System and method to enable rapid recovery of an operating system image of an information handling system after a malicious attack
An information handling system includes a central processing unit, multiple storage devices, and a service processor. The central processing unit executes an operating system of the information handling system. The storage devices include a first storage device that stores a primary boot image for the information handling system, and a second storage device. The service processor executes a first boot process. During the first boot process, the service processor stores a recovery boot image on the second storage device, and restarts the first boot process after the recovery boot image being stored on the second storage device. During a second boot process, the service processor removes the second storage device from a bootable device menu in response to the second storage device storing the recovery boot image, and hides the second storage device from being discoverable by the operating system.
1. An information handling system comprising:
a plurality of storage devices including a first storage device to store a primary boot image of an operating system of the information handling system, a second storage device, and a third storage device; and
a service processor to communicate with the first and second storage devices, and to execute a first boot process, which causes the service processor to:
execute the first boot process of the primary boot image, so that during the first boot process the service processor:
initiates a basic input/output system (BIOS) setup option;
receives, within the BIOS setup option, a user selection of the second storage device as a recovery storage device;
stores a recovery boot image on the second storage device, wherein the recovery boot image is a partial OS boot image; and
restarts the first boot process after the recovery boot image is stored on the second storage device; and
execute a second boot process of the primary boot image, so that during the second boot process the service processor disables a driver for the second storage device to hide the second storage device from being discoverable by the operating system, and removes the second storage device from a bootable device menu.
2. The information handling system of claim 1 , the service processor to receive a recovery mode selection via an out-of-band communication, to execute a recovery boot process from in response to the recovery mode selection being received, during the recovery boot process, the service processor to: unhide the second storage device, boot to the recovery boot image on the second storage device, and configure the operating system of the information handling system based on the recovery boot image.
3. The information handling system of claim 2 , the service processor to store the recovery boot image as the primary boot image on the first storage device after the operating system of the information handling system is configured during the recovery boot process.
4. The information handling system of claim 2 , the service processor to patch the primary boot image on the first storage device based on the recovery boot image after the operating system of the information handling system is configured during the recovery boot process.
5. The information handling system of claim 1 , the service processor further to provide a basic input/output setup option during the first boot process, and to receive the recovery boot image during the basic input/output setup option prior to the recovery boot image being stored on the second storage device.
6. The information handling system of claim 1 , wherein each of the storage devices is a different type of storage device.
7. A method comprising:
executing, by a service processor, a first boot process of an information handling system, wherein the first boot process is executed from a primary boot image of an operating system stored on a first storage device of the information handling system, wherein the information handling system further includes a second storage device and a third storage device, during the execution of the first boot process:
the service processor initiates a basic input/output system (BIOS) setup option, receives, within the BIOS setup option, a user selection of the second storage device as a recovery storage device, and stores a recovery boot image on the second storage device, wherein the recovery boot image is a partial OS boot image; and
the first boot process restarts after the recovery boot image is stored on the second storage device; and
executing, by the service processor, a second boot process of the primary boot image, so that during the second boot process:
the second storage device is removed from a bootable device menu in response to the second storage device storing the recovery boot image; and
a driver for the second storage device is disabled to hide the second storage device from discovery by the operating system.
8. The method of claim 7 further comprising:
receiving a recovery mode selection via an out-of-band communication,
executing a recovery boot process from in response to the recovery mode selection being received, during the recovery boot process:
unhiding the second storage device;
booting to the recovery boot image on the second storage device; and
configuring the operating system of the information handling system based on the recovery boot image.
9. The method of claim 8 further comprising:
storing the recovery boot image as the primary boot image on the first storage device after the operating system of the information handling system is configured during the recovery boot process.
10. The method of claim 8 further comprising:
patching the primary boot image on the first storage device based on the recovery boot image after the operating system of the information handling system is configured during the recovery boot process.
11. The method of claim 7 further comprising:
providing a basic input/output setup option during the first boot process, and to receive the recovery boot image during the basic input/output setup option prior to the recovery boot image being stored on the second storage device.
12. The method of claim 7 wherein each of the storage devices is a different type of storage device.
13. An information handling system comprising:
a central processing unit to execute an operating system of the information handling system;
a plurality of storage devices including a first storage device to store a primary boot image for the information handling system, a second storage device, and a third storage device; and
a service processor to communicate with the central processing unit and with the plurality of storage devices, to execute a first boot process, which causes the service processor to:
execute the first boot process of the primary boot image, during the first boot process, the service processor to:
initiate a basic input/output system (BIOS) setup option;
receive, within the BIOS setup option, a user selection of the second storage device as a recovery storage device;
store a recovery boot image on the second storage device, wherein the recovery boot image is a partial OS boot image; and
restart the first boot process after the recovery boot image being stored on the second storage device; and
execute a second boot process of the primary boot image, during the second boot process, the service processor to:
remove the second storage device from a bootable device menu in response to the second storage device storing the recovery boot image; and
disable a driver for the second storage device, wherein the second storage device is not accessible by the service processor in response to the driver being disabled.
14. The information handling system of claim 13 , the service processor to receive a recovery mode selection via an out-of-band communication, to execute a recovery boot process from in response to the recovery mode selection being received, during the recovery boot process, the service processor to: unhide the second storage device, boot to the recovery boot image on the second storage device, and configure the operating system of the information handling system based on the recovery boot image.
15. The information handling system of claim 14 , the service processor to store the recovery boot image as the primary boot image on the first storage device after the operating system of the information handling system is configured during the recovery boot process.
16. The information handling system of claim 14 , the service processor to patch the primary boot image on the first storage device based on the recovery boot image after the operating system of the information handling system is configured during the recovery boot process.
17. The information handling system of claim 13 , the service processor further to provide a basic input/output setup option during the first boot process, and to receive the recovery boot image during the basic input/output setup option prior to the recovery boot image being stored on the second storage device.