Free your NetBoot server with. BSDPy NetBooting without OS X

Transcription

1 Free your NetBoot server with BSDPy NetBooting without OS X

2 Pepijn Bruienne University of github.com/bruienne! hub.docker.com/u/bruienne

3 Introduction

4 About Me Pepijn Bruienne Mac Dev and Ops Specialist at University of Michigan Munki and home-brew management tools (Izzy) Docker in production 5,000+ users and growing - worldwide No OS X Server - All Linux

5 About Me BSDPy - OSS NetBoot server AutoNBI - CLI NetBoot image creation Member of Docker Hub Mac Admins team: hub.docker.com/repos/ macadmins Docker evangelist (check out DockerCon 2015 videos here: youtube.com/user/dockerrun)

6 Overview NetBoot - why should I care? NetBoot - how does it work? No, really - how does it work? BSDPy - why bother? BSDPy in practice Q & A

7 NetBoot - why should I care? Apple has maintained NetBoot as a technology since 1999 and has been compatible with MacOS 8, 9 and OS X through its lifespan. It allows several different modes of operation: NetBoot - boot a full OS over the network (optionally diskless) NetInstall - boot over the network and install software NetRestore - boot over the network and deploy a disk image

8 NetBoot - why should I care? Typical use in contemporary Mac environment revolves around NetInstall where clients boot a lean OS and client to perform disk operations or to bootstrap a management client as part of the complete machine lifecycle. Some examples of this are: DeployStudio - full-featured imaging tool (thick, thin, zero) - Closed source Imagr - lean imaging tool (thick, thin, zero) - Open source Casper Imaging - full-featured imaging tool to prep clients for use with JAMF Casper (uses NetBoot) - Commercial

9 NetBoot - why should I care? Even if your organization's motto is "Imaging is dead" you can still benefit from NetInstall by using one of the available tools to bootstrap new equipment for your management suite. But-but! DEP! MDM!! As DEP and MDM become more common and access to tools to leverage them are more diverse the use for NetBoot as a technology could shift more to the repair and reload/repurpose stages of a Mac's lifecycle. Options are good.

10 NetBoot - how does it work?

11 NetBoot - how does it work? Leverages DHCP/BOOTP for discovery Lowest common denominator in most network environments Specific DHCP option makes the Apple magic happen (RFC 3925, Vendor class options) tools.ietf.org/html/rfc3925 Vendor class options have generic option code, length and data capabilities, each vendor implements as needed Apple has docs! bootp/bootp-170/documentation/bsdp.doc

12 NetBoot/BSDP - how does it work? After DHCP and BSDP discovery the client has all required information to boot and it: ➀ ➁ ➂ ➃ Requests Mach kernel (booter) over TFTP Request kernelcache/com.apple.boot.plist over TFTP Requests OS DMG over HTTP or NFS Optionally mounts shadow file or user home over AFP

13 No, really - how does it work? Apple keeps uncharacteristically detailed documentation of BSDP on their Open Source portal. Even with the document in hand BSDP is eerily close to a hotdog manufacturing facility. To learn about it, we must go deeper. /giphy inception

14 BSDP - a deep dive A typical BSDP exchange from start to finish looks like this: Client Server BSDP INFORM[LIST] -> <- BSDP ACK[LIST] BSDP INFORM[SELECT] -> <- BSDP ACK[SELECT] TFTP READ -> <- TFTP Data Block 0 TFTP ACK Block 0 -> (...)

15 BSDP INFORM LIST highlights DHCP Option 53 (Message Type) 8 (INFORM) DHCP Option 60 (Vendor Class Identifier) "AAPLBSDPC/ i386/imac12,1" DHCP Option 43 (Vendor-specific Information): BSDP Code 1 (BSDP Message Type) - 1 (LIST)

16 BSDP ACK LIST highlights DHCP Option 53 (Message Type) 5 (ACK) DHCP Option 60 (Vendor Class Identifier) "AAPLBSDPC" DHCP Option 43 (Vendor-specific Information): BSDP Code 1 (BSDP Message Type) - 1 (LIST) BSDP Code 4 (Server Priority) BSDP Code 7 (Default Image ID) BSDP Code 9 (Boot Image List) - Variable

