Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is multi-factor authentication supported by any current bios'es?

Update What I want to do is to make it impossible to go into the bios setup without both a password and another factor.

It would also be nice to be able to prevent boot without the "other" factor.

Specific hardware/bios combinations which support this would also be interesting as a part of the answer.

share|improve this question

3 Answers 3

It's difficult to say, since there could be a BIOS somewhere that does it, but I've not been able to find anything. You're probably going to have to stick to password protecting your BIOS.

If you're looking for a way to secure your system with multi-factor authentication, consider setting up TrueCrypt and using system (boot) encryption to encrypt the entire disk. This allows you to set a password to decrypt the disk at boot, and (if I remember correctly) you can use keyfiles off any standard USB mass storage device in newer versions.

share|improve this answer

There has been some work done for gPXE and Etherboot, which is by default on KVM and can be loaded to the network card: http://etherboot.org/wiki/safebootmode

Simply gPXE on the network card would have to be protected the way that it's not writable or extractable from the OS, and it can load the kernel over the network, check hash.

Not sure how actually PXE BIOS can be secured, on the KVM this should be pretty much OK and I am actually interested in this, as I use gPXE a bit.

share|improve this answer
    
Interesting. But not exactly what I am looking for. I wanted to prevent bios access/startup on the machine locally. I have updated the question. –  steenhulthin Aug 16 '12 at 5:57
up vote 0 down vote accepted

After some more researching I have found that Fujitsu has some solutions using smartcards. (more info: http://uk.ts.fujitsu.com/rl/servicesupport/techsupport/Software/SystemLock/SystemLock.htm ).

For instance Fujitsu Celsius H710 and H910 do support smartcards as a second factor for bios login it seems. (Celsius H710 manual (p. 60): http://support.ts.fujitsu.com/manuals/ShowDescription_KMT.asp?DokuID=219009 )

I suspect that other vendors have similar solutions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.