http://bugzilla.novell.com/show_bug.cgi?id=536309 User cyberorg@opensuse.org added comment http://bugzilla.novell.com/show_bug.cgi?id=536309#c1 Jigish Gohil changed: What |Removed |Added ---------------------------------------------------------------------------- Component|3rd party software |System Imaging AssignedTo|cyberorg@opensuse.org |ms@novell.com QAContact|opensuse-communityscreening |adrian@novell.com |@forge.provo.novell.com | --- Comment #1 from Jigish Gohil 2009-09-02 09:51:30 MDT --- This is for kiwi netboot image. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=536309 User cyberorg@opensuse.org added comment http://bugzilla.novell.com/show_bug.cgi?id=536309#c3 Jigish Gohil changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cyberorg@opensuse.org --- Comment #3 from Jigish Gohil 2009-09-02 10:01:49 MDT --- No, not kiwi-ltsp-bootimages, just kiwi-netboot image ;) kiwi-ltsp-bootimages package just contains prebuilt boot images created using kiwi-desc-netboot. https://build.opensuse.org/package/show?package=kiwi&project=Virtualization%3AAppliances -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=536309 User alexo.veto@gmail.com added comment http://bugzilla.novell.com/show_bug.cgi?id=536309#c7 Alex Savin changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #7 from Alex Savin 2009-09-03 03:54:16 MDT --- I add new variable, because change behavior for NBDROOT - make security risk: it allow user overwrite NBDROOT(in boot menu) and get any system(from Internet), with root access, in internal! network! NBDROOT_DEFAULT - it allow simply configure boot menu(pxelinux.cfg/default) for trusted network(with trusted user), or for network with no Internet access (and without nbd-server on clients computers) if you think it's not important - then all OK -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=536309 User alexo.veto@gmail.com added comment http://bugzilla.novell.com/show_bug.cgi?id=536309#c9 --- Comment #9 from Alex Savin 2009-09-03 07:31:45 MDT --- (In reply to comment #8)

hmm, a security risk... as far as I know we don't display a boot menu when booting via pxe, ??? /srv/tftpboot/message-ltsp and /srv/tftpboot/pxelinux.cfg/* it is boot menu files, and same organization can use it to run different OS (via pxe) in one workstation

but you are right someone could plugin the device into the network and boot from for example a USB stick and use the exported root filesystem. But if someone has physical access to plugin the network cable into a client of his choice he is in the network anyways because he will get an ip from DHCP then

is kiwi-ltsp used for public terminal?(in library, university, other...)? in this cases user can't access to network cable and bios(can't change boot device) - he can boot only that in pxelinux.cfg/* menu, and can add same boot option(such as NBDROOT) before NBDROOT was replaced by KIWI/config.*, but now user can use: NBDROOT="internet_IP;port" and run samething like BackTrack (http://www.remote-exploit.org/) and attack to internal network services -------------------------- I little change, my last post, sorry my ugly english (In reply to comment #7)

I add new variable, because change behavior for NBDROOT - make security risk: NEW BEHAVIOR OF NBDROOT allow user overwrite NBDROOT(in boot menu) and download any system(from Internet), with root access, in internal network!, EVEN IF ADMINISTRATOR DON'T WANT ALLOW IT

if administrator want allow overwrite NBDROOT, he need use NBDROOT_DEFAULT in KIWI/config.* -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=536309 User ms@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=536309#c11 Marcus Schaefer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED Info Provider|alexo.veto@gmail.com | Resolution| |FIXED --- Comment #11 from Marcus Schaefer 2009-09-10 16:21:04 MDT --- ok I changed my patch to allow cmdline line overwrites only if the variable ALLOW_CMDLINE_OVERWRITE=yes is set on config.<MAC> or config.default by default no overwrites are allowed which should add an acceptable level of security -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=536309 http://bugzilla.novell.com/show_bug.cgi?id=536309#c13 --- Comment #13 from Alex Savin 2010-01-07 19:46:18 UTC --- Example, "eval export $i" don't work: #------------------------------ NBDROOT="192.168.0.1;2001" if [ ! -z "$NBDROOT" ];then KLIST[0]="NBDROOT=$NBDROOT"; fi for i in ${KLIST[@]};do eval export $i done echo $NBDROOT this work: #------------------------------ NBDROOT="192.168.0.1;2001" if [ ! -z "$NBDROOT" ];then KLIST[0]="NBDROOT=$NBDROOT"; fi for i in ${KLIST[@]};do eval export \"$i\" done echo $NBDROOT -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=536309 https://bugzilla.novell.com/show_bug.cgi?id=536309#c16 Marcus Schaefer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #16 from Marcus Schaefer 2011-04-28 16:21:02 UTC --- that's ok I have added the patch thanks -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.