For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt, and this page is available as Markdown at https://docs.us.ovhcloud.com/en/bare-metal-cloud/dedicated-servers/sgx-enable-and-use.md.
  • English

How to manage Intel SGX on a dedicated server

View as Markdown

Enabling Intel Software Guard Extensions (SGX) on your server allows you to run SGX-ready applications. Intel SGX provides advanced hardware and RAM security encryption features to isolate specific parts of code and data for each application.

Requirements

  • Access to the OVHcloud Control Panel or to the OVHcloud API
  • A dedicated server compatible with the SGX option in your OVHcloud account
  • The credentials received by email after installation
  • Ubuntu 24.04 or equivalent is installed on the server

 

Instructions

Enabling SGX

The activation of SGX is possible from the OVHcloud Control Panel, the OVHcloud API, or your server's BIOS.

Via the OVHcloud Control Panel
Via the OVHcloud API
Manual configuration in the BIOS

1 - Logging in to the OVHcloud Control Panel

Log in to the OVHcloud Control Panel, navigate to the Bare Metal Cloud section, and click Dedicated servers. Select the server on which you want to enable SGX.

 

2 - Enabling SGX

From the General Information tab, in the Advanced Features panel, click the more options ... button next to the Security - Intel SGX (Software Guard Extensions) entry and select Enable SGX from the dropdown menu.

Dedicated advanced features sgx

On the next screen, click on the Enable button.

Dedicated advanced features sgx - step 2

You can choose to enable SGX with a specific amount of reserved memory or allow your application to reserve the memory it needs automatically. Once your choice is made, click on Confirm.

Dedicated advanced features choose sgx

A confirmation window will appear. Please confirm that you understand that enabling Intel SGX technology will result in a server reboot.

Dedicated advanced features confirm sgx

Warning

NOTE: This will result in one or more server reboots, depending on the model.

 

Installing the SGX software stack

Use the following commands to install the Intel SDK to develop and run SGX applications.

First, install some dependencies:

sudo apt update
sudo apt install autoconf automake build-Essential cmake debhelper git libcurl4-openssl-dev libprotobuf-dev libssl-dev libtool lsb-release ocaml ocamlbuild protobuf-compiler python-is-python3 reprepro wget perl unzip pkgconf libboost-dev libboost-system-dev libboost-thread-dev libsystemd0

Next, download the source code and prepare the submodules and prebuilt binaries:

BASE_DIR=/opt/intel
[[ -d $BASE_DIR ]] || sudo mkdir -p $BASE_DIR && sudo chown `whoami` $BASE_DIR
cd $BASE_DIR

git clone https://github.com/intel/linux-sgx.git

cd linux-sgx
git checkout sgx_2.26
make preparation

Build and install the SGX SDK:

make sdk_install_pkg
$ ./linux/installer/bin/sgx_linux_x64_sdk_2.26.100.0.bin --prefix=$BASE_DIR/

 

Test the sample application in simulation mode

To build and run the LocalAttestation sample code in simulation mode:

BASE_DIR=/opt/intel
cd $BASE_DIR/sgxsdk/SampleCode/LocalAttestation/
source $BASE_DIR/sgxsdk/environment

make clean
SGX_MODE=SIM make
cd bin
sudo ./app
succeed to load enclaves.
succeed to establish secure channel.
Succeed to exchange secure message...
Succeed to close Session...

 

Build and install the Intel SGX PSW

The Intel SGX Platform Software (PSW) provides software libraries to run SGX applications in hardware mode. To create the local Debian repository that hosts the packages, run the following commands:

BASE_DIR=/opt/intel
cd $BASE_DIR/linux-sgx
make deb_local_repo

Create the following file to add the local Debian package repository to the repository configuration system:

cat /etc/apt/sources.list.d/sgx.sources
Types: deb
URIs: file:/opt/intel/linux-sgx/linux/installer/deb/sgx_debian_local_repo
Suites: noble
Components: main
trusted: yes

Then, install the following packages:

sudo apt update
sudo apt-get install libsgx-epid libsgx-quote-ex libsgx-dcap-ql

 

Test the sample application in hardware mode (optional)

To build and run the LocalAttestation sample code in hardware mode:

BASE_DIR=/opt/intel
cd $BASE_DIR/sgxsdk/SampleCode/LocalAttestation/
source $BASE_DIR/sgxsdk/environment

make clean
SGX_MODE=HW make
cd bin
sudo ./app
succeed to load enclaves.
succeed to establish secure channel.
Succeed to exchange secure message...
Succeed to close Session...

 

Go further

To go further (develop your own application, register for remote attestation, etc.), here are some useful resources:

Browse all the Dedicated Servers guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.

Learn more about Dedicated Servers on the OVHcloud US website.