44

I have just installed Ubuntu 15.10, after having been with 16.04 LTS for some time to try it out. While I was using 16.04, I tried to install Nvidia Drivers and got told that I needed to disable SecureBoot for that, so I provided a password and on the next reboot some software asked for it. However, my BIOS settings still showed SecureBoot to be enabled, and I could still see how if I tried to boot from anything that wasn't signed, it would refuse to do so.

However, when I reinstalled Ubuntu 15.10 (completely deleting everything related to 16.04, including grub in the EFI partition), every time I boot I get a Booting in insecure mode message.

I have checked everything, and both: Windows and the BIOS setting report SecureBoot to be enabled

3
  • I've run into something similar with an HP EliteDesk 705, but I haven't yet investigated it fully. What make and model computer do you have, and what brand of EFI is it? (Typing dmesg | grep -i efi should produce output with EFI information. One of the first lines should identify the EFI's manufacturer, as in efi: EFI v2.31 by American Megatrends.)
    – Rod Smith
    Jan 27, 2016 at 14:08
  • This is an MSI GS60 laptop, and the EFI is also by American Megatrends too. I find it strange how that happens even with Secure boot enabled
    – vagaerg
    Jan 27, 2016 at 16:12
  • Does this answer your question? "Booting in insecure mode" when secure boot is turned on Feb 28, 2021 at 9:29

3 Answers 3

51

If you want get rid of the message about Insecure Boot you need to enable secure boot. To do this you need turn on validation in module MOK (Machine Owner Key):

sudo mokutil --enable-validation

You will be asked to enter twice temporary password and than after reboot get a possibility to change validation state.

If validation is enabled than no more message about insecure boot appears. But remember, you will not be able to run any unsigned drivers: nVidia drivers and VirtualBox will not be working.

To disable validation type:

sudo mokutil --disable-validation

and then reboot.

If you disable validation and have in BIOS Secure Boot switched ON, still you will not be able to boot anything that wasn't signed. Even though your ubuntu has validation disable but "is seen" by BIOS (UEFI) as signed because of shim-signed package. Shim package while your ubuntu is booting checks what is the MOK state and if validation is disabled shows message "Booting in insecure mode".

3
  • 1
    @Peter I can now run the nvidia proprietary driver with validation disabled AND Secure Boot switched ON in the UEFI.
    – sanwablo
    Jan 4, 2017 at 16:35
  • Virtualbox works here with validation activated.
    – poch
    May 23, 2018 at 18:02
  • You can run any proprietary or self-compiled kernel module with validation enabled if you sign it yourself and enroll your signing key as the MOK. See askubuntu.com/a/797442/12049
    – ssice
    Feb 13, 2019 at 9:57
5

You can check the status of Secure Boot by -

$ mokutil --sb-state

For you, the output might be -

SecureBoot enabled
SecureBoot validation is disabled in shim

You need to use the following command to re-enable Secure Boot validation, which will eventually not show the text "booting in insecure mode".

$ sudo mokutil --enable-validation

Here, the command will ask you to enter a password. This password is not your login password but just a temporary password. You need to set a password which will be asked in the following steps.

Now, restart and follow the instruction shown on Perform MOK management blue screen.
Select Change Secure Boot state.

Sources -
https://wiki.debian.org/SecureBoot
https://wiki.ubuntu.com/UEFI/SecureBoot

0

The first answer above includes this claim: 'If you want get rid of the message about Insecure Boot you need to enable secure boot.' That claim is false. Here is why (and the explanation might be of help to people who want rid of the message).

Seeing the message 'booting in insecure mode' does not entail that secure boot is disabled in one's BIOS (a.k.a. in one's 'UEFI'). For, I have seen that message when secure boot was disabled at the BIOS level; what caused the message to show (or at least sufficed for its being shown) was the following. I had issued the command sudo mokutil --disable-validation and then rebooted and then gone through a mokutil (or should I say 'EFI'?) rigmarole. I had done that disabling in order to try to fix another problem to do with secure boot.

The command sudo mokutil --enable-validation sufficed to rid me of the 'booting in insecure mode' message. Thus I was returned to my previous happy state where secure boot was disabled and (yet) I did not see the message. Or rather that was the result when - again - I had rebooted (via that command) into the 'mokutil' interface and specifically, for one thing, told that interface to disable secure boot - or, rather, keep it disabled. That latter problem - namely, that one has to tell the interface generated by the mokutil command to disable something that is disabled already - is the tip of an iceberg. That iceberg is one of gratuitous unclarity that, rather shockingly, the mokutil-generated UI adds to the already perilous ocean of so-called secure boot. (Indeed, I may here be misunderstanding the interface at issue. If so, that only confirms my point.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .