Prestudy encryption and unattended upgrades #859

Objective

Detail an implementation proposal for allowing end-users to perform unattended firmware upgrade, deploy configuration changes, and collect support data for transmission to first line support in a "secure enough" way.

Basic Idea

1. Auto-mount USB media
2. Maybe decrypt disk (Bitlocker/LUKS), or
3. Decrypt/authenticate files on disk
4. Perform upgrade, or config change, in a defined order
5. Signal progress on LEDs and in logs (for remote syslog monitoring)

Encryption Alternatives

• Bitlocker support for Linux (FUSE), pro: works with Windows
• Password protected zip files, pro: simple works with basically any operating system
• GPG/PGP signed files, pro: simple, many (most?) prominent MUAs have support for it
• Symmetric key in ietf-keystore yang, user may deploy startup-config with same key on a group of devices

Resources

• https://wiki.netmodule.com/configuration/usb-autorun