0

I have a fresh install of Debian 12, but every time I boot it prompts me for a MOK password (just the password, no other options). I know what the password should be, but entering it says it doesn't match. However, if I enter something invalid 3 times in a row, it says I've reached the limit and takes me to the standard GRUB menu listing all my boot options. From there, I can just boot into my system like normal, bypassing the MOK password prompt.

I don't recall installing MOK or SHIM or anything of the sort for this installation, though it was present for a previous installation (where I had the same issues, and hence the reinstall). I don't really care about having secureboot so disabling it altogether (along with the prompt) is acceptable, even preferable.

I have tried:

  • Using QWERTY keyboard (my keyboard is already QWERTY, as are my input settings in the OS itself. I've also tried passwords with only numbers)
  • Changing the password with mokutil (sudo mokutil --password)
  • Disabling secure boot (it is disabled in my UEFI already, and I confirmed it's disabled with mokutil --sb-state. I also disabled it with sudo mokutil --disable-validation for good measure)
  • Resetting MOK (sudo mokutil --reset)
  • Reinstalling Debian via live USB
  • Reinstalling both Debian and GRUB (I have a windows dual boot setup, went into windows, deleted every UNIX partition and filesystem, then reinstalled Debian and GRUB with manual partitioning of the newly empty volumes and a live USB)

Worth mentioning is I haven't allowed windows to update in a long time (at least 6 months). So it's possible there's a missing firmware update that could fix this issue, but it's also possible (as has happened before) that updating my firmware could cause this issue another way. It's a surface device, so plausible that windows updates would also update firmware.

So my question is, how do I disable the MOK prompt on boot altogether, and just load straight into GRUB?

2 Answers 2

2

As @user10489 said, you have a MOK enroll/import operation in progress.

To cancel it, sudo mokutil --revoke-import or sudo mokutil --reset should do the job.

Note that all QWERTY keyboard layouts are not equal: most computers use a US English keyboard layout at boot time, until the operating system allows the choice of a specific keyboard layout.

2
  • Thank you, sudo mokutil --revoke-import worked. I had already tried sudo mokutil --reset so I'm not sure why that didn't work originally, but I'm glad the problem is solved. Thanks again and have a nice day :)
    – omnicube
    Nov 29, 2023 at 5:50
  • There are so many issues found online about missing boot/efi/EFI/debian/mmx64.efi but no solution, but the answer is here, thanks! Jan 28 at 19:16
1

The MOK password prompt typically only runs once at initial machine set up. It is probably running more often because it has never succeeded.

Typically the MOK password utility is only activated when secure boot is enabled AND you install a driver that must be compiled (like the nvidia dkms driver). In order for a driver like this to load at boot, it must be signed. So a MOK key is created and the driver is signed with it, and then at next boot the MOK utility tries to enroll the custom key. This process only needs to be done once (when the initial key is created) and future updates can reuse the already enrolled key.

The password is a one time password, it should not be needed after it is successfully entered after the next boot. If enrolling the key through this process is failing, there are several ways to manually enroll it. For instance, you can copy the public MOK key file into the EFI partition and then manually load it through BIOS menus and then delete it from the EFI partition.

Note that the MOK utility is actually loaded by grub; it typically only runs once and then next time the normal kernel is booted. If you are seeing it repeatedly, either grub is stuck or something is re-triggering it for next boot.

3
  • I think you got the load order backwards: the firmware loads shimx64.efi, as instructed by the NVRAM boot variable (check with sudo efibootmgr -v). The shim will load the MOK utility /boot/efi/EFI/debian/mmx64.efi if necessary, and ultimately grubx64.efi.
    – telcoM
    Nov 29, 2023 at 5:43
  • Oh thanks this is a great explanation of what's actually happening. For now I think I'll go without secure boot, but if I enable it in future this will be helpful then :)
    – omnicube
    Nov 29, 2023 at 5:54
  • Actually, either order is possible. Grub can load shimx64.efi or efi bios can. Good point though. Either way, it should be one shot.
    – user10489
    Nov 29, 2023 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .