Users Guide

● Enable bootloader protection in EXEC mode. Use the boot protect enable command to configure a username and
password. You can configure up to three users per switch.
OS10# boot protect enable username root password calvin
Disable bootloader protection for a specified user by using the boot protect disable command.
Enable bootloader protection
OS10# boot protect enable username root password calvin
Disable bootloader protection
OS10# boot protect disable username root
Display bootloader protectection
OS10# show boot protect
Boot protection enabled
Authorized users: root linuxadmin admin
Secure Boot
OS10 secure boot verifies the authenticity and integrity of the OS10 image. Secure boot protects a system from malicious code
being loaded and executed during the boot process.
Using secure boot, you can validate the OS10 image during installation and on demand at any time.
Secure boot:
● prevents the OS10 software, including the kernel and system files, from being compromised during the boot operation
● verifies the new digital image signature before installation
● protects and validates the startup configuration file at startup
OS10 checks the validity of the OS10 image before you install or upgrade your system:
● To check the validity of the OS10 image before you upgrade, see Validate and upgrade OS10 image.
● To check the validity of the OS10 image before you install it, see Validate OS10 image before manual installation from ONIE.
If you have already installed Release 10.5.1.0 or later, to enable secure boot, see Enable secure boot.
Enable secure boot
Enabling the secure boot feature prevents the OS10 software (kernel and system binaries) from being compromised during the
boot operation.
Secure boot is disabled by default. To enable secure boot, use the secure-boot enable command or RESTCONF API.
OS10 stores the kernel signatures and system-file hashes internally. When you enable secure boot, OS10 uses the signatures and
hashes to validate the binaries during the next and future reboots.
OS10 has two images, A and B. One image is active, which is the current running version and used as the running software at
the next system reload. The other image remains standby, used for software upgrades.
You can use the secure-boot verify command to validate the kernel, system binaries, and startup configuration file for
both the installed images at any time.
secure-boot verify {kernel | file-system-integrity | startup-config}
After a switch reboot:
● If kernel binary file validation fails, OS10 returns to the GRUB menu. The system returns to the GRUB menu when the kernel
binary, kernel signature file, or both have been compromised. To load OS10, reboot your system using the other OS10 image.
After OS10 loads, reinstall the OS10 image to replace the invalid image.
● If the OS10 system binary file validation fails, the OS10 image loads only in EXEC mode. Configuration mode is blocked. You
can reboot your system using the other OS10 image and replace the invalid image with a valid OS10 image.
● If both the installed OS10 images are compromised, you must install a new image using ONIE. For more information, see
Installation using ONIE.
Security
1139