Security Configurations Supported by WAN Boot (Overview)
WAN boot supports varying levels of security. You can use a combination of
the security features that are supported in WAN boot to meet the
needs of your network. A more secure configuration requires more administration, but also protects
your system data to a greater extent. For more critical systems, or those
systems you want to install over a public network, you might choose the
configuration in Secure WAN Boot Installation Configuration. For less critical systems, or systems on semi-private networks, consider
the configuration that is described in Insecure WAN Boot Installation Configuration.
This section briefly describes the different configurations you can use to set the
level of security for your WAN boot installation. The section also describes the
security mechanisms that are required by these configurations.
Secure WAN Boot Installation Configuration
This configuration protects the integrity of the data exchanged between the server and
client, and helps keep the contents of the exchange confidential. This configuration uses
an HTTPS connection, and uses either the 3DES or AES algorithm to encrypt
the client configuration files. This configuration also requires the server to authenticate itself
to the client during the installation. A secure WAN boot installation requires the
following security features.
HTTPS enabled on the WAN boot server and the install server
HMAC SHA1 hashing key on the WAN boot server and the client
3DES or AES encryption key for the WAN boot server and the client
Digital certificate of a certificate authority for the WAN boot server
If you want to also require client authentication during the installation, you must
also use the following security features.
For a list of the tasks that are required to install with
this configuration, see Table 11-1.
Insecure WAN Boot Installation Configuration
This security configuration requires the least administration effort, but provides the least secure
transfer of data from the web server to the client. You do not
need to create a hashing key, encryption key, or digital certificates. You do
not need to configure your web server to use HTTPS. However, this configuration
transfers the installation data and files over an HTTP connection, which leaves your
installation vulnerable to interception over the network.
If you want the client to check the integrity of the data
that is transmitted, you can use a HMAC SHA1 hashing key with this
configuration. However, the Solaris Flash archive is not protected by the hashing key.
The archive is transferred insecurely between the server and the client during the
installation.
For a list of the tasks that are required to install with
this configuration, see Table 11-2.
