Is FOG able to fit my needs?

[eadhor]

Okay,

just to make it hopefully more clear. ! 0_1500915821660_Untitled Diagram.jpg

Of course it’s not a shopping mall. The Customers offer different services. You can imagine it like a self-service ticket station in a train station.

The network itself is high-security.

[george1421]

@Tom-Elliott said in Is FOG able to fit my needs?:

you start to break your own “Highly Secure” layout

High physical security or high ICT computer security not necessarily the same thing.

[george1421]

@eadhor Do you want the sub customers to be able to deploy images or will you manage the process from Germany?

The issue I’m seeing right now is isolation of each sub company’s images. Right now the FOG ACL system is pretty weak in that you are an admin or not an admin. If you are admin you have access to everything.

What we would need for this idea to work is to use the location plugin and then find a way to restrict images and IT admins to specific locations (this was a request of mine for several years now). In that IT admins from location A can only see images that are assigned to location A, location B and so on. Right now that level of control is missing in FOG.

[Tom Elliott]

I have to be honest, if the information handling is meant to be this highly secure, I doubt there’s a single imaging solution that can meet your needs.

That all said, localized FOG Servers could do what you want, but the moment you think about “centrally managing” them, you start to break your own “Highly Secure” layout.

[eadhor]

@george1421
Alle sub-customers use the same subnet IP range.

I have talked to a lot of people the last few hours. It COULD be possible to use the FOG Server as DHCP.

@Sebastian-Roth
The PC’s could be delivered by our supplier with a pre-installed FOG-Client. The problem working with the PC’s is the following. If u want to plug somthin in, you have to jump over a wall, or maybe walk around it, unlock a cage, plug it in, walk or jump back, do what u gotta do, jump over again, unplug it, lock the cage. It’s a high-security area.

[george1421]

@eadhor I still think we need to understand the work flow here.

FOG requires pxe booting for imaging to work. You can use static IP mapping for the client computers. But you will need to have a dhcp server on this network. The fog server can act as a dhcp server if needed. If the customer is using a static IP addressing schema as a security measure then FOG is not a good fit here.

If you do use static IP and a dhcp server is possible, then we have some options. The target OS will need to have a way to identify the machine and to configure a static IP address for itself since FOG can’t do this for you.

FOG isn’t designed to be a multi-tenant in design. If you are an admin in fog you can see all images installed on the fog server. One option would be to setup multiple fog servers. Depending on your scale of deployment you could use an intel nuc as your FOG server. The FOG server doesn’t require much CPU for imaging. I know of someone creating a docker version of FOG, but its not clear if you can have more than one docker fog container per docker server.

Do each of the sub customers have their own isolated network or do they share the same network and subnet IP range?

[Sebastian Roth]

Just thinking out load about the special case of non-PXE and non-USB bootable environment. CD-boot would be another option. In case all this does not work it would be possible (not tried yet but in theory) to add the FOG deploy OS to your hard disk and boot it from there. So when the PC boots up it shows a boot menu where default is to boot the normal OS and the second menu item is deploying a new image to that PC. Of course for the initial setup you’d need to boot all the PCs via USB key once.

[Sebastian Roth]

@eadhor said in Is FOG able to fit my needs?:

I will start in early october with a REF-System if i get a go.

I’d advice you to start setting up a FOG server in the next couple of weeks (maybe at home in a VM if you don’t have resources at work) to get to know the system. You only need two VMs as a starter. Showing your supervisor how easy things would be using FOG will probably help in the decision process.

magic FOG USB key isn’t an option, because the PC’s are not so easy accessible, but it would be an option if there is no other way.

Not sure what that means (locked up in a different room?) but maybe a USB extension cord would do the trick…

[eadhor]

@Sebastian-Roth

magic FOG USB key isn’t an option, because the PC’s are not so easy accessible, but it would be an option if there is no other way.

[eadhor]

@Sebastian-Roth
I can tell that my superiors, but i cant promise anything I am at the end of the food-chain in this company

Thanks so far. I will start in early october with a REF-System if i get a go.

[Sebastian Roth]

@eadhor As a side note I wanted to add that we are here to help you setting this up properly and possibly even add some code changes to make it work for you (if we think this would be interesting to others as well). From what you are saying this sounds like FOG would save your company a huge amount of money! We’d love to see you making some donation to the project if FOG is working for you.

[Sebastian Roth]

@george1421 said in Is FOG able to fit my needs?:

You must have dhcp enabled on this network for pxe booting to work.

While George is absolutely right about this in the way FOG is meant to usually work (PXE boot which needs DHCP!) this could be avoided by USB booting the clients for deployment of an image. So all the PCs would usually boot from the disk and if someone wants to change the image he has to plug-in the “magic FOG USB key” and hit F12 to boot from that. Just an idea.

@eadhor Your setup sounds kind of special but I think it can be done. Probably needs some modifications but it’s still way better than sending the PCs back and forth.

The sub-customers should only see their own images and not the ones from other sub-customers.

There are several different ways of achieving this I reckon.

• Setup as many FOG servers (in VMs for example) as you have sub-customers - depending on the network structure this might be a good idea anyway
• Possibly FOG plugin accesscontrol is good enough for your needs
• Modify FOG to your needs (it’s open source)
• …

[eadhor]

Its one location with multiple sub-customers. You could see it as a shopping mall where each store is a sub-customer with up to 100 PCs.

So i could create the image here in Germany, transfer it to the server in Britain and then it should work?

[george1421]

This should be possible to do with a few exceptions.

But lets answer a question first. Does the location in Brittan have multiple sub-customers or would it be only one sub-customer per location?

The static IP address may be a problem because you would need to find away to index the host to get the right IP address. This step will need to be done post imaging in your setupcomplete.cmd or unattend.xml file actions that run after OOBE is done. You WILL NEED to use dhcp to image the computer. Once the computer is imaged then it may have a static IP address. You must have dhcp enabled on this network for pxe booting to work.