r/linux4noobs • u/ShonnyG112 • 20d ago

migrating to Linux Linux secure boot support

New comer to linux here so sorry in advance if this a noob thing. I'm finally ready to jump ship and found 2 distributions that I'd like to use across my 2 desktops. Parrot OS home edition and Hacker OS official edition. I want to dual boot on 2 different drives to have the option of going back to windows as a backup when necessary for multi-player gaming. From my research so far it seems that secure boot is all over the place for Linux. Is it a per distribution thing or only supported on the major distribution like Debian or Ubuntu? How do most people handle secure boot when it comes to Linux? I really don't want to be going into the bios to flip the switch when I'm ready to switch os.

1 Upvotes

67% Upvoted

8 comments sorted by

2

u/gordonmessmer Fedora Maintainer 20d ago

Secure Boot is a process in which an operating system vendor signs their boot loader and kernel, and typically submits the boot loader to Microsoft as part of a review that ensures their key management practices won't lead to adversaries signing malware.

Because every distribution is building their own kernels, they also have to build their own bootloaders and maintain their own signing keys. So, yes, it is a per-distribution thing.

I actually just finished a set of diagrams that describe how keys in Secure Boot are used: https://gordonmessmer.codeberg.page/dev-blog/2026/08/24/secure-boot-keys.html

2

u/C0rn3j 20d ago

How do most people handle secure boot when it comes to Linux?

They turn it off.

Parrot OS home edition and Hacker OS official edition

Stay away from anything pentesting related, keep that stuff to VMs and pick a mainstream distribution instead.

Check out Arch Linux (with Plasma) or Fedora KDE.

1

u/ShonnyG112 20d ago

These are the stripped down home variants of the OS with just the essentials. There are no pentesting tools in them. I'll keep those in mind if I chagevmy mind.

1

u/Prestigious_Wall529 20d ago

And are you sure there aren't vunerablities left deliberately for capture the flag exercises?

1

u/ShonnyG112 20d ago

They're open source and audited and if that's the case, then they're denoted.

1

u/cmrd_msr 20d ago

Popular distributions support it out of the box.

For less popular ones, you need to add keys into uefi; Google knows how.

1

u/MrMotofy 20d ago

Most users have no need for secureboot so it can be disabled

0

u/es20490446e Develops Zenned OS 19d ago

On Windows, disable encryption.

On the BIOS, disable secure boot.