15 Setting up a UEFI HTTP Boot server #

Before setting up the DHCP servers, specify the network interface for them in /etc/sysconfig/dhcpd:

DHCPD_INTERFACE="eth0"
DHCPD6_INTERFACE="eth0"

This way, the DHCP servers provide the service on the eth0 interface only.

To set up a DHCPv4 server for both PXE Boot and HTTP Boot, add the following configuration to the /etc/dhcpd.conf file:

option domain-name-servers 192.168.111.1;
option routers 192.168.111.1;
default-lease-time 14400;
ddns-update-style none;
class "pxeclients" {
  match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
  option vendor-class-identifier "PXEClient";
  next-server 192.168.111.1;
  filename "/bootx64.efi";
}
class "httpclients" {
  match if substring (option vendor-class-identifier, 0, 10) = "HTTPClient";
  option vendor-class-identifier "HTTPClient";
  filename "http://www.httpboot.local/sle/EFI/BOOT/bootx64.efi";
}
subnet 192.168.111.0 netmask 255.255.255.0 {
  range dynamic-bootp 192.168.111.100 192.168.111.120;
  default-lease-time 14400;
  max-lease-time 172800;
}

Note that the DHCPv4 server must use the HTTPClient parameter for the vendor class ID, as the client uses it to identify an HTTP Boot offer.

Start the DHCP daemon:

systemctl start dhcpd

To set up the DHCPv6 server, add the following configuration to /etc/dhcpd6.conf:

option dhcp6.bootfile-url code 59 = string;
option dhcp6.vendor-class code 16 = {integer 32, integer 16, string};
subnet6 2001:db8:f00f:cafe::/64 {
        range6 2001:db8:f00f:cafe::42:10 2001:db8:f00f:cafe::42:99;
        option dhcp6.bootfile-url "http://www.httpboot.local/sle/EFI/BOOT/bootx64.efi";
        option dhcp6.name-servers 2001:db8:f00f:cafe::1;
        option dhcp6.vendor-class 0 10 "HTTPClient";
}

This configuration defines the type of the boot URL, the vendor class, and other required options. Similar to the DHCPv4 settings, it is necessary to provide the boot URL, which must have an IPv6 address. It is also necessary to specify the vendor class option. In DHCPv6, it consists of the enterprise number and the vendor class data (length and the content). Since the HTTP Boot driver ignores the enterprise number, you can set it to 0. The content of the vendor class data needs to be HTTPClient; otherwise, the client ignores the offer.

The older HTTP Boot implementation, which does not follow RFC 3315, requires a different configuration:

option dhcp6.bootfile-url code 59 = string;
option dhcp6.vendor-class code 16 = string;
        subnet6 2001:db8:f00f:cafe::/64 {
        range6 2001:db8:f00f:cafe::42:10 2001:db8:f00f:cafe::42:99;
        option dhcp6.bootfile-url "http://www.httpboot.local/sle/EFI/BOOT/bootx64.efi;
	option dhcp6.name-servers 2001:db8:f00f:cafe::1;
	option dhcp6.vendor-class "HTTPClient";
}

Start the dhcpv6 daemon.

systemctl start dhcpd6

option dhcp6.bootfile-url code 59 = string;
option dhcp6.vendor-class code 16 = {integer 32, integer 16, string};

subnet6 2001:db8:f00f:cafe::/64 {
        range6 2001:db8:f00f:cafe::42:10 2001:db8:f00f:cafe::42:99;

        class "PXEClient" {
	        match substring (option dhcp6.vendor-class, 6, 9);
	}

        subclass "PXEClient" "PXEClient" {
	        option dhcp6.bootfile-url "tftp://[2001:db8:f00f:cafe::1]/bootloader.efi";
	}

	class "HTTPClient" {
	        match substring (option dhcp6.vendor-class, 6, 10);
	}

	subclass "HTTPClient" "HTTPClient" {
	        option dhcp6.bootfile-url "http://www.httpboot.local/sle/EFI/BOOT/bootx64.efi";
		option dhcp6.name-servers 2001:db8:f00f:cafe::1;
		option dhcp6.vendor-class 0 10 "HTTPClient";
	}
}

class "HTTPClient" {
        match substring (option dhcp6.vendor-class, 6, 21);
	}

subclass "HTTPClient" "HTTPClient:Arch:00016" {
        option dhcp6.bootfile-url "http://www.httpboot.local/sle/EFI/BOOT/bootx64.efi";
	option dhcp6.name-servers 2001:db8:f00f:cafe::1;
	option dhcp6.vendor-class 0 10 "HTTPClient";
}