17 BSDP INFORM SELECT highlights DHCP Option 53 (Message Type) 8 (INFORM) DHCP Option 60 (Vendor Class Identifier) "AAPLBSDPC/ i386/imac12,1" DHCP Option 43 (Vendor-specific Information): BSDP Code 1 (BSDP Message Type) - 2 (SELECT) BSDP Code 8 (Selected Boot Image ID)

18 BSDP ACK SELECT highlights DHCP sname - IP or hostname of server DHCP file - name of booter file DHCP Option 53 (Message Type) 5 (ACK) DHCP Option 60 (Vendor Class Identifier) "AAPLBSDPC" DHCP Option 43 (Vendor-specific Information): BSDP Code 1 (BSDP Message Type) - 2 (SELECT) BSDP Code 8 (Selected Boot Image ID)

19 BSDP - a deep dive Had enough? dd1000c292c be0a0002ca0a fdeff f d a a0002ca dd e f6f74 2e e636f6d f6e62692f 4e492e6e62692f f626f6f

20 Whoa.

21 BSDPy - why bother? BSDPy began like any other piece of code I had written before: "I wonder if I could...?" Here, I wondered if given Apple's documentation I could write enough Python code to "fool" an OS X client into thinking it was talking to a legitimate NetBoot server.

22 BSDPy - why bother? As I figured out how to add more parts of the Apple BSDP specs to my code I realized I might actually be able to retire the last remaining production Mac "servers" we had in use.

23 I know BSDP

24 BSDPy - why bother? After a few more weeks I had a functional BSDP server that was able to serve client requests. I showed others and asked for feedback. I used feedback from awesome fellow Mac Admins to fix bugs, add features and further improve my code. I also gave it a name - BSDPy. Project page is here: bitbucket.org/bruienne/bsdpy

25 BSDPy Basic Features Serve NetInstall images (NetBoot w/ shadow considered) Serve standalone from a single host Filter images by system identifier (MacBookPro8,1) Filter images by MAC address (00:11:22:33:44:55) Set a server priority (Client picks server with higher priority)

26 BSDPy Advanced Features Serve BSDP, TFTP and HTTP/NFS from separate hosts Serve HTTP/NFS from dedicated file server(s) Connect to an API to determine client entitlements Runs on most Linux distros and Windows (beta feature)

27 Advanced Features Explained Serve from separate hosts NetBoot server listens on local subnet TFTP and HTTP/NFS services on a separate dedicated host Useful if IP Helpers are impossible: have dedicated BSDPy instances on each subnet

28 Advanced Features Explained Dedicated HTTP/NFS file server(s) NetBoot server(s) point clients to dedicated file server Dedicated file server can be a single host or clustered/loadbalanced Useful if an existing load-balanced file cluster exists - must use HTTP

29 Advanced Features Explained API-based entitlement checking During BSDP LIST phase BSDPy queries an API using IP address, MAC address and Model ID (imac12,1) API determines which image(s) the client is entitled to, sends back list. List includes URLs to TFTP and HTTP/NFS servers. Useful to create location-specific or model-specific restrictions not possible with Apple's OS X Server. Point client to local TFTP/HTTP/NFS server based on IP.

30 Advanced Features Explained Runs on Linux and Windows hosts Any Linux with Python 2.7 is compatible Windows Server support in beta, thanks Marnin Goldberg! Generates randomized server priority to allow compatible NetBoot clustering

31 BSDPy in practice Docker is the recommended deployment method: hub.docker.com/u/bruienne/bsdpy/ Puppet module available courtesy of Sam Keeley: github.com/ keeleysam/puppet-bsdpy Windows deployment documentation available soon, contact me for details Available ports 67 (BSDP), 69 (TFTP), 80 (HTTP) or 111/2049 (NFS)

32 Running BSDPy Run with Docker $ docker run -d -p 67:67/udp -v /nbi:/nbi --name bsdpy bruienne/bsdpy:1.0 $ docker run -d -p 69:69/udp --volumes-from bsdpy --name tftpd macadmins/tftpd $ docker run -d -p 80:80 -v /nbi:/usr/share/nginx/html:ro --name httpd nginx Run directly from Linux $ systemctl start httpd # Or your preferred distro and HTTPD $ systemctl start tftpd # Or your preferred distro and TFTPD $ $ git clone -b api bsdpy $ cd bsdpy $ python bsdp-server.py -p /nbi -r http -i eth0

