No idea why that's the case (probably a bug) or if it applies to that system, but if your disk is GPT and the EFI boot partition isn't the first partition on disk, that could be the issue. However, I remember discovering that my wife's will only boot from Partition #1 of a USB device that's set up with the GPT partition scheme, even though it will happily boot from a later partition of that same USB device when it's set up as MBR.
If it's set up as GPT, it's meant to be booted in UEFI mode, in which case you might need to disable Secure Boot (not sure if CentOS has been updated to support Secure Boot like Ubuntu has), but you wouldn't need Legacy Option ROMs. Keeping Thunderbolt boot support disabled avoids is your external disk set up using the MBR partition scheme or GPT partition scheme? If it's the former, it's meant to be booted in Legacy BIOS mode, in which case you'd need to disable Secure Boot and also enable Legacy Option ROMs to allow booting from that type of device. If you enter the Recovery Key at that point, the TPM will "reseal" to the new hardware/firmware environment, which would include that Thunderbolt device, but the next time you try to boot without that device connected, you'll see a Recovery Key prompt because the hardware environment will have changed again. When that check detects a change, you'll see a Recovery Key prompt because the TPM will refuse to release the decryption key as a security measure (as you saw when you disabled Secure Boot, which is a firmware change). Thunderbolt boot support can also cause BitLocker Recovery Key prompts to appear because when boot support is enabled, Thunderbolt devices are enumerated at boot and are therefore included in the hardware and firmware environment that the TPM looks at when performing its "platform integrity check".
Lastly, unless your external SSD is in an actual Thunderbolt enclosure (as opposed to regular USB-C), then tinkering with Thunderbolt boot support won't make a difference, and I would recommend keeping that off unless you actually need it, because if you have Thunderbolt boot support enabled, Thunderbolt devices that are connected at boot get to bypass the normal Thunderbolt port security routines, which is a risk because unlike USB, Thunderbolt grants access to PCIe, which in turn allows DMA (hence the port security measure in the first place). Otherwise, I've also seen systems that only support booting from USB "removable storage class" devices like the overwhelming majority of flash drives and will not support booting from USB "fixed disk class" devices like external hard drives and SSDs.
Is your external disk set up using the MBR partition scheme or GPT partition scheme? If it's the former, it's meant to be booted in Legacy BIOS mode, in which case you'd need to disable Secure Boot and also enable Legacy Option ROMs to allow booting from that type of device.
0 kommentar(er)
