UEFI PXE Boot - Multiple Distributions

Rocky Linux Help & Support
1

I have attempted to follow the information in the following previous posts
https://forums.rockylinux.org/t/pxe-boot-uefi-mode/
https://forums.rockylinux.org/t/kickstart-problems-with-pxe-boot-in-efi-mode-rocky-9-3/

I am attempting to deploy multiple distributions over PXE because I support a large organization throughout multiple buildings. Due the environment I am working in, our security posture requires SecureBoot. Disabling it to complete the installation is not an option.

I think I know what the issues is but I have no idea how to fix it and I cannot find the answer to what I am looking for anywhere.

I am using the bootx64.efi and grubx64.efi file from the Rocky 9.5 DVD ISO and I just downloaded it today. These files are located in my /var/lib/tftpboot/ directory.
I copied the entire images folder into the tftpboot directory as well.
I am using the bootx64.efi file as the file that my Windows DHCP server is pointing to.
Inside that directory I also have a grub.cfg file.

grub.cfg

menuentry 'Install Rocky 9.5' {
  linuxefi Rocky-9/iomages/pxeboot/vmlinuz ip=dhcp inst.repo=ftp:/192.168.0.1/Rocky-9
  initrdefi Rocky-9/images/pxeboot/initrd.img
}
menuentry 'Install Alma 9.5' {
  linuxefi Alma-9/iomages/pxeboot/vmlinuz ip=dhcp inst.repo=ftp:/192.168.0.1/Alma-9
  initrdefi Alma-9/images/pxeboot/initrd.img
}
menuentry 'Install Ubuntu 22.04' {
  linuxefi Ubuntu-2204/iomages/pxeboot/vmlinuz ip=dhcp inst.repo=ftp:/192.168.0.1/Ubuntu-2204
  initrdefi Ubuntu-2204/images/pxeboot/initrd.img
}

It boots into the grub bootloader menu successfully.
I can complete the installation of Rocky successfully. So I know the FTP and kernel loading method works.
But if I attempt to select Ubuntu or Alma I get “bad shim signature”

2

Hey there!

That’s because PXE booting with Secureboot expects you to have the whole cert chain correctly, which means, as you already noticed booting with the Rocky shim and then trying to install Alma, Ubuntu, RHEL or any other distro will end in a bad shim error.

Coming from the Foreman world, I know that a team there has been working on implementing a function that serves individual shims for each different distro that gets PXE booted,
it basically boils down to the DHCP server being managed by Foreman and serving the correct shim to the correct distro to boot :+1:

There was also a talk about that on multiple conferences up to now, the last one being the CfgMgmtCamp:

Maybe this helps you too if you just want to implement this yourself the barebones way :slightly_smiling_face: