Bare metal device management
Examples described herein include systems and methods for bare metal management of computing devices. Firmware of the computing device can be configured to contact a network location as part of an HTTP boot and download a boot agent. The boot agent can be prioritized to execute before a primary OS boot loader. The boot agent can download an OS configuration including a package that is inserted into the primary OS. The primary OS, as configured, can then boot. The boot agent can also attest to OS health and device compliance on subsequent boots. For example, the boot agent can cause the firmware to track how many boots have occurred since compliance verification. If a threshold number of boots occur without verification, the boot agent can initiate restoration. Alternatively, if a decommission flag is set, the boot agent can cause the computing device to boot into its original configuration.
1. A method for bare metal device management, comprising:
configuring, by a computing device, a boot agent to execute before a primary operating system (“OS”) boot manager during boot of the computing device, wherein the computing device has at least one physical processor;
applying, by the computing device, an OS configuration to the primary OS, the OS configuration being specified by a management server; and
when at least one boot has occurred since the computing device performed a compliance check with the management server, downloading a new boot agent and booting the primary OS on the computing device using the new boot agent;
incrementing a counter in firmware of the computing device to indicate a number of boots that have occurred since the compliance check; and
resetting the counter after the compliance check.
2. The method of claim 1 , further comprising:
storing a first date of a preceding successful boot in firmware of the computing device;
comparing the first date to a second date that indicates a prior compliance check; and
in response to the comparison, downloading the new boot agent when the first date is greater than the second date.
3. The method of claim 1 , further comprising:
retrieving, from firmware of the computing device, a network location;
before permitting the primary OS to boot, contacting the network location and receiving the boot agent; and
adding, by the computing device, the boot agent to a system partition of the computing device.
4. The method of claim 1 , further comprising:
during booting from the new boot agent, confirming that the primary OS has the OS configuration specified by the management server.
5. The method of claim 1 , further comprising:
saving a last boot time to the firmware;
in an instance in which the last boot time is more recent than a last compliance check from a management server, incrementing a counter; and
in an instance in which the counter exceeds a threshold, downloading the new instance of the boot agent.
6. The method of claim 5 , further comprising:
in an instance in which the counter is less than a threshold, booting the primary OS as currently configured.
7. The method of claim 1 , further comprising:
receiving a decommissioning message from the management server;
storing a flag in the firmware; and
upon detecting the flag during a subsequent boot, loading a pre-OS boot environment without the boot agent for performing a default boot sequence.
8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, perform stages for bare metal device management, the stages comprising:
configuring, by a computing device, a boot agent to execute before a primary operating system (“OS”) boot manager during boot of the computing device, wherein the computing device has at least one physical processor;
applying, by the computing device, an OS configuration to the primary OS, the OS configuration being specified by a management server; and
when at least one boot has occurred since the computing device performed a compliance check with the management server, downloading a new boot agent and booting the primary OS on the computing device using the new boot agent;
receiving a decommissioning message from the management server;
storing a flag in the firmware; and
upon detecting the flag during a subsequent boot, loading a pre-OS boot environment without the boot agent for performing a default boot sequence.
9. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
incrementing a counter in firmware of the computing device to indicate a number of boots that have occurred since the compliance check; and
resetting the counter after the compliance check.
10. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
storing a first date of a preceding successful boot in firmware of the computing device;
comparing the first date to a second date that indicates a prior compliance check; and
downloading the new boot agent when the first date is greater than the second date.
11. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
retrieving, from firmware of the computing device, a network location;
before permitting the primary OS to boot, contacting the network location and receiving the boot agent; and
adding, by the computing device, the boot agent to a system partition of the computing device.
12. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
during booting from the new boot agent, confirming that the primary OS has the OS configuration specified by the management server.
13. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
saving a last boot time to the firmware;
in an instance in which the last boot time is more recent than a last compliance check from a management server, incrementing a counter; and
in an instance in which the counter exceeds a threshold, downloading the new instance of the boot agent.
14. The non-transitory, computer-readable medium of claim 13 , the stages further comprising:
in an instance in which the counter is less than a threshold, booting the primary OS as currently configured.
15. A computing device that performs bare metal device management, comprising:
a physical memory storage including a non-transitory, computer-readable medium comprising instructions; and
a processor that executes the instructions to carry out stages comprising:
configuring a boot agent to execute before a primary operating system (“OS”) boot manager during boot of the computing device;
applying an OS configuration to the primary OS, the OS configuration being specified by a management server;
when at least one boot has occurred since the computing device performed a compliance check with the management server, downloading a new boot agent and booting the primary OS on the computing device using the new boot agent;
incrementing a counter in firmware of the computing device to indicate a number of boots that have occurred since the compliance check; and
resetting the counter after the compliance check.
16. The computing device of claim 15 , the stages further comprising:
storing a first date of a preceding successful boot in firmware of the computing device;
comparing the first date to a second date that indicates a prior compliance check; and
downloading the new boot agent when the first date is greater than the second date.
17. The computing device of claim 15 , the stages further comprising:
retrieving, from firmware of the computing device, a network location;
before permitting the primary OS to boot, contacting the network location and receiving the boot agent; and
adding, by the computing device, the boot agent to a system partition of the computing device.