# Firmware Configuration

Single-board computers use a [file-based system ](https://hub.subspace.services/books/hardware/page/single-board-computers-6VY "Single-Board Computers")store their settings while traditional computers use a [low-level operating system like BIOS or UEFI](https://hub.subspace.services/books/hardware/page/efi-bios "EFI & BIOS"). We explore some basic configuration options for an always-on server.

# Single-Board Computers

The [Raspberry Pi](https://www.raspberrypi.com/) computer series do not have a battery source to ensure that firmware settings are saved even if the computer loses power. This means that they do not use a conventional BIOS or EFI architecture.

[![1000006150.png](https://hub.subspace.services/uploads/images/gallery/2025-02/scaled-1680-/1000006150.png)](https://hub.subspace.services/uploads/images/gallery/2025-02/1000006150.png)

Instead, these systems use a configuration file that is stored on the hard drive and used to configure the system during the boot process. These settings are configured through the [command line](https://www.raspberrypi.com/documentation/computers/configuration.html) or a [graphic user application](https://projects.raspberrypi.org/en/projects/raspberry-pi-using/9).

[![1000006145.png](https://hub.subspace.services/uploads/images/gallery/2025-02/scaled-1680-/1000006145.png)](https://hub.subspace.services/uploads/images/gallery/2025-02/1000006145.png)


## Performance Options

These settings pertain to the overall hardware performance configurations for your single-board computer.

<details id="bkmrk-overlay-file-system-"><summary>Overlay File System</summary>

This option allows the Raspberry Pi to boot in a mode where [files on the SD card cannot be altered](https://storage.raspberrypi.com/product-information/f1a2k217gltilbt5cead63rjkbk9?response-content-disposition=attachment%3B%20filename%3D%22Making-a-more-resilient-file-system.pdf%22%3B%20filename%2A%3DUTF-8%27%27Making-a-more-resilient-file-system.pdf&amp;response-content-type=application%2Fpdf&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=product-information%2F20250211%2Feu-west-1%2Fs3%2Faws4_request&amp;X-Amz-Date=20250211T224739Z&amp;X-Amz-Expires=172800&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=267245ef0b145cc13a0ef386f29dd9fcf43869c82ce203743693e632f70d2ee7) and any modifications are only temporarily saved in memory while the operating system is powered on.

This increases the Raspberry Pi's life expectancy, but cannot be used for interactive systems that need to store long-term data between power cycles.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-gpu-memory-this-allo"><summary>GPU Memory</summary>

This allows you to change the amount of memory allocated to the graphical processing unit of the Raspberry Pi.

Due to [fundamental differences](https://retropie.org.uk/docs/Memory-Split/) in the way that system-on-a-chip computers handle their graphical processing, this setting is an optimized default for your specific model. There is no need to alter these settings and doing so many decrease performance.

<p class="callout info">*Recommended:* Default</p>

</details>## Interface Options

These settings control the different physical and digital interfaces that can be used to interact with the Raspberry Pi.

<details id="bkmrk-ssh-this-allows-you-"><summary>SSH</summary>

This allows you to remotely connect to your server through a terminal and run commands to administrate your server.

<p class="callout info">*Recommended:* Enabled</p>

</details><details id="bkmrk-vnc-this-provides-re"><summary>VNC</summary>

This provides remote access to your Raspberry Pi's user desktop environment. We are disabling it to install RDP, a similar, more modern alternative. If desired, you can leave it on for additional access options.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-spi-the%C2%A0serial-perip"><summary>SPI</summary>

The [Serial Peripheral Interface](https://learn.sparkfun.com/tutorials/serial-peripheral-interface-spi) is used by the Raspberry Pi to communicate with external sensors through the GPIO port.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-i2c-the-inter-integr"><summary>I2C</summary>

The Inter-Integrated Circuit is an alternate standard used to communicate with devices through the GPIO port.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-serial-port-this-dis"><summary>Serial Port</summary>

This disables serial connections through the GPIO port.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-1-wire-this-disables"><summary>1-Wire</summary>

This disables a communication protocol that uses one wire on the GPIO port.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-remote-gpio-this-dis"><summary>Remote GPIO</summary>

This disables [remote access to the GPIO port](http://abyz.me.uk/rpi/pigpio/python.html#pigpio.pi) through Python.

