Secure Boot and the TPM
Everything your server does rests on the assumption that the code it booted is the code you installed. Secure Boot and the TPM are how a machine can actually check that, rather than trusting it blindly.
A server’s whole security story assumes the operating system that booted is the one you trust. But the boot chain — firmware, bootloader, kernel — runs before any of your defences, and tampering there is invisible to everything above it. Secure Boot and the TPM close that blind spot.
What Secure Boot does
Secure Boot has the firmware verify a cryptographic signature on each stage of the boot — bootloader, then kernel — before running it. Unsigned or tampered code is refused. It stops a class of attack where malware installs itself below the operating system, where no antivirus or audit inside the OS can see it.
What the TPM adds
The TPM is a small secure chip that measures each boot stage into tamper-resistant registers. Those measurements can then gate secrets: for example, a disk encryption key that is only released if the machine booted exactly as expected. Change the boot chain and the key stays locked. This is how disk encryption can unlock automatically yet still resist an attacker who swaps the boot media.
The threat it addresses
This is about physical and firmware-level tampering — an “evil maid” with access to the hardware, or malware persisting beneath the OS. For a server in a controlled rack that is a smaller risk than for a laptop, which is why it matters most for machines holding sensitive data or in less controlled locations. See who secures what.
The practical caveats
- Custom or out-of-tree kernel modules must be signed, or Secure Boot refuses them
- TPM-sealed secrets break deliberately when the boot changes — including legitimate kernel updates, so you need a recovery path
- It protects the boot, not a running system someone has valid access to
When to turn it on
Worth it for machines holding regulated or high-value data, or where you cannot fully trust physical access. For a general web server behind good access control it is defence in depth rather than a necessity. If you want it set up — including TPM-backed disk unlock — tell us; our machines ship with the hardware for it. See IPMI and the BMC.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base