5.2. Configuring a RHEL instance on the AWS Marketplace with Secure Boot

Prerequisites

1. You have installed the following packages on the RHEL instance:

   • awscli2
   • python3
   • openssl
   • efivar
   • keyutils
   • edk2-ovmf
   • python3-virt-firmware

2. You have verified that the RHEL AMI has the uefi-preferred option enabled in boot settings:

   $ aws ec2 describe-images \
   --image-id ami-0a951f007be151ff9 \
   --region us-east-2 \
   | grep -E '"ImageId"|"Name"|"BootMode"'

   "Name": "RHEL-10.1.0_HVM-20260217-x86_64-0-Hourly2-GP3",
   "BootMode": "uefi-preferred",
   "ImageId": "ami-0a951f007be151ff9",

   주의

   Store your private keys separately from the RHEL instance where you use them. If an intruder gains access to the instance, they could use the stored secrets to escalate their privileges and compromise your system security.

3. You have verified the platform status of the RHEL Marketplace AMI instance:

   $ sudo mokutil --sb-state

   SecureBoot disabled
   Platform is in Setup Mode

   The setup mode allows updating the Secure Boot UEFI variables within the instance.

Procedure

1. Generate a custom_db.cer custom certificate:

   $ openssl req -quiet \
   -newkey rsa:3072 \
   -nodes -keyout custom_db.key \
   -new -x509 -sha256 \
   -days 3650 \
   -subj "/CN=Signature Database key/" \
   --outform DER -out custom_db.cer

2. Generate UEFI variables file by using the virt-fw-vars utility:

   $ virt-fw-vars --enroll-redhat \
   --add-db-cert OvmfEnrollDefaultKeys custom_db.cer \
   --set-dbx /usr/share/edk2/ovmf/DBX* \
   --output-auth .

   For details, see the virt-fw-vars(1) man page on your system.

3. Convert Public Key (PK) variable to the Extensible Firmware Interface (EFI) Signature List (ESL) format:

   $ tail -c +41 PK.auth > PK.esl

   참고

   Each GUID is an assigned value and represents an EFI parameter:

   • 8be4df61-93ca-11d2-aa0d-00e098032b8c: EFI_GLOBAL_VARIABLE_GUID
   • d719b2cb-3d3a-4596-a3bc-dad00e67656f: EFI_IMAGE_SECURITY_DATABASE_GUID

   The EFI_GLOBAL_VARIABLE_GUID parameter maintains settings of the bootable devices and boot managers, while the EFI_IMAGE_SECURITY_DATABASE_GUID parameter represents the image security database for Secure Boot variables db, dbx, and storage of required keys and certificates.

4. Transfer the database certificates to the target instance, use the efivar utility to manage UEFI environment variables.

   1. To transfer Key Exchange Key (KEK.auth), enter:

      $ sudo efivar -w -A 0x67 -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-KEK -f KEK.auth

   2. To transfer allowed signature database (db.auth), enter:

      $ sudo efivar -w -A 0x67 -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-db -f db.auth

   3. To transfer forbidden signature database (dbx.auth) for x64 architecture, enter:

      $ sudo efivar -w -A 0x67 -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-dbx -f dbx.auth

   4. To transfer PK.esl, enter:

      $ sudo efivar -w -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-PK -f PK.esl

5. Reboot the instance from the AWS console.