What you always wanted to know about SecureBoot - TUXEDO Computers

We often receive questions about what SecureBoot is and why it is deactivated by default on TUXEDO. SecureBoot is a concept that often causes confusion, especially for users who are using it for the first time. Many wonder whether this technology is really necessary and what impact it has on the use of Linux.

In practice, SecureBoot offers both advantages and limitations. A common assumption is that SecureBoot is absolutely necessary to ensure the security of a system. However, this is only an additional protective measure that ensures that only trustworthy software is executed when the system is started.

At TUXEDO Computers, we have made a conscious decision to disable SecureBoot by default. Our goal is to give our users maximum flexibility and control, especially with regard to the installation of Linux and other open source operating systems, where SecureBoot can sometimes lead to complications.

FAQ about SecureBoot

What is SecureBoot?

SecureBoot is a security function that was developed by Microsoft and was first delivered for Windows 8 from 2012 with UEFI version 2.3.1. SecureBoot is designed to protect the integrity of the boot loader and the kernel. Up to and including Windows 10, SecureBoot was optional; with Windows 11 it is a prerequisite, but Microsoft has not yet enforced it.

How does SecureBoot work?

SecureBoot works with cryptographic signatures. Every program that is loaded by the UEFI firmware contains a signature. Before the firmware allows execution, it checks whether the program is trustworthy by verifying the signature. In this way, SecureBoot ensures that the boot manager, kernel and kernel modules come from a trusted source when Linux is started and prevents untrusted programs from being executed.

SecureBoot and Linux

In order for Linux to run with SecureBoot, the corresponding components must be signed directly or indirectly by a certificate stored in the UEFI (usually from Microsoft) or a manually entered certificate. TUXEDO OS currently uses the second approach. The steps for using SecureBoot with TUXEDO OS are described below.

Requirements for SecureBoot on your TUXEDO

We are not yet activating SecureBoot as we are waiting for a Microsoft-signed shim with an embedded TUXEDO certificate. In connection with SecureBoot, a Shim is a simple software package that can be used as a first-stage boot loader on UEFI systems and loads a signed boot loader there. It also enables the simple reloading and management of own certificates (Machine Owner Keys MOKs), which are then permanently stored, with an interface that is identical for all systems.

TUXEDO OS with SecureBoot

In order to use SecureBoot with TUXEDO OS using our self-signed certificate, some manual steps are currently required:

Step 1: Required packages

By default, the shim-signed package is already pre-installed under TUXEDO OS. Check this, install it if necessary and restart the system.

Step 2: Import certificate

Download the certificate from our GitHub instance and import it as a Machine Owner Key (MOK). In addition to the sudo password, you will be asked for a one-time password, which you must repeat for security reasons.

sudo mokutil --import TUXEDO_Computers_GmbH_Secure_Boot_Signing.crt

Step 3: Import certificate

In order for our driver package tuxedo-drivers to be integrated into the process, you must import a MOK for DKMS. Before you do this, make sure that the directory /var/lib/shim-signed/mok/MOK.der exists on your system. If this is not the case, create it with the command:

sudo update-secureboot-policy --new-key

You must then reinstall all DKMS packages so that the respective modules are signed with the new key. The command will tell you which packages these are:

dkms status

This is followed by the import, where the one-time password is also requested again.

sudo mokutil --import /var/lib/shim-signed/mok/MOK.der

Step 4: Configure MokManager

Use the following command to ensure that the key is displayed in the MokManager after the restart. If nothing is displayed there, the import did not work.

sudo mokutil --list-new

To ensure that the MOKManager is displayed long enough the next time you restart, switch off its timeout:

sudo mokutil --timeout -1

Step 5: Activate SecureBoot

The next restart will open the MOKManager, where you can select Enroll MOK and click on the key in the next window to view the certificate.

Then restart the system. Now you can switch to the BIOS/UEFI and activate SecureBoot on the next restart.

Step 6: Manage certificate

Check the status of SecureBoot in the terminal at any time with the following command:

sudo mokutil --sb-state

If you want to remove a certificate from the MOK, use the following command:

sudo mokutil --delete TUXEDO_Computers_GmbH_Secure_Boot_Signing.crt

For an overview of other commands for managing the MOK and the certificate, simply enter

mokutil -h