Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #180229 > unrolled thread

Secure boot - Uefi installation

Back to article view | Back to linux.debian.user

Contents

  Secure boot - Uefi installation Karagkiaouris Diamantis <diamantis.karagkiaouris.dev@gmail.com> - 2017-04-17 23:40 +0200
    Re: Secure boot - Uefi installation Mark Fletcher <mark27q1@gmail.com> - 2017-04-18 01:30 +0200
      Re: Secure boot - Uefi installation Tony Baldwin <tonybaldwin@gmx.com> - 2017-04-18 05:50 +0200
      Re: Secure boot - Uefi installation Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-04-19 21:00 +0200
        Re: Secure boot - Uefi installation Diamantis Karagkiaouris <diamantis.karagkiaouris.dev@gmail.com> - 2017-04-19 21:10 +0200
          Re: Secure boot - Uefi installation Joel Rees <joel.rees@gmail.com> - 2017-04-20 02:40 +0200
            Re: Secure boot - Uefi installation Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-04-20 20:30 +0200
        Re: Secure boot - Uefi installation Mark Fletcher <mark27q1@gmail.com> - 2017-04-20 00:50 +0200
          Re: Secure boot - Uefi installation Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-04-20 07:10 +0200
    Re: Secure boot - Uefi installation solitone <solitone@mail.com> - 2017-04-18 07:40 +0200
    Re: Secure boot - Uefi installation Kent West <westk@acu.edu> - 2017-04-20 15:50 +0200
      Re: Secure boot - Uefi installation Kent West <westk@acu.edu> - 2017-04-20 15:50 +0200
      Re: Secure boot - Uefi installation solitone <solitone@mail.com> - 2017-04-20 15:50 +0200
        libreboot? Doc to follow? -- Re: Secure boot - Uefi installation fc <fc@AreYouForThePeople.org> - 2017-04-20 21:00 +0200
          Re: libreboot? Doc to follow? -- Re: Secure boot - Uefi installation Steve McIntyre <steve@einval.com> - 2017-04-21 00:40 +0200
            Re: libreboot? Doc to follow? -- Re: Secure boot - Uefi installation Joel Rees <joel.rees@gmail.com> - 2017-04-22 02:00 +0200
        RE: Secure boot - Uefi installation Bonno Bloksma <b.bloksma@tio.nl> - 2017-04-22 01:00 +0200
          Re: Secure boot - Uefi installation Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-04-22 09:20 +0200
      Re: Secure boot - Uefi installation Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-04-20 20:10 +0200
        Re: Secure boot - Uefi installation Steve McIntyre <steve@einval.com> - 2017-04-21 00:40 +0200
    Re: Secure boot - Uefi installation Joel Rees <joel.rees@gmail.com> - 2017-04-21 05:00 +0200

Page 1 of 2  [1] 2  Next page →

#180229 — Secure boot - Uefi installation

Dear All,

How can i install debian with UEFI support? Is there any simple tutorial?
Also do i have to disable the secure boot and then proceed with uefi 
installation?
I have tried but then a message "could not authenticate boot media" 
emerges and the boot stop right there.
I am new to debian and i don't want to abandon for this silly reason.

Thank you

[toc] | [next] | [standalone]

#180236

On Tue, Apr 18, 2017 at 12:30:47AM +0300, Karagkiaouris Diamantis wrote:
> Dear All,
> 
> How can i install debian with UEFI support? Is there any simple tutorial?
> Also do i have to disable the secure boot and then proceed with uefi
> installation?
> I have tried but then a message "could not authenticate boot media" emerges
> and the boot stop right there.
> I am new to debian and i don't want to abandon for this silly reason.
> 
> Thank you
> 
Unless things have changed very recently, yes -- you need to disable 
secure boot, then you can do an install to UEFI media. I say this with 
the caveat that I have used UEFI-aware Debian install media but the only 
UEFI install I have actually done was of LFS not Debian.

