create a multiboot system with win1, lubuntu, ghostbsd

callamon

Hi,
I would like to install GhostBSD in a multiboot system based on an old ASUS B53E. Win10 and Lubuntu works, but how to install a GhostBSD ... I need some advice/help!
Thanks!!!

vimanuelt

I would suggest a more reliable solution...VirtualBox.

VirtualBox is a straightforward tool for running multiple operating systems on a single machine. It’s easy enough to set up, provided you have sufficient CPU cores, RAM, and disk space. In practice, you can run several virtual machines at once, letting you switch between environments quickly, test software on different platforms, and share files without much trouble.

Running separate VMs also isolates issues: if one crashes, the others stay up. However, the physical host is still a single point of failure. If it goes down, so do all your VMs. Backups are wise, especially for critical data. For added security, consider hosting important services on separate hardware or in the cloud.

callamon

@vimanuelt Thanks for your reply. In this case it is no solution. I need a multiboot system.
I know VMs, I also them, but not in this case ...

DHOC_TAZH

callamon I hear you! Multiboot is how I'm rolling right now with one of my two GhostBSD installs. Bare metal.

I want that as I am looking to gain 3d acceleration for some apps and future work. I cannot do that effectively with a VM install, passthrough is a PITA. Similar to yours, Win11 Home, Lubuntu LTS and GhostBSD.

Edit, if you install with a multiboot setup, make sure you install ReFind. Installing the BSD bootloader only will overwrite the Windows bootloader and Grub for Lubuntu. Not easy to replace those if they're accidentally deleted.

vimanuelt

Install GhostBSD and select rEFInd as the boot manager during installation.
Afterward, install other operating systems on separate drives for a cleaner setup and easier maintenance. If using separate drives isn't an option, you can install them on different partitions instead.

vimanuelt

You can drop GRUB on Linux and use rEFInd instead; rEFInd detects GhostBSD automatically. That's my new recommendation for Linux users who want to multiboot.

DHOC_TAZH

vimanuelt

Yes, generally that can be done. If this is done, Secure Boot needs to be shut off from the BIOS. I choose to keep Secure Boot on for Windows 11 and Lubuntu. This means I have to get into BIOS to shut off Secure Boot before booting up GhostBSD. A hassle, but one I choose to live with for certain security reasons. 🙂

vimanuelt

DHOC_TAZH If you want you can look into adding support by:

Creating your own Secure Boot keys (PK, KEK, DB)
Signing GhostBSD's loader.efi with your DB key
Preparing the ESP to work with shimx64.efi and mmx64.efi

Here's an early prototype script. Feel free to improve it.

#!/bin/sh

# Secure Boot Setup Script for GhostBSD
# Author: Sho Kami Sei and Ghostfixer
# License: BSD 3-Clause

set -e
trap 'echo "Script aborted."; exit 1' INT TERM

# === Configuration ===
KEYDIR="$HOME/secureboot/keys"
ESP_DIR="/boot/efi"
GHOSTBSD_LOADER="$ESP_DIR/EFI/ghostbsd/loader.efi"
SIGNED_LOADER="$ESP_DIR/EFI/ghostbsd/loader.signed.efi"
BOOT_DIR="$ESP_DIR/EFI/Boot"
SHIM_URL="https://cdimage.ubuntu.com/releases/22.04/release/ubuntu-22.04.3-live-server-amd64.iso"

# === Helper Functions ===
require_tool() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "Required tool '$1' is not installed. Please install it first."
    exit 1
  fi
}

log_step() {
  echo
  echo "$1"
  echo "----------------------------------------"
}

fail_if_missing() {
  if [ ! -f "$1" ]; then
    echo "Missing required file: $1"
    exit 1
  fi
}

# === Checks ===
log_step "[0] Verifying environment..."

for tool in openssl cert-to-efi-sig-list sign-efi-sig-list sbsign; do
  require_tool "$tool"
done

fail_if_missing "$GHOSTBSD_LOADER"

# === Step 1: Create Key Directory ===
log_step "[1] Creating key directory..."
mkdir -p "$KEYDIR"
cd "$KEYDIR" || exit 1

