Docs for share passwords and pxe_admin_password; Upload-Image.ps1 back to CRLF
KB: Part 4 step 5 (Tools > Share accounts), the Upload-Image password prompt, the new site-vars rows and example, share sign-in without the shipped password, and that a re-run keeps the webapp's share passwords. site-vars examples and SITE-CUSTOMIZATION.md list the new keys. Upload-Image.ps1 lost its CRLF line endings in fa79f76; restored.
This commit is contained in:
cproudlock
@@ -85,10 +85,17 @@ restores the previous netplan config AND NIC names on any failure. Backups:
|
||||
|
||||
| Value | Default | Where it lives |
|
||||
|-----------------------------|---------------------------------------|---------------------------------------------------------|
|
||||
| Linux user | pxe / pxe | `autoinstall/user-data` (identity.username, password hash) |
|
||||
| Samba upload user | pxe-upload / pxe | `playbook/pxe_server_setup.yml` (Samba user creation) |
|
||||
| Samba blancco user | blancco / blancco | `playbook/pxe_server_setup.yml` |
|
||||
| Sudo password | pxe | autoinstall password hash; also referenced in scripts that ssh + sudo |
|
||||
| Linux user | pxe / pxe at install | `autoinstall/user-data` hash; site-vars `pxe_admin_password` (required) replaces it on first boot |
|
||||
| Samba upload user | pxe-upload / pxe | webapp Tools > Share accounts (seed: site-vars `pxe_upload_password`) |
|
||||
| Samba blancco user | blancco / blancco | webapp Tools > Share accounts (seed: site-vars `blancco_smb_password`) |
|
||||
| Samba clonezilla user | clonezilla / clonezilla-backup | webapp Tools > Share accounts (seed: site-vars `clonezilla_smb_password`) |
|
||||
| Sudo password | = Linux user | dev scripts that ssh + sudo read `PXE_PASS` (default pxe) |
|
||||
|
||||
The three Samba passwords are stored by the webapp
|
||||
(`/var/lib/pxe-webapp/updates/shares/accounts.json`, 0600) and applied by
|
||||
`webapp/services/share_accounts.py` to Samba, startnet.cmd in boot.wim, the
|
||||
iPXE menu and the Blancco preferences; every playbook run re-applies them,
|
||||
so site-vars only seeds them.
|
||||
|
||||
### WiFi and BMC (Blancco licensing)
|
||||
|
||||
@@ -245,8 +252,8 @@ site:
|
||||
credentials:
|
||||
pxe_user: pxe
|
||||
pxe_password: pxe
|
||||
pxe_upload_password: pxe
|
||||
blancco_password: blancco
|
||||
pxe_upload_password: <per site>
|
||||
blancco_password: <per site>
|
||||
|
||||
blancco:
|
||||
wifi_ssid: INTERNETACCESS
|
||||
|
||||
@@ -588,7 +588,7 @@
|
||||
<div class="step">
|
||||
<span class="step-number">Step 1</span>
|
||||
<h3>Copy the build folder to the Windows PC</h3>
|
||||
<p>Copy the whole <span class="command-inline">pxe-usb</span> folder to a local disk, for example <span class="command-inline">C:\pxe-usb</span>. If the site has settings (admin subnets, Clonezilla password), add <span class="command-inline">site-vars.yml</span> now: see <a href="#sitevars">Site Settings</a>.</p>
|
||||
<p>Copy the whole <span class="command-inline">pxe-usb</span> folder to a local disk, for example <span class="command-inline">C:\pxe-usb</span>. Add the site's <span class="command-inline">site-vars.yml</span> now (at least the site name and the passwords): see <a href="#sitevars">Site Settings</a>.</p>
|
||||
<div class="alert alert-info">
|
||||
<strong>Why local:</strong>
|
||||
The build runs as administrator, and an administrator window cannot see network drives mapped in your normal session. A local copy is also faster and does not fail half-way if the network drops.
