We are preparing a lab with 44 MacBooks (Apple M4, 16 GB RAM) and have a few infrastructure requirements:

We need the Macs to authenticate against our Samba Active Directory (LDAP/Kerberos) domain.
We would like to understand whether FOG Project can clone a macOS image and replicate it across the other machines, since all devices share the same hardware configuration.
If FOG is not suitable for this scenario, we would appreciate recommendations for tools or methods that can help us deploy a standardized macOS image to all machines.
This imaging/deployment process is performed once every semester, so we are looking for a reliable and repeatable solution.

Could you please advise on the feasibility of this approach and suggest best practices or tools for mass deployment and domain integration in this context?

Thank you.

As I work at a secondary school, I was able to get hold of some Catalina iMacs (iMac 14.3).
I already use FOG to deploy Windows and Linux images on PCs.

I would like to deploy a LinuxMint image on these iMacs.

However, I am unable to boot into PXE on them with FOG, and I do not know what is wrong.

I modified my DHCP server as follows:

## FOG
class "UEFI-32-1" {
match if substring(option vendor-class-identifier, 0, 20) = "PXEClient:Arch:00006";
filename "i386-efi/ipxe.efi";
}

class "UEFI-32-2" {
match if substring(option vendor-class-identifier, 0, 20) = "PXEClient:Arch:00002";
filename "i386-efi/ipxe.efi";
}

class "UEFI-64-1" {
match if substring(option vendor-class-identifier, 0, 20) = "PXEClient:Arch:00007";
filename "ipxe.efi";
}

class "UEFI-64-2" {
match if substring(option vendor-class-identifier, 0, 20) = "PXEClient:Arch:00008";
filename "ipxe.efi";
}

class "UEFI-64-3" {
match if substring(option vendor-class-identifier, 0, 20) = "PXEClient:Arch:00009";
filename "ipxe.efi";
}

class "Apple-Intel-Netboot" {
    match if substring (option vendor-class-identifier, 0, 14) = "AAPLBSDPC/i386";
    option dhcp-parameter-request-list 1,3,17,43,60;
    if (option dhcp-message-type = 8) {
            option vendor-class-identifier "AAPLBSDPC";
            if (substring(option vendor-encapsulated-options, 0, 3) = 01:01:01) {
                # BSDP List
                option vendor-encapsulated-options 01:01:01:04:02:80:00:07:04:81:00:05:2a:09:0D:81:00:05:2a:08:69:50:58:45:2d:46:4f:47;
                }
            elsif (substring(option vendor-encapsulated-options, 0, 3) = 01:01:02) {
                #BSDP Select
                option vendor-encapsulated-options 01:01:02:08:04:81:00:05:2a:82:0a:4e:65:74:42:6f:6f:74:30:30:31;
                # filename "i386-efi/ipxe.efi";
                filename "snp.efi";
                }
            }
        }

class "Legacy" {
match if substring(option vendor-class-identifier, 0, 20) = "PXEClient:Arch:00000";
filename "undionly.kkpxe";
}

### END FOG

I tested ipxe.efi in 64-bit and 32-bit, as well as snp.efi, but it still doesn’t work. I get some kind of spinning planet when I try to boot.

I admit I don’t fully understand the documentation page: https://wiki.fogproject.org/wiki/index.php/FOG_on_a_MAC

Thanks in advance!

Thanks for your reply. Its strange. I am working with (almost exclusively) early 2012 hardware. My older Imacs 2009-2011 afaict pxe boot fine image with FOG w/o issue. The problem comes along when, I try to image our macbooks. They display different levels of progress before they flat out hang. I had one mbpx,y I’m almost sure it was a 3rd gen intel just can’t find it right now. I may be being processed to go out the door to our clients.

Yes the 2019 verison of ipxe was executed from a boot of clonezill 3.1.x the version I would attempt to boot from ventory stick or from an imaged usb stick would display an error regarding not having efi capability and/or hang or return to the ventoy menu. If I just let them be long enough the MBP would just restart.

