Secure boot
The Secure boot feature provides the authentication to ensure that the switch runs the intended software and no malicious
party has altered the intended software.
Secure boot validates the firmware and operating system running on the switch and, if there is an authentication failure, it
disallows booting into the switch.
Secure boot requires an immutable
Root of Trust
. The BIOS is the immutable
Root of Trust
in your switch.
GRUB locates the SHIM LOCK protocol and registers the SHIM verify function to be used after any load image it performs.
Thereafter, the image that is loaded by GRUB is verified before it is run.
Secure boot keys
Secure boot supports the following keys:
●
Dell Networking
●
Microsoft
●
Cumulus
●
Big Switch Networks
Secure boot files
For secure boot, the
.bin
file is replaced with the
.tar
file. The
.tar
archive file has both the
.bin
file and the
.sig
file to
verify the secure boot
.bin
file. You do not have to untar the
.tar
file to access the
.bin
file.
NOTE:
If you specify the
.bin
file, the
.sig
file
MUST
be in the same location as the
.bin
file.
Installation
If the installation is unsuccessful because of an issue with keys; for example, the keys do not match, an error message displays:
ONIE: Executing installer: tftp://onie-server/onie-updater-x86_64.tar
Failure: Verification Failure
If the installation is unsuccessful because of an issue with the signature; for example, if you untar the
.tar
file or if the
signature file is not in the correct location, an error message displays:
ONIE: Executing installer: diag-installer-x86_64-dellemc_
<platform>
_c3538-r0-x.xx.x.x-
x-2020-02-16.tar
Failure: Not found signature file
If the installation is successful, the following displays:
Successful install:
ONIE: Executing installer: file:///lib/onie/onie-updater.tar
Verifying image checksum ... OK.
Preparing image archive ... OK.
ONIE: Version : x.xx.x.x-x
ONIE: Architecture : x86_64
ONIE: Machine : dellemc_
<platform>
_c3538
ONIE: Machine Rev : 0
ONIE: Config Version: 1
ONIE: Build Date : 2020-02-23T19:09-08:00
8
40
Secure boot