|
||||
@@ -695,7 +695,7 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
|
||||
<button class="copy-button" onclick="copyCode(this)">Copy</button>
|
||||
<pre>powershell -ExecutionPolicy Bypass -File .\Upload-Image.ps1</pre>
|
||||
</div>
|
||||
<p>It checks the MCL cache first (finished, consistent, every file matching MCL's own hashes), copies it to the server and has the server hash every file; files that arrived wrong are sent again. It ends with <span class="highlight">Upload complete: all N file(s) verified on the server</span>. Add <span class="command-inline">-IncludeDrivers</span> to also send the hardware drivers MCL downloaded.</p>
|
||||
<p>It asks for the <span class="command-inline">pxe-upload</span> password (the site's, see <a href="#shares">Share passwords</a>; add <span class="command-inline">-Pass <password></span> to give it on the command line). It checks the MCL cache first (finished, consistent, every file matching MCL's own hashes), copies it to the server and has the server hash every file; files that arrived wrong are sent again. It ends with <span class="highlight">Upload complete: all N file(s) verified on the server</span>. Add <span class="command-inline">-IncludeDrivers</span> to also send the hardware drivers MCL downloaded.</p>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -755,6 +755,18 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
|
||||
<h3>Shop Floor apps (optional)</h3>
|
||||
<p>A Shop Floor PC gets the provisioning package and the ShopFloor auto-logon and lockdown, and nothing else. To install your own applications on it, see <a href="#apps">Adding Shop Floor Apps</a>.</p>
|
||||
</div>
|
||||
|
||||
<div class="step" id="shares">
|
||||
<span class="step-number">Step 5</span>
|
||||
<h3>Share passwords</h3>
|
||||
<p>Three Samba logins are used on the imaging network: <span class="command-inline">pxe-upload</span> (WinPE and Shop Floor setup on every PC, image and app uploads), <span class="command-inline">blancco</span> (Blancco's erasure reports) and <span class="command-inline">clonezilla</span> (Clonezilla back up and restore). Their shipped passwords are the same at every site.</p>
|
||||
<p>Open <strong>Tools > Share accounts</strong>. Each account shows <span class="highlight">Site password</span> or <span class="highlight">Default password</span>. For any still on the default, type a new password twice and click <strong>Save</strong>: 8-64 characters from A-Z a-z 0-9 . _ ~ -. The server changes the login and every file that carries it (the WinPE boot image, the boot menu, the Blancco preferences) at once.</p>
|
||||
<ul>
|
||||
<li>Change a password only when no PC is imaging: the page refuses while one is, because that PC's next share connection would fail.</li>
|
||||
<li>Passwords set in <span class="command-inline">site-vars.yml</span> at install are applied the same way; after that this page is where they change.</li>
|
||||
<li>The PXE boot files are readable by any PC on the imaging switch, and they carry the <span class="command-inline">pxe-upload</span> and <span class="command-inline">clonezilla</span> passwords. A site password keeps other sites' people and PCs out; it does not hide it from a PC on your own imaging switch.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<hr class="section-divider">
|
||||
|
||||
<!-- PART 5 -->
|
||||
@@ -772,7 +784,7 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
|
||||
<hr class="section-divider">
|
||||
|
||||
<h2 id="sitevars">Site Settings</h2>
|
||||
<p>Site settings live in one small text file, <span class="command-inline">site-vars.yml</span>, in the build folder. The USB builder copies it onto the stick and the server reads it while it installs. Without the file the defaults are used: fine for a test, but every production site should set at least <span class="command-inline">site_name</span> and <span class="command-inline">clonezilla_smb_password</span>.</p>
|
||||
<p>Site settings live in one small text file, <span class="command-inline">site-vars.yml</span>, in the build folder. The USB builder copies it onto the stick and the server reads it while it installs. Without the file the defaults are used: fine for a test, but every production site must set <span class="command-inline">pxe_admin_password</span> (the install stops without it) and should set <span class="command-inline">site_name</span> and the three share passwords.</p>
|
||||
|
||||
<div class="step">
|
||||
<span class="step-number">Step 1</span>
|
||||
