Safe Boot Bios

[Gano Richardson]

WhenI rebooted the computer, my monitor gives a "signal out of range" error because I believe the video is being detected at a higher resolution than the monitor supports. How can I force Ubuntu to start up in a lower resolution so that I can adjust display properties. I've already tried editing the /etc/default/grub and un-commenting #GRUB_GFXMODE=640x480 line. I know in Windows, you can press F8 on boot to go into a safe video mode so I'm looking for the equivalent in Ubuntu.

To start Ubuntu into safe mode (Recovery Mode) hold down the left Shift key as the computer starts to boot. If holding the Shift key doesn't display the menu press the Esc key repeatedly to display the GRUB 2 menu. From there you can choose the recovery option.

-method 1

first boot:

press the escape key to enter the startup menu then enter normally the os login manager , then restart

second boot:

press the shift key , it will redirect you to the gnu grub screen

I found out that my motherboard calls this "Windows 8 Features" which I therefore turned on. This showed some new settings for Secure Boot which become enabled by default. I changed the other settings as restrictive as possible.

After setting an Administrator password I saved and exited the setup and tried booting the operating system which worked without an issue. Since I am running Fedora 25, I didn't expect any trouble. However, when I enter the BIOS it says that Secure Boot is disabled, even though right below the status it is set to enabled.

At first I thought this is temporary because I haven't restarted the machine, but even after a complete reboot, the system still says "Disabled" (as shown in the screenshot). The administrator password works on the other hand. ;-)

I'm sorry, but that is not the case. You can in fact sign your own bootloader with your own keys (if your motherboard supports that, mine does and many others probably too) or let Microsoft sign your bootloader with the official keys, that are standard on all computer that ship with Windows 8+.

Wasn't aware of that, I would try updating the bios then if you haven't already. Never thought secure boot was supported beyond windows, although it does seem either your install of fedora or your motherboard isn't playing nice as it sits right now. Being a new feature as that wiki post reads, I would definitely update the bios although I'm not sure a Z97 board would get any updates to specifically make it work any better on Linux, but its possible.

I feel like there must be a configuration/compatibility problem inside the BIOS or something related to the hardware. I don't think that the board would disable Secure Boot if there was an issue with Fedora, since that would defeat the purpose of having it.

Turns out my motherboard doesn't set the default keys from Microsoft if you set the "Secure Boot Mode" to "Standard". In fact you have to set it to custom, where you would be able to set your own keys too.

After I confirmed the action and hit F10, I rebooted the system and went back to the BIOS. Now it finally says "Secure Boot state: Enabled". I rebooted again and let the system proceed to booting the OS which worked perfectly with Fedora.

Update: So I tried booting off a Live-CD that I was quite sure doesn't have a Secure Boot signature and the BIOS refused to boot it as expected. When I used the Fedora 25 Live-DVD, it booted just like from my internal hard drive. So I assume that I can be fairly certain, that Secure Boot is working ;-)

hello, I recently received my framework laptop and am looking to install Linux, however the option for secure boot is not available in my bios menu. I boot up the system, press f2, go to setup utility, but under security there is no option to disable secure boot. the only options are:

For Intel 13th Gen, secure boot is enabled by default. (Thanks Microsoft.) To disable it, access the Administer Secure Boot panel from the BIOS root screen before attempting to boot an unsigned image. Otherwise, the content of the Administer Secure Boot panel is blocked when a secure boot fails.

If you get the message blocking Administer Secure Boot, then power off and try again. When powering on, either press F2 before the BIOS attempts to load an image, or power on with no OS image attached.

I freshly installed Fedora 39 Worsktation Edition on my second SSD.

I have a Dual boot with Windows 11.

I kept my WIndows 11 installation on the other SSD to play competitive gaming such as CS:GO.

And the face-it anticheat requires secure boot to run.

Before enabling secure boot again first follow the steps detailed in /usr/share/doc/akmods/README.secureboot.

Once that is done then replace the unsigned driver with one that has been signed and it should work for you.

