45

I have just installed Ubuntu 15.10, after having been with 16.04 LTS for some time to try it out. While I was using 16.04, I tried to install Nvidia Drivers and got told that I needed to disable SecureBoot for that, so I provided a password and on the next reboot some software asked for it. However, my BIOS settings still showed SecureBoot to be enabled, and I could still see how if I tried to boot from anything that wasn't signed, it would refuse to do so.

However, when I reinstalled Ubuntu 15.10 (completely deleting everything related to 16.04, including grub in the EFI partition), every time I boot I get a Booting in insecure mode message.

I have checked everything, and both: Windows and the BIOS setting report SecureBoot to be enabled

vagaerg
  • 647

3 Answers3

51

If you want get rid of the message about Insecure Boot you need to enable secure boot. To do this you need turn on validation in module MOK (Machine Owner Key):

sudo mokutil --enable-validation

You will be asked to enter twice temporary password and than after reboot get a possibility to change validation state.

If validation is enabled than no more message about insecure boot appears. But remember, you will not be able to run any unsigned drivers: nVidia drivers and VirtualBox will not be working.

To disable validation type:

sudo mokutil --disable-validation

and then reboot.

If you disable validation and have in BIOS Secure Boot switched ON, still you will not be able to boot anything that wasn't signed. Even though your ubuntu has validation disable but "is seen" by BIOS (UEFI) as signed because of shim-signed package. Shim package while your ubuntu is booting checks what is the MOK state and if validation is disabled shows message "Booting in insecure mode".

Peter
  • 526
6

You can check the status of Secure Boot by -

$ mokutil --sb-state

For you, the output might be -

SecureBoot enabled
SecureBoot validation is disabled in shim

You need to use the following command to re-enable Secure Boot validation, which will eventually not show the text "booting in insecure mode".

$ sudo mokutil --enable-validation

Here, the command will ask you to enter a password. This password is not your login password but just a temporary password. You need to set a password which will be asked in the following steps.

Now, restart and follow the instruction shown on Perform MOK management blue screen.
Select Change Secure Boot state.

Sources -
https://wiki.debian.org/SecureBoot
https://wiki.ubuntu.com/UEFI/SecureBoot

Hrishikesh Kadam
  • 359
  • 5
  • 14
0

The first answer above includes this claim: 'If you want get rid of the message about Insecure Boot you need to enable secure boot.' That claim is false. Here is why (and the explanation might be of help to people who want rid of the message).

Seeing the message 'booting in insecure mode' does not entail that secure boot is disabled in one's BIOS (a.k.a. in one's 'UEFI'). For, I have seen that message when secure boot was disabled at the BIOS level; what caused the message to show (or at least sufficed for its being shown) was the following. I had issued the command sudo mokutil --disable-validation and then rebooted and then gone through a mokutil (or should I say 'EFI'?) rigmarole. I had done that disabling in order to try to fix another problem to do with secure boot.

The command sudo mokutil --enable-validation sufficed to rid me of the 'booting in insecure mode' message. Thus I was returned to my previous happy state where secure boot was disabled and (yet) I did not see the message. Or rather that was the result when - again - I had rebooted (via that command) into the 'mokutil' interface and specifically, for one thing, told that interface to disable secure boot - or, rather, keep it disabled. That latter problem - namely, that one has to tell the interface generated by the mokutil command to disable something that is disabled already - is the tip of an iceberg. That iceberg is one of gratuitous unclarity that, rather shockingly, the mokutil-generated UI adds to the already perilous ocean of so-called secure boot. (Indeed, I may here be misunderstanding the interface at issue. If so, that only confirms my point.)

user1445233
  • 1