<p class="callout info">*Recommended:* Disabled</p>

</details>## System Options

These pertain to general settings of the core Debian operating system.

<details id="bkmrk-change-password-for-"><summary>Change Password</summary>

For security, it is imperative that you change the default password for your Raspberry Pi computer.

</details><details id="bkmrk-change-hostname-this"><summary>Change Hostname</summary>

This allows you to change the name that your server uses while on your network; such as "raspberrypi.local".

</details><details id="bkmrk-power-led-if-desired"><summary>Power LED</summary>

If desired, you can turn off the LEDs on the Raspberry Pi.

</details><details id="bkmrk-wait-for-network-con"><summary>Wait for Network Connection</summary>

This requires that an internet connection is available before the Raspberry Pi will boot into the operating system.

<p class="callout info">*Recommended: Enabled*</p>

</details>## Disable Unused Hardware

Using rfkill to disable Bluetooth and wifi

[<button class="nav-button" type="button">Maintenance</button>](https://hub.subspace.services/books/monitoring-maintenance/page/maintenance "Maintenance")

# EFI & BIOS

Computer hardware has evolved over the years and the industry stardard have continued to shift. This has led to computer hardware that leverage different mechanisms to achieve the same end. For low-level firmware, there are two technologies widely available for configuring hardware.

## BIOS

Older PC systems use a [BIOS](https://en.m.wikipedia.org/wiki/BIOS) – or Basic Input/Output System – to handle core functions before the computer has loaded an operating system. The BIOS is used to configure fundamental computer settings that affects how hardware interacts with the operating system. This architecture stores your settings on a small memory chip powered by a coin-cell battery. Through a user navigable interface, core computer features can be configured.

<table border="1" class="align-center" id="bkmrk-ami-bios" style="border-collapse: collapse; width: 99.9805%; border-width: 1px;"><colgroup><col style="width: 100%;"></col></colgroup><tbody><tr><td>[![1000006149.jpg](https://hub.subspace.services/uploads/images/gallery/2025-02/scaled-1680-/1000006149.jpg)](https://hub.subspace.services/uploads/images/gallery/2025-02/1000006149.jpg)AMI BIOS</td></tr></tbody></table>

## EFI

Modern computer systems use UEFI – or the Unified Extensible Firmware Interface – to manage these settings through a graphic interface. Some systems require enabling an advanced or administer mode to access all firmware settings.

<table border="1" class="align-center" id="bkmrk-ami-uefi" style="border-collapse: collapse; width: 99.9805%; border-width: 1px;"><colgroup><col style="width: 100%;"></col></colgroup><tbody><tr><td>[![1000006146.webp](https://hub.subspace.services/uploads/images/gallery/2025-02/scaled-1680-/1000006146.webp)](https://hub.subspace.services/uploads/images/gallery/2025-02/1000006146.webp)AMI UEFI</td></tr></tbody></table>

## Configuring Your Hardware

There are numerous manufacturers who use different BIOS and UEFI software for their computer systems. There is no definitive standard for BIOS or EFI systems, resultibg in many different descriptive names for the same features. While we try to cover the most common names, you may need to do some personal research. It's entirely possible that feature is not available on your computer system.

<p class="callout success">If a feature is missing, don't panic! You may still be able to follow these guides without running into any issues.</p>

Some OEM systems, such as business-grade workstation PCs, have simplified firmware with minimal configurable options. This computer can work as a server but may require configuration through the operating system to properly manage power and efficiency settings.