Unfortunately if the driver was installed before performing the steps in that file, the currently installed driver will not be signed because the key has not yet been created by the kmodgenca command. The key must be created before akmods can sign the driver and that is not done by default.

I was surpised that the keys existed and thats why I investigated.

I suspect that may well be important to force the keys to be created if you do not reboot between installing akmods and building the nvidia driver.

It also does not negate the requirement to use mokutil and import the key into the bios for use by secure boot. The only part of the instructions in the README that might be unnecessary after a reboot is the use of the kmodgenca command.

I agree. If the installer were to first generate the key and run the mokutil command, then compile the drivers and install the normal kmod-* package; the new drivers would already be signed. The only required step for the user then would be to actually import the key into the bios during the reboot.

If secure boot is disabled there would be no difference for the user and if secure boot is enabled then the driver still could be automatically loaded since it would be signed when initially installed.

That would only happen if you system boots the /boot/efi/EFI/BOOT/BOOTX64.EFI instead of /boot/efi/EFI/fedora/shimx64.efi. Supposedly, booting the BOOTX64.EFI would run the fbx64.efi which should install a new entry into the UEFI boot menu using the information in the file /boot/efi/EFI/fedora/BOOTX64.CSV. For some UEFI implementations that could lead to running out of space in the UEFI memory.

Hello. I am trying to fully disable Optane on my system. I have disabled Optane from the Intel Rapid Storage Technology app. I was hoping that this would disable Optane completely, but my SSD is still set to SATA Mode: "M.2/RAID Optane" in the BIOS. I want to change this to SATA Mode: AHCI. (My motherboard: -AORUS-PRO-rev-10#kf)

When I try to change this option, it persists even though I save changes. Now, there is one feature I haven't tried to change- In my BIOS, when "M.2/RAID Optane" is selected as the SATA mode, there is an entry for "M.2/Optane Genie" and "M.2_1/RST Pcie Storage Remapping". I can disable M.2_1 without issue. However, when I try to disable M.2/Optane Genie, I get this warning:

Now we see the extent of the problem. I can't back up the system. If I use a Windows utility to image the drive, I will need Windows to run the utility and restore it. Now if Windows is damaged when I disable the feature, how can I restore it if I used a Windows Utility!? But if I try to use a Linux-based utility like Clonezilla, the drive is unreadable, because Linux cannot mount the device.

1) Will changing the SATA mode even do what I want? I need an SSD drive that can dual-boot multiple OS's securely. Perhaps it's possible to install a Linux OS on the drive without changing the SATA Mode? (I suppose I can try this myself).

2) How great is the risk associated with changing the SATA Mode? Is this warning just there so Gigabyte can waive liability? Since I have disabled Optane in Windows, is it actually safe to change this?

3) How can I backup the system? I can't do it from within Windows, because if I lose Windows, I can't restore. I can't do it from Linux, becuase Linux can't mount the device. I don't have a drive big enough to clone it directly, but the Windows partition is itself very small. Perhaps there's a way to clone partition to partition? Clonezilla supports this... but it's Linux under the hood.

A good answer for any of these questions will be sufficent for me. If I can install Linux on the device without changes, good! If I can turn off the RAID and use it as an AHCI device, good! And if I lose the data in the process, it's OK if I can recover it and continue booting into Windows.

Intel does not verify all solutions, including but not limited to any file transfers that may appear in this community. Accordingly, Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade.

Given this and the extremely short time frame I have to purchase the systems I need, I am resorting to purchasing nearly end-of-life hardware on which we can still disable the secure boot setting in the bios for this year.

I am clearly missing something that I need to learn quickly. So, I'm asking all of you if you have any experience with this. If the Kace K2000 isn't going to do secure boot, what other deployment options are available that will do this? A few years back, when the Apple hardware required a version of secured booting, that drove me to using an MDM platform for my deployments. Am I now at the same point for our windows hardware?

From what I understand by talking with KACE they are fighting to get their certificate going with MS so then we can do PXE with Secure Boot enabled. For now you could use this as a workaround -to-uefi-boot-with-secure-boot-on-the-sda-with-usb

3a8082e126