|
Is multi-factor authentication supported by any current bios'es? Update What I want to do is to make it impossible to go into the bios setup without both a password and another factor. It would also be nice to be able to prevent boot without the "other" factor. Specific hardware/bios combinations which support this would also be interesting as a part of the answer. |
||||
|
|
It's difficult to say, since there could be a BIOS somewhere that does it, but I've not been able to find anything. You're probably going to have to stick to password protecting your BIOS. If you're looking for a way to secure your system with multi-factor authentication, consider setting up TrueCrypt and using system (boot) encryption to encrypt the entire disk. This allows you to set a password to decrypt the disk at boot, and (if I remember correctly) you can use keyfiles off any standard USB mass storage device in newer versions. |
|||
|
|
|
There has been some work done for gPXE and Etherboot, which is by default on KVM and can be loaded to the network card: http://etherboot.org/wiki/safebootmode Simply gPXE on the network card would have to be protected the way that it's not writable or extractable from the OS, and it can load the kernel over the network, check hash. Not sure how actually PXE BIOS can be secured, on the KVM this should be pretty much OK and I am actually interested in this, as I use gPXE a bit. |
|||
|
|
After some more researching I have found that Fujitsu has some solutions using smartcards. (more info: http://uk.ts.fujitsu.com/rl/servicesupport/techsupport/Software/SystemLock/SystemLock.htm ). For instance Fujitsu Celsius H710 and H910 do support smartcards as a second factor for bios login it seems. (Celsius H710 manual (p. 60): http://support.ts.fujitsu.com/manuals/ShowDescription_KMT.asp?DokuID=219009 ) I suspect that other vendors have similar solutions. |
|||
|
|
