Imagine a system with one or more LUKS encrypted partitions (root or others) or volumes and you need to unlock these partitions/volumes during startup. In this case you need to be able to log in remotely and provide a password at the early boot phase. This can be achieved by using one or more mkinitcpio hook(s) that configure a network interface and start some kind of SSH server. Some packages listed below contribute various mkinitcpio build hooks to ease the configuration. The following tutorials add a remote unlocking method in addition to the existing local console password prompt.

iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as:

• boot from a web server via HTTP
• boot from an iSCSI SAN
• boot from a Fibre Channel SAN via FCoE
• boot from an AoE SAN
• boot from a wireless network
• boot from a wide-area network
• boot from an Infiniband network
• control the boot process with a script

You can use iPXE to replace the existing PXE ROM on your network card, or you can chainload into iPXE to obtain the features of iPXE without the hassle of reflashing.

iPXE is free, open-source software licensed under the GNU GPL (with some portions under GPL-compatible licences), and is included in products from several network card manufacturers and OEMs.

The Achilles heel of [your secure device] is the secure boot chain. In this presentation we will show our results from auditing commonly used boot loaders and walk through the attack surface you open yourself up to. You would be surprised at how much attack surface exists when hardening and defense in depth is ignored. From remote attack surface via network protocol parsers to local filesystems and various BUS parsing, we will walk through the common mistakes we've seen by example and showcase how realistic it is for your product's secure boot chain to be compromised.

Network booting is cool. Once you have setup everything you can stop juggling iso images in your virtual machine configs. Instead you just kick a network boot and pick whatever you want install from the boot menu delivered by the boot server.

This article is not about the basics of setting up a boot server. The internet has tons of tutorials on how to install a tftp server and how to boot your favorite OS from tftp. This article will focus on configuring network boot for libvirt-managed virtual machines.

Ventoy is an open source tool to create bootable USB drive for ISO files.
With ventoy, you don't need to format the disk over and over, you just need to copy the iso file to the USB drive and boot it.
You can copy many iso files at a time and ventoy will give you a boot menu to select them.
Both Legacy BIOS and UEFI are supported in the same way. 200+ ISO files are tested.
A "Ventoy Compatible" concept is introduced by ventoy, which can help to support any ISO file.

See https://www.ventoy.net for detail.

So you’ve just rented a new server, in some random data center, from one of the popular hosting providers. You don’t have physical access to the machine, but you rely on your data to be stored securely on the server. You probably want to encrypt the entire system, even the swap partition. The server needs to be able to decrypt the filesystems to boot, but you don’t want the encryption key to be accessible by it, so nobody with physical access can access your data or even tamper with it.

Introducing Talos™ II

Talos™ II — the world's first computing system to support the new PCIe 4.0 standard — also boasts substantial DDR4 memory, dual POWER9 CPUs, next-generation security, and a price that won't break the bank. Let the power of Talos™ II accelerate your computing!

Broad, standards-compliant support for both DHCPv4 and DHCPv6

• Free-open source, shared under MPL 2.0 licensing

• Direct address assignment (DHCPv4 and DHCPv6) or DHCPv6 prefix delegation

• Dynamic IP addressing and static host reservations

• Dynamic DNS for updating DNS records as leases are renewed or expired

• Tracking of MAC addresses, even in DHCPv6

• Extend and customize Kea through Hooks

• Add and change subnets and pools without restarting Kea

• Store leases and host reservations in a MySQL, PostgreSQL or Cassandra database rather than a text file

• Replace the entire Kea configuration, or separately manage leases, subnets and host reservations through a REST API

• Comprehensive Developer and Administrator documentation.

• ISC offers commercial 7 x 24 support for Kea, as well as consulting and contract development to assist in implementing Kea, including migration from ISC DHCP.

Kea runs on Linux, BSD, and MacOS, like ISC DHCP. The Kea distribution does not yet include a DHCP client or relay, but because both are standards-based, the ISC DHCP client works fine with the Kea DHCP server. Kea is under active development.

Foreman is a complete lifecycle management tool for physical and virtual servers. We give system administrators the power to easily automate repetitive tasks, quickly deploy applications, and proactively manage servers, on-premise or in the cloud.

Provision from anywhere

Bare metal, Amazon EC2, Google Compute Engine, OpenStack, Libvirt, oVirt, VMware, and many other providers allow you to manage a hybrid cloud through Foreman

Configuration

An external node classifier, hiera-like parameters, and reports monitoring for Puppet, Salt and Chef are included. Completely ready to tweak host groups in your data center.

Tired of reinventing the wheel by implementing drivers for firmware again and again.
Not with LinuxBoot!

The NERF project is a collaboration with Ron Minnich at Google (creator of LinuxBIOS and coreboot) that aims to build an open, customizable, and slightly more secure firmware for server machines based on using Linux and Heads in the ROM to replace UEFI as the bootloader.

Unlike coreboot, NERF doesn't attempt to replace the chipset initialization code with opensource. Instead it retains the vendor PEI (Pre-EFI environment) code as well as the signed ACM (authenticated code modules) that Intel provides for establishing the TXT (trusted execution environment). The NERF firmware replaces the DXE (Driver Execution Environment) portion of UEFI with a few open source wrappers, the Linux Kernel and the Heads measured runtime.

tl;dr: this post explains how the new openstack-tempest-ci-live-booter package configures a machine to PXE boot a Debian Live system running on KVM in order to run functional testing of OpenStack. It may be of interest to you if you want to learn how to PXE boot a KVM virtual machine running Debian Live, even if you aren’t interested in OpenStack.

The installation of the Openvswitch on Ubuntu brings an automatic integration into the boot sequence. When Ubuntu is booted, the Openvswitch is also started. Any bridge or port, which has been defined in previous sessions, is restored.
BUT: No L3 interfaces are set up, junk interfaces, which have been defined in previous sessions, are restored.

These instructions will walk you through booting Container Linux via iPXE on real or virtual hardware. By default, this will run Container Linux completely out of RAM. Container Linux can also be installed to disk.

A mininum of 1024M of RAM is required to boot Container Linux via PXE.

Over the last two years secure boot support for virtual machines was added to qemu, kvm (linux kernel) and ovmf (edk2/tianocore). This talk covers the implementation details and the issues we had to deal with along the way.

debirf is a system that will create diskless, all-in-ram images (kernel and initramfs) that boot entirely into ram and leave the user in a fully functional Debian system, disks untouched.

Boot-Repair is a simple tool to repair frequent boot issues you may encounter in Ubuntu like when you can't boot Ubuntu after installing Windows or another Linux distribution, or when you can't boot Windows after installing Ubuntu, or when GRUB is not displayed anymore, some upgrade breaks GRUB, etc.

Boot-Repair lets you fix these issues with a simple click, which (generally reinstalls GRUB and) restores access to the operating systems you had installed before the issue.

Boot-Repair also has advanced options to back up table partitions, back up bootsectors, create a Boot-Info (to get help by email or forum), or change the default repair parameters: configure GRUB, add kernel options (acpi=off ...), purge GRUB, change the default OS, restore a Windows-compatible MBR, repair a broken filesystem, specify the disk where GRUB should be installed, etc.

Boot-Repair is a free software, licensed under GNU-GPL.

For a recent customer setup of Debian/wheezy on a IBM x3630 M4 server we used my blog entry “State of the art Debian/wheezy deployments with GRUB and LVM/SW-RAID/Crypto” as a base. But this time we wanted to use (U)EFI instead of BIOS legacy boot.