Skip to main content

How to manage Intel SGX on a dedicated server

Stephanie R.
Updated

Learn how to enable the SGX feature via the OVHcloud Control Panel or OVHcloud API.

Enabling Intel Software Guard Extensions (SGX) on your server allows you to run SGX-ready applications. Intel SGX provides advanced hardware and RAM security encryption features to isolate specific parts of code and data for each application.

Requirements

  • Access to the OVHcloud Control Panel or to the OVHcloud API
  • A dedicated server compatible with the SGX option in your OVHcloud account
  • The credentials received by email after installation
  • Ubuntu 24.04 or equivalent is installed on the server

 

Instructions

Enabling SGX

The activation of SGX is possible from the OVHcloud Control Panel, the OVHcloud API, or your server's BIOS.

1 - Logging in to the OVHcloud Control Panel

Log in to the OVHcloud Control Panel, navigate to the Bare Metal Cloud section, and click Dedicated servers. Select the server on which you want to enable SGX.

 

2 - Enabling SGX

From the General Information tab, in the Advanced Features panel, click the more options ... button next to the Security - Intel SGX (Software Guard Extensions) entry and select Enable SGX from the dropdown menu.

dedicated_advancedFeatures_enableSGX.png

On the next screen, click on the Enable button.

dedicated_advancedFeatures_SGX.png

You can choose to enable SGX with a specific amount of reserved memory or allow your application to reserve the memory it needs automatically. Once your choice is made, click on Confirm.

dedicated_advancedFeatures_chooseSGX.png

A confirmation window will appear. Please confirm that you understand that enabling Intel SGX technology will result in a server reboot.

dedicated_advancedFeatures_confirmSGX.png

NOTE: This will result in one or more server reboots, depending on the model.

1 - Logging in to the API console

From the OVHcloud API:

  • Click on Authentication in the top left.
  • Then click on Login with OVHcloud SSO.
  • Enter your OVHcloud credentials.
  • Click on the Authorize button to authorize API calls from this site.

 

2 - Enabling SGX

Retrieve the name of your server from the list returned by the following call:

GET /dedicated/server

Check that your service has the SGX option using this call:

GET /dedicated/server/{serviceName}/biosSettings/sgx

Enable SGX using the server name:

NOTE: This will result in one or more server reboots, depending on its model.

POST /dedicated/server/{serviceName}/biosSettings/sgx/configure

Check the progress of the configuration task by calling this endpoint with the taskId returned by the previous call:

GET /dedicated/server/{serviceName}/task/{taskId}

You can verify that the status is enabled:

GET /dedicated/server/{serviceName}/biosSettings/sgx

1 - Start a Remote KVM session

Log in to the OVHcloud Control Panel, navigate to the Bare Metal Cloud section, and click Dedicated servers. Select the server on which you want to enable SGX.

From the IPMI/KMV tab, start a Remote KVM session:

dedicated_ipmiTab.png

 

2 - Enabling SGX

Then, from the KVM, initiate a server reboot and enter the BIOS (usually by pressing the DEL or F2 key).

In the BIOS, go to the Advanced > Processor Configuration section.

Enable the TME and SGX options and configure the desired PRMRR size:

dedicated_kvm_enableSGX.png

Save the changes by pressing the F10 key. A confirmation window will appear. Please confirm with the Yes option.

Your server will then reboot into your operating system.

 

Installing the SGX software stack

Use the following commands to install the Intel SDK to develop and run SGX applications.

First, install some dependencies:

sudo apt update
sudo apt install autoconf automake build-Essential cmake debhelper git libcurl4-openssl-dev libprotobuf-dev libssl-dev libtool lsb-release ocaml ocamlbuild protobuf-compiler python-is-python3 reprepro wget perl unzip pkgconf libboost-dev libboost-system-dev libboost-thread-dev libsystemd0

Next, download the source code and prepare the submodules and prebuilt binaries:

BASE_DIR=/opt/intel
[[ -d $BASE_DIR ]] || sudo mkdir -p $BASE_DIR && sudo chown `whoami` $BASE_DIR
cd $BASE_DIR

git clone https://github.com/intel/linux-sgx.git

cd linux-sgx
git checkout sgx_2.26
make preparation

Build and install the SGX SDK:

make sdk_install_pkg
$ ./linux/installer/bin/sgx_linux_x64_sdk_2.26.100.0.bin --prefix=$BASE_DIR/

 

Test the sample application in simulation mode

To build and run the LocalAttestation sample code in simulation mode:

BASE_DIR=/opt/intel
cd $BASE_DIR/sgxsdk/SampleCode/LocalAttestation/
source $BASE_DIR/sgxsdk/environment

make clean
SGX_MODE=SIM make
cd bin
sudo ./app
succeed to load enclaves.
succeed to establish secure channel.
Succeed to exchange secure message...
Succeed to close Session...

 

Build and install the Intel SGX PSW

The Intel SGX Platform Software (PSW) provides software libraries to run SGX applications in hardware mode. To create the local Debian repository that hosts the packages, run the following commands:

BASE_DIR=/opt/intel
cd $BASE_DIR/linux-sgx
make deb_local_repo

Create the following file to add the local Debian package repository to the repository configuration system:

cat /etc/apt/sources.list.d/sgx.sources
Types: deb
URIs: file:/opt/intel/linux-sgx/linux/installer/deb/sgx_debian_local_repo
Suites: noble
Components: main
trusted: yes

Then, install the following packages:

sudo apt update
sudo apt-get install libsgx-epid libsgx-quote-ex libsgx-dcap-ql

 

Test the sample application in hardware mode (optional)

To build and run the LocalAttestation sample code in hardware mode:

BASE_DIR=/opt/intel
cd $BASE_DIR/sgxsdk/SampleCode/LocalAttestation/
source $BASE_DIR/sgxsdk/environment

make clean
SGX_MODE=HW make
cd bin
sudo ./app
succeed to load enclaves.
succeed to establish secure channel.
Succeed to exchange secure message...
Succeed to close Session...

 

Go further

To go further (develop your own application, register for remote attestation, etc.), here are some useful resources:

For more information and tutorials, please see our other Dedicated Servers support guides or explore the guides for other OVHcloud products and services.

 

Related articles