Why use a bios password and remove automount of boot partition

[skleeschulte]

Hi, thank you for this framework! I followed the proxmox install instructions and wondered:

• Is it necessary to set a bios password?
• Why am I instructed to remove automount of the boot partition?

[noahbliss]

Hey @skleeschulte, the bios password shouldn't be necessary, but I've encountered weird cases with consumer-grade systems that didn't always change the bios configuration pcr when specific changes were made. Better to just lock it and require it be wiped (changing pcr1)

Re boot partition, main risk is competition with other boot-interfering programs/OS elements. It's possible to accidentally sign a kernel that doesn't have the initramfs bundled, in which case there is effectively no protection.

The tl;dr: best practice/good hygiene