Zero-touch SEP Linux deployment on Secure Boot Linux golden images

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

Customers require a fully automated (zero-touch) method to deploy SEP agents on Linux VMs where Secure Boot is enabled. Standard deployments require manual interaction with the MOK (Machine Owner Key) manager upon reboot, which blocks unattended automation.

Environment

• Operating System: Linux
• Hypervisor: VMware vSphere / ESXi
• Firmware: UEFI with Secure Boot enabled
• Product: Symantec Endpoint Protection (SEP) for Linux / Symantec Agent for Linux

Cause

UEFI Secure Boot is designed to prevent undetected tampering of the trust chain, requiring manual approval of the Symantec module signing certificate (sis-key.der) in the MOK list.

Resolution

VMware preserves the UEFI NVRAM state during cloning, which includes the MOK database. By enrolling the key once on a Master VM (Golden Image) and sanitizing the agent identity, all clones inherit the trusted state.

Phase 1: Master VM Preparation

1. Install the SEP Linux Agent on the Linux Golden Image.
2. Import the Symantec public key to the MOK list:

   • # mokutil --import /usr/lib/symantec/sdcssagent/driver/sis-key.der

3. Reboot the system and complete the MOK enrollment at the UEFI console (Shim UEFI key management).
4. Once booted, verify the modules are loaded:

   • # /usr/lib/symantec/status.sh

Phase 2: Golden Image Sanitization

1. Navigate to the directory containing the Linux Installer.
2. Run the built-in image preparation command:

   • # ./LinuxInstaller --image

   • Note: This command stops all SEP services and clears the unique device identity.
3. Warning: Do not start SEP services or reboot after this command. Shut down the Master VM immediately.

Phase 3: Cloning and Verification

1. Convert the Master VM to a template in vCenter.
2. Deploy clones using standard automation.
3. On the first boot, the agent will detect the unique hardware UUID, generate a fresh identity, and register with SEPM.
4. Verify the modules load automatically without MOK prompts.