securing Ubuntu bootloader using TPM

Question

I am currently working with Ubuntu 16.04 , with an Intel CPU that supports TPM2 module.

I am trying to harden my boot-loader, i tried using trustedgrub2 fork that supports TPM2 , i understand that trustedgrub2 currently does not support UEFI BIOS so i switched to UEFI-CSM which should emulate the legacy BIOS , unfortunately after installing trustedgrub , the system still boots with the GRUB2.

I also tried using tboot , but it seems that there is almost no documentation to be found anywhere.

My questions are , is there any good tutorial for using/installing trustedgrub2? or maybe is there any alternative to the options above to make the boot process more secure?

Thanks!

https://www1.cs.fau.de/filepool/projects/mark/index.html – forest Oct 24 '18 at 02:48 — forest, Oct 24 '18 at 02:48

score 1 · Answer 1 · 2018-10-23T10:50:06.970

1

Ubuntu supports Secure Boot. This requires UEFI-only mode. Please disable CSM. The TPM can be used by the Linux Integrity Measurement Architecture.

Back in the day, apparently IMA was very immature.
Progress is made.
It seems like IMA is compiled into Ubuntu since 14.04, according to this page.

From what i've been reading, still some works needs to be done.

edited Oct 23 '18 at 10:50

answered Oct 23 '18 at 10:17

Your answer does not explain how to secure the _bootloader_. – forest Oct 24 '18 at 02:47

odo · Answer 2 · 2018-10-24T08:17:53.310

Here are the steps to run tboot:

Enable EFI booting mode in BIOS setup menu, enable VT-x, VT-d, TPM ,TXT in BIOS setup menu, save and exit
apt-get update
apt-get install tpm-tools
apt-get install mercurial
hg clone http://hg.code.sf.net/p/tboot/code tboot-code
cd tboot-code/tboot
make install
cd ../utils
make install
copy your /sbin/init to /boot
grub-mkconfig -o /boot/grub/grub.cfg
reboot
select tboot from grub boot menu
login as root
run txt-stat, after booting into ubuntu

Taken from here: https://sourceforge.net/p/tboot/wiki/Home/

Actually, on Ubuntu 18.04.1 it works like that:

sudo txt-stat | grep TRUE 
    senter_done: TRUE
    private_open: TRUE
    locality_1_open: TRUE
    locality_2_open: TRUE
    secrets: TRUE
    lock: TRUE
TXT measured launch: TRUE
secrets flag set: TRUE
TBOOT: TPM nv_locked: TRUE
TBOOT: TPM nv_locked: TRUE

securing Ubuntu bootloader using TPM

2 Answers2