Dell SmartFabric OS10 User Guide Release 10.5.3

Enable secure boot in OS10

Enabling the secure boot feature prevents the OS10 software (kernel and system binaries) from being compromised during the boot operation.

Secure boot is disabled by default. To enable secure boot, use the secure-boot enable command or RESTCONF API.

OS10 stores the kernel signatures and system-file hashes internally. When you enable secure boot, OS10 uses the signatures and hashes to validate the binaries during the next and future reboots.

OS10 has two images, A and B. One image is active, which is the current running version and used as the running software at the next system reload. The other image remains standby, used for software upgrades.

You can use the secure-boot verify command to validate the kernel, system binaries, and startup configuration file for both the installed images at any time.

secure-boot verify {kernel | file-system-integrity | startup-config}

After a switch reboot:

• If kernel binary file validation fails, OS10 returns to the GRUB menu. The system returns to the GRUB menu when the kernel binary, kernel signature file, or both have been compromised. To load OS10, reboot your system using the other OS10 image. After OS10 loads, reinstall the OS10 image to replace the invalid image.
• If the OS10 system binary file validation fails, the OS10 image loads only in EXEC mode. Configuration mode is blocked. You can reboot your system using the other OS10 image and replace the invalid image with a valid OS10 image.
• If both the installed OS10 images are compromised, you must install a new image using ONIE. For more information, see Installation using ONIE.
• If the validation of the kernel and OS10 system binary files succeeds, OS10 loads successfully.

OS10# show secure-boot status
Last boot was via secure boot : yes
Secure boot configured : yes
Latest startup config protected: yes

OS10# show secure-boot file-integrity-status
File Integrity Status: OK