I'm new to Linux and want to install Parrot OS Home Edition and Hacker OS Official Edition on two different desktops. On each system, I'd like to dual-boot Linux and Windows using separate drives so I can still boot Windows for multiplayer gaming when needed. Secure Boot support seems inconsistent across Linux distributions. Is it determined by each distribution, or do only major distributions such as Debian and Ubuntu support it? How do people usually configure Secure Boot, and can I avoid entering the firmware settings every time I switch operating systems?
4 Answers
Secure Boot support is largely distribution-specific. The distribution has to provide signed bootloaders and kernels that your firmware trusts. Ubuntu, Debian, Fedora, and openSUSE support it out of the box, and distributions based on them may inherit that support. Projects using custom kernels or bootloaders may require extra setup. Another option is to generate your own signing keys and enroll them in UEFI with a tool such as sbctl.
For the least trouble, consider a mainstream distribution such as Fedora KDE or an Ubuntu-based option. Security-focused distributions can be useful, but even their home editions may have less polished Secure Boot support than the major desktop distributions. Running specialized security tools in a virtual machine is often easier unless you specifically need direct hardware access.
Many people simply disable Secure Boot, especially when using a less common distribution, because it avoids compatibility and driver issues. Popular distributions generally configure it automatically, while others may require manually enrolling keys in the UEFI settings. Check the specific installation documentation for both distributions before deciding.
Secure Boot works by allowing the firmware to run only trusted, signed boot software. Since each distribution builds and maintains its own bootloader, kernel, and signing process, support varies from one distribution to another. If both operating systems have properly signed boot chains, you can normally leave Secure Boot enabled and select either system from the boot menu without changing the firmware setting each time.
The editions I’m considering are intended for general home use and don’t include the usual penetration-testing tools, but I’ll also look into mainstream alternatives.