0

I had the same issue that VernonB discribed here in this post What exactly is MOK in Linux for? and I also disabled security boot. But I Wonder if I will have future problems with this mok password If I reinstall my Ubuntu and Nvidia driver again?

1 Answer 1

0

Disabling Secure Boot is a firmware setting ("BIOS setting", although all systems with Secure Boot have UEFI instead of legacy BIOS).

So unless you reset your firmware settings (legacy name: "CMOS reset"), or you perform a system firmware update ("BIOS update") and the update resets your firmware settings for you, Secure Boot should stay disabled unless you enable it again.

Reinstalling the OS or the Nvidia driver should have no effect to the Secure Boot status at all.


The "MOK password" seems to be often misunderstood.

Ubuntu includes automation to create and register a Machine Owner's Key (MOK) for Secure Boot, if the system has Secure Boot enabled. The process of registering can be started, but cannot be completed while any operating system is running, because the registration process must be certain that the command to register the MOK actually comes from the user, not from any program that is pretending to be the user.

So, when Ubuntu creates a MOK, it requires you to set a one-time password for completing the MOK registration process. Next time you boot, Secure Boot will first validate Microsoft's signature on the shimx64.efi Secure Boot loader, and then shimx64.efi will detect that a MOK registration process has been initiated. It will interrupt the boot process, and present you with the blue MOK Manager screen. If you choose to complete the MOK registration process, it will ask you to enter the password you set before rebooting to confirm that 1.) you are the user that started the process and 2.) you really want to complete the MOK registration process.

After that, the "MOK password" is never again needed: its job is done. If the MOK is lost because the system firmware settings are reset for any reason, then you'll need to redo the MOK registration process from the beginning again.


The actual MOK will be located in /var/lib/shim-signed/mok/ directory once it has been created. It is a two-part cryptographic key: the public part, also called certificate, will be in the MOK.der file. This is the part that gets registered into the system firmware. You can view it in a human-readable form with any command that can handle DER-formatted X.509 certificates, for example:

sudo openssl x509 -inform DER -in /var/lib/shim-signed/mok/MOK.der -noout -text

The private part will be only in the MOK.priv file, readable only by root. This file will be automatically used by dkms and other kernel and module management tools as necessary to sign e.g. Nvidia driver modules as part of their installation process if Secure Boot is enabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.