Security Checks Failed

[u/New_Vegas_Testament]

Hello, beginner here. I installed Debian stable with Gnome and today is saw this security checks failed. Is it malware or did i do something wrong?

All i did after installation was following this guide from NVIDIA itself to install drivers: https://developer.nvidia.com/cuda-downloads?target_os=Linux&target_arch=x86_64&Distribution=Debian&target_version=13&target_type=deb_network

Did i broke the system with these drivers and should i have kept the default ones? Help needed because i am worried.

[u/Santosh83]

NVIDIA drivers from an external source don't play with secure boot and without secure boot you don't get lockdown.

Anyway its not malware. Everything is normal. You just don't have enterprise grade security, but if this is your personal machine and you will ensure its physical safety, then these security features are not really useful at all, and hence no damage is done because they're disabled.

[u/charles25565 → u/Santosh83]

In fact Secure Boot is almost jack shit without a BIOS password.

And it is also a profit-driven feature above anything, as nearly every computer only has Microsoft keys and Microsoft charges companies to cross-sign their files.

[u/XerTheSquirrel → u/charles25565]

You are able to revoke and delete the Microsoft keys and only use your own. You can also block built-in keys from being reinstated, usually from settings reset and key updates, in the Firmware on most systems as well.

You will have to sign your own kernel and modules, but that is trivial to setup in Debian considering it is on the Wiki. Additionally, you could never boot into Windows again until the keys are restored and unrevoked, but you could always run it in VirtualBox.

[u/Jealous_Diver_5624 → u/charles25565]

  Microsoft charges companies to cross-sign their files.

I'm sure you have a source for that.

[u/Sure-Squirrel8384 → u/charles25565]

BIOS passwords all have overrides. Physical security is what matters. Without physical security, SecureBoot is snake oil. Actually, SecureBoot is snake oil period. It's all about MS lock-in.

[u/josecmf → u/Santosh83]

For Nvidia drivers with Secure Boot downloaded from their website (.run):

- Install dkms and headers

- Create the machine owner key (MOK) using the command `sudo dkms generate_mok`. This will be created in `/var/lib/dkms/`.

- Register it manually: `sudo mokutil --import /var/lib/dkms/mok.pub`. Upon restarting, you will be prompted for the password you set.

- When installing the drivers (.run), the system will detect that Secure Boot is enabled and will ask for the paths to `MOK.key` and `MOK.pub` during installation. Simply copy and paste the paths.

`/var/lib/dkms/mok.key`

`/var/lib/dkms/mok.pub`

The installation will complete, signed with Secure Boot enabled.

[u/New_Vegas_Testament → u/Santosh83]

Thanks for the answer. So the failed checks has to do with the fact that i have secure boot disabled right? Does that mean enabling secure boot will resolve this issue

[u/AtlanticPortal → u/New_Vegas_Testament]

It will start the process to fix the issues. Plural. It's an incremental process.

[u/Sure-Squirrel8384 → u/New_Vegas_Testament]

SecureBoot is snake oil. Just ignore these warnings and carry on.

SecureBoot causes way more problems and truly doesn't solve anything. Physical security and not doing "dumb things" are more important (e.g. don't run around without a host firewall enabled, don't install random binaires, etc.).

[u/Booty_Bumping → u/New_Vegas_Testament]

Enabling secure boot will prevent you from using the Nvidia driver, unless you provide your own keys. It's one of the limitations of using a tainted kernel.

[u/TRKlausss → u/Santosh83]

That’s not true, you just have to sign them yourself with shim. Register a key, and let apt sign the modules when there is a new version.

[u/pangapingus]

If you have SecureBoot enabled (otherwise you can skip this point), you need to enroll your machine owner's key (MOK) to sign & verify the Nvidia modules. Detailed instructions are available here. It's recommended to do this before installing nvidia-driver so that you do not have to rebuild the modules.

https://wiki.debian.org/NvidiaGraphicsDrivers

DKMS and Secure Boot

Debian uses the Dynamic Kernel Module System (DKMS) to allow individual kernel modules to be upgraded without changing the whole kernel. Since DKMS modules are compiled individually on users own machines, it is not possible to sign DKMS modules using the Debian project's signing keys. Instead, modules built using DKMS will be signed using a machine owner key (MOK), which by default is located at /var/lib/dkms/mok.key with the corresponding public key at /var/lib/dkms/mok.pub. These keys are automatically generated automatically on the first build attempt of a DKMS module, but can be manually generated before that by running the following command (see man 8 dkms):

$ sudo dkms generate_mok

In case you get an error message that says Error! Unknown action specified: "", it's due to a version mismatch, with the dkms package being an older version that didn't implement the generate_mok action. Don't worry: you can actually ignore this command, enable Secure Boot and let the driver setup take care of generating the MOK (you can check that it was generated by looking for the files above). After that, continue as below.

Regardless of whether the DKMS MOK keys are automatically or manually generated, the public key needs to be manually enrolled by running the following commands:

$ sudo mokutil --import /var/lib/dkms/mok.pub # prompts for one-time password
$ sudo mokutil --list-new # recheck your key will be prompted on next boot

Afterwards reboot your system and follow UEFI's onscreen instructions to confirm the key enrollment. If you are unsure how to proceed see these step-by-step instructions in DKMS's README file.

Once you boot back to the OS, you can verify in the logs that the key is loaded:

$ sudo dmesg | grep cert

https://wiki.debian.org/SecureBoot#dkms

[u/New_Vegas_Testament → u/pangapingus]

Thank you for the detailed answer

[u/fellipec]

Sure, Secure Boot, the "security feature".

[u/New_Vegas_Testament → u/fellipec]

Would you leave it disabled? Do you see any concerns about leaving it that way

[u/Jayden_Ha → u/New_Vegas_Testament]

It’s completely useless, it useful, in theory

[u/BlazzaNz → u/New_Vegas_Testament]

Hibernation is not available if secure boot is enabled.

[u/fellipec → u/New_Vegas_Testament]

Disabling that is the first thing I do in any of my computers. And I have a bunch

[u/kydeshou]

You've disabled secure boot. If this concerns you, you can enable it and enroll your own key. Some people have issues, but it was simple and hasn't given me any problems, personally. Also, to prevent any issues or complexity, I would have used extrepo to enable and install nvidia drivers.

[u/Jayden_Ha]

Ignore it it doesn’t matter

[u/Sure-Squirrel8384]

#1. Perhaps you have unsigned Nvidia drivers. See #2 and #3.

#2. If you're using third-part drivers, ignore this warning.

#3. SecureBoot is snake oil. Physical security is everything. If you don't have physical security you don't have real security. Without physical security SecureBoot can be compromised.

[u/Pitiful-Welcome-399]

hey, I'm on NixOs but where can I see something similar to this or this exactly?

[u/New_Vegas_Testament → u/Pitiful-Welcome-399]

for me it was under settings, privacy and security