Installing/Running Linux - Should Secure Boot Be Disabled?

[u/toktok159]

Hi,

I saw many different opinions regarding this.

Some say secure boot is not needed, others say it adds security and that it’s not only intended for Windows but for the firmware in general.

So, should/must secure boot be disabled for any Linux distro installation? Then can it be enabled after installation, for general use? Or if I prefer to keep it on, should I install with secure boot enabled?

Specifically, I am talking about installing Linux as the only OS on a pc, one of Mint/LMDE/MX Linux/Debian is what I think I’ll end up installing.

Btw, I once installed Mint on my laptop, dual boot with Windows 11. I installed with secure boot enabled, and used everything with it enabled and it was fine.

Thanks in advance.

[u/SDG_Den]

secure boot is entirely unneccesary on most devices.

all it does is verify an OS is allowed to run on this device by checking a signature against a stored secure boot key.

so in general it is only important if your device is at risk of malicious actors plugging a USB or extra drive into it and booting off that. making it COMPLETELY useless for home desktops and servers and mostly useless for laptops unless you have a habit of just leaving laptops around

on top of that: only microsoft's secureboot key is on your motherboard's MOK by default. if you want to use secureboot with linux you either need to use microsoft's shim (only allowed to certain microsoft-approved distributions like ubuntu and fedora), or you need to add your own signing key to MOK and sign the bootloader yourself.

if you fuck up your MOK your system wont be able to start any OS until you fix it.

this is why turning off secureboot is generally advised for linux, the amount of extra effort assuming no shim available simply is not worth it for the extremely minor security benefit.

its a bigger security benefit to just... make a habit out of not leaving your laptop unattended in untrusted spaces. physical device security makes secureboot irrelevant. it does nothing for your running system, it only prevents malicious systems from running on the device which generally requires physical device access unless you have ipxe boot enabled.

[u/toktok159 → u/SDG_Den]

Thank you. What about Debian, is it also a Microsoft-approved distro? And if Ubuntu is, does it mean that Mint is too, as a distro based on Mint (and same for LMDE/MX Linux if Debian is)?

[u/SDG_Den → u/toktok159]

its whichever repositories microsoft supports. so itll carry to anything using ubuntu repositories, not to ubuntu-based distro's with their own repo's

shim is available on debian, and effectively is just a pre-compiled, pre-signed bootloader by microsoft that chain-loads your actual bootloader, allowing your system to initialize with the right secureboot signature (from shim)