Categories

  • Get help with your FOG system.
    FOG Problems Hardware Compatibility Windows Problems Linux Problems Mac Problems General Problems
    13k Topics
    114k Posts
    K

    @Tom-Elliott
    hash problem still exists with old snapin …
    fog log on client PC102CAD

    ---------------------------------SnapinClient--------------------------------- 23.06.2026 15:49:19 Client-Info Client Version: 0.13.0
    23.06.2026 15:49:19 Client-Info Client OS: Windows
    23.06.2026 15:49:19 Client-Info Server Version: 1.6.0-beta.2443
    23.06.2026 15:49:19 Middleware::Response Success
    23.06.2026 15:49:19 SnapinClient Running snapin 000_SCHUELER
    23.06.2026 15:49:19 Middleware::Communication Download: http://192.168.0.196/fog/service/snapins.file.php?mac=F8:ED:FC:55:D6:2D|0A:00:27:00:00:02&taskid=170
    23.06.2026 15:49:21 SnapinClient C:\Program Files (x86)\FOG\tmp\000_SCHUELER_202604211353.bat
    23.06.2026 15:49:21 SnapinClient ERROR: Hash does not match
    23.06.2026 15:49:21 SnapinClient ERROR: --> Ideal: 81FEB595799A8F03E1F938D8F2EED0D30DEACF35F878B5E3A7857688F79C144902D427BF69546C48D04A57E1247881EAF2FD9EF91A75714788823E4E0F93985B
    23.06.2026 15:49:21 SnapinClient ERROR: --> Actual: 81C5644226BDDC79CC6D00F18923612E773FCFB4E427A39EE15D2B6341AA5C9E45D7E6FC3FDC5AD7CB90DA4358867FDAE227BA20480EBE8F0D5C6B633001F5A3
    23.06.2026 15:49:21 Middleware::Communication URL: http://192.168.0.196/fog/service/snapins.checkin.php?taskid=170&exitcode=-1&mac=F8:ED:FC:55:D6:2D|0A:00:27:00:00:02&newService&json

  • Get the latest news on what's happening.
    Security Advisories
    184 Topics
    825 Posts
    A

    @Tom-Elliott I really appreciate that you are putting effort into providing more frequent releases, which makes it easier for everyone to deploy new security fixes in time. Keep up the good work!

  • View tutorials or talk about FOG in general.
    General Tutorials
    2k Topics
    19k Posts
    K

    @Florent Hi Florent,

    I actually have been meaning to look into this some more, but the likely answer is no, or at least, not entirely. The way that support works is, you download a signed iPXE 2.0 binary from iPXE and a copy of their signed shim. That shim is signed with the Microsoft keys and trusts the iPXE signing keys. What this means in practical terms is, all the steps above would still need to occur, it’s just that the signing of the iPXE binary is managed by iPXE, and you don’t need to enroll a key to boot iPXE.

    That said, I would imagine this only covers you for booting iPXE, any chainloaded binaries would still need to be signed either with Microsoft’s key or a MOK key you’ve enrolled on the machine. In FOG’s case this means the FOS kernel has to be signed and trusted on the system, in addition to any other binaries (for example memtest, refind) you plan to boot via FOG.

    The other likely blocker is the build itself. Naturally, only iPXE can sign binaries that the iPXE Shim will support. Currently the FOG installer actually builds a slightly modified iPXE binary from source. While I’m unsure if these are all that different from the pre-built binaries from 2.0 in terms of support and functionality, it would at the very least need to be changed to instead pull the iPXE 2.0 binaries.

    I don’t think any of these are particularly hard to overcome or deal with though. The bottom line is, 2.0 makes it easier, but only to a point. To get real proper Secure Boot support in FOG, they’ll likely need to generate their own signing keys, and start signing at least the FOS kernels (if not iPXE itself) and update FOG to include shim support somehow.

    That said, for basic support, I doubt they would need to go the full mile and get a Microsoft approved signing key, I think distributing a certificate/key you can enroll via MokManager and using a pre-existing signed shim (like the iPXE provided one) would more than suffice for most usecases. I’m not sure how difficult it would actually be to implement any of this into FOG, that’s a question for someone who knows PHP and is more familiar with the FOG codebase than I.

    Sorry if that’s a bit long winded, it’s not an easy topic to distill. Hope that helps though.

  • Report bugs, request features, or get the latest progress.
    General Feature Request Bug Reports
    2k Topics
    21k Posts
    K

    @Valer Hi Valer,

    You can see my tutorial on using Secure boot with Shim, and my thoughts on what 2.0 means for Secure Boot with FOG here: http://forums.fogproject.org/post/158170

123

Online

12.7k

Users

17.6k

Topics

156.6k

Posts