That shouldn't be a compliance issue in an isolated factory area anyway however to please the compliance nazis... It's a non-secure protocol but the stuff being transferred isn't controlled data. It's just chunks of the imaging software and OS kernel needed to boot the PC, which are freely available outside of your organisation anyway.
In terms of the actual hard drive image which could contains controlled data, this can be encrypted when you create it and will only be decrypted on the client PC as it's imaging.
So you could argue that the stream is encrypted at the application level rather than the protocol level.
Our enviroment is in retail stores, and the devices being imaged are POS devices. The O/S is standard (XP POS Ready), but the application is company specific.
Is it possible to encrypt .gho images, and then use the ghost.exe to decrypt it once it's downloaded it to the device? I've had a quick google of this and not found much.
I don't use anything which is in a full always active setup but I have software on my laptop I used to PXE boot machines for cloning. Basically:
1) Laptop into network at the site i'm at
2) software setup to boot a bootable CD image I've created (which contains ghost and my server mappings for the .gho images etc)
3) set device (i.e. tabletPC with no cdrom etc) to book from PXE, it finds PXE server running on my laptop, boots to PXE and loads the bootable CD image. Then I just select the image I want from the drive mappings and away it goes.
Not a great system but works well when faced with a bunch of tabletPC's with no CD.
Normally day to day, I just use a bootable CD with the drivers on I need, running Ghostcast Server on a Server 2008 box which hosts the images.
Yes, we use something similar for when our technitions are onsite. Unfortunately it is not them that re-image the devices, it is normally store staff who are not IT trained or savvy. Our current solution:
- Staff call to make bootable floppy disk
- Staff takes disk to device, and reboots it
- Disk loads DOS, network driver, net, etc and maps a drive to a server hosting the image
- ghost.exe is then called to grab the image, pull it down, extract it and reboot the device
- Device is then configured (IP, device name, company specific config, etc) using a bespoke configuration tool
The problem is, floppy disks are a tiresome unreliable media which can be lost, changed, etc. I spend far too much time supporting that and I want to move on to using DHCP.
The problem is challenges I've received regarding security and PCI regulations:
- TFTP is not secure (So I'd need another method of downloading the boot disk image, can you use SFTP for this?)
- DHCP is not a supported/secure protocol (I've got around this by saying it will only be running when a device is being imaged and then stopped)
I'm stuggling to find an alternative to TFTP or PXE in general. Any suggestions?
