I'm new to Linux and am planning to install Parrot OS Home Edition and Hacker OS Official Edition on two different desktops. I'd like to dual-boot each machine using separate drives, keeping Windows available for multiplayer gaming and other situations where I need it. I've read that Secure Boot support varies across Linux distributions. Is it handled separately by each distribution, or is it mainly supported by larger projects such as Debian, Ubuntu, Fedora, and openSUSE? How do people usually configure Secure Boot for Linux? Ideally, I'd like to switch between Windows and Linux without entering the firmware settings every time.
3 Answers
For less common distributions, you may need to enroll their signing keys in the system’s UEFI firmware yourself. If the distribution isn’t prepared for Secure Boot, the simplest option is usually to disable it, but then Windows and Linux will both need to be installed and configured with that setting in mind. With a normal boot menu and both systems installed correctly, you shouldn’t need to enter the firmware setup whenever you want to change operating systems.
Secure Boot support is largely distribution-specific. The distribution has to provide signed bootloaders and kernels, and many popular projects use keys trusted by default on modern computers. Ubuntu, Debian, Fedora, and openSUSE support this in various ways, while smaller or highly customized distributions may not. You can also create and enroll your own signing keys with a tool such as sbctl, though that requires more setup.
A lot of people simply turn Secure Boot off, especially when using distributions with custom kernels or bootloaders. If Secure Boot isn’t important for your use case, that’s generally the least complicated approach. For an easier first Linux experience, a mainstream distribution such as Fedora KDE or Arch with Plasma may have better documentation and hardware support. Pentesting-focused distributions are often better kept in virtual machines unless you specifically need them installed directly.
The home editions I’m considering are intended for general use and don’t include the full set of pentesting tools, but I’ll also compare them with mainstream distributions before deciding.