iDRAC9 Security Configuration Guide

System Password

N/A

Enables you to set the system password which is the password that you must enter to allow the system to boot to an OS. This option is read-only if the password jumper (PWRD_EN) is not installed in the system. A password has up to a maximum of 32 characters. Enable a Setup Password using SHA256 hash and salt.

Setup Password

Enables you to set the Setup password. The Setup password is the one you must enter to change any BIOS settings, except for the System password, which can be changed without entering the correct Setup password. This option is read-only if the password jumper (PWRD_EN) is not installed in the server. A password must have up to a maximum of 32 characters. Enable a System Password using SHA256 hash and salt.

Password Status

Unlocked/Locked

Locks the system password. To prevent the system password from being modified, set this option to locked and enable Setup password. This field also prevents the system password from being disabled by the user while the system is booting. Set password status to “Locked”.

Power Button

Enabled/Disabled

When set to Disabled, this blocks someone from pressing the power button to shut down the system, however, the system can still be powered on. This is a security setting as it protects from accidental or malicious powering off the system.

UEFI Variable Access

Standard/Controlled

This field provides varying degrees of securing UEFI variables. When set to Standard, UEFI variables are accessible in the OS based on the UEFI specification. When set to Controlled, selected UEFI variables are protected in the environment and new UEFI boot option entries are forced to be appended to the end of the current boot order.

In-Band Manageability Interface

Enabled/Disabled

When set to Disabled, this setting hides the Management Engine's (ME) HECI devices and the system's IPMI devices from the OS. This prevents the OS from changing the ME power capping settings, and blocks access to all in-band management tools. All management functions must be managed by using the out-of-band techniques.

Secure Boot

Enabled/Disabled

Allows you to enable Secure Boot, where the BIOS authenticates each component that is executed during the boot process using the certificates in the Secure Boot Policy. The following components are validated in the boot process:

• UEFI drivers that are loaded from PCIe cards
• UEFI drivers and executables from mass storage devices
• Operating System boot loaders

Secure Boot Policy

Standard/Custom

When Secure Boot Policy is Standard, the BIOS uses the system manufacturer’s key and certificates to authenticate pre-boot images. When Secure Boot Policy 33 Setting up BIOS on 14th Generation (14G) Dell PowerEdge Servers is set to Custom, the BIOS uses the user-customized key and certificates.

Secure Boot Mode

User Mode/Deploy Mode

Configures how the BIOS uses the Secure Boot Policy Objects (PK, KEK, db, and dbx). In Setup Mode and Audit Mode, PK is not present, and BIOS does not authenticate programmatic updates to the policy objects. In User Mode and Deployed Mode, PK is present, and BIOS performs signature verification on programmatic attempts to update policy objects.

Deployed Mode is the most secure mode. Use Setup, Audit, or User Mode when provisioning the system, then use Deployed Mode for normal operation. Available mode transitions depend on the current mode and PK presence. For more information about transitions between the four modes, see Figure 77 in the UEFI 2.6 specification.

In Audit Mode, the BIOS performs signature verification on pre-boot images and logs results in the Image Execution Information Table but executes the images whether they pass or fail verification. Audit Mode is useful for programmatically determining a working set of policy objects.

Secure Boot Policy Settings

N/A

Enables you to configure the Secure Boot Custom Policy. A user can enroll and delete the PK, KEK, db, and dbx entries.