A UEFI safeguard: nothing may load ahead of the operating system unless it is signed and authenticated. AHV guests must have UEFI and no IDE disks to turn it on, and hosts can get it through the Security Dashboard.
Read more: Nutanix docs
In the Ultra Transcenders books
Each book explains Secure Boot in context, with comparison tables and the common traps.
Terms in this definition
- UEFI
The modern firmware standard that took over from BIOS. Because Hyper-V generation 2 machines use it, they can start up from a virtual SCSI disk and have Secure Boot switched on.
- ELT
Extract, load, transform: raw data lands in the target system first and is transformed there. See ETL for the opposite order.
- OS
Operating system, which you manage yourself on IaaS VMs. PaaS offerings like App Service do not expose it.
- Nutanix AHV
The hypervisor from Nutanix. Veeam's integration backs up its VMs to repositories and can restore to it from backups of vSphere, Hyper-V, AHV and other platforms.
- IDE
Visual Studio Code, PyCharm and similar desktop editors are IDEs. Databricks Connect, or the Databricks extension for Visual Studio Code, lets code written in them execute and be debugged on Azure Databricks.
- TURN
If a direct link can't be made, RDP Shortpath for Windows 365 relays UDP traffic via Microsoft servers on port 3478 instead.
- Get
Key Vault permission on secrets that allows a single secret to be read; App Service Key Vault references need nothing beyond it.
- Security Dashboard
A view in Prism Central showing security metrics and compliance for clusters. Some controls can be set from its hardening widget; others are only reported there.
Related terms
- BIOS
Generation 2 Hyper-V machines use UEFI with Secure Boot; Generation 1 machines rely on this older firmware.
- BitLocker
Encrypts entire Windows volumes. Nutanix Move neither detects it on source VMs nor carries vTPM data across, so plan a separate route to the keys; on AHV it can rely on a vTPM if Secure Boot is on.
- Device Health Attestation
Reports, measured only while Windows starts up, on things like code integrity, Secure Boot and BitLocker, so that compliance policies can check a device's health.
- Guest Attestation extension
Lets Azure monitor a VM's boot integrity by passing its vTPM boot measurements to Azure Attestation. The VM also needs Secure Boot and vTPM switched on and must be able to reach the
AzureAttestationservice tag outbound. - IDE
A VM disk bus that is emulated. Attaching a disk of this type rules out AHV Secure Boot, and Nutanix Guest Tools needs an empty CD-ROM on IDE or SATA.
- MOK
On a UEFI Secure Boot machine, this has to be enrolled in firmware before the Linux agent's kernel module will load. Cloud UEFI machines with Secure Boot offer no access to that menu, so Linux agents cannot be installed on them.
- Q35
Secure Boot works only with this AHV machine type, so any aCLI command for such a VM has to specify it.
- secure boot validation script
A script for testing whether an ESX host is able to use UEFI secure boot. In recovery, run it once the host has rebooted with secure boot turned off, and then look in /var/log/esxupdate.log.