BIOS Updates on the Servers

Below are the steps for updating the BIOS on the Application and Monitor Servers. We provide instructions for Intel NUC devices, in accordance with our hardware recommendations. You should also update the BIOS on other computers such as the Admin Workstation, but those instructions will vary depending on the manufacturer and model of your device.

What you need

  1. A clean USB device to download the .bio file
  2. An internet-connected workstation, such as the Admin Workstation
  3. A UPS (uninterrupted power supply), such as a surge-protecting power supply with a backup battery (This is not required, but strongly recommended)
  4. A keyboard and monitor

Perform Backups

Before performing any updates on the servers, we recommend you back up the Application Server.

Prepare the USB Stick

Using the Disks application, delete existing partitions on the USB device, if applicable, and reformat the entire device with one FAT32 partition. Note that you will lose access to all existing data on this USB stick.

Download and Verify Appropriate .bio Files

For Intel NUC Devices

Check the make and model of your servers.

Note

We will be following the F7 BIOS update method, as documented by Intel (available as a PDF).

Proceed to the Intel Download Centre to download the correct file. Each make and model of Intel NUC will offer various file types; select the .bio option.

Warning

Do not download BIOS updates from anywhere other than the manufacturer’s website. Be sure that you are on the correct website and that it has a valid SSL Certificate. Intel’s SSL Certificate is issued to *.intel.com and signed by DigiCert. Be sure you download the files specific to the model of your servers.

Intel provides an md5 checksum on the download page. Once you have downloaded the .bio file, using the Files application, browse to the file, right click and select Properties ▸ Digests, select MD5, and click Hash. Compare the result in the Digest column to the md5 sum listed on Intel’s website. If these two values do not match, do not proceed, and contact support@freedom.press. Tails provides a detailed explanation of this process. (Note that the hash in the screenshot below is an example only, and will not match your specific .bio file.)

gtkhash tails

Once you have verified the hash, copy the .bio file to your USB device.

Update the BIOS

Power off the Monitor Server. We recommend plugging it into an uninterrupted power supply (UPS). Plug in the keyboard, monitor, and USB key, and power on the server, then press F7 when prompted to enter the BIOS Update tool.

Select the USB device and navigate to the .bio file you have downloaded, then hit Enter. The update will take several minutes–do not interrupt the update or unplug the server during this time.

Repeat these steps on the Application Server. These steps are also available on Intel’s website (PDF).