Debian install media can boot a UEFI-aware machine if secure boot is 
disabled. I believe the live images only use MBR boot method, presumably 
so they can work on the largest number of machines, even old ones 
(UEFI-only machines are only just now emerging)

Mark

[toc] | [prev] | [next] | [standalone]

#180238

On 04/17/2017 07:21 PM, Mark Fletcher wrote:
> On Tue, Apr 18, 2017 at 12:30:47AM +0300, Karagkiaouris Diamantis wrote:
>> Dear All,
>>
>> How can i install debian with UEFI support? Is there any simple tutorial?
>> Also do i have to disable the secure boot and then proceed with uefi
>> installation?
>> I have tried but then a message "could not authenticate boot media" emerges
>> and the boot stop right there.
>> I am new to debian and i don't want to abandon for this silly reason.
>>
>> Thank you
>>
> Unless things have changed very recently, yes -- you need to disable
> secure boot, then you can do an install to UEFI media. I say this with
> the caveat that I have used UEFI-aware Debian install media but the only
> UEFI install I have actually done was of LFS not Debian.
>
> Debian install media can boot a UEFI-aware machine if secure boot is
> disabled. I believe the live images only use MBR boot method, presumably
> so they can work on the largest number of machines, even old ones
> (UEFI-only machines are only just now emerging)
>
> Mark
>

I thought UEFI compatible installations was the default now.
I'm pretty sure my hardware is uefi-ized, and it's all working fine.
Then again, I did not install current stable, but rather upgraded to 
Jessie from old stable (wheezy)

tony
-- 
93 - 93/93
http://tonybaldwin.me
all tony, all the time

[toc] | [prev] | [next] | [standalone]

#180291

Le 18/04/2017 à 01:21, Mark Fletcher a écrit :
>
> I believe the live images only use MBR boot

BIOS boot.

[toc] | [prev] | [next] | [standalone]

#180293

[Multipart message — attachments visible in raw view] — view raw

I am really pissed off with the installation as it failed miserably.
It asks me if i want to force uefi and then it fails on grub configuration.
In opensuse i didnt have this issue.
I really like the idea of hands on but this is nonsense.
In every upgrade of debian testing should i cross my fingers?

Am 19.04.2017 21:54 schrieb "Pascal Hambourg" <pascal@plouf.fr.eu.org>:

> Le 18/04/2017 à 01:21, Mark Fletcher a écrit :
>
>>
>> I believe the live images only use MBR boot
>>
>
> BIOS boot.
>
>

[toc] | [prev] | [next] | [standalone]

#180302

On Thu, Apr 20, 2017 at 4:02 AM, Diamantis Karagkiaouris
<diamantis.karagkiaouris.dev@gmail.com> wrote:
> I am really pissed off with the installation as it failed miserably.

If it fails after disabling UEFI, you probably have a machine with a
BIOS that doesn't really disable UEFI when you tell it to nicely. (I
hear some won't allow it at all. The entry is there in the BIOS
configuration screens, but it either does nothing or is trapped back
to UEFI on such hardware.)

> It asks me if i want to force uefi and then it fails on grub configuration.

What do you mean by force UEFI?

> In opensuse i didnt have this issue.
> I really like the idea of hands on but this is nonsense.
> In every upgrade of debian testing should i cross my fingers?

It sounds like there is something I don't know about what you are doing.

> Am 19.04.2017 21:54 schrieb "Pascal Hambourg" <pascal@plouf.fr.eu.org>:
>>
>> Le 18/04/2017 à 01:21, Mark Fletcher a écrit :
>>>
>>>
>>> I believe the live images only use MBR boot
>>
>>
>> BIOS boot.

-- 
Joel Rees

I'm imagining I'm a novelist:
http://joel-rees-economics.blogspot.com/2017/01/soc500-00-00-toc.html
More of my delusions:
http://reiisi.blogspot.jp/p/novels-i-am-writing.html

[toc] | [prev] | [next] | [standalone]

#180338

Le 20/04/2017 à 02:36, Joel Rees a écrit :
> On Thu, Apr 20, 2017 at 4:02 AM, Diamantis Karagkiaouris
> <diamantis.karagkiaouris.dev@gmail.com> wrote:
>> I am really pissed off with the installation as it failed miserably.
>
> If it fails after disabling UEFI, you probably have a machine with a
> BIOS that doesn't really disable UEFI when you tell it to nicely. (I
> hear some won't allow it at all.

I have a very old (~2007) UEFI motherboard which allows to enable or 
disable EFI boot, but it seems that many recent UEFI firmwares don't 
allow to disable EFI boot. At best they allow to enable or disable 
legacy boot (in BIOS compatibility mode), but EFI boot sources keep 
precedence when available. I have seen a few netbooks with 32-bit UEFI 
firwares which did not support legacy boot at all.

>> It asks me if i want to force uefi and then it fails on grub configuration.
>
> What do you mean by force UEFI?

I suspect it is the question asked by the installer when booted in EFI 
mode but it finds a legacy boot system on a disk. If you answer to force 
UEFI, it proceeds to install GRUB EFI. Otherwise, it proceeds to install 
GRUB BIOS instead.

It would mean that the Debian installer did boot in EFI mode.
Installing GRUB EFI requires an EFI system partition so if you choose 
custom partitioning, you must create one if it does not exist.

You can get more information about the failure by looking up the 
installer logs in /var/log, or by running grub-install and update-grub 
manually in a shell.

>> In opensuse i didnt have this issue.

openSUSE bought a signed key for secure boot.

[toc] | [prev] | [next] | [standalone]

#180297

On Wed, Apr 19, 2017 at 08:53:52PM +0200, Pascal Hambourg wrote:
> Le 18/04/2017 à 01:21, Mark Fletcher a écrit :
> >
> >I believe the live images only use MBR boot
> 
> BIOS boot.
> 
Pedant. You knew exactly what I meant.

[toc] | [prev] | [next] | [standalone]

#180309

Le 20/04/2017 à 00:44, Mark Fletcher a écrit :
> On Wed, Apr 19, 2017 at 08:53:52PM +0200, Pascal Hambourg wrote:
>> Le 18/04/2017 à 01:21, Mark Fletcher a écrit :
>>>
>>> I believe the live images only use MBR boot
>>
>> BIOS boot.
>>
> Pedant.

Pleased to meet you. I'm Pascal.

> You knew exactly what I meant.

Of course I did. That is why I corrected your mistake.

[toc] | [prev] | [next] | [standalone]

#180239

On Tuesday, 18 April 2017 00:30:47 CEST Karagkiaouris Diamantis wrote:
> do i have to disable the secure boot and then proceed with uefi
> installation?

Yes, you should disable secure boot. I had to do this when I installed Jessie 
on an HP UEFI laptop.

[toc] | [prev] | [next] | [standalone]

#180328

[Multipart message — attachments visible in raw view] — view raw

On Mon, Apr 17, 2017 at 4:30 PM, Karagkiaouris Diamantis <
diamantis.karagkiaouris.dev@gmail.com> wrote:

> Dear All,
>
> How can i install debian with UEFI support? Is there any simple tutorial?
> Also do i have to disable the secure boot and then proceed with uefi
> installation?
> I have tried but then a message "could not authenticate boot media"
> emerges and the boot stop right there.
> I am new to debian and i don't want to abandon for this silly reason.
>
> Thank you
>
>

I thought I had kept notes when I did this, but I can't find them.

I installed on a Dell (don't recall the model number now, but it's a recent
model), and I found that the firmware appears to be buggy, in that you can
specify a UEFI installation to boot, and it shows the setting you enter,
but it ignores that setting and boots only to the default installation,
which is something like "\boot\default\boot64.efi".

The only way I could get around it was to create a separate \default
directory (or whatever the default directory name was - I don't now
remember) and copy my debian64.efi (or whatever it was) file into that
directory, renamed as boot64.efi (or whatever the default name was that it
was looking for).

Stupid firmware programming!


-- 
Kent West                    <")))><
Westing Peacefully - http://kentwest.blogspot.com

[toc] | [prev] | [next] | [standalone]

#180329

[Multipart message — attachments visible in raw view] — view raw

On Thu, Apr 20, 2017 at 8:41 AM, Kent West <westk@acu.edu> wrote:

>
>
> On Mon, Apr 17, 2017 at 4:30 PM, Karagkiaouris Diamantis <
> diamantis.karagkiaouris.dev@gmail.com> wrote:
>
>> Dear All,
>>
>> How can i install debian with UEFI support? Is there any simple tutorial?
>> Also do i have to disable the secure boot and then proceed with uefi
>> installation?
>> I have tried but then a message "could not authenticate boot media"
>> emerges and the boot stop right there.
>> I am new to debian and i don't want to abandon for this silly reason.
>>
>> Thank you
>>
>>
>
> I thought I had kept notes when I did this, but I can't find them.
>
> I installed on a Dell (don't recall the model number now, but it's a
> recent model), and I found that the firmware appears to be buggy, in that
> you can specify a UEFI installation to boot, and it shows the setting you
> enter, but it ignores that setting and boots only to the default
> installation, which is something like "\boot\default\boot64.efi".
>
> The only way I could get around it was to create a separate \default
> directory (or whatever the default directory name was - I don't now
> remember) and copy my debian64.efi (or whatever it was) file into that
> directory, renamed as boot64.efi (or whatever the default name was that it
> was looking for).
>
> Stupid firmware programming!
>
>
> --
> Kent West                    <")))><
> Westing Peacefully - http://kentwest.blogspot.com
>


This thread outlines my woes that I had previously:

https://lists.debian.org/debian-user/2017/03/msg00544.html

-- 
Kent West                    <")))><
Westing Peacefully - http://kentwest.blogspot.com

[toc] | [prev] | [next] | [standalone]

#180330

On Thursday, 20 April 2017 08:41:26 CEST Kent West wrote:
> I installed on a Dell (don't recall the model number now, but it's a recent
> model), and I found that the firmware appears to be buggy, in that you can
> specify a UEFI installation to boot, and it shows the setting you enter,
> but it ignores that setting and boots only to the default installation,
> which is something like "\boot\default\boot64.efi".

