Dell PowerSwitch S5212F-ON EMC SmartFabric OS10 User Guide Release 10.5.1 - Page 1139

● Enable bootloader protection in EXEC mode. Use the boot protect enable command to configure a username and password. You can configure up to three users per switch. OS10# boot protect enable username root password calvin Disable bootloader protection for a specified user by using the boot protect disable command. Enable bootloader protection OS10# boot protect enable username root password calvin Disable bootloader protection OS10# boot protect disable username root Display bootloader protectection OS10# show boot protect Boot protection enabled Authorized users: root linuxadmin admin Secure Boot OS10 secure boot verifies the authenticity and integrity of the OS10 image. Secure boot protects a system from malicious code being loaded and executed during the boot process. Using secure boot, you can validate the OS10 image during installation and on demand at any time. Secure boot: ● prevents the OS10 software, including the kernel and system files, from being compromised during the boot operation ● verifies the new digital image signature before installation ● protects and validates the startup configuration file at startup OS10 checks the validity of the OS10 image before you install or upgrade your system: ● To check the validity of the OS10 image before you upgrade, see Validate and upgrade OS10 image. ● To check the validity of the OS10 image before you install it, see Validate OS10 image before manual installation from ONIE. If you have already installed Release 10.5.1.0 or later, to enable secure boot, see Enable secure boot. Enable secure boot Enabling the secure boot feature prevents the OS10 software (kernel and system binaries) from being compromised during the boot operation. Secure boot is disabled by default. To enable secure boot, use the secure-boot enable command or RESTCONF API. OS10 stores the kernel signatures and system-file hashes internally. When you enable secure boot, OS10 uses the signatures and hashes to validate the binaries during the next and future reboots. OS10 has two images, A and B. One image is active, which is the current running version and used as the running software at the next system reload. The other image remains standby, used for software upgrades. You can use the secure-boot verify command to validate the kernel, system binaries, and startup configuration file for both the installed images at any time. secure-boot verify {kernel | file-system-integrity | startup-config} After a switch reboot: ● If kernel binary file validation fails, OS10 returns to the GRUB menu. The system returns to the GRUB menu when the kernel binary, kernel signature file, or both have been compromised. To load OS10, reboot your system using the other OS10 image. After OS10 loads, reinstall the OS10 image to replace the invalid image. ● If the OS10 system binary file validation fails, the OS10 image loads only in EXEC mode. Configuration mode is blocked. You can reboot your system using the other OS10 image and replace the invalid image with a valid OS10 image. ● If both the installed OS10 images are compromised, you must install a new image using ONIE. For more information, see Installation using ONIE. Security 1139