On Thu, Oct 14, 2010 at 1:39 PM, Jonas Smedegaard <span dir="ltr"><<a href="mailto:dr@jones.dk">dr@jones.dk</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">On Thu, Oct 14, 2010 at 03:01:09PM +0200, <a href="mailto:bertagaz@ptitcanardnoir.org" target="_blank">bertagaz@ptitcanardnoir.org</a> wrote:<br>
</div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div class="im">
On Thu, Oct 14, 2010 at 01:44:14PM +0200, Christian Brędstrup wrote:<br>
</div><div class="im"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
> But that'd suppose to have a configured network at boot, which > might accomplished with the 'ip' option pass to the kernel at boot, > but then should it be static IP or dhcp?<br>
><br>
<br>
I think most non-techs use a router with DHCP to access the internet. I could of course be wrong but in my experience it is the most common configuration.<br>
</blockquote>
<br>
Yeah, but how does the user know what IP address his FB had by the DHCP so that he can install it with the web interface? Zeroconf might be the answer, but as I'm talking about using the debian installer, that'd mean put avahi in it, which I'm not sure is feasable nor is a good idea. Like what if a malicious user is on the network you're installing the FB on. If he/she uses zeroconf too, that'd be problematic.<br>
</div></blockquote>
<br>
If security is a concern (and it is!), then we need some way of establishing a secure connection between the FreedomBox and its user.<br>
<br>
Avoiding Zeroconf is security by obscurity: Malicious users of same network cannot simply query Zeroconf for FreedomBoxes but can still portscan the network.<br></blockquote><div><br>Agreed.<br><br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
I briefly proposed in an earlier post to implement a special "handshake" in the FreedomBox boot process. Such routine could be added to the installer too - which means that handshake could be made to not require internet access, and thus be possible with a cross-over ethernet cable directly between the box and its user.<br>
</blockquote><div><br>How about something a bit more low-tech? Plugs should ship with passwords printed on stickers on the bottom, just like wifi routers do.<br><br>It just needs to be easy to generate/embed a unique random password each time the base image is installed. And easy for the user to change it afterwards. For people installing from some other media, it might make sense to write a tool which maniuplates the .iso image before it's burnt, embedding the password that way.<br>
<br>-- <br></div></div>Bjarni R. Einarsson<br>Founder, CEO and janitor of the Beanstalks Project.<br><br><a href="http://beanstalks-project.net/" target="_blank">http://beanstalks-project.net/</a> ~ <a href="http://bre.klaki.net/" target="_blank">http://bre.klaki.net/</a><br>