Invalid Token.dat with Deep Freeze

[PCF24]

Hello everyone,
We would like to install software on the student computers in the future. Unfortunately we have a problem with the FOG Client Token. We use Deep Freeze as protection software. This software does not allow changes to be retained on the hard drive. After a restart, all changes to the operating system are reset.
The token.dat is also reset and the FOG client can no longer communicate with the server. Invalid Token.dat appears in the log.
If we go to “Reset Encryption Data” on the host in the FOG server, it works again.
Can you switch off token renewal on the client?
Or perhaps you can simply use the FOG API to automatically “Reset Encryption Data” on all clients every DAY.
Or can you switch off the checking of the token?
Thanks in advance.
Heinz

[Tom Elliott]

@PCF24 The whole point of the “token” is to ensure the system is a “known” device from fogs perspective. This way it’s a 2 way trust between the FOG server and the FOG client.

Since there’s exchange of information such as Hostname, AD join, Printer installs, Snapins, etc…, we wouldn’t want that being exchanged in plain text to just any ol’ system.

If you configure your base image to have all the software/drivers/printers, necessary, then work with Deep Freeze, you shouldn’t need the FOG Client on the image at all.

Just my 2 cents.

The whole point of the Client is to allow changes using the UI. Since you’re using a system to prevent changes the FOG Client (in my opinion) is basically pointless to have on your machines.

[PCF24]

@Tom-Elliott
Thank you very much for your reply.
The Fog Client definitely makes sense for software distribution. The image is rolled out once, after which the software should be kept up to date via the software distribution. This means that the software on the computers is more up-to-date and you hardly have to do any work. This is how we currently do it with a different software distribution. But I would like to use the software distribution from FOG.

I just don’t understand why the FOG client has to update the token every time the computer starts.
If the Fog Client only did this once at the very beginning (first commissioning), security would also be guaranteed. The Token.dat is currently updated every time a user logs in.
Even with Windows you can define that the computer account should not be updated so that the computer does not fall out of the domain. Otherwise Deep Freeze would not work at all in a Windows domain.
If necessary, I have to move the FOGClient to an unprotected partition. But that would be a lot of work with 1500 computers.

Is there perhaps a way that I could automatically run “Reset Encryption Data”. That would save me a lot of work.
Thanks

[Tom Elliott]

@PCF24 you could create a trigger I suppose, or a crontab that runs form the fog server to clear all the hosts sec token data. I can’t give you the exact commands but that would do the trick. Maybe somebody with more backend knowledge of the mysql and sending queries as part of the shell script could help out a lot more?

Not that I couldn’t figure it out, but I’m unable to at the moment.

[PCF24]

@Tom-Elliott
Something like that would be extremely helpful to me. I don’t know enough about the backend. Maybe some of you have more information about this.
Thanks

[PCF24]

Hello everyone,
I would also pay for the effort if one of you sent me a script that I could run via crontab.
Thanks

[rodluz]

@PCF24 Here is a quick and dirty script to reset all your hosts.
I tested it with two hosts and it is working for me. I don’t want to reset all my hosts.

You will have to paste your FOG server IP, FOG user api token, and FOG settings api token to the script.
You will also need to install jq in your FOG server.
Debian base: sudo apt install jq. RHEL based: sudo dnf install jq

#!/bin/bash

server_ip="http://10.10.10.10"
fog_user_token="PASTE_YOUR_USER_API_TOKEN_HERE"
fog_api_token="PASTE_YOUR_FOG_SETTINGS_API_TOKEN_HERE"

all_hosts=$(curl -S -s -X GET -H 'content-type: application/json' -H "fog-user-token: $fog_user_token" -H "fog-api-token: $fog_api_token" $server_ip/fog/host/ | jq '.hosts[]')
all_ids=$(echo "$all_hosts" | jq '.id')
all_ids=${all_ids//\"/}

for host_id in $all_ids
do
        curl -S -s -o /dev/null -H "fog-user-token: $fog_user_token" -H "fog-api-token: $fog_api_token" -X PUT -d '{"pub_key":""}' $server_ip/fog/host/$host_id/edit
        curl -S -s -o /dev/null -H "fog-user-token: $fog_user_token" -H "fog-api-token: $fog_api_token" -X PUT -d '{"sec_tok":""}' $server_ip/fog/host/$host_id/edit
        curl -S -s -o /dev/null -H "fog-user-token: $fog_user_token" -H "fog-api-token: $fog_api_token" -X PUT -d '{"sec_time":"0000-00-00 00:00:00"}' $server_ip/fog/host/$host_id/edit
done