>

Check Secure Boot Status with mokutil

Read the live Secure Boot state from UEFI firmware — 'SecureBoot enabled' or 'disabled' — in one command, no reboot into firmware setup required.

Linuxuefisecure-bootmokutilsecurityLow risk
Run mokutil --sb-state to print the current Secure Boot status (e.g. 'SecureBoot enabled').

01Command

Command
$ mokutil --sb-state

02What it does

mokutil talks to the EFI runtime variable that the firmware sets, so it reports the real state the running kernel booted under — more trustworthy than eyeballing the BIOS screen. This matters before installing out-of-tree drivers like NVIDIA or VirtualBox kernel modules, which fail to load signature checks when Secure Boot is on unless you enroll a Machine Owner Key with mokutil --import. It works only on UEFI systems; on legacy BIOS boots the tool reports that Secure Boot isn't supported.

03Risk

RiskLow risk
Requirementsmokutil (sudo apt install mokutil / sudo dnf install mokutil); requires UEFI boot (not legacy BIOS)
!Warning: If you plan to disable Secure Boot in firmware setup, know that some distributions (and disk-encryption setups that rely on it) behave differently — check your distro's guidance before switching.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • SecureBoot — Debian Wiki
    Debian · community · 2026-09-17
    Evidence: Explains Secure Boot on Debian-family systems, the Machine Owner Key (MOK) mechanism, and using mokutil to inspect and enroll keys.
  • mokutil(1) — Linux manual page
    Arch Linux · community · 2026-09-17
    Evidence: mokutil --sb-state reports the current Secure Boot state as seen from the running kernel via the EFI variable.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17