33 Running BSDPy DEBUG: BSDPY_IP: DEBUG: BSDPY_NBI_PATH: /nbi DEBUG: BSDPY_IFACE: eth0 DEBUG: BSDPY_PROTO: http DEBUG: BSDPY_NBI_URL: DEBUG: [========= Updating boot images list =========] DEBUG: Considering NBI source at /nbi/109-13e28.nbi DEBUG: /nbi/109-13e28.nbi DEBUG: [========= End updated list =========] DEBUG: [===== Using the following boot images =======] DEBUG: /nbi/109-13e28.nbi DEBUG: [====== End boot image listing ======] DEBUG: -=============================================- <snip for client LIST and SELECT requests> DEBUG: Resolving BSDPY_NBI_URL to IP - mynbirepo.org -> DEBUG: Found BSDPY_NBI_URL - using basedmgpath DEBUG: -========================================================================- DEBUG: Return ACK[SELECT] to 3c:1:de:ad:be:ef on port 68 DEBUG: --> TFTP URI: tftp:// /nbi/109-13e28.nbi/i386/booter DEBUG: --> Boot Image URI:

34 Running BSDPy Setting additional options - Environment variables $BSDPY_IFACE - Interface to listen on $BSDPY_IP - IP address to advertise to clients $BSDPY_PROTO - Use HTTP or NFS to transfer DMG $BSDPY_NBI_PATH - Look for NBIs at this local path $BSDPY_NBI_URL - Base HTTP URL to load DMGs from $BSDPY_API_URL - API endpoint to determine NBI entitlement $BSDPY_API_KEY - Optional API key to access API

35 API request At launch BSDPy sends: - all Boolean - List of all available images For each new client request it sends: - ip_address - String - mac_address - String - model_name - String Returns JSON dict(s) of images the client is entitled to.

36 API response JSON reply should: Array of dicts named images with keys: name - Name of the image shown on client booter_url - Absolute TFTP path to booted (kernel) root_dmg_url - Valid complete URL to NetInstall.dmg priority - Image ID ( or )

37

38 API Caching side-note In large environments (like mine) the volume of client requests may generate a lot of API queries. To handle that kind of volume better BSDPy will automatically use a linked Redis instance when run from Docker to cache requests. Linked Redis instance should be setup with --link redis:db where "redis" is the name of the running Redis service and "DB" the name it has to BSDPy. enterprisemac.bruienne.com/2015/06/03/bsdpy-redis-caching

39 Who is using it? Small animation studio in Glendale, CA - Linux ~100 clients Global service contractor - ~10k clients by year end Cloud DTP vendor - 7 BSDPy servers, ~1,000 lab clients Enterprise logging vendor - 3 BSDPy servers, ~100 clients NSW, Australia Dept. of Education - 2,200(!) BSDPy servers Whitby School, Greenwich, CT Rutgers University, New Brunswick, NJ

40 BSDPy in practice Simple single-host example Clients discover via DHCP Optional redirect by IP helper BSDP server serves TFTP and HTTP Client requests files from same server

41 BSDPy in practice Two-host example Clients discover via DHCP Optional redirect by IP helper BSDP server points sname Get booter from BSDP host Get OS image from Nginx host

42 BSDPy in practice API example Clients discover via DHCP Optional redirect by IP helper BSDPy queries API API knows IP-range grouping API redirects client to a local file server

43 Common pitfalls Subnets separating server and clients - use IP Helpers Outbound or inbound firewalling Needs ports 67 UDP, 69 UDP, 80 TCP or 110/2049 UDP/TCP TFTP can be slow, optimize TFTP block size (1468) Older EFI may need extra coaxing (press N at boot selector) Newer EFI gives up BSDP queries quickly with slow DHCP

44 Demo? $./do_demo.sh

45 How to get support File an issue on Bitbucket: bitbucket.org/bruienne/bsdpy Come find me on IRC - ##osx-server on Freenode Find me on Twitter (pithiness encouraged) me - bruienne@gmail.com

46 How to contribute Open a pull request on Bitbucket: bitbucket.org/bruienne/bsdpy Test BSDPy in an environment I can't replicate Find bugs! Report bugs! Get bacon! File/support feature request with $vendor to integrate

47 Q&A Thank you! bitbucket.org/bruienne/bsdpy hub.docker.com/u/bruienne/bsdpy/