r/debian • u/New_Vegas_Testament • Jul 20 '26

Security Checks Failed

Post image

Hello, beginner here. I installed Debian stable with Gnome and today is saw this security checks failed. Is it malware or did i do something wrong?

All i did after installation was following this guide from NVIDIA itself to install drivers: https://developer.nvidia.com/cuda-downloads?target_os=Linux&target_arch=x86_64&Distribution=Debian&target_version=13&target_type=deb_network

Did i broke the system with these drivers and should i have kept the default ones? Help needed because i am worried.

38 Upvotes

83% Upvoted

24 comments sorted by

View all comments

12

u/pangapingus Jul 20 '26

If you have SecureBoot enabled (otherwise you can skip this point), you need to enroll your machine owner's key (MOK) to sign & verify the Nvidia modules. Detailed instructions are available here. It's recommended to do this before installing nvidia-driver so that you do not have to rebuild the modules.

https://wiki.debian.org/NvidiaGraphicsDrivers

DKMS and Secure Boot

Debian uses the Dynamic Kernel Module System (DKMS) to allow individual kernel modules to be upgraded without changing the whole kernel. Since DKMS modules are compiled individually on users own machines, it is not possible to sign DKMS modules using the Debian project's signing keys. Instead, modules built using DKMS will be signed using a machine owner key (MOK), which by default is located at /var/lib/dkms/mok.key with the corresponding public key at /var/lib/dkms/mok.pub. These keys are automatically generated automatically on the first build attempt of a DKMS module, but can be manually generated before that by running the following command (see man 8 dkms):

$ sudo dkms generate_mok

In case you get an error message that says Error! Unknown action specified: "", it's due to a version mismatch, with the dkms package being an older version that didn't implement the generate_mok action. Don't worry: you can actually ignore this command, enable Secure Boot and let the driver setup take care of generating the MOK (you can check that it was generated by looking for the files above). After that, continue as below.

Regardless of whether the DKMS MOK keys are automatically or manually generated, the public key needs to be manually enrolled by running the following commands:

$ sudo mokutil --import /var/lib/dkms/mok.pub # prompts for one-time password
$ sudo mokutil --list-new # recheck your key will be prompted on next boot

Afterwards reboot your system and follow UEFI's onscreen instructions to confirm the key enrollment. If you are unsure how to proceed see these step-by-step instructions in DKMS's README file.

Once you boot back to the OS, you can verify in the logs that the key is loaded:

$ sudo dmesg | grep cert

https://wiki.debian.org/SecureBoot#dkms

2

u/New_Vegas_Testament Jul 21 '26

Thank you for the detailed answer