From Grub4Dos Wiki

NOT FINISHED YET!

introduction

To boot over networks there are at least three different methods. The first and most easy method is limited to boot form local area networks and is called PXE booting, for more information on this topic see grub4dos guide pxe. To ship around the limitation to LAN you can for example virtual extend your LAN over WAN by using a Virtual Private Networks, advanced usual in trade hardware routers support this feature. The advantage of using a VPN is the the VPN abstracts setting up encryption and security over WAN. These two methods are not the topic here, this wiki site is about direct internet/WAN booting without special hardware.

security

The main goal of this site is to explain a prof of concept implementation while security is in back in mind but with a low priority. In the opinion of the author (mr) there must be first a working implementation and the paranoid security details are later the final touch.

The DOS wget port with SSL can be found here, at this point there is no review about the SSL implementation and quality of this port.

implementation

real mode phase

Example #1:
     BIOS -> harddisk MBR -> grub4dos -> DOS ->
     wget another DOS image from https webserver and store on harddisk ->
     grub4dos's grub.exe -> emulate the image as a device -> boot the virtual device

Result #1:
     initially booted to DOS, downloaded an fresh DOS image and booted the updated DOS

Example #2:
     BIOS -> harddisk MBR -> grub4dos -> DOS ->
     wget an Linux kernel (and initrd) ->
     grub4dos's grub.exe -> use kernel (and initrd) to boot Linux 

Result #2:
     initially booted to DOS, downloaded a fresh Linux kernel (and initrd) and booted it

Example #3:
     BIOS -> harddisk MBR -> grub4dos -> Linux ->
     wget an Linux kernel (and initrd) ->
     kexec grub4dos's grub.exe -> use kernel (and initrd) to boot the updated Linux 

Result #4:
     initially booted to Linux, downloaded a fresh Linux kernel (and initrd) and booted it

protected mode phase

As you see it's not hard to get the real mode phase to work. As soon the downloaded kernel takes over control it's up to the new kernel to mount the ssl webserver as a device and to recharge the other needed files from the webserver.