Three years after the M4800, it’s time to upgrade again. Let’s start with debian-9.2.1-amd64-netinst.iso.

Booting it up

My new laptop came with an OEM Windows 10 preinstalled. I wanted to keep it just in case, but it turns out that:

  • since I want BitLocker, SecureBoot needs to be enabled
  • Ubuntu supports SecureBoot, but Debian does not
  • since I want LVM+encryption, I need to use Debian

So I’m ditching the pre-installed Windows (I’ll make a VirtualBox VM later on if I really need it).


System install is pretty uneventful, except for the fact that the trackpad is apparently not working within the installer. I was able to install on LVM with encryption as desired. I was happy to find MATE as one of the desktop options.

Post-install customization


Keyboard and trackpad setup appear to work just fine out of the box (including for GDM).

The default driver appears to work just fine with the embedded LCD display, but is unable to handle my two external DP monitors (see below).

Nvidia driver

I am using this laptop on a docking station with two DisplayPort monitors. This works only if the builtin Intel GPU is disabled, and the add-on Nvidia GPU only is enabled.

Using the nvidia (non-free) driver

To install the nVidia driver:

  • make sure installed kernel headers (linux-headers) match kernel (linux-image), otherwise DKMS won’t build.
  • install nvidia-driver (note: this will build a kernel module, so requires a working compiler)
  • install nvidia-xconfig
  • run nvidia-xconfig --query-gpu-info by hand and make note of PCI BusID
  • run nvidia-xconfig --busid=PCI:x:x:x to generate xorg.conf

BIOS setup

To disable the built-in Intel GPU:

  • Video -> Switchable graphics -> uncheck Enable Switchable Graphics

(I have also checked Graphics Special Mode, not sure whether this is needed).

Desktop environment

  • Set focus-follows-mouse
  • Set keyboard shortcut for lock screen to Win+L
  • Set MATE terminal to white-on-black

Disable GNOME Keyring SSH agent:

$ gsettings get org.mate.session gnome-compat-startup
['smproxy', 'keyring']
$ gsettings set org.mate.session gnome-compat-startup "['smproxy']"
$ gsettings get org.mate.session gnome-compat-startup

$ mate-session-properties
# uncheck SSH Key Agent and maybe others.
# This will create a copy of /etc/xdg/autostart/gnome-keyring-ssh.desktop
# in ~/.config/autostart, with appropriate settings to turn it off.

Sudo configuration

Add myself to group sudo.

APT sources

In /etc/apt/sources.list: add contrib and non-free.

Wifi drivers

The Intel wireless drivers require non-free binary components, see


firmware-iwlwifo vim rsync net-tools pcscd apt-transport-https openvpn binutils ltrace strace scdaemon


Hipchat is linked against Qt libraries that assume OpenSSL 1.0, but Debian provides 1.1.

Work around:

# apt-get install libssl1.0.2
# ln -s /usr/lib/x86_64-linux-gnu/ /opt/HipChat4/lib/
# ln -s /usr/lib/x86_64-linux-gnu/ /opt/HipChat4/lib/

(Note: the Atlassian web site gives incomplete instructions – they do not mention libcrypto).