If I remeber right, when I installed debian alongside windows 8 on my previous 
UEFI HP laptop, I had to disable fast boot in windows 8, otherwise it would 
boot directly windows, not grub.

[toc] | [prev] | [next] | [standalone]

#180341 — libreboot? Doc to follow? -- Re: Secure boot - Uefi installation

Hello:

2 things:

a. Even given all of their recent "damage" to themselves,
how does Libreboot play into this?  Is there a guide with respect to
Debian that people can use to go the Libreboot route -- supported
by this list?

b. This UEFI crap - and Microsoft/Intel trying to lock everything to 
themselves crap is crappy.

Has anyone gathered all of these UEFI steps and good workarounds into 
One place that people can follow?

I would be happy to help in that effort.

(I would also be happy to push that one answer
out onto forums where I see this issue mentioned.)

Thanks!

On 4/20/2017 9:49 AM, solitone wrote:
> On Thursday, 20 April 2017 08:41:26 CEST Kent West wrote:
>> I installed on a Dell (don't recall the model number now, but it's a recent
>> model), and I found that the firmware appears to be buggy, in that you can
>> specify a UEFI installation to boot, and it shows the setting you enter,
>> but it ignores that setting and boots only to the default installation,
>> which is something like "\boot\default\boot64.efi".
> If I remeber right, when I installed debian alongside windows 8 on my previous
> UEFI HP laptop, I had to disable fast boot in windows 8, otherwise it would
> boot directly windows, not grub.
>
>

[toc] | [prev] | [next] | [standalone]

#180351 — Re: libreboot? Doc to follow? -- Re: Secure boot - Uefi installation

fc@AreYouForThePeople.org wrote:
>
>Hello:
>
>2 things:
>
>a. Even given all of their recent "damage" to themselves,
>how does Libreboot play into this?  Is there a guide with respect to
>Debian that people can use to go the Libreboot route -- supported
>by this list?

Pass.

>b. This UEFI crap - and Microsoft/Intel trying to lock everything to 
>themselves crap is crappy.
>
>Has anyone gathered all of these UEFI steps and good workarounds into 
>One place that people can follow?

UEFI as a design is fine, but there are a lot of crappy
implementations out there. Just like there are lots of crappy
BIOSes. :-(

For more information about UEFI and Debian, I wrote a long wiki page
at 

  https://wiki.debian.org/UEFI

Please check that out, and please ask if anything's not clear.

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
Is there anybody out there?

[toc] | [prev] | [next] | [standalone]

#180382 — Re: libreboot? Doc to follow? -- Re: Secure boot - Uefi installation

On Fri, Apr 21, 2017 at 7:31 AM, Steve McIntyre <steve@einval.com> wrote:
> fc@AreYouForThePeople.org wrote:
>>
>>Hello:
>>
>>2 things:
>>
>>a. Even given all of their recent "damage" to themselves,
>>how does Libreboot play into this?  Is there a guide with respect to
>>Debian that people can use to go the Libreboot route -- supported
>>by this list?
>
> Pass.
>
>>b. This UEFI crap - and Microsoft/Intel trying to lock everything to
>>themselves crap is crappy.
>>
>>Has anyone gathered all of these UEFI steps and good workarounds into
>>One place that people can follow?
>
> UEFI as a design is fine,

If the option is nothing or UEFI, I'm still not sure which I'd take.

For a decent processor, I think I'd actually prefer raw hardware, but
such a decent processor doesn't exist. Nor do the I/O devices I'd be
able to attach to it.

Different people have different ideas of what they want, I guess.
(Shoot, I even have different ideas of what I want. ;-/ )

> but there are a lot of crappy
> implementations out there. Just like there are lots of crappy
> BIOSes. :-(
>
> For more information about UEFI and Debian, I wrote a long wiki page
> at
>
>   https://wiki.debian.org/UEFI

Thanks. Looks useful.

> Please check that out, and please ask if anything's not clear.
>
> --
> Steve McIntyre, Cambridge, UK.                                steve@einval.com
> Is there anybody out there?

