Added section on updating the BIOS and its settings

freedomofpress · Feb 18, 2021 · dce615f · dce615f
1 parent 6b45c75
commit dce615f
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 2 deletions.
diff --git a/docs/servers.rst b/docs/servers.rst
@@ -1,12 +1,38 @@
 Set Up the Servers
 ==================
 
+Pre-Install Steps
+-----------------
+
+Upgrade the Server BIOS
+~~~~~~~~~~~~~~~~~~~~~~~
+Before beginning the installation process, you should upgrade your servers' BIOS
+to the most recent stable version available. This process will differ for each
+server make/model - if you are using one of the recommended NUC models, you can
+find instructions in :doc:`update_bios`.
+
+Update BIOS Settings
+~~~~~~~~~~~~~~~~~~~~
+Once the BIOS has been updated, you should boot into it again to disable any unused
+hardware, including:
+
+* wireless LAN and Bluetooth
+* Thunderbolt support
+* audio support (output, speakers, microphones)
+* other features supported by the hardware but not used by SecureDrop.
+
+In most cases, you should enable support for LAN and USB ports only.
+
+You should also check the servers' boot settings. Ubuntu 20.04 supports both
+Legacy and UEFI boot modes, with UEFI preferred. You should also disable Secure
+Boot. SecureDrop uses a custom kernel with security patches, which is unsigned
+and will not boot if Secure Boot is enabled.
 
 Install Ubuntu
 --------------
 
 .. note:: Installing Ubuntu is simple and may even be something you are very familiar
-  with, but it is **strongly** encouraged that youread and follow this documentation
+  with, but it is **strongly** encouraged that you read and follow this documentation
   exactly as there are some "gotchas" that may cause your SecureDrop setup to break.
 
 The SecureDrop *Application Server* and *Monitor Server* run **Ubuntu Server

diff --git a/docs/update_bios.rst b/docs/update_bios.rst
@@ -18,7 +18,7 @@ What you need
 Perform Backups
 ~~~~~~~~~~~~~~~
 
-Before performing any updates on the servers, we recommend you :doc:`back up the Application Server <backup_and_restore>`.
+If you are updating the BIOS on an existing SecureDrop system, we recommend you :doc:`back up the Application Server <backup_and_restore>` before proceeding.
 
 Prepare the USB Stick
 ~~~~~~~~~~~~~~~~~~~~~~~