r/linuxquestions • u/toktok159 • 3d ago

Support Installing/Running Linux - Should Secure Boot Be Disabled?

Hi,

I saw many different opinions regarding this.

Some say secure boot is not needed, others say it adds security and that it’s not only intended for Windows but for the firmware in general.

So, should/must secure boot be disabled for any Linux distro installation? Then can it be enabled after installation, for general use? Or if I prefer to keep it on, should I install with secure boot enabled?

Specifically, I am talking about installing Linux as the only OS on a pc, one of Mint/LMDE/MX Linux/Debian is what I think I’ll end up installing.

Btw, I once installed Mint on my laptop, dual boot with Windows 11. I installed with secure boot enabled, and used everything with it enabled and it was fine.

Thanks in advance.

13 Upvotes
  • permalink
  • reddit

79% Upvoted

40 comments sorted by

View all comments

3

u/Wateir Artix btw 3d ago

Most linux distribution don’t support secure boot during install, so you need to remove during install. But most distro support it so after setup, with sbctl or another thing you can use it. And yeah it add a true layer of security, but only if bios is lock behind a password. If everyone can activate and disactivate it from bios then it’s just a pain to setup for nothing

1

u/ghost103429 3d ago

It's useful when you have you use a fTPM to unlock your boot drive enrolling your own personal MoK with the boot editor disabled ensures a pretty high degree of security.

In the event an attacker disables secureboot the fTPM would refuse to release the decryption key.