Users Guide

Display bootloader protectection
OS10# show boot protect
Boot protection enabled
Authorized users: root linuxadmin admin
Secure Boot
OS10 secure boot verifies the authenticity and integrity of the OS10 image. Secure boot protects a system from malicious code
being loaded and executed during the boot process.
Using secure boot, you can validate the OS10 image during installation and on demand at any time.
Secure boot:
● verifies the OS10 image with the digital signature before installation
● prevents the OS10 software, including the kernel and system files, from being compromised during the boot operation
● protects and validates the startup configuration file at startup
OS10 checks the validity of the OS10 image before you install or upgrade your system:
● To check the validity of the OS10 image before you upgrade, see Validate and upgrade OS10 image.
● To check the validity of the OS10 image before you install it, see Validate OS10 image before manual installation from ONIE.
If you have already installed Release 10.5.1.0 or later, to enable secure boot, see Enable secure boot.
NOTE: You cannot directly go to ONIE from OS10, when secure boot is enabled. OS10 GRUB menu has options only for
OS10 A and B. When you reload from OS10 to ONIE and when secure boot is enabled in OS10, go to BIOS and choose ONIE
to boot.
Enable secure boot in OS10
Enabling the secure boot feature prevents the OS10 software (kernel and system binaries) from being compromised during the
boot operation.
Secure boot is disabled by default. To enable secure boot, use the secure-boot enable command or RESTCONF API.
NOTE: On some switches, OS10 secure boot is enabled by default
OS10 stores the kernel signatures and system-file hashes internally. When you enable secure boot, OS10 uses the signatures and
hashes to validate the binaries during the next and future reboots.
OS10 has two images, A and B. One image is active, which is the current running version and used as the running software at
the next system reload. The other image remains standby, used for software upgrades.
NOTE:
When you reload the switch from OS10 to ONIE and when secure boot is enabled in OS10, select ONIE from the
BIOS to boot. You cannot directly go to ONIE from OS10, when secure boot is enabled.
You can use the secure-boot verify command to validate the kernel, system binaries, and startup configuration file for
both the installed images at any time.
secure-boot verify {kernel | file-system-integrity | startup-config}
After a switch reboot:
● If kernel binary file validation fails, OS10 returns to the GRUB menu. The system returns to the GRUB menu when the kernel
binary, kernel signature file, or both have been compromised. To load OS10, reboot your system using the other OS10 image.
After OS10 loads, reinstall the OS10 image to replace the invalid image.
● If the OS10 system binary file validation fails, the OS10 image loads only in EXEC mode. Configuration mode is blocked. You
can reboot your system using the other OS10 image and replace the invalid image with a valid OS10 image.
● If both the installed OS10 images are compromised, you must install a new image using ONIE. For more information, see
Installation using ONIE.
● If the validation of the kernel and OS10 system binary files succeeds, OS10 loads successfully.
NOTE:
If you are installing OS10 image using zero touch deployment (ZTD):
● Secure boot is disabled after ZTD reloads the switch.
Security 1331