opsi Version 3.3.1 - opsi Download - uib

9.5. Boot files
9. opsi data storage (backend)
'/tftpboot/linux' contains the boot files needed for the system start with the PXE-
Bootproms.
9.6.
Securing the shares with encrypted passwords
The installation software 'opsi preLoginLoader' accesses the shares provided by the
depot server in order to install software and to write configuration information and log
files. This is done with the privileges of the system user 'pcpatch'. Securing these
shares and therefore the authentification data of 'pcpatch' is important for two reasons:
● general system security and data integrity
● meet the license agreements of special software packets
To give the client task 'preLoginLoader' access to authentication data, the server task
'reInstallationManager' creates a specific key when preparing a client re-installation
request. This key is stored in the file '/etc/pckeys' and is passed to the PC with the
reinstallation request. The client PC will store this key in the local file
'c:\opsi\cfg\locked.cfg' during system installation (access rights limited to the
administrators). Also, on the server, the file '/etc/pckeys' is only accessible by user root.
This way every PC has got an unique key only known to the client itself and the depot
server, not accessible by client standard users. The key is used to encrypt the password
of the user 'pcpatch'. The encrypted password will be transferred to the client at boot
time via webservice. Hence the servers 'pcpatch' password can be changed any time.
The new encrypted password will be sent to every client at the next reboot.
123