5.2. 使用安全引导在 Azure 上配置 RHEL 虚拟机

流程

1. 使用 openssl 工具生成自定义证书 custom_db.cer ：

   $ openssl req -quiet \
   -newkey rsa:4096 \
   -nodes -keyout custom_db.key \
   -new -x509 \
   -sha256 -days 3650 \
   -subj "/CN=Signature Database key/" \
   --outform DER \
   -out custom_db.cer

2. 将证书转换为 base64 编码的格式：

   $ echo `base64 -w0 custom_db.cer`

   MIIFIjCCAwqgAwIBAgITNf23J4k0d8c0NR ...

3. 创建并编辑 azure-example-template.json Azure Resource Manager (ARM)文件，以注册新的 Azure Compute Gallery 镜像版本：

   $ vi azure-example-template.json

   {
       "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
       "contentVersion": "1.0.0.0",
       "resources": [
           {
               "type": "Microsoft.Compute/galleries/images/versions",
               "apiVersion": "2023-07-03",
               "name": "__<your compute gallery/your image definition/version>__",
               "location": "__<location of the VHD>__",
               "properties": {
                   "storageProfile": {
                       "osDiskImage": {
                           "source": {
                               "id": "__<your-storage-account-id>__",
                               "uri": "__<url-with-the-vhd>__"
                           },
                           "hostCaching": "ReadOnly"
                       }
                   },
                   "securityProfile": {
                       "uefiSettings": {
                           "signatureTemplateNames": [
                               "MicrosoftUefiCertificateAuthorityTemplate"
                           ],
                           "additionalSignatures": {
                               "db": [
                                   {
                                       "type": "x509",
                                       "value": [
                                           "__<base64 of custom_db.cer>__"
                                       ]
                                   }
                               ]
                           }
                       }
                   }
               }
           }
       ]
   }

4. 使用 azure-cli 工具注册镜像版本：

   $ az deployment group create --name <example_deployment> \
   --resource-group <example_resource_group> \
   --template-file <example_template.json>

5. 从 Azure 门户重启实例。

验证

1. 检查新创建的 RHEL 实例是否启用了安全引导：

   $ mokutil --sb-state

   SecureBoot enabled

2. 使用 keyctl 工具验证自定义证书的内核 keyring ：

   $ sudo keyctl list %:.platform

   keys in keyring:
   ...
   586621657: ---lswrv 0 0
   asymmetric: _Signature Database key_: f064979641c24e1b935e402bdbc3d5c4672a1acc
   ...