Overview
On systems with UEFI Secure Boot enabled, the Linux kernel only loads signed kernel modules. The Teramind Linux Agent ships a signed kernel module (dlp_lsm.ko) that enables real-time file content monitoring for DLP features. To use it on Secure Boot systems, you must generate your own signing key and certificate, enroll it as a Machine Owner Key (MOK), and pass it to the installer at install time.
One-time step per machine MOK enrollment persists across Agent updates, reinstalls, and kernel upgrades - you only need to do this once.
File Tracking Backends
The Agent automatically selects a backend based on MOK enrollment status:
Backend | When Used | Capabilities |
Kernel module ( | Preferred; requires MOK enrolled | Real-time file content scanning; supports DLP rules such as sensitive-data detection and file-transfer blocking |
eBPF | Automatic fallback if MOK not enrolled | Tracks file operations (open, read, write) but cannot inspect file content (i.e., content-based DLP rules are unavailable) |
Secure Boot & MOK Status Reference
Secure Boot | MOK Enrolled | Agent Behavior |
OFF | N/A | Kernel module loads directly |
ON | YES | Kernel module loads directly |
ON | NO | eBPF fallback (automatic); kernel module skipped |
How to Check Secure Boot Status
mokutil --sb-state
Expected output: SecureBoot enabled or SecureBoot disabled.
Installation Options
Option 1: Install Agent First, Enroll MOK Later (Recommended)
This is the simplest approach. The Agent works immediately via eBPF. Enroll MOK when convenient to unlock full DLP capabilities.
Step 1: Generate a signing key and certificate
# Generate a 4096-bit RSA private key and self-signed certificate (valid 10 years)
openssl req -new -x509 -newkey rsa:4096 -keyout ~/mok.key -out ~/mok.crt -days 3650 \
-subj "/CN=My MOK Signing Key/" -nodes
# Convert certificate to DER format for mokutil
openssl x509 -in ~/mok.crt -outform DER -out ~/mok.cer
Step 2: Install the Agent
DEB (Ubuntu/Debian):
sudo TMINSTANCE=onsite TMROUTER=<server-ip> \
LSM_SIGNING_KEY=~/mok.key LSM_SIGNING_CERT=~/mok.crt \
apt install ./<teramind-agent>
RPM (RHEL):
sudo TMINSTANCE=onsite TMROUTER=<server-ip> \
LSM_SIGNING_KEY=~/mok.key LSM_SIGNING_CERT=~/mok.crt \
dnf install ./<teramind-agent>
The Agent starts with eBPF file tracking. If Secure Boot is detected and MOK is not enrolled, the installer prints enrollment instructions.
Note: In the commands above, replace the placeholder values with your actual values. For example:
TMINSTANCE=onsiteandTMROUTER=<server-ip>are required only for On-Premises deployments. Omit them for Cloud deployments.<server-ip>is your Teramind Server IP address (e.g.,10.52.52.84).<teramind-agent>is the actual Agent package filename. For example:tmagent_26.23.447_debian13_amd64.deb(On-Premises) /tmagent_26.23.447_debian13_amd64-i(__8393b2bf7cca79d089e51d56ef558f75a5ca2073).deb(Cloud).
Step 3: Enroll the Signing Key
sudo mokutil --import ~/mok.cer
You will be prompted to create a one-time password - remember it for the next step.
Step 4: Check Status
mokutil --list-enrolled
mokutil --sb-state
Step 5: Reboot and Confirm
After reboot, the UEFI MOK Manager (blue screen) appears automatically:
Select Enroll MOK
Select Continue
Select Yes
Enter the password you set in Step 3
Select Reboot
After reboot, the Agent automatically switches from eBPF to the kernel module.
Option 2: Enroll MOK Before Installing the Agent
Step 1: Generate a signing key and certificate
# Generate a 4096-bit RSA private key and self-signed certificate (valid 10 years)
openssl req -new -x509 -newkey rsa:4096 -keyout ~/mok.key -out ~/mok.crt -days 3650 \
-subj "/CN=My MOK Signing Key/" -nodes
# Convert certificate to DER format for mokutil
openssl x509 -in ~/mok.crt -outform DER -out ~/mok.cer
Step 2: Enroll the Signing Key
sudo mokutil --import ~/mok.cer
Set a one-time password when prompted.
Step 3: Check Status
mokutil --list-enrolled
mokutil --sb-state
Step 4: Reboot and Confirm
Do it at the UEFI MOK Manager. The process is the same as Option 1, Step 5 above.
Step 5: Install the Agent
DEB (Ubuntu/Debian):
sudo TMINSTANCE=onsite TMROUTER=<server-ip> \
LSM_SIGNING_KEY=~/mok.key LSM_SIGNING_CERT=~/mok.crt \
apt install ./<teramind-agent>
RPM (RHEL):
sudo TMINSTANCE=onsite TMROUTER=<server-ip> \
LSM_SIGNING_KEY=~/mok.key LSM_SIGNING_CERT=~/mok.crt \
dnf install ./<teramind-agent>
The kernel module loads immediately - no eBPF fallback.
Note: In the commands above, replace the placeholder values with your actual values. For example:
TMINSTANCE=onsiteandTMROUTER=<server-ip>are required only for On-Premises deployments. Omit them for Cloud deployments.<server-ip>is your Teramind Server IP address (e.g.,10.52.52.84).<teramind-agent>is the actual Agent package filename. For example:tmagent_26.23.447_debian13_amd64.deb(On-Premises) /tmagent_26.23.447_debian13_amd64-i(__8393b2bf7cca79d089e51d56ef558f75a5ca2073).deb(Cloud).
Verify the Installation
Check Agent status:
sudo /usr/share/tmagent/deploy.sh --status
Confirm these lines appear in the output:
SecureBoot: enabled
MOK status: enrolled
Module sig: signed (Teramind Module Signing)
Kernel module: loaded
Check MOK enrollment status independently:
mokutil --list-enrolled
Frequently Asked Questions (FAQ)
1. Do I need to re-enroll after Agent updates?
No. MOK enrollment is per-certificate, not per-package. As long as the same signing certificate is used, enrollment persists across all Agent updates and reinstalls.
2. Does MOK enrollment affect other software or the OS?
No. It only permits loading of kernel modules signed with the enrolled certificate. It does not affect other software, OS updates, or Secure Boot validation of the OS itself.
3. What happens if I skip MOK enrollment entirely?
The Agent still monitors file activity using the eBPF-based tracker. However, content-aware DLP features, such as sensitive-data detection and file-transfer blocking require the kernel module and will not work until MOK is enrolled and the machine is rebooted.