So I did attempted to roll my own and ran into the same problem with the oobox downloadable iso/zip file. Hang… I am researching w/o much success with how clonezilla compiled their ipxe menu entry or how to just plain add efi capability to ipxe.iso/zip and burn it to a usb stick. I just am not knowledable enough to formulate a good question or find what I am looking for (cause I don’t know:))

So thanks again for your reply. I have a large donations of older MBP’s coming just before the holidays and I would lik to be able to make it rain.

Regards,

Thanks George. No but I will now that I have time machine back ups. Can I use mac-boot to create the stick then just update those 2 things?

I have a bridged network VM on Parallels on MacOS, it boots into the fog menu fine but when I try to run anything that needs bzimage or boot.php it is unable to connect to the fog server and the connection times out. From the IPXE shell the fog server is not pingable either.

Unsure as to why there is any difference between my vmware VM’s and baremetal machines which are deploying fine, there isn’t any firewall on the iMac. The fog web interface is accessible and I can browse to the target files

Thanks for any suggestions
-Tauric

Edit: Resolved now, it was a driver issue

https://wiki.fogproject.org/wiki/index.php?title=FOG_on_a_MAC#Using_bless

I understand the bless comand but will this not change the boot partition permanently? I dont have a problem to boot from the right partion.

Hi,

no I have the time to deal with this problem again.

Again further details how I have done it:

could it be that there have to be done other work that the fat32 boot partition will find the exact file to boot.
I have made the USB-boot sticks with Rufus. I dont kow if there were made changes by rufus.

thank you very much.
Mathew

Thanks a lot 🙂

So in order for the Mac to connect to the FOG server, does Fog have to handle DCHP itself?

No. You can try to make your existing DHCP server to properly answer the Mac bootp protocol or use other methods like “bless” (see mentioned wiki article) or USB boot (George’s answer). I don’t have a Mac myself for testing so this is all just from information gathered over the years.

Windows 10 (bootcamp) and OS X

Can you give me some informations what I should select for the image caputring Operating System, ImageType (singeDisk…sectorbysector), Partiton…

And which setting than to deploy the Image.

Is it possible to assign the bootcamp to my local activeDirectory Domain after deployment?

Thank you very much.

Would you be so kind and let us know what steps you took and what is missing in the documentation?

@astrugatch

I just wanted to follow up on this. I realize this thread is ancient but I feel this is still very much relevant. We ended up going with Mosyle (PAID) for our MAC / Apple MDM. We are unhappy with it. It does not meet either myself or the instructors expectations.

You are 100% correct, Mosyle does not meet the expectations of a true MDM. It’s clunky and the support is not great. I have not looked at munki yet but am going to pursue that to try and make the most of what we have. I am also looking at another product called FileWave, which is supposed to work very well with pretty much every platform (minus Linux). FileWave is a paid service / subscription.

Thanks again!

With FOG you’d run: chain tftp://x.x.x.x/default.ipxe (put in the FOG server IP instead of x.x.x.x…)

Also, the prohibitory symbol (crossed out circle) could also mean an incompatible OS for the hardware, I do a little bit with snow leopard to make it work on unsupported hardware, and it usually involves a kernel swap at a minimum to get old OS’s booting on new hardware.

Not sure if youre still having issues with corestorage or not, but “diskutil cs list” will show you your corestorage groups, which would typically need to be deleted before cloning or modifying partitions (you would get the prohibitory symbol from this too).

Also, just as a random tidbit, you can install OSX on an HFS+ disk all the way up to 10.13 (never tested 10.14+, might still work) if you run the installer from the commandline and use the

–converttoapfs NO

switch for the installer. This might give you a LITTLE bit more flexibility as far as being able to read partitions/volumes from linux utilities (APFS support is much harder to come by).

Understand the next thing I say is a guess because I don’t know. Its possible that Microsoft has connected user management or maybe password management to the T2 chip. Its possible with a different T2 chip it also protects/encrypts the password file. It may also be possible that changing the computer name does something unexpected with the user accounts. I don’t use Apple computers so I don’t have any experience with them.

From a debugging standpoint, we know that FOS Linux can access the hard drive of the Apple computer (because it can send a computer image). You may be able to use debug mode to access files on the target computer. I don’t know what you can do to reset the password externally but if you need to do things on a file level you can do this with FOS Linux. If you find a solution in debug mode then possibly you can write a FOG Post Install Script to apply those same settings during image deployment.