Boot menu: Secure Boot check for WinPE, Blancco through the shim; tracked as a file
Live since 2026-10-14 for every client (all UEFI clients now run iPXE 2.0):
- WinPE skips the 'Secure Boot must be ENABLED' warning and its 5 s wait
when iPXE reads Secure Boot as on (${efi/SecureBoot:uint8}); otherwise,
or on an iPXE that cannot read it, it warns as before.
- Blancco and Blancco debug start through Ubuntu's shim (iPXE shim
command), so they run with Secure Boot on; an iPXE without the command
boots the kernel directly as before. The separate Secure Boot TEST entry
is gone.
- Blancco has its own menu section; only Clonezilla and Memtest stay under
'Secure Boot must be DISABLED'.
The playbook now installs playbook/ipxe/GetPxeScript.aspx instead of an
inline copy that had drifted from the live menu. Checked that the Blancco
Releases page still parses it (one item blancco, :blancco_efi block).
This commit is contained in:
cproudlock
115
playbook/ipxe/GetPxeScript.aspx
Normal file
115
playbook/ipxe/GetPxeScript.aspx
Normal file
@@ -0,0 +1,115 @@
|
||||
#!ipxe
|
||||
|
||||
set server 172.16.9.1
|
||||
|
||||
:menu
|
||||
menu GE Aerospace PXE Boot Menu
|
||||
item --gap -- ---- Windows Deployment ----
|
||||
item winpe Windows PE (Image Deployment)
|
||||
item --gap -- ---- Drive Erase ----
|
||||
item blancco Blancco Drive Eraser
|
||||
item blancco_debug Blancco Drive Eraser (debug / SSH)
|
||||
item --gap -- ---- Utilities (Secure Boot must be DISABLED) ----
|
||||
item clonezilla Clonezilla Live (Disk Imaging)
|
||||
item memtest Memtest86+ (Memory Diagnostics)
|
||||
item --gap -- ----
|
||||
item reboot Reboot
|
||||
item exit Exit to BIOS
|
||||
choose --default winpe --timeout 30000 target && goto ${target}
|
||||
|
||||
:winpe
|
||||
# iPXE 2.0 reads the firmware variable; older iPXE cannot (empty), so it
|
||||
# warns as before. Secure Boot confirmed on: no warning, no wait.
|
||||
iseq ${efi/SecureBoot:uint8} 1 && goto winpe_boot ||
|
||||
echo
|
||||
echo Secure Boot is OFF on this PC (or this iPXE cannot tell).
|
||||
echo Windows deployment requires Secure Boot to be ENABLED.
|
||||
echo If you disabled it for Clonezilla/Memtest, re-enable it now.
|
||||
echo
|
||||
prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot
|
||||
|
||||
:winpe_boot
|
||||
kernel http://${server}/win11/wimboot gui
|
||||
initrd http://${server}/win11/EFI/Microsoft/Boot/boot.stl EFI/Microsoft/Boot/Boot.stl
|
||||
initrd http://${server}/win11/EFI/Microsoft/Boot/BCD EFI/Microsoft/Boot/BCD
|
||||
initrd http://${server}/win11/EFI/Boot/bootx64.efi EFI/Boot/bootx64.efi
|
||||
initrd http://${server}/win11/Boot/boot.sdi Boot/boot.sdi
|
||||
initrd http://${server}/win11/sources/boot.wim sources/boot.wim
|
||||
boot
|
||||
|
||||
:clonezilla
|
||||
set base http://${server}/clonezilla
|
||||
kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
|
||||
initrd ${base}/initrd.img
|
||||
boot
|
||||
|
||||
:blancco
|
||||
iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi
|
||||
|
||||
:blancco_bios
|
||||
echo Loading Blancco for legacy BIOS (canonical)...
|
||||
kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img quiet loglevel=3 archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed
|
||||
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed
|
||||
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed
|
||||
initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed
|
||||
initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed
|
||||
boot
|
||||
:blancco_bios_failed
|
||||
echo
|
||||
echo Blancco BIOS boot FAILED.
|
||||
prompt Press any key to return to menu... && goto menu
|
||||
|
||||
:blancco_debug
|
||||
iseq ${platform} pcbios && goto blancco_bios ||
|
||||
echo Loading Blancco UEFI (debug: verbose, SSH for root)...
|
||||
kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle blancco.debug=1 || goto blancco_efi_grub
|
||||
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
|
||||
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
|
||||
initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub
|
||||
# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through
|
||||
# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the
|
||||
# line fails harmlessly and the kernel boots directly (Secure Boot off).
|
||||
shim http://${server}/blancco/shimx64.efi ||
|
||||
boot || goto blancco_efi_grub
|
||||
|
||||
:blancco_efi
|
||||
echo Loading Blancco UEFI (direct kernel)...
|
||||
kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp quiet loglevel=3 nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub
|
||||
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
|
||||
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
|
||||
initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub
|
||||
# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through
|
||||
# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the
|
||||
# line fails harmlessly and the kernel boots directly (Secure Boot off).
|
||||
shim http://${server}/blancco/shimx64.efi ||
|
||||
boot || goto blancco_efi_grub
|
||||
:blancco_efi_grub
|
||||
echo Direct kernel boot failed - trying GRUB chain fallback...
|
||||
chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
|
||||
|
||||
:memtest
|
||||
kernel http://${server}/memtest/memtest.efi || goto secureboot_warn
|
||||
boot
|
||||
|
||||
:secureboot_warn
|
||||
echo
|
||||
echo ======================================================
|
||||
echo This option requires Secure Boot to be DISABLED.
