coelner/gedankensplitter
1
0
Fork 0
Code Pull Requests Releases Activity
0e3e970f16
gedankensplitter/linux_hardening.md
user 3d1b29ad34 linux_hardening
2022-03-02 16:17:56 +01:00

690 B
Raw Blame History

secureboot

Most of the distributions are delievered with a microsoft-signed SHIM bootloader, which should allow the boot with active secureboot without deleting OEM keys. the SHIM bootloader gets controlled with mokutil.

  • systemctl reboot --firmware
  • bootctl
  • efibootmgr -v
  • mokutil --sb-state
  • mokutil --list-enrolled
  • mokutil --enable-validation

ubuntu

ubuntu provides a update-secureboot-policy script to generate and enroll a secureboot mok, but this needs an already active secureboot.

cryptsetup luks

crypsetup luksDump /dev/sdaX cryptsetup luksChangeKey /dev/sdaX cryptsetup luksErase

ressource: http://jk.ozlabs.org/docs/sbkeysync-maintaing-uefi-key-databases/