From: Alexander Tereschenko <aleksandr.v.tereschenko@linux.intel.com>
To: openbmc@lists.ozlabs.org
Subject: Re: BMC update via TFTP
Date: Mon, 9 Dec 2019 17:06:48 +0100 [thread overview]
Message-ID: <f6254181-64e8-e923-8d60-9f7632a899e5@linux.intel.com> (raw)
In-Reply-To: <d6b4685e-5834-7bfb-609e-c53159a54176@linux.ibm.com>
On 06-Dec-19 23:52, Joseph Reynolds wrote:
> I was thinking along the lines of adding [SFTP][] (or SCP) support and
> then migrating existing TFTP users to the new secure solution.
>
> That is, the BMC admin performing [code update][] can currently get a
> firmware image via POST DownloadViaTFTP to URI
> /xyz/openbmc_project/software.
> My idea is to offer a DownloadViaSFTP method (or preferably a Redfish
> API) for this. Note that the TFTP download is disabled by default per
> [bmcweb config][].
>
> Once OpenBMC supports downloading firmware via SFTP, we can encourage
> our users to set up their SFTP servers and take down their TFTP
> servers. I realize that sounds easy, but I don't have a feeling how
> difficult that would be in practice.
>
> Does that sound feasible?
>
> - Joseph
>
> [SFTP]: https://man.openbsd.org/sftp-server
> [code update]:
> https://github.com/openbmc/docs/blob/master/code-update/code-update.md
> [bmcweb config]:
> https://github.com/openbmc/bmcweb/blob/41d1d1833f476766f88cfb624e66eef7906bdf8c/CMakeLists.txt#L98
Yes, that could be a solution for the problem we discuss, providing both
integrity and confidentiality, without any major OpenBMC development
necessary - but it would mean more operational burden for BMC admins.
The problem with SCP/SFTP in this context is that for this to work in
the same manner as TFTP, the BMC must be an SSH client - i.e. have some
sort of identity/credentials for the SCP/SFTP server provisioned first.
That might not be the easiest solution to setup, but it's of course
possible and can be automated if OpenBMC provides respective config knobs.
Existing ways we have in code-update.md either don't require credentials
(TFTP), so being a client is easy, or are not making a "client" from
BMC, it's the admin who uploads stuff (SCP/REST).
regards,
Alexander
next prev parent reply other threads:[~2019-12-09 16:06 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-03 12:02 BMC update via TFTP rgrs
2019-12-03 16:12 ` Gunnar Mills
2019-12-03 17:08 ` Gunnar Mills
2019-12-03 19:55 ` Adriana Kobylak
2019-12-04 15:47 ` Joseph Reynolds
2019-12-04 21:36 ` Vernon Mauery
2019-12-05 11:05 ` Alexander Tereschenko
2019-12-05 22:37 ` Vernon Mauery
2019-12-06 14:03 ` Alexander Tereschenko
2019-12-06 22:52 ` Joseph Reynolds
2019-12-09 16:06 ` Alexander Tereschenko [this message]
2019-12-10 1:25 ` Joseph Reynolds
2019-12-10 18:58 ` [EXTERNAL] " Neeraj Ladkani
2019-12-10 21:10 ` Joseph Reynolds
2019-12-11 4:56 ` Bonnie Lo/WYHQ/Wiwynn
2019-12-11 5:59 ` Lei YU
2019-12-11 21:51 ` Milton Miller II
2019-12-11 11:02 ` Alexander Tereschenko
2019-12-11 20:17 ` Joseph Reynolds
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f6254181-64e8-e923-8d60-9f7632a899e5@linux.intel.com \
--to=aleksandr.v.tereschenko@linux.intel.com \
--cc=openbmc@lists.ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.