Authentication always required after boot

[yotamguttman]

this dialogue box started appearing right as the OS loads, every time after it boots.

it supposedly started when I disabled secureboot, in order to successfully install Nvidia drivers, as per the recommendation from another thread, that solved the previous issue.

@computersavvy

Thank you for posting that as text. The image is not required for future posts.

That info is enough.
Secureboot seems to be preventing loading the nvidia drivers.
If you wish to boot as is and secureboot is not required, then simply enter the bios setup and disable secureboot.

As an alternative there are a couple things to do that enable signing the nvidia module so it can be loaded while secureboot is enabled.

1. Follow all the steps in the file /usr/share/doc/akmods/README.secureboot. All that must be done using sudo for each command.
2. Once step 1 is complete then rebuild the nvidia modules (which will now be signed)
   a. Remove the old (unsigned) nvidia modules with sudo dnf remove kmod-nvidia-*
   b. Build the new (signed) modules with sudo akmods --force

After step 2.b. completes then reboot. This time the nvidia modules should load and be functional.

when the system boots this is the first thing that I see, I can see the desktop dimmed in the background but cannot do anything before I enter the password. this isn’t the lock screen. I disabled the lockscreen by enabling automatic login. before that, every time I booted the system, I’d get straight to the desktop environment password free and be able to start working. I suspect that this is the passkey I set when I disabled the secureboot. though I can’t be sure as it’s the same password I set to my OS and may be mixing things up it’s just an knowledgeable suggestion.

info:

• OS: Fedora Workstation 39.
  I am dual booting, Fedora is running on a separate hard drives from Windows.
• system: PC: Dell XPS 8930

thanks a lot for all the helpers!

[computersavvy (Jeff V)]

@yotamguttman

I suspect that this is the passkey I set when I disabled the secureboot. though I can’t be sure as it’s the same password I set to my OS and may be mixing things up it’s just an knowledgeable suggestion.

If you set a password at the same time as disabling secure boot then it is probably a boot password within bios. If that is the case then simply enter the bios again and remove the password there.

Most do not ever set a password within bios and bios passwords must be entered before the OS even begins to load.

[yotamguttman]

thanks for your reply

I see what you mean. I don’t recall setting a password using the BIOS. I did set a password in the Terminal when I followed the first step (mentioned below):

@computersavvy

Follow all the steps in the file /usr/share/doc/akmods/README.secureboot. All that must be done using sudo for each command.

@yotamguttman

Now you need to enroll the public key in MOK, this process is described
below.
- Ask MOK to enroll new keypair with certificate with the command
  `mokutil --import /etc/pki/akmods/certs/public_key.der`.
- mokutil asks to generate a password to enroll the public key.
- Rebooting the system is needed for MOK to enroll the new public key.
- On next boot MOK Management is launched and you have to choose
  "Enroll MOK".
- Choose "Continue" to enroll the key or "View key 0" to show the keys
  already enrolled.
- Confirm enrollment by selecting "Yes".
- You will be invited to enter the password generated above.
  WARNING: keyboard is mapped to QWERTY!
- The new key is enrolled, and system ask you to reboot.

You can confirm the enrollment of the new keypair once the system
rebooted with:
 `mokutil --list-enrolled | grep Issuer`
or with:
 `mokutil --test-key /etc/pki/akmods/certs/public_key.der`

one of them was setting a key. I used the same password I set for the OS when I first installed it. as I proceeded with the instructions and booted the system. I wonder if this was when I unintentionally set this password.

[computersavvy (Jeff V)]

enabling and disabling secure boot is done within the bios setup menu, and at that point there is usually 2 password options. One for administering the bios which will require the password before entering the setup menu and the second for booting which will require the password before the machine can be booted into the OS.

enrolling the key from mokutil is not the same since it never enters the actual setup menu but only thru the blue MOK Management screen given during that boot for actually importing the key into the bios.
The password given when performing that command during import of the key is only for use as the final step to actually complete the import.

• Ask MOK to enroll new keypair with certificate with the command
  mokutil --import /etc/pki/akmods/certs/public_key.der.
  - mokutil asks to generate a password to enroll the public key.
• Rebooting the system is needed for MOK to enroll the new public key.
• On next boot MOK Management is launched and you have to choose
  “Enroll MOK”.
• Choose “Continue” to enroll the key or “View key 0” to show the keys
  already enrolled.
• Confirm enrollment by selecting “Yes”.
  - You will be invited to enter the password generated above.
  WARNING: keyboard is mapped to QWERTY!

[vgaetera (Vladislav Grigoryev)]

Make sure the keyring and login passwords are synchronized:
Keyring Authentication required prompt every login - #2 by vgaetera
If automatic login is enabled, set an empty password on the keyring.

[yotamguttman]

I see. so I remember now that when I was following the mokutil steps, and rebooted my system so that the MOK Manager will be launch, I was requested to fill in a password and I filled in the same password I set for my OS. I didn’t know I could simply leave it blank.

do I follow the mokutil steps again for MOK to be launched upon restart? would it affect the Nvidia drivers in anyway?

@yotamguttman

- mokutil asks to generate a password to enroll the public key.

just to be sure, this isn’t the step the password was created right? because that was through the Terminal not the BIOS.

[yotamguttman]

thanks for the tip!

it took me some tinkering but I managed to install the Passwords and Keys app.
under the login page, which one is it that I should delete the password for? btw, I don’t see an option to change the password, only a delete button.

[vgaetera (Vladislav Grigoryev)]

@yotamguttman

which one is it that I should delete the password for?

Right click the “Login” keyring.

[tutacat]

Jeff! It is clearly not a UEFI (uefi setup) password, since they are in the OS. If there was a BIOS password set, the windows would be before boot and not in Linux. It clearly states the keyring password as well.