@@ -807,7 +819,10 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Build-PxeUsb.ps1 -Interactive
|
||||
<tr><th>Setting</th><th>What it does</th><th>When to set it</th><th>Example</th></tr>
|
||||
<tr><td><span class="command-inline">site_name</span></td><td>The site name stamped on Blancco erasure reports and the monthly CMMC evidence packs. Not set: <em>Unnamed site</em>. Letters, digits, spaces and . , - ( ) & / only.</td><td><strong>Always</strong></td><td><span class="command-inline">"Example Site"</span></td></tr>
|
||||
<tr><td><span class="command-inline">site_timezone</span></td><td>Time zone of the server clock, of every time in the web interface, and of the evidence-pack month boundaries.</td><td>If the site is not on US Eastern time</td><td><span class="command-inline">"America/Chicago"</span></td></tr>
|
||||
<tr><td><span class="command-inline">clonezilla_smb_password</span></td><td>Password of the share Clonezilla backs up to and restores from. The boot menu carries it, so it protects the share on the imaging network only. 8-64 characters from A-Z a-z 0-9 . _ ~ -</td><td><strong>Always</strong> (the default is the same at every site)</td><td><span class="command-inline">"ExSite-Clone-2026"</span></td></tr>
|
||||
<tr><td><span class="command-inline">pxe_admin_password</span></td><td>Password of the server's own login, <span class="command-inline">pxe</span> (console, SSH and sudo). Required: the install stops while the server still has the shipped password. 8-128 characters. Keep it with the site's admin passwords.</td><td><strong>Always</strong></td><td><span class="command-inline">"<a long site password>"</span></td></tr>
|
||||
<tr><td><span class="command-inline">pxe_upload_password</span></td><td>Password of the <span class="command-inline">pxe-upload</span> share login: WinPE and Shop Floor setup on every imaging PC, <span class="command-inline">Upload-Image.ps1</span>, app uploads. 8-64 characters from A-Z a-z 0-9 . _ ~ -. Not set: the shipped default. Used at the install only; later, <strong>Tools > Share accounts</strong>.</td><td><strong>Always</strong></td><td><span class="command-inline">"ExSite-Upload-2026"</span></td></tr>
|
||||
<tr><td><span class="command-inline">blancco_smb_password</span></td><td>Password of the <span class="command-inline">blancco</span> share login Blancco saves erasure reports with. Same rules as above.</td><td><strong>Always</strong></td><td><span class="command-inline">"ExSite-Reports-2026"</span></td></tr>
|
||||
<tr><td><span class="command-inline">clonezilla_smb_password</span></td><td>Password of the share Clonezilla backs up to and restores from. The boot menu carries it, so it protects the share on the imaging network only. Same rules as above.</td><td><strong>Always</strong> (the default is the same at every site)</td><td><span class="command-inline">"ExSite-Clone-2026"</span></td></tr>
|
||||
<tr><td><span class="command-inline">corp_admin_cidrs</span></td><td>The GE subnets allowed to reach the web interface (port 9009) and SSH. Not set: all of GE. The imaging network always has access.</td><td>Recommended once the server is on the GE network</td><td><span class="command-inline">["10.12.34.0/24"]</span></td></tr>
|
||||
<tr><td><span class="command-inline">pxe_nic_mac</span><br><span class="command-inline">corp_nic_mac</span></td><td>Pin the imaging port and the GE port by MAC address instead of picking the imaging port at install. Then both cables may be in from the start.</td><td>Only if the automatic pick is not wanted</td><td><span class="command-inline">"34:c8:d6:b1:10:10"</span></td></tr>
|
||||
<tr><td><span class="command-inline">pxe_nic_allowed_switches</span></td><td>A <em>managed</em> imaging switch sends LLDP/CDP like a GE switch, and the server would refuse to serve on it. Its name (or MAC) here marks it as the imaging switch. Comma separated.</td><td>Only if the imaging switch is managed</td><td><span class="command-inline">"IMG-SW-01"</span></td></tr>
|
||||
@@ -847,8 +862,12 @@ site_name: "Example Site"
|
||||
# Time zone of the server clock and the web interface.
|
||||
site_timezone: "America/New_York"
|
||||
|
||||
# Password of the Clonezilla backup share (8-64 characters from
|
||||
# A-Z a-z 0-9 . _ ~ -).
|
||||
# The server's own login (pxe): required.
|
||||
pxe_admin_password: "<a long site password>"
|
||||
|
||||
# The share logins (8-64 characters from A-Z a-z 0-9 . _ ~ -).
|
||||
pxe_upload_password: "ExSite-Upload-2026"
|
||||
blancco_smb_password: "ExSite-Reports-2026"
|
||||
clonezilla_smb_password: "ExSite-Clone-2026"
