Linux hosts with UEFI Secure Boot enabled require additional configuration to run CrowdStrike Falcon with full functionality. Without importing CrowdStrike's public signing key, the sensor runs in Reduced Functionality Mode (RFM) with limited protection.
This guide covers installing Falcon Sensor on Linux with Secure Boot and importing the required signing key.
Understanding the Requirement
Secure Boot only allows signed kernel modules to load. CrowdStrike Falcon uses kernel modules for:
- Deep kernel-level visibility
- Process monitoring and blocking
- File system protection
- Network activity monitoring
Without the CrowdStrike signing key: Kernel rejects Falcon modules → Sensor enters RFM → Limited protection
How to Check if Secure Boot is Enabled
mokutil --sb-stateOr check dmesg:
dmesg | grep -i secureLook for: secureboot: Secure boot enabled
Requirements
- Ubuntu 18.04+, RHEL/CentOS, or SUSE/SLES
- OpenSSL installed
- mokutil installed
- CrowdStrike signing certificate (crowdstrike_signing.x509)
- Physical or console access for MOK enrollment (cannot be done via SSH alone)
Install Prerequisites
Ubuntu
sudo apt-get install openssl mokutilRHEL/CentOS
sudo yum install openssl mokutilSUSE/SLES
sudo zypper install openssl mokutilStep 1: Download the CrowdStrike Signing Certificate
- Log into the Falcon Console
- Navigate to Support and Resources > Resources and Tools > Tool Downloads
- Download crowdstrike_signing.x509 (Falcon Linux Sensor code signing certificate)
- Transfer the file to your Linux host
Step 2: Import the Key with mokutil
Import the CrowdStrike public key to the Machine Owner Key (MOK):
sudo mokutil --import /path/to/crowdstrike_signing.x509You'll be prompted to create a password. Remember this password - you'll need it during the reboot enrollment process.
Note: This password is separate from your root/system password and is only used for MOK enrollment.
Step 3: Reboot and Enroll the Key
- Reboot the host:
sudo reboot-
Watch for the MOK Management screen
-
On Ubuntu: Appears before the GRUB menu
-
Blue screen with "Perform MOK management"
-
Enroll the key:
-
Select Enroll MOK
-
Select Continue
-
Enter the password you created during import
-
Select Enroll the key(s)
-
Select Reboot
Important: If you miss the MOK screen, the import command remains pending. Just reboot again and watch for the prompt.
Step 4: Verify Key Enrollment
After reboot, verify CrowdStrike's key was added:
sudo cat /proc/keys | grep crowdstrikeExpected output:
asymmetri Crowdstrike, Inc: www.crowdstrike.com: : X509.rsa If you see this, the key is enrolled successfully.
Step 5: Install the Falcon Sensor
Now install the sensor as normal:
Ubuntu/Debian
sudo dpkg -i falcon-sensor__amd64.deb RHEL/CentOS
sudo yum install falcon-sensor-.rpm SUSE/SLES
sudo zypper install falcon-sensor-.rpm Configure and Start
sudo /opt/CrowdStrike/falconctl -s --cid=
sudo systemctl start falcon-sensor Step 6: Verify Sensor is NOT in RFM
Check the sensor status:
sudo /opt/CrowdStrike/falconctl -g --rfm-stateThe sensor should report it's NOT in Reduced Functionality Mode.
You can also check the Falcon Console - hosts in RFM show a warning indicator.
Known Behaviors
Two-Minute Protection Delay After Reboot
When Secure Boot is enabled, the Falcon sensor doesn't take blocking actions for two minutes after reboot. This is expected behavior to allow the system to stabilize.
Kernel Updates May Require Re-enrollment
Some kernel updates may require re-importing the MOK key. If the sensor enters RFM after a kernel update, repeat the mokutil import process.
Troubleshooting
Sensor still in RFM after key import
- Verify the key is in /proc/keys
- Restart the falcon-sensor service
- Check for kernel compatibility issues
MOK enrollment screen doesn't appear
- Some systems require physical/console access
- Check BIOS/UEFI settings for MOK options
- Verify mokutil shows pending imports:
mokutil --list-new
Key import succeeds but sensor still fails
- Ensure you downloaded the correct certificate (2022 version)
- Verify Secure Boot is actually enabled
- Check sensor logs:
journalctl -u falcon-sensor