# A way to disable bootup from SD card

**URL:** <https://www.wago.community/t/a-way-to-disable-bootup-from-sd-card/1283>\
**Category:** Hardware and Linux\
**Tags:** pfc200\
**Created:** [October 29, 2024, 4:10pm UTC](https://www.wago.community/t/a-way-to-disable-bootup-from-sd-card/1283 "2024-10-29T16:10:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![edwin](https://avatars.discourse-cdn.com/v4/letter/e/73ab20/32.png) [@edwin](https://www.wago.community/u/edwin)\
**Post date:** [October 29, 2024, 4:10pm UTC](https://www.wago.community/t/a-way-to-disable-bootup-from-sd-card/1283/1 "2024-10-29T16:10:22Z")

</div>

Hello,

The wago PFC200 has a SD card. I read, about the boot device order.

“7 Boot PFC with custom image “sd.hdimg” on SD-Card  
PFC boot device order checks SD-Card slot before internal NAND.”

“PowerOff PFC  
Insert SD-Card with custom-image  
PowerOn PFC”"

Source: [GitHub - WAGO/pfc-firmware-sdk-G2: Firmware SDK for PFC200-G2 family](https://github.com/WAGO/pfc-firmware-sdk-G2)

In the facotory, only the firmware in the controller is allowed to run. Not from the SD card.

Can I disable the bootup from a SD card anywhere?

Thank you,  
Newbie.

DR;TL;  
For security reasons, I want to disable the SD card.  
(No access to SD card at all, if possible. And no bootup from SD card, as a minimum.)  
Is it possible? And how can I do it myself?

---

<div class="post-metadata">

**Author:** ![edwin](https://avatars.discourse-cdn.com/v4/letter/e/73ab20/32.png) [@edwin](https://www.wago.community/u/edwin)\
**Post date:** [October 30, 2024, 7:34am UTC](https://www.wago.community/t/a-way-to-disable-bootup-from-sd-card/1283/2 "2024-10-30T07:34:00Z")

</div>

Addition / Note.

“Restrict access to the control cabinet” is the solution from the PFC100/PFC200 CyberSecurity manual.

Source: mxxxxxxxx\_\_CyberSecurity\_\_0en.pdf; Cyber Security for Controller PFC100/PFC200; Version 1.2.0

"5.2.1.6 Memory Card Slot  
The controllers have a memory card slot (1). A potential attacker could start the system from a prepared SD card. As a general rule, as soon as an SD card is installed, the controller boots from the SD card. This allows the data in the internal flash memory to be manipulated or the control application to be interfered with directly. Manipulation is difficult or impossible to detect.

Note  
Restrict access to the control cabinet:  
Install the controller in a control cabinet and ensure that only a restricted group of persons has access to the control cabinet."

---

<div class="post-metadata">

**Author:** ![AdamReeve](https://sea2.discourse-cdn.com/flex016/user_avatar/www.wago.community/adamreeve/32/59_2.png) [@AdamReeve](https://www.wago.community/u/AdamReeve)\
**Post date:** [October 30, 2024, 12:48pm UTC](https://www.wago.community/t/a-way-to-disable-bootup-from-sd-card/1283/3 "2024-10-30T12:48:28Z")

</div>

From the Web-Based Management, go to the Security tab and then the Boot Mode page. From there, you can disable booting from a memory card.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/wago/original/1X/02241c9f65218ae9eaeef4cd908dbdb94ed0e44c.png)

---

<div class="post-metadata">

**Author:** ![edwin](https://avatars.discourse-cdn.com/v4/letter/e/73ab20/32.png) [@edwin](https://www.wago.community/u/edwin)\
**Post date:** [October 31, 2024, 8:44am UTC](https://www.wago.community/t/a-way-to-disable-bootup-from-sd-card/1283/4 "2024-10-31T08:44:00Z")

</div>

This morning, I tested this solution for the command line. And it woks. No boot up, from the SD card. Thank you.

$ /etc/config-tools/get\_boot\_mode --force\_internal\_boot --json  
{“force\_internal\_boot”: “disabled”}

$ /etc/config-tools/config\_boot\_mode --force\_internal\_boot enabled

$ /etc/config-tools/get\_boot\_mode --force\_internal\_boot --json  
{“force\_internal\_boot”: “enabled”}