikugeek.com, cvs-all@FreeBSD.org, cvs-committers@FreeBSD.org, Wilko Bulte , Paul Richards Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On 11-Dec-01 Nate Williams wrote: >> It has that, but it's simple. You didn't read my earlier message though >> where >> I detailed what we _did_ do for my lab at school. We didn't use the loader >> at >> all, instead we hacked (it was a small hack, and an #ifdef for it could be >> made) boot2 to not accept user input and to boot the kernel directly. > > FWIW, this is what I did when I setup a lab full of insecure PC's. I > simply created a custom boot loader that ignored user input. > > This was the best way I could think of to make the boxes secure. (That > and forcing the box to boot from hard-disk first.) > > Since I knew the password, I could change the boot order, then stick in > a floppy to do recovery. Yes, it was a pain, but security doesn't come > w/out costs. Yep, exactly what we did. It's a very simple change to boot2 and I could make it configurable so that one did 'make -DBOOT_BOOT2_SECURE BOOT_BOOT2_KERNEL="/boot/kernel/kernel"' to make boot2 not accept user input and load /boot/kernel/kernel instead of /boot/loader if desired. > Nate -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve!" - http://www.FreeBSD.org/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message