Stay Protected with Librem 14’s Latest Pureboot Feature
Latest posts by David Hamner (see all)
- Easy App Development: Text Forwarding - January 22, 2024
- Retain Your Control and Customize Everything with Modular Software - January 22, 2024
- Nasty Software - December 18, 2023
The Librem 14 Pureboot bundle is pushing the envelope on security tools. Newly added to our latest PureBoot release is a feature that protects against file changes on your root filesystem. This is the same validation done on the boot partition, simply expanded to specified directories on the root filesystem. This allows you to cryptographically sign your OS files with keys in your control.
Why to Enable This Feature
Enabling this feature on boot adds a few minutes to startup but protects against many filesystem-level attacks. Our chief security officer Kyle Rankin explains how he created this feature and precisely what this does and dost not protect against.
Upgrading PureBoot
To get the new root scanning feature enabled, you’ll need to be running our latest PureBoot. If you’re running an older version, you’ll need to upgrade. To do so, download and extract the Librem-14 Pureboot ROM onto a USB flash drive. Then attach your USB to your Librem 14 and boot it.
Press any key on startup to interrupt the boot process, then select ‘options’, ‘Flash/Upgrade the BIOS’, then Select Flash the firmware with new ROM retaining all settings.
Next, select the attached USB, then select the ROM file on your USB.
You’ll see a successful flash message if everything goes well. Note, the subsequent restart will take a bit of time.
How to Enable the New feature
With the BIOS updated and paired with the Librem Key, let’s start by generating new hashes for the filesystem.
Go back to options, then select Check/Update file hashes on root disk, then Update root hashes.
This process will take a few minutes
You can use the same menu to “check the root hashes” for any changes that may have occurred. This is a handy way to verify your root filesystem on demand.
You can also precisely control which root folders are validated by selecting options, Configuration settings, Change the root directories to hash.
Enter the folders you want checked, separated with a space and without a leading slash.
You can enable auto root hash checking for every boot from the same menu.
Make sure to select “Save the current configuration to the running BIOS” to make the alterations persistent.
Saving the settings will take about a minute to complete, and you’ll need to re-sign your boot files and regenerate your HOTP/TOTP secret.
With these settings applied, your Librem 14 will now validate your root folders automatically on startup.
How to Manage the Changes
If you run updates or change a file in one of your checked root folders, you’ll get prompted about the changes the next time you boot, if you set PureBoot to scan the root file system at each boot. Otherwise the changes will only get detected the next time you run a scan. In either case you need to mark the changes as valid so you can tell the legitimate changes apart from future tampering. To do so, reboot and select options, select Check/Update file hashes on the root disk, and then update root hashes.If a bad file is detected, you’ll have the option to abort the boot and investigate.
Troubleshooting could include mounting your filesystem, looking at the files
You can also chroot into your system with a known unaltered kernel.
For advice on how to handle your particular case, our support staff can walk you through possible solutions. Here is how to get in touch
Purism Products and Availability Chart
| Model | Status | Lead Time | ||
|---|---|---|---|---|
 | Librem Key (Made in USA) | In Stock ($59+) | 10 business days | |
 | Librem 5 | In Stock ($699+) 3GB/32GB | 10 business days | |
| Librem 5 COMSEC Bundle | In Stock ($1299+) Qty 2; 3GB/32GB | 10 business days | |
| Liberty Phone (Made in USA Electronics) | Backorder ($1,999+) 4GB/128GB | Estimated fulfillment February | |
| Librem 5 + SIMple (3 GB Data) | In Stock ($99/mo) | 10 business days | |
| Librem 5 + SIMple Plus (5 GB Data) | In Stock ($129/mo) | 10 business days | |
| Librem 5 + AweSIM (Unlimited Data) | In Stock ($169/mo) | 10 business days | |
 | Librem 11 | In Stock ($999+) 8GB/1TB | 10 business days | |
 | Librem 14 | Backorder ($1,370+) | Estimated fulfillment December | |
 | Librem Mini | Backorder ($799+) | 10 business days | |
 | Librem Server | In Stock ($2,999+) | 45 business days |
Recent Posts
Related Content
- PureOS Crimson Development Report: October 2024
- The Case for Free/Libre and Open-Source Software: Enhancing Security and Privacy in the Digital Age
- RIP RSA AES: The Immediate Need of Quantum-Resistant Cryptography
- PureOS Crimson Development Report: September 2024
- True Choice for Smartphone Privacy and Security
