Enable Linux Secure Boot

You can use the signed Arctic Wolf certificate to enable Linux Secure Boot on a device for Aurora Protect.

Follow these instructions to enable Linux Secure Boot using the Arctic Wolf certificate before installing the agent.

If Secure Boot is already enabled using a certificate, you must additionally enroll the Arctic Wolf certificate in your Machine Owner Key (MOK). This step ensures a smooth transition while Arctic Wolf gradually releases updated Linux kernel drivers signed with Arctic Wolf keys. Adding the Arctic Wolf certificate ensures that drivers load successfully during agent upgrades and avoids downtime.

Support for Aurora Protect Desktop agent with Linux Secure Boot is currently only available on Red Hat Enterprise Linux and Ubuntu distributions. You must use a supported version of the Aurora Protect Desktop agent. The minimum required agent version is 2.1.1580.
  1. Download the signed Arctic Wolf Signed Secure Boot certificate and store it on the device where you want to enable Secure Boot.
    1. Sign in to the Arctic Wolf Unified Portal.
    2. In the navigation menu, click Resources > Downloads.
    3. Scroll to the Aurora Endpoint Software Downloads section.
    4. In the Product drop-down menu, click Tools.
    5. Find Arctic Wolf Signed Secure Boot Certificate (awn-secureboot.der) and click Download.
  2. On the device with the certificate, import the certificate for MOK enrollment.
    1. Import the certificate using this command: sudo mokutil --import awn-secureboot.der
    2. When prompted, specify a one-time MOK enrollment password.
    3. Reboot the device.
      During the reboot, the MOK Manager screen appears.
  3. Complete the MOK enrollment.
    1. Select Enroll MOK.
    2. Select Continue.
    3. Enter the password that you specified.
    4. Approve the enrollment.
    5. Reboot the device again when prompted.
  4. Verify the certificate enrollment.
    1. Check that the Arctic Wolf certificate is enrolled using this command: mokutil --list-enrolled | grep -i arctic
    2. Check that the signature is valid using this command: dmesg | grep -i 'module verification'
    3. Check that Secure Boot is enabled using this command: mokutil --sb-state
Install the Linux agent (yum or zypper) or Install the Linux agent (rpm or dpkg)