|
||||
echo
|
||||
echo 1. Reboot this machine
|
||||
echo 2. Press F2 / Del to enter BIOS Setup
|
||||
echo 3. Disable Secure Boot
|
||||
echo 4. Save and exit BIOS
|
||||
echo 5. PXE boot again and select this option
|
||||
echo
|
||||
echo Re-enable Secure Boot after completing the task.
|
||||
echo ======================================================
|
||||
echo
|
||||
prompt Press any key to return to menu...
|
||||
goto menu
|
||||
|
||||
:reboot
|
||||
reboot
|
||||
|
||||
:exit
|
||||
exit
|
||||
@@ -241,103 +241,18 @@
|
||||
- blancco
|
||||
- memtest
|
||||
|
||||
- name: "Create GetPxeScript.aspx (iPXE boot menu)"
|
||||
- name: "Install GetPxeScript.aspx (iPXE boot menu)"
|
||||
# The live menu, tracked as a file (playbook/ipxe/GetPxeScript.aspx).
|
||||
# WinPE skips the Secure Boot warning when iPXE reads Secure Boot as on
|
||||
# (iPXE 2.0 ${efi/SecureBoot}); Blancco starts through the Ubuntu shim
|
||||
# (iPXE shim command) so it runs with Secure Boot on. The Blancco
|
||||
# Releases page edits this file (test entry), so keep exactly one
|
||||
# "item blancco" line and the :blancco_efi kernel+initrd block.
|
||||
copy:
|
||||
src: "{{ usb_mount }}/ipxe/GetPxeScript.aspx"
|
||||
dest: "{{ web_root }}/Altiris/iPXE/GetPxeScript.aspx"
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
content: |
|
||||
#!ipxe
|
||||
|
||||
set server 172.16.9.1
|
||||
|
||||
:menu
|
||||
menu GE Aerospace PXE Boot Menu
|
||||
item --gap -- ---- Windows Deployment ----
|
||||
item winpe Windows PE (Image Deployment)
|
||||
item --gap -- ---- Utilities (Secure Boot must be DISABLED) ----
|
||||
item blancco Blancco Drive Eraser
|
||||
item clonezilla Clonezilla Live (Disk Imaging)
|
||||
item memtest Memtest86+ (Memory Diagnostics)
|
||||
item --gap -- ----
|
||||
item reboot Reboot
|
||||
item exit Exit to BIOS
|
||||
choose --default winpe --timeout 30000 target && goto ${target}
|
||||
|
||||
:winpe
|
||||
echo
|
||||
echo Windows deployment requires Secure Boot to be ENABLED.
|
||||
echo If you disabled it for Blancco/Clonezilla, re-enable it now.
|
||||
echo
|
||||
prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot
|
||||
|
||||
:winpe_boot
|
||||
kernel http://${server}/win11/wimboot gui
|
||||
initrd http://${server}/win11/EFI/Microsoft/Boot/boot.stl EFI/Microsoft/Boot/Boot.stl
|
||||
initrd http://${server}/win11/EFI/Microsoft/Boot/BCD EFI/Microsoft/Boot/BCD
|
||||
initrd http://${server}/win11/EFI/Boot/bootx64.efi EFI/Boot/bootx64.efi
|
||||
initrd http://${server}/win11/Boot/boot.sdi Boot/boot.sdi
|
||||
initrd http://${server}/win11/sources/boot.wim sources/boot.wim
|
||||
boot
|
||||
|
||||
:clonezilla
|
||||
set base http://${server}/clonezilla
|
||||
kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
|
||||
initrd ${base}/initrd.img
|
||||
boot
|
||||
|
||||
:blancco
|
||||
iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi
|
||||
|
||||
:blancco_bios
|
||||
echo Loading Blancco for legacy BIOS (canonical)...
|
||||
kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img quiet loglevel=3 archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed
|
||||
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed
|
||||
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed
|
||||
initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed
|
||||
initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed
|
||||
boot
|
||||
:blancco_bios_failed
|
||||
echo
|
||||
echo Blancco BIOS boot FAILED.
|
||||
prompt Press any key to return to menu... && goto menu
|
||||
|
||||
:blancco_efi
|
||||
echo Loading Blancco UEFI (direct kernel)...
|
||||
kernel http://${server}/blancco/vmlinuz-ubuntu initrd=kexec-initrd.img ip=dhcp quiet loglevel=3 nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub
|
||||
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
|
||||
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
|
||||
initrd --name kexec-initrd.img http://${server}/blancco/kexec-initrd.img || goto blancco_efi_grub
|
||||
boot
|
||||
:blancco_efi_grub
|
||||
echo Direct kernel boot failed - trying GRUB chain fallback...
|
||||
chain http://${server}/blancco/grubx64.efi || goto secureboot_warn
|
||||
|
||||
:memtest
|
||||
kernel http://${server}/memtest/memtest.efi || goto secureboot_warn
|
||||
boot
|
||||
|
||||
:secureboot_warn
|
||||
echo
|
||||
echo ======================================================
|
||||
echo This option requires Secure Boot to be DISABLED.
|
||||
echo
|
||||
echo 1. Reboot this machine
|
||||
echo 2. Press F2 / Del to enter BIOS Setup
|
||||
echo 3. Disable Secure Boot
|
||||
echo 4. Save and exit BIOS
|
||||
echo 5. PXE boot again and select this option
|
||||
echo
|
||||
echo Re-enable Secure Boot after completing the task.
|
||||
echo ======================================================
|
||||
echo
|
||||
prompt Press any key to return to menu...
|
||||
goto menu
|
||||
|
||||
:reboot
|
||||
reboot
|
||||
|
||||
:exit
|
||||
exit
|
||||
|
||||
- name: "Ensure Apache listens on port 4433"
|
||||
lineinfile:
|
||||
|
||||
Reference in New Issue
Block a user