Detections
Analytics

1.2 Host hardware must enable UEFI Secure Boot

Information

UEFI Secure Boot is a security feature of the Unified Extensible Firmware Interface (UEFI) specification. Its primary purpose is to ensure that only signed and trusted boot loaders and operating system kernels are allowed to execute during the system startup. This helps protect systems from malware and unauthorized software that might try to run before the operating system loads. By verifying the digital signatures of bootable applications and drivers, Secure Boot prevents potentially harmful code from compromising the boot process.

Enabling UEFI Secure Boot on the ESXi host hardware helps prevent malware and untrusted configurations.

Solution

You must enable the physical server's UEFI Secure Boot in the server BIOS/UEFI.

 -

Put the non-compliant Host into maintenance mode:
vim-cmd hostsvc/maintenance_mode_enter

 -

Verify Secure Boot compatibility:
/usr/lib/vmware/secureboot/bin/secureBoot.py -c

 -

Restart the ESXi host with the reboot command.

 -

on the ESXI physical host BIOS/UEFI configuration, ensure that "boot mode" is UEFI

 -

Under Boot or Security menus, look for "Secure Boot" and set it to "Enabled".

 -

Save all modified firmware changes and reboot the ESXi host.

 -

Verify results.

Impact:

Enabling this after installation may render the host unbootable. Refer to the vSphere documentation for more information about enabling Secure Boot.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CSCv7|5.4, CSCv7|18.4

Plugin: Unix

Control ID: dfec1777d139860398b92edbc1722150bee512a682ef00a9b391611b3ee8e4fe