killerbees19

coreboot @ Lenovo ThinkPad T440p

Replace original BIOS/UEFI with open-source alternative coreboot and strip down Intel ME.

This is my very first experience with SPI chips and external flashing 🥳

These are my personal notes, just in case I need them again…

Hardware

• Notebook: Lenovo ThinkPad T440p (20AN/20AW; without dGPU / only iGPU)
• Top chip: Winbond 25Q32FVSIQ (4 MiB; accessible through "big door")

pomo-mondreganto

First, try to install wireguard:

# this should fail with module compilation error
sudo apt update && sudo apt install -y wireguard wireguard-dkms wireguard-tools linux-headers-$(uname -r) build-essential

Then, go to /usr/src/wireguard-<version here> and comment out lines 96,97,99 in compat/compat.h to have

mkropat

#!/bin/sh

echo "| Name | Partition | Size (kB) | Path | Type |"
echo "|------|-----------|-----------|------|------|"

for d in /dev/block/bootdevice/by-name/*; do
  name=$(basename -- "$d")

  device=$(basename "$(readlink -- "$d")")
  read -r _ fsmount fstype _ <<EOF

artizirk

NB: This document describles a 'Old-School' way of using Yubikey with SSH

Modern OpenSSH has native support for FIDO Authentication. Its much simpler and should also be more stable with less moving parts. OpenSSH also now has support for signing arbitary files witch can be used as replacement of gnupg. Git also supports signing commits/tags with ssh keys.

Pros of FIDO

• Simpler stack / less moving parts
• Works directly with ssh, ssh-add and ssh-keygen on most computers
• Simpler
• Private key can never leave the FIDO device

Cons of FIDO