# === Step 2: Generate Keys ===
log_step "[2] Generating Secure Boot keys (PK, KEK, DB)..."

openssl req -new -x509 -newkey rsa:2048 -nodes -keyout PK.key -out PK.crt -days 3650 -subj "/CN=GhostBSD PK/"
openssl req -new -x509 -newkey rsa:2048 -nodes -keyout KEK.key -out KEK.crt -days 3650 -subj "/CN=GhostBSD KEK/"
openssl req -new -x509 -newkey rsa:2048 -nodes -keyout DB.key -out DB.crt -days 3650 -subj "/CN=GhostBSD DB/"

# === Step 3: Create .auth and .esl Files ===
log_step "[3] Creating UEFI .auth and .esl files..."

cert-to-efi-sig-list -g "$(uuidgen)" PK.crt PK.esl
cert-to-efi-sig-list -g "$(uuidgen)" KEK.crt KEK.esl
cert-to-efi-sig-list -g "$(uuidgen)" DB.crt DB.esl

sign-efi-sig-list -k PK.key -c PK.crt PK PK.esl PK.auth
sign-efi-sig-list -k KEK.key -c KEK.crt KEK KEK.esl KEK.auth
sign-efi-sig-list -k DB.key -c DB.crt db DB.esl DB.auth

# === Step 4: Sign loader.efi ===
log_step "[4] Signing GhostBSD loader.efi..."

cp "$GHOSTBSD_LOADER" "$KEYDIR/loader-original.efi"
sbsign --key DB.key --cert DB.crt --output "$SIGNED_LOADER" "$GHOSTBSD_LOADER"
mv "$SIGNED_LOADER" "$GHOSTBSD_LOADER"

# === Step 5: Manual shim Setup ===
log_step "[5] Setting up shim and mm... (manual step)"

mkdir -p "$BOOT_DIR"

echo "Please manually obtain shimx64.efi and mmx64.efi:"
echo "   - Mount and extract from:"
echo "     $SHIM_URL"
echo "   - Or download shim-signed from:"
echo "     https://packages.ubuntu.com/search?keywords=shim-signed"
echo
echo "Then copy them into:"
echo "   cp shimx64.efi $BOOT_DIR/BOOTX64.EFI"
echo "   cp mmx64.efi $BOOT_DIR/mmx64.efi"
echo "   cp $GHOSTBSD_LOADER $BOOT_DIR/grubx64.efi  # or configure shim to load loader.efi"
echo

# === Step 6: Summary and Key Enrollment ===
log_step "[6] Done. Final steps:"

echo "Secure Boot key files are in: $KEYDIR"
echo "Copy these to a USB stick for enrollment using KeyTool.efi or UEFI setup:"
echo "   $KEYDIR/PK.auth"
echo "   $KEYDIR/KEK.auth"
echo "   $KEYDIR/DB.auth"
echo
echo "You can now reboot and enroll your keys. After that, enable Secure Boot in firmware."

DHOC_TAZH

vimanuelt Would I need to reinstall Refind if I choose to have these keys created?

vimanuelt

How to Install rEFInd on Lubuntu: Making GhostBSD a secondary boot option

This guide helps you install rEFInd on Linux to make booting GhostBSD alongside Linux easier; especially if GRUB isn't detecting it properly.

Step 1: Install Required Tools

Open a terminal and run:

sudo apt update
sudo apt install refind

This installs rEFInd and its configuration utilities.

Step 2: Install rEFInd to the EFI System Partition (ESP)

Run the rEFInd install script:

sudo refind-install

This copies rEFInd to /boot/efi/EFI/refind/ and sets it as the default EFI bootloader (does not remove GRUB).

If You See an Error Like:

“Not installing to the ESP” or
“ESP not mounted”

You may need to manually mount your EFI partition:

sudo mkdir -p /boot/efi
sudo mount /dev/sdXY /boot/efi

Replace /dev/sdXY with your EFI partition (usually something like /dev/sda1, type vfat and around 512MB).

Then rerun:

sudo refind-install

Step 3: Reboot and Use rEFInd

Reboot your machine:

sudo reboot

You should now see the rEFInd boot menu with entries for LMDE, FreeBSD, and other installed systems.

If GhostBSD doesn't appear:

Press F2 to refresh
Press F10 to view boot options

Why Use rEFInd?

Graphical EFI boot manager with theme support
Auto-detects FreeBSD, GhostBSD, Linux, Windows, and more
Clean interface with easy fallback to GRUB if needed

vimanuelt

No.