Remote Booting Using a Wireless Network Card?

Eboneye asks: "I have been assigned to a project to figure out how to make a diskless portable workstation (laptop) boot through a wireless connection. The idea is to have a stateless client that stores no local data (for security purposes). The only totally network boot stuff I have found uses PXE extensions. I have seen nothing like this in a PCMCIA card, much less a -wireless- PCMCIA card. For the proof of concept, we'll boot from a read only device, but of course during the setup phase use media to create a boot image on a boot server. I am currently looking at a couple different products that will provide a booting service. Ultimately, the goal is a to have a wireless tablet that can use different PCMCIA wireless adapters to connect to different LANs. Because of the specialized concerns of tablet PCs the solution has to be Windows compatible (sorry, Linux). Has anyone seen or worked on remote boot through wireless? Any experiences, gotchas, or suggestions for ways to solve this are welcome."

Comments

Don't bother

[duffbeer703]

You obviously haven't put enough thought into this.

A scheme like this, where you have to wait for a boot image to traverse a network, kinda defeats the purpose of tablet pcs.

If you are doing this for security, use applications that utilize strong encyrption. Playing games like this at the OS level is not the appropriate place to do this.

Serious security issues with 802.11b

[TheSHAD0W]

I strongly recommend you do NOT attempt this using the 802.11b protocol.

Let's assume you set up your wireless network PROPERLY; it has a gateway machine which restricts communications within your internal network, with that gateway being the only machine accessible to your wireless network. Your intent would be for your wireless machines to have nothing accessible, except to that gateway. Your remote machines would use an encrypted tunnel to log onto that gateway.

By remote-booting, you've destroyed that paradigm. A remotely-booting client would have no resources able to establish that encrypted tunnel, so you would not be able to boot through that gateway. Okay, fine, so let's say you put the boot image on the gateway machine outside the tunnel, or on a second server provided just for that purpose.

Now you have a brand new security hole... First off, an attacker doesn't need any security codes to grab a copy of your boot image; and that boot image, in order to establish your encrypted tunnels, would give the attacker, if not direct access to the gateway, at least valuable information narrowing down your security window. Having individual passwords users have to enter to log on might help things, but doesn't close the hole...

Since the link the booting PC would by definition be unencrypted, an attacker could spoof the wireless gateway for the period of time during when a wireless machine was booting, substituting a modified copy of the boot image. The result would be an insecure client, in which, if a password is entered, it could be forwarded to the attacker; or that machine might act as its own gateway, from the attacker through the insecure machine onto your network.