could not load the secure boot enrollment menu

[robertkwild]

hi all,

i get this

i have a windows DHCP server and ive added the right boot options

let me know

thanks,
rob

[Tom Elliott]

@robertkwild Thanks for the screenshot. That error is a bug in the installer, not in your DHCP options.

020c618f means the FOG web server answered HTTP 401 for mmx64.efi. On a fresh install, the installer copies MokManager into the web folder before it downloads the Secure Boot files, so mmx64.efi is never there.

To fix it now, run the installer one more time. The second run finds the downloaded file and copies it. Then pick “Enroll Secure Boot Key” again.

To confirm before you re-run, check that this file is missing:

ls -l /var/www/html/fog/service/secureboot/mmx64.efi

Tracked in https://github.com/FOGProject/fogproject/issues/1868.

[robertkwild]

@Tom-Elliott the file isnt there

ls -l /var/www/html/fog/service/secureboot/mmx64.efi
ls: cannot access '/var/www/html/fog/service/secureboot/mmx64.efi': No such file or directory

reran the install and now when i do a ls the file is there

now what please tom

EDIT - ok ive enrolled the key, i had to select “iPXE”

how do i know its working/enrolled?

[Tom Elliott]

@robertkwild Good, that screen is MokManager, so the fix worked.

1. Pick the last entry, iPXE. That is the network copy of the key.
2. Pick MOK.der.
3. Optional: View key 0 shows the certificate. Check it names your FOG server, then press a key.
4. Pick Continue, then Yes.
5. Pick Reboot.

Do not wait on these screens. MokManager reboots on its own if it sits idle.

After the reboot, PXE boot as normal. A Secure Boot task should now load the kernel.

[robertkwild]

@Tom-Elliott but do i need to enroll the machine to capture/deploy an image?

[Tom Elliott]

@robertkwild No, only need to enroll if you want to use Secureboot (after enrollment)?

[robertkwild]

@Tom-Elliott

i get this now when i do a quick enrollment

very wierd, when i pxebooted i got a black screen cli (different from the usual white gui one)

i restarted again (got the correct white screen gui), clicked on “quick enrollment”, went back to the web portal and cliked “all hosts” and i could see the host it added

[Tom Elliott]

@robertkwild The enrollment step worked. This new error is a network timeout, not Secure Boot.

4c0a6092 means the server never answered the kernel (bzImage) download. iPXE checks the Secure Boot signature only after the download finishes. So this error says nothing about the key yet.

Please run these two commands on the FOG server and post the output.

First, check that the server can send the kernel at all:

curl -s -o /dev/null -w '%{http_code} %{size_download}\n' http://10.110.10.60/fog/service/ipxe/bzImage

Then try Quick Registration on the laptop again, and right after it fails, run:

sudo grep bzImage /var/log/apache2/access.log /var/log/nginx/access.log /var/log/httpd/access_log 2>/dev/null | tail -n 5

If the log has no line from the laptop’s IP, the request never reached the web server. If it has a 200 with a small byte count, the transfer started and then dropped.

To answer your earlier question: once a Secure Boot task boots past bzImage into FOS, the key is enrolled. If it were not enrolled, you would get a security error after the download, not a timeout.

[robertkwild]

@Tom-Elliott ok ive got somewhere

so i did “quick enrollment” and now i see it on the web portal

after i did “enroll secure boot key”

went back on the host on the web portal and i dont see the key its enrolled

answer to your questions

curl -s -o /dev/null -w '%{http_code} %{size_download}\n' http://10.110.10.60/fog/service/ipxe/bzImage
200 11063696

cant do the other one as now its registered the host on fog

[Tom Elliott]

@robertkwild Good progress. The server sends the full kernel (200 11063696), and registration booted FOS, so the earlier timeout was a one-off. If it comes back, post the screen and the access log line from that moment.

The empty Secure Boot fields on the host page are expected. The “Enroll Secure Boot Key” menu item enrolls the key in the laptop’s firmware through MokManager. FOG is not part of that step, so nothing reports back to the server.

Two ways to fill them in:

• Let FOS check and record it. On the host, create an “Enroll Secure Boot” task and PXE boot the laptop. FOS sees the key is already trusted, enrolls nothing, and records the state, the date, and the certificate fingerprint.
• Type it in. Set “Secure Boot Enrolled” to today’s date and “Enrolled Via” to mok, then click Update. mok means a person confirmed the key in MokManager, which is what you did.

I’d use the task, because it checks the key instead of trusting a typed value.