{"id":10983,"date":"2024-05-22T23:23:41","date_gmt":"2024-05-23T04:23:41","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=10983"},"modified":"2024-05-24T23:49:39","modified_gmt":"2024-05-25T04:49:39","slug":"signing-kernel-modules","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=10983","title":{"rendered":"Signing Kernel Modules"},"content":{"rendered":"\n

The new servers being built at work use SecureBoot — something that you don’t even notice 99% of the time. But that 1% where you are doing something “strange” like trying to use OpenZFS … well, you’ve got to sign any kernel modules that you need to use. Just installing them doesn’t work — they won’t load. <\/p>\n\n\n\n

To sign a kernel module, first you need to create a signing key and use mokutil to import it into the machine owner key store. <\/p>\n\n\n

\ncd \/root\nmkdir signing\ncd signing\nopenssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "\/CN=Windstream\/"\n\nmokutil --import MOK.der\n<\/pre><\/div>\n\n\n
When you run mokutil, you will set a password. This password will be needed to complete importing the key to the machine.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Get access to the console — out of band management, vSphere manager, stand in front of the server. Reboot, and there will be a “press any key” screen for ten seconds that begins the import process. Press any key!<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
 Select “Enroll MOK”<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
View the key and verify it is the right one, then use ‘Continue’ to import it<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Enter the password used when you ran mokutil<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Then reboot<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
To verify your key has been successfully enrolled:<\/p>\n\n\n
\nmokutil --list-enrolled\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"
The new servers being built at work use SecureBoot — something that you don’t even notice 99% of the time. But that 1% where you are doing something “strange” like trying to use OpenZFS … well, you’ve got to sign any kernel modules that you need to use. Just installing them doesn’t work — they …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[294,2021,2020,1195],"class_list":["post-10983","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-linux","tag-machine-owner-key","tag-mok","tag-redhat"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/10983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10983"}],"version-history":[{"count":2,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/10983\/revisions"}],"predecessor-version":[{"id":10999,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/10983\/revisions\/10999"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}