Categories

• Technical Help

  Get help with your FOG system.

  FOG Problems Hardware Compatibility Windows Problems Linux Problems Mac Problems General Problems
  13k Topics

  115k Posts

  M

  Hello, I use the dev-branch version and for about 10 days when I launch the installer each time in the middle of the installation there is this message and my client workstations are no longer authenticated…

  This run will mint a new FOG PKI CA. A CA's name constraints are fixed at the moment it's issued -- widening them later means re-issuing it (rm -rf the CA directory, then re-run). Extra hostnames for this server, space-separated (3 min, blank = none): Internal domains, space-separated, e.g. example.local (3 min, blank = none):
• Announcements

  Get the latest news on what's happening.

  Security Advisories
  184 Topics

  825 Posts

  A

  @Tom-Elliott I really appreciate that you are putting effort into providing more frequent releases, which makes it easier for everyone to deploy new security fixes in time. Keep up the good work!

• General Topics

  View tutorials or talk about FOG in general.

  General Tutorials
  2k Topics

  19k Posts

  K

  @Tom-Elliott Just a thought, was reading through the docs and I noticed that because of the adhereance to stock iPXE 2.0 netbooting with HTTPS is disabled by default. This may be a little too complicated so I’d get avoiding this, but you could probably work around this by nesting shim and iPXE to boot a custom signed iPXE. It would work something like this:

  Netboot iPXE 2.0 normally with it’s shim Use autoexec.ipxe with the shim command to reload that shim Using autoexec.ipxe chainload a custom build of iPXE 2.0 that has the FOG certificate bundled and trusted.

  If the binary chained isn’t already trusted, I believe you should be able to use some scripting to then automatically chain in mokmanager or fallback to chaining via http.

  Provided you use the normal FOG signing keys, this should work fine, though it does mean having two shims. It may be worth it to close that small gap in HTTPS. Both the shim and custom iPXE could be chain loaded via TFTP. It does add a little more complexity to the signing and boot process but I figured it was worth mentioning, as having HTTPS wherever possible does seem valuable.

• Developers

  Report bugs, request features, or get the latest progress.

  General Feature Request Bug Reports
  2k Topics

  21k Posts

  T

  @Valer I think we need to understand what this plugin is doing.

  CSS isn’t something we’ve allowed to be injectable though it could be.

  You can still use your own CSS but that’s more at the FOG Configuration -> FOG Setting -> FOG_THEME, but you would need to put it on your server in a location you type the path too here.

  https://docs.fogproject.org/en/latest/development/plugin-development

  This is a good toolkit for understanding how to build your own plugin.