Chapter 3: Serial Port, Device and User Configuration
74
8.
Connect a new Opengear device, either factory-reset or Config-Erased, to the network and
apply power. It may take up to 5 minutes for the device to reboot itself.
Example ISC DHCP (dhcpd) server configuration
The following is an example DHCP server configuration fragment for serving an .opg configuration image
via the ISC DHCP server, dhcpd:
option space opengear code width 1 length width 1;
option opengear.config-url code 1 = text;
class "opengear-config-over-dhcp-test" {
match if option vendor-class-identifier ~~ "^Opengear/";
vendor-option-space opengear;
option opengear.config-url "https://example.com/opg/${class}.opg";
}
This setup can be modified to upgrade the configuration image using the opengear.image-url option, and
providing a URI to the firmware image.
Setup when the LAN is untrusted
If the connection between the file server and a to-be-configured Opengear device includes an untrusted
network, a two-handed approach can mitigate the issue.
NOTE
This approach introduces two physical steps where trust can be difficult, if not impossible, to
establish completely. First, the custody chain from the creation of the data-carrying USB flash drive to its
deployment. Second, the hands connecting the USB flash drive to the Opengear device.
•
Generate an X.509 certificate for the Opengear device.
•
Concatenate the certificate and its private key into a single file named client.pem.
•
Copy client.pem onto a USB flash drive.
•
Set up an HTTPS server such that access to the .opg or .xml file is restricted to clients that can
provide the X.509 client certificate generated above.
•
Put a copy of the CA cert that signed the HTTP server’s certificate — ca-bundle.crt — onto the USB
flash drive bearing client.pem.
•
Insert the USB flash drive into the Opengear device before attaching power or network.
•
Continue the procedure from ‘Copy the saved .opg or .xml file to a public-facing directory on a file
server’ above using the HTTPS protocol between the client and server.
Prepare a USB drive and create the X.509 certificate and private key
•
Generate the CA certificate so the client and server Certificate Signing Requests (CSRs) can be
signed.
# cp /etc/ssl/openssl.cnf .
# mkdir -p exampleCA/newcerts
# echo 00 > exampleCA/serial
# echo 00 > exampleCA/crlnumber
# touch exampleCA/index.txt
# openssl genrsa -out ca.key 8192
# openssl req -new -x509 -days 3650 -key ca.key -out demoCA/cacert.pem \
-subj /CN=ExampleCA
# cp demoCA/cacert.pem ca-bundle.crt
This procedure generates a certificate called ExampleCA but any allowed certificate name can be used.
Also, this procedure uses openssl ca. If your organization has an enterprise-wide, secure CA generation
process, that should be used instead.
