Is FOG able to fit my needs?



  • Hi all,

    i am doing some research for a project i want to realize with FOG. I want to know if this is possible.

    We have a client who has different PC’s where people can user our applications. The customer has “sub-customers”. The way we are doing things right now. We are based in germany and our customer is based in Britain. We are getting PCs and have to install the master image on each and every PC, then we send them to Britain. If they need another image, they send it back, we install the correct image and send it back.
    Its very time-consuming.

    My plan right now is to install a FOG-Server where our client is based. Because of security reasons the network is not connected to the internet and every PC has a static IP address.

    So i would install the server here, travel to Britain and integrate it to the network. New PC’s should get one (of many) master image from the Server. If they want to change the image this should be possible too.

    The sub-customers should only see theire own images and not the ones from other sub-customers.

    I hope its clear what i mean, i had to be cryptic. If you have any questions i can try to be more precise.

    Kind regards
    Denny



  • Okay,

    just to make it hopefully more clear. ! 0_1500915821660_Untitled Diagram.jpg

    Of course it’s not a shopping mall. The Customers offer different services. You can imagine it like a self-service ticket station in a train station.

    The network itself is high-security.


  • Moderator

    @Tom-Elliott said in Is FOG able to fit my needs?:

    you start to break your own “Highly Secure” layout

    High physical security or high ICT computer security not necessarily the same thing.


  • Moderator

    @eadhor Do you want the sub customers to be able to deploy images or will you manage the process from Germany?

    The issue I’m seeing right now is isolation of each sub company’s images. Right now the FOG ACL system is pretty weak in that you are an admin or not an admin. If you are admin you have access to everything.

    What we would need for this idea to work is to use the location plugin and then find a way to restrict images and IT admins to specific locations (this was a request of mine for several years now). In that IT admins from location A can only see images that are assigned to location A, location B and so on. Right now that level of control is missing in FOG.


  • Senior Developer

    I have to be honest, if the information handling is meant to be this highly secure, I doubt there’s a single imaging solution that can meet your needs.

    That all said, localized FOG Servers could do what you want, but the moment you think about “centrally managing” them, you start to break your own “Highly Secure” layout.



  • @george1421
    Alle sub-customers use the same subnet IP range.

    I have talked to a lot of people the last few hours. It COULD be possible to use the FOG Server as DHCP.

    @Sebastian-Roth
    The PC’s could be delivered by our supplier with a pre-installed FOG-Client. The problem working with the PC’s is the following. If u want to plug somthin in, you have to jump over a wall, or maybe walk around it, unlock a cage, plug it in, walk or jump back, do what u gotta do, jump over again, unplug it, lock the cage. It’s a high-security area.


  • Moderator

    @eadhor I still think we need to understand the work flow here.

    FOG requires pxe booting for imaging to work. You can use static IP mapping for the client computers. But you will need to have a dhcp server on this network. The fog server can act as a dhcp server if needed. If the customer is using a static IP addressing schema as a security measure then FOG is not a good fit here.

    If you do use static IP and a dhcp server is possible, then we have some options. The target OS will need to have a way to identify the machine and to configure a static IP address for itself since FOG can’t do this for you.

    FOG isn’t designed to be a multi-tenant in design. If you are an admin in fog you can see all images installed on the fog server. One option would be to setup multiple fog servers. Depending on your scale of deployment you could use an intel nuc as your FOG server. The FOG server doesn’t require much CPU for imaging. I know of someone creating a docker version of FOG, but its not clear if you can have more than one docker fog container per docker server.

    Do each of the sub customers have their own isolated network or do they share the same network and subnet IP range?


  • Developer

    Just thinking out load about the special case of non-PXE and non-USB bootable environment. CD-boot would be another option. In case all this does not work it would be possible (not tried yet but in theory) to add the FOG deploy OS to your hard disk and boot it from there. So when the PC boots up it shows a boot menu where default is to boot the normal OS and the second menu item is deploying a new image to that PC. Of course for the initial setup you’d need to boot all the PCs via USB key once.


  • Developer

    @eadhor said in Is FOG able to fit my needs?:

    I will start in early october with a REF-System if i get a go.

    I’d advice you to start setting up a FOG server in the next couple of weeks (maybe at home in a VM if you don’t have resources at work) to get to know the system. You only need two VMs as a starter. Showing your supervisor how easy things would be using FOG will probably help in the decision process.

    magic FOG USB key isn’t an option, because the PC’s are not so easy accessible, but it would be an option if there is no other way.

    Not sure what that means (locked up in a different room?) but maybe a USB extension cord would do the trick…



  • @Sebastian-Roth

    magic FOG USB key isn’t an option, because the PC’s are not so easy accessible, but it would be an option if there is no other way.



  • @Sebastian-Roth
    I can tell that my superiors, but i cant promise anything :( I am at the end of the food-chain in this company ;)

    Thanks so far. I will start in early october with a REF-System if i get a go.


  • Developer

    @eadhor As a side note I wanted to add that we are here to help you setting this up properly and possibly even add some code changes to make it work for you (if we think this would be interesting to others as well). From what you are saying this sounds like FOG would save your company a huge amount of money! We’d love to see you making some donation to the project if FOG is working for you.


  • Developer

    @george1421 said in Is FOG able to fit my needs?:

    You must have dhcp enabled on this network for pxe booting to work.

    While George is absolutely right about this in the way FOG is meant to usually work (PXE boot which needs DHCP!) this could be avoided by USB booting the clients for deployment of an image. So all the PCs would usually boot from the disk and if someone wants to change the image he has to plug-in the “magic FOG USB key” and hit F12 to boot from that. Just an idea.

    @eadhor Your setup sounds kind of special but I think it can be done. Probably needs some modifications but it’s still way better than sending the PCs back and forth.

    The sub-customers should only see their own images and not the ones from other sub-customers.

    There are several different ways of achieving this I reckon.

    • Setup as many FOG servers (in VMs for example) as you have sub-customers - depending on the network structure this might be a good idea anyway
    • Possibly FOG plugin accesscontrol is good enough for your needs
    • Modify FOG to your needs (it’s open source)


  • Its one location with multiple sub-customers. You could see it as a shopping mall where each store is a sub-customer with up to 100 PCs.

    So i could create the image here in Germany, transfer it to the server in Britain and then it should work?


  • Moderator

    This should be possible to do with a few exceptions.

    But lets answer a question first. Does the location in Brittan have multiple sub-customers or would it be only one sub-customer per location?

    The static IP address may be a problem because you would need to find away to index the host to get the right IP address. This step will need to be done post imaging in your setupcomplete.cmd or unattend.xml file actions that run after OOBE is done. You WILL NEED to use dhcp to image the computer. Once the computer is imaged then it may have a static IP address. You must have dhcp enabled on this network for pxe booting to work.


Log in to reply
 

462
Online

39010
Users

10725
Topics

101898
Posts

Looks like your connection to FOG Project was lost, please wait while we try to reconnect.