5.2. 使用安全引导在 Azure 上配置 RHEL 虚拟机

流程

1. 使用 openssl 工具生成自定义证书 custom_db.cer ：

   $ openssl req -quiet \
   -newkey rsa:4096 \
   -nodes -keyout custom_db.key \
   -new -x509 \
   -sha256 -days 3650 \
   -subj "/CN=Signature Database key/" \
   --outform DER \
   -out custom_db.cer

2. 将证书转换为 base64编码的格式：

   $ echo base64 -w0 custom_db.cer
   
   MIIFIjCCAwqgAwIBAgITNf23J4k0d8c0NR ....

3. 创建并编辑 azure-example-template.json Azure Resource Manager (ARM)文件，以注册新的 Azure Compute Gallery 镜像版本：

   $ vi azure-example-template.json
   
   {
       "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
       "contentVersion": "1.0.0.0",
       "resources": [
           {
               "type": "Microsoft.Compute/galleries/images/versions",
               "apiVersion": "2023-07-03",
               "name": "<your compute gallery/your image definition/version>",
               "location": "<location of the VHD>",
               "properties": {
                   "storageProfile": {
                       "osDiskImage": {
                           "source": {
                               "id": "<your-storage-account-id>",
                               "uri": "<url-with-the-vhd>"
                           },
                           "hostCaching": "ReadOnly"
                       }
                   },
                   "securityProfile": {
                       "uefiSettings": {
                           "signatureTemplateNames": [
                               "MicrosoftUefiCertificateAuthorityTemplate"
                           ],
                           "additionalSignatures": {
                               "db": [
                                   {
                                       "type": "x509",
                                       "value": [
                                           "<base64 of custom_db.cer>"
                                       ]
                                   }
                               ]
                           }
                       }
                   }
               }
           }
       ]
   }

4. 使用 azure-cli 工具注册镜像版本：

   $ az deployment group create --name <example-deployment> \
   --resource-group <example-resource-group> \
   --template-file <example-template.json>

5. 从 Azure 门户重启实例。

验证

1. 检查新创建的 RHEL 实例是否启用了安全引导机制：

   $ mokutil --sb-state
   SecureBoot enabled

2. 使用 keyctl 工具验证自定义证书的内核密钥环：

   $ sudo keyctl list %:.platform
   
   keys in keyring:
   ...
   586621657: ---lswrv   0   0
   asymmetric: Signature Database key: f064979641c24e1b935e402bdbc3d5c4672a1acc
   ...