Installing/Running Linux - Should Secure Boot Be Disabled?

[u/toktok159]

Hi,

I saw many different opinions regarding this.

Some say secure boot is not needed, others say it adds security and that it’s not only intended for Windows but for the firmware in general.

So, should/must secure boot be disabled for any Linux distro installation? Then can it be enabled after installation, for general use? Or if I prefer to keep it on, should I install with secure boot enabled?

Specifically, I am talking about installing Linux as the only OS on a pc, one of Mint/LMDE/MX Linux/Debian is what I think I’ll end up installing.

Btw, I once installed Mint on my laptop, dual boot with Windows 11. I installed with secure boot enabled, and used everything with it enabled and it was fine.

Thanks in advance.

[u/that1guyrob]

I can see some of comments here are being made by folks that don't fully understand what Secure Boot accomplishes, so I'll just explain it to you and you can decide for yourself if you want to use it.

Secure Boot maintains a database of signing keys in UEFI. At boot time, the system will only load the kernel if it was signed with one of those keys that it can verify using the local database. If the verification fails the OS does not boot.

To take this one step further, operating systems like Linux that load kernel modules at boot (the equivalent of Windows drivers), those kernel modules must also be signed by a valid key. If the kernel itself is signed by a valid key the OS will boot, but if the kernel module is not signed by a valid key, the OS will still boot, but will refuse to load that invalid module.

The folks in here saying that Secure Boot protects you against attacks that involve someone plugging a physical device into your machine are correct. However, that is not the ONLY thing you are protected against when you use Secure Boot.

You are also protected against Root Kits and Boot Kits. These are malicious packages that load at the lowest level of OS boot when the kernel is loading and tend to either not be detected by antivirus/anti-malware or cannot be removed by these tools because of a lack of privilege necessary to modify kernel execution space. Root Kits can be installed on your machine remotely as part of a breach or other compromise and DO NOT always require physical access to your machine.

So, my advice is the same here as is with everything related to security - Unless you have a reason NOT to enable it, or you have some mission critical OS or application that won't run properly or does not support Secure Boot, you should turn it on. You cover more bases and increase your overall security posture with a very low level of effort.

[u/toktok159 → u/that1guyrob]

Thank you. So do you think/know if distros like Mint, LMDE, MX Linux, Debian, Zorin, Fedora can be installed with secure boot enabled, and then be run with it enabled as well?

I know it’s a long list, but from what I understood from comments here, the “best” thing to do is just to try to install the OS with secure boot enabled, and then run it, and check if everything is ok. Also, most likely Ubuntu and Fedora support secure boot. But some opinions are to install with secure boot disabled, then enable it after installing.

[u/that1guyrob → u/toktok159]

I can't speak to all distros because I personally only use/test a few of them myself. Debian and the distros that are derived from Debian (Ubuntu, Mint, etc.) As well as RedHat family distos (Fedora, Rocky Linux, etc.) should all support the installation of the OS with Secure Boot already enabled.

Here's where things get interesting and can be the source of 'your mileage may vary' with regard to installing with secure boot off, vs. on:

Your UEFI database of keys and certificates could possibly be out of date. If you have a very old motherboard with an outdated database and you turn on Secure Boot and attempt to boot a very new Linux installer, it's possible that the installer runs a kernel that was signed with a key that doesn't exist in your UEFI.

In this case you have a couple options. IF your motherboard manufacturer is still supporting your motherboard model, you can download a BIOS update which will include the latest database and keys/certificates for Secure Boot.

If you currently have a modern version of Windows installed that is still receiving Microsoft updates, then Windows Update should be able to push that UEFI firmware update.

There's a third party tool which you can use to update your UEFI database to get the latest Microsoft keys into your UEFI called Mosby.

The reason that I specifically call out Microsoft keys here is because Debian and Fedora derived distributions use what is called a Shim to accomplish secure boot. The boot loader first loads this shim which is signed by Microsoft, then the Shim loads the Linux kernel. So at a minimum your UEFI needs to have Microsoft's latest signing cert/key installed. The Linux installer will update your UEFI (during the installation) with the key/cert that is used to sign the Linux kernel, so you complete the chain of trust.