Black Box LES1608A - Example ISC DHCP (Dhcpd) Server Configuration; Setup When the LAN Is Untrusted

58
1. 8 7 7. 8 7 7. 2 26 9 BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.87 7.2269
CHAPTER 4: SYSTEM CONFIGURATION
Alternatively:
 Navigate to System > Administration.
 Check the Config Erase checkbox.
 Check the Reboot checkbox.
 Click Apply.
NOTE: If ZTP is being used to update a working console server’s firmware, the extant configuration must be backed-up before the
console server is unconfigured.
4.7.2 EXAMPLE ISC DHCP (DHCPD) SERVER CONFIGURATION
The following is an example DHCP server configuration fragment for serving an .opg configuration image via the ISC DHCP server,
dhcpd:
option space Black Box code width 1 length width 1;
option Black Box.config-url code 1 = text;
class "Black Box-config-over-dhcp-test" {
match if option vendor-class-identifier ~~ "^Black Box/";
vendor-option-space Black Box;
option Black Box.config-url
"https://example.com/opg/${class}.opg";
}
4.7.3 SETUP WHEN THE LAN IS UNTRUSTED
If the connection between the file server and a to-be-configured Black Box device includes an untrusted network, a two-handed
approach can mitigate the issue.
NOTE: This approach introduces two physical steps where trust can be difficult, if not impossible, to establish completely. First, the
custody chain from the creation of the data-carrying USB flash drive to its deployment. Second, the hands connecting the
USB flash drive to the Black Box device.
 Generate an X.509 certificate for the Black Box device.
 Concatenate the certificate and its private key into a single file named client.pem.
 Copy client.pem onto a USB flash drive.
 Set up an HTTPS server so that access to the .opg or .xml file is restricted to clients that can provide the X.509 client certificate
generated above.
 Put a copy of the CA cert that signed the HTTP server’s certificate—ca-bundle.crt—onto the USB flash drive bearing client.pem.
 Insert the USB flash drive into the Black Box device before attaching power or network.
 Continue the procedure from ‘Copy the saved .opg or .xml file to a public-facing directory on a file server’ above using the HTTPS
protocol between the client and server.