To provide support for both PXE Boot and HTTP Boot, deploy a TFTP server. Install the tftp and start the service:

 systemctl start tftp.socket
systemctl start tftp.service

It is also necessary to install a specific tftpboot-installation package for use with PXE Boot. Run the zypper se tftpboot command, to list of the available tftp-installation packages, then install the package for the desired system version and architecture, for example tftpboot-installation-SLE-15-SP3-x86_64 For example, tftpboot-installation-SLE-VERSION-x86_64 (replace VERSION with the actual version). Copy the content of the SLE-VERSION-x86_64 directory to the root directory of the TFTP server:

cp -r /usr/share/tftpboot-installation/SLE-VERSION-x86_64 /srv/tftpboot

For more information, refer to /usr/share/tftpboot-installation/SLE-VERSION-x86_64/README

Create the sle/ directory under the /srv/www/htdocs/ directory and copy the entire content of the first system ISO image to the /srv/www/htdocs/sle/ directory. Then edit the /srv/www/htdocs/sle/EFI/BOOT/grub.cfg file. Use the following example as a reference:

timeout=60
default=1

menuentry 'Installation IPv4' --class opensuse --class gnu-linux --class gnu --class os {
    set gfxpayload=keep
    echo 'Loading kernel ...'
    linux /sle/boot/x86_64/loader/linux install=http://www.httpboot.local/sle
    echo 'Loading initial ramdisk ...'
    initrd /sle/boot/x86_64/loader/initrd
}

menuentry 'Installation IPv6' --class opensuse --class gnu-linux --class gnu --class os {
    set gfxpayload=keep
    echo 'Loading kernel ...'
    linux /sle/boot/x86_64/loader/linux install=install=http://www.httpboot.local/sle ipv6only=1 ifcfg=*=dhcp6,DHCLIENT6_MODE=managed
    echo 'Loading initial ramdisk ...'
    initrd /sle/boot/x86_64/loader/initrd
}

##
## Use IPv6?
##
#server.use-ipv6 = "enable"
$SERVER["socket"] == "[::]:80" {  }

systemctl start lighttpd

systemctl start apache2

To use the HTTPS Boot, you need to convert an existing server certificate into the DER format and enroll it into the client's firmware.

Assuming you already have a certificate installed on your server, convert it into the DER format for use with the client using the following command:

openssl x509 -in CERTIFICATE.crt -outform der -out CERTIFICATE.der

cat CERTIFICATE.crt server.key > CERTIFICATE.pem

cp server-almighty.pem /etc/ssl/private/
chown -R root:lighttpd /etc/ssl/private/server-almighty.pem
chmod 640 /etc/ssl/private/server-almighty.pem

server.modules = (
  "mod_access",
  "mod_openssl",
)

# IPv4
$SERVER["socket"] == ":443" {
    ssl.engine                 = "enable"
    ssl.pemfile                = "/etc/ssl/private/server-almighty.pem"
}
# IPv6
$SERVER["socket"] == "[::]:443" {
    ssl.engine                 = "enable"
    ssl.pemfile                = "/etc/ssl/private/server-almighty.pem"
}

systemctl restart lighttpd

APACHE_SERVER_FLAGS="SSL"

cp server.key /etc/apache2/ssl.key/
chown wwwrun /etc/apache2/ssl.key/server.key
chmod 600 /etc/apache2/ssl.key/server.key
cp server.crt /etc/apache2/ssl.crt/

cd /etc/apache2/vhosts.d
cp vhost-ssl.template vhost-ssl.conf

SSLCertificateFile /etc/apache2/ssl.crt/server.crt
 SSLCertificateKeyFile /etc/apache2/ssl.key/server.key

systemctl restart apache2

systemctl restart dhcpd
systemctl restart dhcpd6