UEFI with Safe Boot turned on.... Help!

[jamartin]

Hello everyone,

Setup: FOG 1.5.4
CentOS 7
Clonezilla Live: 20180329-artful

I want to make it easier to image PC’s. Right now I have to go into every machine to turn off “Safe Boot” and then using the servers IP address and “ipxe.efi” via option 66 and 67 on our DHCP server I can get an associated host to image from FOG.

If a host is not pre-associated with FOG we can still get to the FOG menu:

I would like to not have to turn off secure boot every time.

So far the only working solution which allows booting with all security turned on is Clonezilla.

Here’s where things seem to get tricky for me. I know FOG doesn’t natively support UEFI and Safe Boot but there is a Clonezilla PXE Boot option I want to try.

Website: https://clonezilla.org/livepxe.php

I’ve followed the steps listed here and in another site:

https://community.spiceworks.com/topic/352773-fog-and-uefi

They say to copy the necessary files (initrd.img, filesystem.squashfs, vmlinuz) from the “Live” folder from the Clonezilla Live image. For ease I put them in the tftp root.

tftp folder:

Both mention configuring the pxelinux.cfg menu “default” which I’ve done using http and tftp destinations:

They say to reboot and watch the clients go but it never happens. They mention the ability to select Clonezilla from a menu but I have no idea what menu. The only menu I’ve ever seen is the one shown above which has never mentioned Clonezilla.

If I try to run the process with Safe Boot on I always get an error from the PC:

I can’t seem to get anywhere with it.

Is there a secondary menu I’m missing that isn’t loading via FOG?

I have also got the DHCP setup as depicted here:

https://wiki.fogproject.org/wiki/index.php?title=BIOS_and_UEFI_Co-Existence

on Server 2016:

Any help would be greatly appreciated.

Thanks.

[george1421]

The issue is that both iPXE (ipxe.efi) and the FOS linux kernel (bzImage) are not signed. So secure booting is not supported natively by the FOG Project.

In contrast Ubuntu has a signed shim and grub kernel they use to jump start into the ubuntu linux kernel. If someone was a little skilled they could probably make iPXE and FOS boot using a similar shim.