Secure boot

[Gallerilt]

I have not activated secure boot on my old Lenovo with Ubuntu 24.04, and old Sony Vaio with Debian 13. Should this be a problem? Or will it be a problem if I aktivate it?

 

[kc1di]

If everything is working for you I would not activate it especially on older equipment since it can cause problems.
It's sort of a miss nomer anyway as secure boot does not make a Linux machine and more secure. JMHO. If you want to learn more about secure boot and it's issues this is a good article to start with it's long.

Your Linux PC has a Secure Boot problem - what to do first (and the workaround to avoid)

Secure Boot has always been a nuisance for Linux users, but Microsoft's expiring 2011 certificate authorities are making it a real pain.

www.zdnet.com

 

[osprey]

I have not activated secure boot on my old Lenovo with Ubuntu 24.04, and old Sony Vaio with Debian 13. Should this be a problem? Or will it be a problem if I aktivate it?

Secure boot is optional for linux users. There are advantages and disadvantages that users can assess for themselves. Users can weigh things up to decide whether to use it or not. Here are some of the factors one might consider:

Secure boot protects bootloaders against tampering using a digital signature. If one's machine is stolen or tampered with and the tamperer tries to boot the machine using an ordinary unsigned usb or rootkit of some sort, the machine won't boot.

If the usb has a digitally signed bootloader, then it will boot and the secure boot of the machine will not stop it from booting the usb. Such a bootable usb would provide access to the data on the machine, if not encrypted.

Secure boot does not protect a machine from having its hard drive wiped clean ready for a new installation. Secure boot cannot protect against the hard drive being mounted in another machine and having unencrypted files read and tampered with.

If a user wishes to run customised kernels, then secure boot will prevent them booting, unless each such kernel has been signed with Machine Owner Key for which one can read the details on how to apply it.

If a machine is used in a relatively safe and secure environment like perhaps in a home and unlikely to be tampered with, then secure boot may be less of an issue for the user. In an office environment where there are banks of computers for office workers who can access multiple computers, secure boot may be a greater consideration for protection of the machines.

Most major linux distros like debian, ubuntu, fedora, support secure boot natively so it's easily set to be "on" in the BIOS/UEFI if the user wishes to have it set.

It's not necessary to run secure boot for a machine to function perfectly as intended.

If one wishes to have their data protected, then encryption is usually used. Encrypting data or drives is independent of secure boot, but compatible with it, so using both is more secure than not. Another level of security is to set a BIOS/UEFI password so that a user would need the password to access the BIOS/UEFI to make any alterations there such as unset secure boot.

Personally, although a number of machines here are accessed by different people, secure boot is not used since the users are trusted and the environment is relatively secure from any outside tampering. The other aspect is that back ups are held off site which would minimise losses in the event of any unfortunate events. People just encrypt what they wish to remain private.