As usual the Arch wiki is one of the best resources for this. Not everything is applicable on Debian but should answer most questions. https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
this post was submitted on 07 Jul 2023
19 points (80.6% liked)
Linux
48430 readers
937 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
Most but not all :) Thanks.
I think pcr 7+8 (for grub) or pcr 7+12 (for systemd-boot) should be okay. The more pcr you add, the higher likelihood you need to re-enroll after updates.
https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html
The reason why using your own keys can be a problem is if you exclude the Microsoft certificates, then oproms from graphics cards stop working. You have to add the Microsoft certs after using your own key for the top level platform key.
For Debian, if you use out of kernel modules like Nvidia, you have create signing keys and edit a config file so dkms to sign those modules for those modules to work with Secure Boot. Instructions are on the Debian wiki.
The more pcr you add, the higher likelihood you need to re-enroll after updates
So that means if I run upgrades and forget to re-enroll I'll get a broken system that I won't be able to boot to and fix it?
That just means the TPM will not auto unlock the encrypted disk. You would have to unlock with whatever LUKS password (or key file) you set for that drive. There is optionally a TPM master key you can export that is similar to the Microsoft Bitlocker password (40 digit number iirc), that Lennart mentioned in his blog. If you deleted any other key slots and do not have that TPM master key, you will not be able to unlock the LUKS drive.
If you look at that freedesktop manpage I linked, it states some of the PCR values and what each one measures. When you enroll a PCR, that value is stored in the TPM. If anything differs between the system and the TPM, the TPM will refuse to unlock that encrypted drive.
For example, PCR 0 measures your motherboard UEFI firmware. If you update the firmware, the TPM will not unlock your LUKS drive until you re-enroll the drive once again. Is is a personal choice, but enrolling certain PCR into the TPM can be more inconvenient.
Thank you for the clarification.
While I don't know how well your hardware can work with secure boot, this is a good guide to get started on Arch. https://swsnr.de/2022/01/06/install-arch-with-secure-boot-tpm2-based-luks-encryption-and-systemd-homed.html Don't know how well Debian supports any of the mentioned tools but you probably shouldn't be going with Debian's implementation of secure boot as it uses Microsoft's keys.
I use TPM pcrs 0,1 and 7 with no issues across reboots and zero prompts to unlock LUKS as dracut resigns my kernel images on every update.
From what I can understand Debian uses a generic shim that is signed with Microsoft's keys and then it delegates the rest to the system. Apparently this is a fast way to get secure boot to work but "SHIM only checks signatures of the boot loader and kernel, but not the GRUB config file or initramfs, which opens your machine to attacks". This is why I was looking for a more detailed guide from someone who actually understands this from start to end.
fast way to get secure boot to work
vs best use of secure boot. Your pick.
Your GRUB can be encrypted behind FDE and iirc there is also an option to create a password for grub. So far I haven't seen cases of bootloaders being compromised/bypassed so we are not there yet.
Pretty sure there's not a lack of guides for setting up secure boot on Ubuntu/Debian, unless you are looking for something specific.
Yes, there are but they mostly assume the use of the SHIM. That was the reason why I posted this.
view more: next ›