Re: [Devil-linux-develop] remote update

[Friedrich L. <fl...@fl...>]

Heiko Zuerker wrote on 08.02.2004 20:43 MET:
> Bruce Smith wrote:
> 
>>> I need to implement the option of remotely updating DL when it's on a 
>>> USB stick or something.
>>>
>>> So far I couldn't really decide how I want to do this, so it's 
>>> reliable and most of all secure.
>>>
>>> The update must be signed (pgp) and performed from within initrd, 
>>> that's the easy part.
>>>
>>> My original idea was to add the iso image as boot.cd.new to the root 
>>> of the media and then just check for it's existence, verify it, 
>>> rename it to bootcd.iso and continue.
>>
>>
>> So, the USB stick has to be large enough to hold TWO copies of the ISO?
> 
> 
> Yes correct.
> 
>>> The major problem is that it's easy to temper with the verification 
>>> of the signature, by replacing the initrd on the memory stick.
>>
>>
>>
>> You could put the sig on a secure location on the internet instead of on
>> the media.  But then initrd would need the network up.  :-(
> 
> 
> That's then still the same problem, since initrd would need to verify 
> itself,  which doesn't make much sense.

Then checking a signature of the iso does not make any sense either
if the initrd is tampered with. This seems to be a hen-and-egg problem.

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________