These are some common keyboard commands to enter the BIOS or UEFI menu by manufacturer:

<table border="1" id="bkmrk-asrock-f2-or-del-asu" style="border-collapse: collapse; width: 100%; border-width: 1px;"><colgroup><col style="width: 49.8534%;"></col><col style="width: 49.8534%;"></col></colgroup><tbody><tr><td class="align-right">**ASRock**</td><td>F2 or Del</td></tr><tr><td class="align-right">**Asus**</td><td>F2 or Del</td></tr><tr><td class="align-right">**Acer**</td><td>F2 or Del</td></tr><tr><td class="align-right">**Dell**</td><td>F2 or F12</td></tr><tr><td class="align-right">**Gigabyte**</td><td>F2 or Del</td></tr><tr><td class="align-right">**HP**</td><td>F10</td></tr><tr><td class="align-right">**Intel**</td><td>F2</td></tr><tr><td class="align-right">**Lenovo**</td><td>F1</td></tr><tr><td class="align-right">**MSI**</td><td>Del</td></tr><tr><td class="align-right">**Samsung**</td><td>F2</td></tr><tr><td class="align-right">**Toshiba**</td><td>F2</td></tr></tbody></table>

## Disable Unused Hardware &amp; Features

You can increase the overall security of a home server by disabling extraneous hardware as a proactive measure to decrease your [cyber attack surface area](https://en.m.wikipedia.org/wiki/Attack_surface).

Some common hardware components to disable are:

<details id="bkmrk-serial-port-this-leg"><summary>Serial Port</summary>

This legacy protocol is used for old modems and printers.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-parallel-port-this-l"><summary>Parallel Port</summary>

This legacy protocol is used for old printers, scanners and storage devices.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-audio-ports-our-serv"><summary>Audio Ports</summary>

Our server ideally will be running "headless" (without a display) and should not be used as a media player.

This can include 3.5mm, optical, HDMI and other audio ports.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-bluetooth-bluetooth-"><summary>Bluetooth</summary>

Bluetooth can be left on for connecting smart devices to [Home Assistant](https://hub.subspace.services/books/home-family/chapter/home-assistant "Home Assistant"), but the [protocol can be insecure](https://www.cyber.gc.ca/en/guidance/using-bluetooth-technology-itsap00011).

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-thunderbolt-this-tec"><summary>Thunderbolt</summary>

This technology can be enabled for daisy-chaining multiple displays and storage devices, but it has [known vulnerabilities](https://en.wikipedia.org/wiki/Thunderbolt_(interface)) and should be disabled if not in use.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-wireless-internet-we"><summary>Wireless Internet</summary>

We will use a hardwired connection for our server and the wireless card should be disabled if not in use.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-trusted-platform-mod"><summary>Trusted Platform Module</summary>

This technology is used [predominantly for Windows 11](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/trusted-platform-module-overview) and ensures operating system files are not tampered with. Linux can [use the module for encrypting hard drives](https://wiki.gentoo.org/wiki/Trusted_Platform_Module), but it should be disabled otherwise.

<p class="callout info">*Recommended:* Disabled</p>

</details>## Power-Saving Features   


We are running an always-on server which means our power efficiency settings are an important consideration. Turning off certain hardware when the computer is idle can increase their life expectancy, while turning off other hardware components can decrease stability.

<details id="bkmrk-cool%27n%27quiet-or-spee"><summary>Cool'n'Quiet or SpeedStep</summary>

[Cool'n'Quiet](https://en.m.wikipedia.org/wiki/Cool%27n%27Quiet) (AMD) and [SpeedStep](https://en.m.wikipedia.org/wiki/SpeedStep) (Intel) slow down the processor when idle to decrease overall power usage**.**

<p class="callout info">*Recommended:* Enabled</p>

</details><details id="bkmrk-eist-enhanced-intel-"><summary>EIST</summary>

[Enhanced Intel SpeedStep](https://en.m.wikipedia.org/wiki/SpeedStep) is an advanced mechanism for dynamically scaling the processor's speed and power consumption.

<p class="callout info">*Recommended:* Enabled</p>

</details><details id="bkmrk-c-states-this-featur"><summary>C-States</summary>

This feature allows the CPU to temporarily disable processor sections when they are not being used by the operating system.

