Introduction
In this blog we will show to fix the alarm “Host TPM attestation” on ESXI hosts in VMware vCenter.
Issue
If we go to a cluster within VMware vCenter we will see the following alarm: “Host TPM attestation alarm”.
When we go further in to the alarm we will need to go to “Monitor” and “Triggered Alarms”.
Understanding the Cause
When we go further in to the alarm we will need to go to “Monitor” and “Triggered Alarms”. Here you will see all the current alarms. The one we are looking for is also showing here.
Now we click on the arrow to expand the alarm.
Here we will see information about the alarm, but also the cause of the alarm.
In our case the alarm is caused by not having “Secure Boot” enabled.
Solution
Enable Secure Boot on host
First we need to enable secure boot on our host. This can be done in either ILO/IDRAC or via the BIOS.
For the HPE ProLiant DL Series we will use BIOS.
For the DELL PowerEdge R Series we will use IDRAC.
Warning! Before starting with the solution, always make sure to put the hosts via vCenter in maintenance mode!
HPE ProLiant DL Series (BIOS)
To enter the bios of our HPE server we need to access the console via ILO.
1. browse to the ILO of the host and login to the ILO.
2. Look at the information and make sure “Trusted Platform Module” (TPM) is “Present: Enabled” and the “Module Type” is Present (in my case “TPM 2.0”).
3. Click on the console and choose “HTML5 Console” (I am using ILO 6, your interface may vary)
4. Head back to the vCenter to give the host a reboot.
5. Log a reason for the reboot and click on “OK”.
6. Now go back to the ILO and watch the console.
7. Keep a eye on the Console. Once you see the option for “F9” “System Utilities” press “F9”
8. Once the “System Utilities” has started we choose “System Configuration”.
9. Next we go in to “BIOS/Platform Configuration (RBSU)”.
10. Now we choose “Server Security”.
11. Now we have two options.
If on step 2 the “Trusted Platform Module” (TPM) was not on “Present:Enabled”, but on “Present:Disabled” we can enable this under “Trusted Platform Module Options”.
If on step 2 the “Trusted Platform Module” (TPM) was on “Present:Enabled” select “Secure Boot Settings” and go to step 14.
12. Enable the TPM and click “F10: Save”.
13. Next we will enable “Secure Boot”. Go to “Secure Boot Settings”.
14. Now click on the “Attempt Secure Boot” option and choose “Enabled”.
15. You will get the following message. Click on “OK”
16. Now you will see “Reboot Required”. Click on “Exit”.
17. Choose “F12: Save and Exit”.
18. You will get a message. Click on “OK”.
19. You will get a reboot message. Click on “Reboot”.
20. Go back to vCenter and wait until the server has rebooted.
DELL PowerEdge R Series (IDRAC)
In this part we will change the “Secure Boot” via IDRAC.
1. browse to the IDRAC of the host and login to the IDRAC.
2. Go to “Configuration” and choose “BIOS Settings”.
3. Now go to “System Security”.
4. Make sure “TPM Security” is “On”.
5. Now change “Secure Boot” to “Enabled” and click on “Apply”.
6. Now click on “At Next Reboot”.
7. Now we will go back to vCenter and reboot the host.
8. Log a reason for the reboot and click on “OK”.
9. The host will reboot and you will see the BIOS changes through IDRAC.
Enable Secure Boot on ESXi OS
In this part we will enable “Secure Boot” on the ESXi host. First we need to enable SSH to connect to the host. After that we can enable “Secure Boot”.
Enable SSH on ESXi Host
1. Go to vCenter and login.
2. Choose the host and go to “Configure” -> “Services”. Find “SSH” and click on “START”
Enable Secure Boot through CLI
1. Start a SSH session to the ESXi Host.
2. List the current settings by running:
esxcli system settings encryption get
3. You will get a result like this:
Mode: TPM
Require Executables Only From Installed VIBs: false
Require Secure Boot: false
4. If “Mode” appears as “NONE” run the following command:
esxcli system settings encryption set --mode=TPM
5. Now enable “Secure Boot” by running:
esxcli system settings encryption set --require-secure-boot=T
6. Verify the change and Confirm that “Required Secure Boot” displays true by running:
esxcli system settings encryption get
7. You will get a result like this:
Mode: TPM
Require Executables Only From Installed VIBs: false
Require Secure Boot: true
8. Now we need to save the settings by running:
/bin/backup.sh 0
9. Reboot the server to make sure settings are applied and in place. Run the command:
reboot
By Awid Dashtgoli