Nobody out here but us chickens.


-- 
Joel Rees

I'm imagining I'm a computer scientist.

http://defining-computers.blogspot.com/2017/04/model-boot-up-process-description-with.html

[toc] | [prev] | [next] | [standalone]

#180380

Hi,

>> I installed on a Dell (don't recall the model number now, but it's a 
>> recent model), and I found that the firmware appears to be buggy, in 
>> that you can specify a UEFI installation to boot, and it shows the 
>> setting you enter, but it ignores that setting and boots only to the 
>> default installation, which is something like "\boot\default\boot64.efi".
>
> If I remember right, when I installed debian alongside windows 8 on my previous UEFI HP laptop, I had to disable fast boot in windows 8, otherwise it would boot directly windows, not grub.

The reason for THAT is that Windows with fastboot turned on does a hibernate and not a shutdown when you tell it to shutdown.
So when you turn on the machine it does not do a boot cycle but a resume cycle, never going past the boot process.
Fastboot is on by default but I have not really found it to speed up the boot process when using a SSD to boot from.

Bonno Bloksma

[toc] | [prev] | [next] | [standalone]

#180384

Le 21/04/2017 à 12:24, Bonno Bloksma a écrit :
>
>> If I remember right, when I installed debian alongside windows 8 on my previous UEFI HP laptop, I had to disable fast boot in windows 8, otherwise it would boot directly windows, not grub.
>
> The reason for THAT is that Windows with fastboot turned on does a hibernate and not a shutdown when you tell it to shutdown.

The option you are referring to is "fast startup", not "fast boot".
"Fast boot" is a totally unrelated option available in some BIOS and 
UEFI firmwares.

[toc] | [prev] | [next] | [standalone]

#180336

Le 20/04/2017 à 15:41, Kent West a écrit :
>
> I installed on a Dell (don't recall the model number now, but it's a recent
> model), and I found that the firmware appears to be buggy, in that you can
> specify a UEFI installation to boot, and it shows the setting you enter,
> but it ignores that setting and boots only to the default installation,
> which is something like "\boot\default\boot64.efi".

/EFI/boot/bootx64.efi. It is the default EFI path, used on removable 
media such as installation or live images and by Windows as a rescue 
boot loader.

I had the same issue on HP Elitebook 8460 or 8470 laptops.

> The only way I could get around it was to create a separate \default
> directory (or whatever the default directory name was - I don't now
> remember) and copy my debian64.efi (or whatever it was) file into that
> directory, renamed as boot64.efi (or whatever the default name was that it
> was looking for).

Actually there is a simpler workaround : during the installation of the 
GRUB boot loader, the Debian installer asks whether to install GRUB in 
the "removable device path" or so. Just answer "yes" and it will install 
a copy of GRUB's core image in the default EFI path.

It does the same as "grub-install --force-extra-removable"

[toc] | [prev] | [next] | [standalone]

#180352

pascal@plouf.fr.eu.org wrote:
>Le 20/04/2017 à 15:41, Kent West a écrit :
>>
>> I installed on a Dell (don't recall the model number now, but it's a recent
>> model), and I found that the firmware appears to be buggy, in that you can
>> specify a UEFI installation to boot, and it shows the setting you enter,
>> but it ignores that setting and boots only to the default installation,
>> which is something like "\boot\default\boot64.efi".
>
>/EFI/boot/bootx64.efi. It is the default EFI path, used on removable 
>media such as installation or live images and by Windows as a rescue 
>boot loader.
>
>I had the same issue on HP Elitebook 8460 or 8470 laptops.

It's unfortunately quite common. Far too many bad UEFI implementations
that aren't being validated against the spec properly. :-(

>> The only way I could get around it was to create a separate \default
>> directory (or whatever the default directory name was - I don't now
>> remember) and copy my debian64.efi (or whatever it was) file into that
>> directory, renamed as boot64.efi (or whatever the default name was that it
>> was looking for).
>
>Actually there is a simpler workaround : during the installation of the 
>GRUB boot loader, the Debian installer asks whether to install GRUB in 
>the "removable device path" or so. Just answer "yes" and it will install 
>a copy of GRUB's core image in the default EFI path.
>
>It does the same as "grub-install --force-extra-removable"

That, and it sets a debconf flag so that on future upgrades grub will
remember you need this and re-install there every time it installs in
the normal (correct) Debian path. This is important - if the 2 copies
of grub-efi on the system diverge too much then it can cause boot
failures.

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
Is there anybody out there?

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web