<p class="callout info">*Recommended:* Enabled or Auto</p>

</details><details id="bkmrk-c1e-this-is-an-advan"><summary>C1E</summary>

This is an advanced power-saving state that temporarily decreases the processor speed when idle while allowing for rapid return to an active state.

<p class="callout info">*Recommended:* Enabled</p>

</details><details id="bkmrk-erp-mode-and-eup-mod"><summary>ErP Mode and EuP Mode</summary>

This is a comprehensive power feature related to an EU directive that aims to decrease overall device power usage.

While useful for a standard computer, the setting can fundamentally alter system performance by disabling or [underclocking](https://en.m.wikipedia.org/wiki/Underclocking) hardware.

<p class="callout info">*Recommended:* Disabled</p>

</details>## Boot Settings

We can ensure that our server correctly boots into the operating system and restarts automatically in the event of a power failure.

<details id="bkmrk-boot-priority-if-you"><summary>Boot Priority</summary>

If your server has multiple storage disks, you need to ensure that the disk with the operating system installed has first boot priority.

For security, you can disable booting from additional hard drives.

</details><details id="bkmrk-keyboard-and-mouse-h"><summary>Keyboard and Mouse Halt</summary>

Our server will be remotely accessible and we do not always need input devices – such as a mouse and keyboard – connected to it.

Without this setting disabled, the server will fail to boot without them connected.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-secure-boot-this-fea"><summary>Secure Boot</summary>

This feature is used to verify operating system files during boot to ensure that malicious software cannot start.

By default, the hardware is configured for Microsoft Windows and can be [configured for use with Debian](https://wiki.debian.org/SecureBoot#:~:text=UEFI%20Secure%20Boot%20(SB)%20is,requiring%20further%20signatures%20from%20Microsoft.) if desired. Otherwise, it should be disabled.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-fast-boot-this-featu"><summary>Fast Boot</summary>

This feature disables several important power-on hardware tests and has been known to interfere with some operating system features.

This feature is not supported by Debian out of the box and needs to be configured.

<p class="callout info">*Recommended:* Disabled</p>

</details><details id="bkmrk-restart-after-failur"><summary>Restart After Failure</summary>

In the event that your server loses power unexpectedly, it can be configured to turn back on when power is restored.

<p class="callout info">*Recommended:* Enabled</p>

</details><details id="bkmrk-wake-on-lan-your-ser"><summary>Wake-on-LAN</summary>

Your server can be powered on through your Ethernet connection over the Local Area Network when it receives a "[magic packet](https://en.m.wikipedia.org/wiki/Wake-on-LAN#Magic_packet)".

<p class="callout info">*Recommended:* Enabled</p>

</details><details id="bkmrk-power-schedule-our-s"><summary>Power Schedule</summary>

Our server should remain on at all times and we do not want our server operating on a power cycling schedule.

<p class="callout info">*Recommended:* Disabled</p>

</details>## Storage Interface

There are some settings related to the way hard drives and solid state disks communicate with the operating system.

<details id="bkmrk-sata-mode-advanced-h"><summary>SATA Mode</summary>

[Advanced Host Controller Interface](https://en.m.wikipedia.org/wiki/Advanced_Host_Controller_Interface), or AHCI, enables the use of SSD drives through a SATA connection.

Additionally, it improves performance by strictly enforcing hardware communication standards that can be leveraged by the operating system.

<p class="callout info">*Recommended:* AHCI</p>

</details><details id="bkmrk-raid-redundant-array"><summary>RAID</summary>

[Redundant Array of Independent Disks](https://en.m.wikipedia.org/wiki/RAID_Array), or RAID, enables your system to duplicate hard drive writes in real-time.

This creates a fully functional backup in the event of a hard drive failure. This architecture needs to be setup before installing an operating system and cannot be installed after.

<p class="callout info">*Recommended:* Disabled</p>

</details>[<button class="nav-button" type="button">Maintenance</button>](https://hub.subspace.services/books/monitoring-maintenance/page/maintenance "Maintenance")