|
||||
|
||||
# Who may reach the web interface and SSH from the GE network.
|
||||
@@ -865,7 +884,7 @@ clonezilla_smb_password: "ExSite-Clone-2026"
|
||||
<button class="copy-button" onclick="copyCode(this)">Copy</button>
|
||||
<pre>sudo /opt/first-boot.sh</pre>
|
||||
</div>
|
||||
<p>It re-applies every setting and changes only what differs. Run it when no PCs are imaging: while they are, it postpones restarting services, and a change to the network settings is refused until the floor is idle.</p>
|
||||
<p>It re-applies every setting and changes only what differs, except the three share passwords: those stay as <strong>Tools > Share accounts</strong> has them. Run it when no PCs are imaging: while they are, it postpones restarting services, and a change to the network settings is refused until the floor is idle.</p>
|
||||
|
||||
<hr class="section-divider">
|
||||
|
||||
@@ -881,7 +900,7 @@ clonezilla_smb_password: "ExSite-Clone-2026"
|
||||
<div class="step">
|
||||
<span class="step-number">Step 1</span>
|
||||
<h3>Open the share</h3>
|
||||
<p>From a PC on the imaging switch, open <span class="command-inline">\\172.16.9.1\enrollment\pre-install</span> and sign in as <span class="command-inline">pxe-upload</span> (password <span class="command-inline">pxe</span>, the account <span class="command-inline">Upload-Image.ps1</span> uses).</p>
|
||||
<p>From a PC on the imaging switch, open <span class="command-inline">\\172.16.9.1\enrollment\pre-install</span> and sign in as <span class="command-inline">pxe-upload</span> with the site's password (<a href="#shares">Share passwords</a>; the account <span class="command-inline">Upload-Image.ps1</span> uses).</p>
|
||||
</div>
|
||||
|
||||
<div class="step">
|
||||
|
||||
@@ -49,6 +49,19 @@ corp_nic_mac: "" # e.g. "20:88:10:af:0d:e5"
|
||||
# "clonezilla-backup").
|
||||
# clonezilla_smb_password: "change-me-per-site"
|
||||
|
||||
# Required: the password of the server's own login pxe (console, SSH and
|
||||
# sudo), 8-128 characters. The install stops while the box still has the
|
||||
# shipped "pxe"; every run sets it when it differs.
|
||||
pxe_admin_password: ""
|
||||
|
||||
# Recommended: the passwords of the share logins pxe-upload (WinPE and Shop
|
||||
# Floor setup on every PC, Upload-Image.ps1) and blancco (erasure reports).
|
||||
# Same rules as clonezilla_smb_password. These three only seed the webapp
|
||||
# (Tools > Share accounts) for an account it does not hold yet; after that a
|
||||
# change goes through the webapp page, and a re-run keeps what it holds.
|
||||
# pxe_upload_password: "change-me-per-site"
|
||||
# blancco_smb_password: "change-me-per-site"
|
||||
|
||||
# Recommended: the site name stamped on Blancco erasure reports and the
|
||||
# monthly CMMC evidence packs (empty: "Unnamed site"). Letters, digits,
|
||||
# spaces and . , - ( ) & / only.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -15,6 +15,17 @@ site_timezone: "America/New_York"
|
||||
# and put your admin desks' subnet(s), e.g. ["10.12.34.0/24"]:
|
||||
# corp_admin_cidrs: ["<admin subnet>/24"]
|
||||
|
||||
# Password of the server's own login, pxe (console, SSH, sudo). Required:
|
||||
# the install stops while the server still has the shipped password "pxe".
|
||||
pxe_admin_password: "<a long site password>"
|
||||
|
||||
# Passwords of the share logins pxe-upload (WinPE and Shop Floor setup,
|
||||
# Upload-Image.ps1) and blancco (erasure reports), 8-64 characters from
|
||||
# A-Z a-z 0-9 . _ ~ -. Used at the install; change them later on the web
|
||||
# interface, Tools > Share accounts.
|
||||
pxe_upload_password: "change-me-per-site"
|
||||
blancco_smb_password: "change-me-per-site"
|
||||
|
||||
# Password of the Clonezilla backup share (8-64 characters from
|
||||
# A-Z a-z 0-9 . _ ~ -). The PXE boot menu carries it: an imaging-LAN
|
||||
# secret, not a real one. Default: clonezilla-backup
|
||||
|
||||
Reference in New Issue
Block a user