Saturday 3 August 2024

No more Secure Boot Issues - just use an IODD drive!

If you need a Multiboot solution that works with Secure Boot without any problems (no BIOS issues, no MOK Manager changes to the BIOS for Ventoy, etc.), then get an IODD Virtual drive.

The latest one is USB C and is a 2.5" HDD/SSD enclosure. So you can just buy it and fit you own 2.5" SSD which are pretty cheap these days.

These devices allow you to also select fixed size VHDs as a virtual drive (as well as .ISO files and .IMA floppy image files). This means you can have 100's of virtual drives in one device. Each VHD can contain an MBR or GPT drive, each with multiple partitions (e.g. contents of a Rufus USB drive, WinPE, Windows installer, full OS's, Ventoy drive, E2B drive, etc.).


ST400 IODD (#ad link)


There is also the IODD Mini, a much smaller version which has solid-state memory (not removable).


IODD Mini (#Ad link)


Secure Boot to grub/Ventoy/agFM/Linux, etc.

Secure Boot is supported by many Linux distributions and is an important security feature for ensuring that your boot loader and kernel have not been tampered with. Linux distributions use a Microsoft signed ‘shim’ executable that is then able to verify the subsequent boot stages - that have been signed with the distribution key. The Microsoft signed shim is signed using the “Microsoft 3rd Party UEFI Certificate”, and this certificate is stored in the BIOS database. 

Starting in 2022 for Secured-core PCs it is a Microsoft requirement for the 3rd Party Certificate to be disabled by default. This means that for any of these platforms shipped with Windows preinstalled an extra step is needed to allow Linux or grub2 or Ventoy or E2B to boot with secure boot enabled. 

To enable secure boot to work with Linux we need to enable the “Allow Microsoft 3rd Party UEFI CA” option in the BIOS setup. Use the following steps (example Lenovo): 

1. Boot into the BIOS setup menu. 

e.g. On a Lenovo - Reboot your PC and when the “To interrupt normal startup, press Enter” message is displayed - press the F1 key. Other BIOSes may respond to F8 or F12 or F11 or ESC.

2. In the BIOS menu select the “Security” option and the “Secure Boot” sub-menu. 

Toggle the “Allow Microsoft 3rd party UEFI CA” to be “On” or "Enabled".



No comments:

Post a Comment