dellemc.openmanage.idrac_secure_boot module – Configure attributes, import, or export secure boot certificate, and reset keys.

Note

This module is part of the dellemc.openmanage collection (version 9.9.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install dellemc.openmanage. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: dellemc.openmanage.idrac_secure_boot.

New in dellemc.openmanage 9.6.0

Synopsis 

This module allows you to perform the following operations.`
Import or Export Secure Boot certificate.
Enable or disable Secure Boot mode.
Configure Platform Key (PK) and Key Exchange Key (KEK) policies
Configure Allow Database (DB) and Disallow Database (DBX) certificates.
Reset UEFI Secure Boot keys.

Requirements 

The below requirements are needed on the host that executes this module.

python >= 3.9.6

Parameters 

Parameter	Comments
boot_mode string	Boot mode of the iDRAC. `Uefi` enables the secure boot in UEFI mode. `Bios` enables the secure boot in BIOS mode. Choices: `"Uefi"` `"Bios"`
ca_path path added in dellemc.openmanage 5.0.0	The Privacy Enhanced Mail (PEM) file that contains a CA certificate to be used for the validation.
database list / elements=path	A list of absolute paths of the Allow Database(DB) certificate file for UEFI secure boot. Directory path with write permission when export_certificates is `true`.
disallow_database list / elements=path	A list of absolute paths of the Disallow Database(DBX) certificate file for UEFI secure boot. Directory path with write permission when export_certificates is `true`.
export_certificates boolean	Export all the available certificates in the specified directory for the given keys. export_cetificates is mutually exclusive with import. export_cetificates is `true` either of platform_key or i(key_exchange_key) or database - or disallow_database is required. Choices: `false` `true`
force_int_10 string	Determines whether the system BIOS loads the legacy video (INT 10h) option ROM from the video controller. This parameter is supported only in UEFI boot mode. If UEFI Secure Boot mode is enabled, you cannot enable this parameter. `Disabled` if the operating system supports UEFI video output standards. `Enabled` if the operating system does not support UEFI video output standards. Choices: `"Disabled"` `"Enabled"`
idrac_ip string / required	iDRAC IP Address.
idrac_password aliases: idrac_pwd string	iDRAC user password. If the password is not provided, then the environment variable `IDRAC_PASSWORD` is used. Example: export IDRAC_PASSWORD=password
idrac_port integer	iDRAC port. Default: `443`
idrac_user string	iDRAC username. If the username is not provided, then the environment variable `IDRAC_USERNAME` is used. Example: export IDRAC_USERNAME=username
import_certificates boolean	Import all the specified key certificates. When import_certificates is `true`, then either platform_key, KEK, database, or disallow_database is required. Choices: `false` `true`
job_wait boolean	Whether to wait till completion of the secure boot certificate operation. This is applicable when restart is `true`. Choices: `false` `true` ← (default)
job_wait_timeout integer	The maximum wait time of job_wait in seconds. The job is tracked only for this duration. This option is applicable when job_wait is `true`. Default: `1200`
KEK list / elements=path	A list of absolute paths of the Key Exchange Key (KEK) certificate file for UEFI secure boot. Directory path with write permission when export_certificates is `true`.
platform_key path	The absolute path of the Platform key certificate file for UEFI secure boot. Directory path with write permission when export_certificates is `true`.
reset_keys string	Resets the UEFI Secure Boot keys. `DeleteAllKeys` deletes the content of all UEFI Secure Boot key databases (PK, KEK, DB, and DBX). This choice configures the system in Setup Mode. `DeletePK` deletes the content of the PK UEFI Secure Boot database. This choice configures the system in Setup Mode. `ResetAllKeysToDefault` resets the content of all UEFI Secure Boot key databases (PK, KEK, DB, and DBX) to their default values. `ResetDB` resets the content of the DB UEFI Secure Boot database to its default values. `ResetDBX` resets the content of the DBX UEFI Secure Boot database to its default values. `ResetKEK` resets the content of the KEK UEFI Secure Boot database to its default values. `ResetPK` resets the content of the PK UEFI Secure Boot database to its default values. Choices: `"DeleteAllKeys"` `"DeletePK"` `"ResetAllKeysToDefault"` `"ResetDB"` `"ResetDBX"` `"ResetKEK"` `"ResetPK"`
restart boolean	Secure boot certificate import operation requires a server restart. This parameter provides an option to restart the server. `true` restarts the server. `false` does not restart the server. restart is applicable when import_certificates is `true`. restart will be ignored only when export_certificates is `true`. Choices: `false` ← (default) `true`
restart_type string	Restart type of the server. `ForceRestart` forcefully restarts the server. `GracefulRestart` gracefully restarts the server. restart_type is applicable when restart is `true`. Choices: `"GracefulRestart"` ← (default) `"ForceRestart"`
secure_boot string	UEFI Secure Boot. The secure_boot can be `Enabled` only if boot_mode is `UEFI` and force_int_10 is `Disabled`. `Disabled` disables the secure boot mode. `Enabled` enables the secure boot mode. Choices: `"Disabled"` `"Enabled"`
secure_boot_mode string	The UEFI Secure Boot mode configures how to use the Secure Boot Policy. `AuditMode` sets the Secure Boot mode to an Audit mode when Platform Key is not installed on the system. The BIOS does not authenticate updates to the policy objects and transition between modes. BIOS performs a signature verification on pre-boot images and logs the results in the Image Execution Information table, where it processes the images whether the status of verification is pass or fail. `DeployedMode` sets the Secure Boot mode to a Deployed mode when Platform Key is installed on the system, and then BIOS performs a signature verification to update the policy objects. `UserMode` sets the Secure Boot mode to a User mode when Platform Key is installed on the system, and then BIOS performs signature verification to update policy objects. Choices: `"AuditMode"` `"DeployedMode"` `"UserMode"`
secure_boot_policy string	The following are the types of Secure Boot policy. `Custom` inherits the standard certificates and image digests that are loaded in the system by default. You can modify the certificates and image digests. `Standard` indicates that the system has default certificates, image digests, or hash loaded from the factory. When the Secure Boot Policy is set to Custom, you can perform following operations such as viewing, exporting, importing, deleting, deleting all, and resetting policies. Choices: `"Custom"` `"Standard"`
timeout integer added in dellemc.openmanage 5.0.0	The socket level timeout in seconds. Default: `30`
validate_certs boolean added in dellemc.openmanage 5.0.0	If `false`, the SSL certificates will not be validated. Configure `false` only on personally controlled sites where self-signed certificates are used. Prior to collection version `5.0.0`, the validate_certs is `false` by default. Choices: `false` `true` ← (default)
x_auth_token string added in dellemc.openmanage 9.3.0	Authentication token. If the x_auth_token is not provided, then the environment variable `IDRAC_X_AUTH_TOKEN` is used. Example: export IDRAC_X_AUTH_TOKEN=x_auth_token

Attributes 

Attribute	Support	Description
check_mode	Support: full	Runs task to validate without performing action on the target machine.
diff_mode	Support: none	Runs the task to report the changes made or to be made.

Notes 

Note

This module will always report changes found to be applied for import_certificates when run in check mode.
This module does not support idempotency when reset_type or export_certificates or import_certificates is provided.
To configure the secure boot settings, the idrac_secure_boot module performs the following order of operations set attributes, export certificate, reset keys, import certificate, and restart iDRAC.
export_certificate will export all the certificates of the key defined in the playbook.
This module considers values of restart and job_wait only for the last operation in the sequence.
This module supports IPv4 and IPv6 addresses.
Only reset_keys is supported on iDRAC8.

Examples 

---
- name: Enable Secure Boot.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    secure_boot: "Enabled"

- name: Set Secure Boot mode, Secure Boot policy, and restart iDRAC.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    secure_boot: "Enabled"
    secure_boot_mode: "UserMode"
    secure_boot_policy: "Custom"
    restart: true
    restart_type: "GracefulRestart"

- name: Reset Secure Boot certificates.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    reset_keys: "ResetAllKeysToDefault"

- name: Export multiple Secure Boot certificate.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    export_certificates: true
    platform_key: /user/name/export_cert/pk
    KEK:
      - /user/name/export_cert/kek
    database:
      - /user/name/export_cert/db
    disallow_database:
      - /user/name/export_cert/dbx

- name: Import multiple Secure Boot certificate without applying to iDRAC.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    import_certificates: true
    platform_key: /user/name/certificates/pk.pem
    KEK:
      - /user/name/certificates/kek1.pem
      - /user/name/certificates/kek2.pem
    database:
      - /user/name/certificates/db1.pem
      - /user/name/certificates/db2.pem
    disallow_database:
      - /user/name/certificates/dbx1.pem
      - /user/name/certificates/dbx2.pem

- name: Import a Secure Boot certificate and restart the server to apply it.
  dellemc.openmanage.idrac_secure_boot:
    idrac_ip: "192.168.1.2"
    idrac_user: "user"
    idrac_password: "password"
    ca_path: "/path/to/ca_cert.pem"
    import_certificates: true
    platform_key: /user/name/certificates/pk.pem
    restart: true
    job_wait_timeout: 600

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key

Description

error_info

dictionary

Details of the HTTP Error.

Returned: on HTTP error

Sample: {"error": {"@Message.ExtendedInfo": [{"Message": "Unable to process the request because an error occurred.", "MessageArgs": [], "MessageId": "GEN1234", "RelatedProperties": [], "Resolution": "Retry the operation. If the issue persists, contact your system administrator.", "Severity": "Critical"}], "code": "Base.1.0.GeneralError", "message": "A general error has occurred. See ExtendedInfo for more information."}}

msg

string

Status of the secure boot operation.

Returned: always

Sample: "Successfully imported the SecureBoot certificate."

Authors

Abhishek Sinha(@ABHISHEK-SINHA10)
Lovepreet Singh (@singh-lovepreet1)

dellemc.openmanage.idrac_secure_boot module – Configure attributes, import, or export secure boot certificate, and reset keys.

Synopsis

Requirements

Parameters

Attributes

Notes

Examples

Return Values