How to Remove MokManager Password for PC Boot

Remove MOK Manager Password from PC Boot

Secure Boot is a security feature developed by Microsoft and implemented in most modern PCs. It ensures that your PC boots using only software that is trusted by the PC manufacturer. Secure Boot relies on digital signatures to verify the integrity of boot loaders and other firmware. However, managing Secure Boot can be challenging due to the need for signing keys and passwords. This article explains how to remove the MOK Manager password from PC boot.

What is MOK Manager

Machine Owner Key (MOK) Manager is a utility that comes with the Shim bootloader on some Linux distributions. MOK Manager allows users to enroll their own Machine Owner Keys (MOKs) into the firmware, bypassing Secure Boot's restrictions and allowing unsigned binaries to run. However, using MOK Manager requires a password, which can be a hassle if you forget it or want to change it.

How to Remove MOK Manager Password

To remove the MOK Manager password from PC boot, you can follow these steps:

1. Boot your PC and press the key to enter the UEFI/BIOS setup. This key varies by manufacturer, but common keys include F2, F10, or DEL.

2. Once in the UEFI/BIOS setup, navigate to the Secure Boot settings.

   // Example Secure Boot settings path
Security > Select Secure Boot > Secure Boot Configuration

3. Disable Secure Boot.

   // Example Secure Boot disabled option
Secure Boot: Disabled

4. Save the changes and exit the UEFI/BIOS setup.

5. Boot your PC and enter the MOK Manager password when prompted.

6. In the MOK Manager menu, select "Enroll MOK" and then "Continue".

   // Example MOK Manager enrollment menu
Please select an action...
Enroll MOK
Cancel enrollment
Continue booting


7. When prompted, select "Remove MOK", and then confirm by typing "yes".

   // Example MOK removal prompt
This operation will remove all MOKs. Are you sure you want to continue? (yes/no)


What about mokutil

mokutil is a command-line tool for managing MOKs on Linux systems. You can use it to list, add, and remove MOKs. However, it cannot remove the MOK Manager password directly. You must follow the above steps to disable Secure Boot and remove the MOK Manager password.

However, you can use mokutil to create a new MOK and enroll it in Secure Boot. This can be useful if you have forgotten the MOK Manager password or want to change it. Here's an example of how to create a new MOK and enroll it using mokutil:

Generate a new MOK using the openssl command:

// Example MOK generation command
openssl req -new -x509 -days 3650 -nodes -newkey rsa:2048 -keyout mok.key -out mok.crt -subj "/CN=My MOK/"

1. Convert the MOK certificate to DER format using the openssl command:

   // Example MOK conversion command
openssl x509 -in mok.crt -outform DER -out mok.der

2. Enroll the new MOK using mokutil:

   // Example MOK enrollment command
sudo mokutil --import mok.der

• MOK Manager is a utility for managing MOKs on Linux systems.

• Disabling Secure Boot in the UEFI/BIOS setup is necessary to remove the MOK Manager password.

• The mokutil command can create and enroll new MOKs but cannot remove the MOK Manager password directly.

References

• Manage Secure Boot on Surface Devices

• Mok Manager - ArchWiki

• mokutil - Man Page