2019...a step by step activating ssl and complying iPXE with it

[Tom Elliott]

@marted In the bin folder should be another folder called error_logs with the latest file you just attempted installing.

Can you provide this log so we can see what’s happening and why?

[marted]

@Tom-Elliott two fils in it
First one foginstall.log

Second one fog_error_1.5.7.log

[marted]

@Tom-Elliott but I fond something here in the forum and I was wondering if this are the steps i should do to make it works:

Install of fog with the “-S” option to activate SSL

Copy of the certificate and the private key on the machine

Edit the Vhost file with the path of the private key and the certificate (with a restart of Apache2)

Modify the CA by default in the directories /etc/apache2/ssl/CA/ and /opt/fog/snapins/ssl/CA/ with our own CA

Execute the script buildipxe.sh from the directory /path/to/fogproject_git_repo/utils/FOGiPXE/

And finally, copy the new binaries from /path/to/fogproject_git_repo/packages/tftp to /tftpboot

[Tom Elliott]

@marted If you copy and paste the contents of the logs we can read them much more simply.

That said, it appears to be failing because your machine is missing the git command.

I don’t know what OS you’re running, but you should there are numerous programs needed to be installed in order to build iPXE.

You’ll need to install these programs to successfully build iPXE to begin with.

First, start with installing git for your OS. (typically apt-get install build-essential wget git or yum -y groupinstall "DevelopmentTools" ; yum -y install git)

[marted]

@Tom-Elliott Now it works
it finished compiling the iPXE and after this I’ve booted a computer and everything was OK, iPXE boot. when it boots a computer It says that it boot http iPXE but I think this is not the right information right?
the web access is still non secure even with https. Is there any way to fix that?

[Tom Elliott]

@marted TO get rid of the “not secure” you see, you need to download the ca.cert from the FOG Server.

https://foglabunix/fog/management/other/ca.cert.der

And put that in your machine’s trust root authority.

As to making iPXE obtain from https, you should be able to do this by reinstalling fog (assuming you didn’t reinstall when building the ipxe binaries)?

[Sebastian Roth]

@marted said in 2019...a step by step activating ssl and complying iPXE with it:

when it boots a computer It says that it boot http iPXE but I think this is not the right information right?

Please take a picture of that and post here.

Important: In the picture you posted earlier it looks like you run the installer with sudo (sudo ./installfog.sh). You should not! Properly change to the root account using sudo -i und run the installer from that.

[marted]

@Tom-Elliott said in 2019...a step by step activating ssl and complying iPXE with it:

TO get rid of the “not secure” you see, you need to download the ca.cert from the FOG Server.
https://foglabunix/fog/management/other/ca.cert.der
And put that in your machine’s trust root authority.

Could you tell me where to put exactly the certificate on my server root ?

[marted]

@Tom-Elliott said in 2019...a step by step activating ssl and complying iPXE with it:

As to making iPXE obtain from https, you should be able to do this by reinstalling fog (assuming you didn’t reinstall when building the ipxe binaries)?

The iPXE was recompiled at the end of the new installation with success. Do I have to start again the installation?

[Tom Elliott]

@marted Your local machine (the one you’re accessing the FOG GUI from) Trusted Root Authority.

This is either Certlm.msc or certmgr.msc (LM = Local Machine, MGR = Current User) in windows.

[Tom Elliott]

When running the installer, you should only need to use the -S argument. -C forces the installer to recreate the CA certificates. -K forces regenerating the keys for the fog server. the -K won’t be overly problematic but the -C will cause issues

the -S just forces HTTPS.

As @Sebastian-Roth as requested, please provide a photo of the tftp trying to use http instead of https

Thank you,

[marted]

@Tom-Elliott got this. Thanks

[marted]

@Tom-Elliott said in 2019...a step by step activating ssl and complying iPXE with it:

@marted TO get rid of the “not secure” you see, you need to download the ca.cert from the FOG Server.
https://foglabunix/fog/management/other/ca.cert.der
And put that in your machine’s trust root authority.
As to making iPXE obtain from https, you should be able to do this by reinstalling fog (assuming you didn’t reinstall when building the ipxe binaries)?

Tom I have a little bit different configuration from the standard. My FOG server is in private network 192. and I have a NAT IP 132. 1:1 only for my server for accessing it from internet. Even with certificate installed it says that the certificate is only for 192.168 and name foglabunix and not for my address 132.208, which is normal. How can i pass to the certificate my second IP 132.208?
Is there a way to add it in fogconfig file in the variable ipaddress both with the private IP or there is other way?
By the way in MAC OS when I installed the certificate, even with 132.208 it accepted it and I have a SSL connection with no error.

[Tom Elliott]

@marted why not access the fog server using foglabunix? The cert is valid for that name

[marted]

@Tom-Elliott I run the installation only with -S and root like @Sebastian-Roth Sebastian offered. The installation passed with no problems. Monday morning will try the boot and will post it here

[marted]

@Tom-Elliott it doesn’t work
it passed only with the IP NAT 132.208

[Tom Elliott]

@marted can you add a dns entry on the nat side to get you access? For internet proper links I wouldn’t recommend using the fog ca, you should probably get a proper certificate from a 3rd party to present for internet based sites.

[marted]

@Tom-Elliott if I get a 3rd party certificate which I can do, how can I replace the fog certificate?

[Tom Elliott]

@Tom-Elliott even better, use a reverse proxy for internet to redirect into your internal network and present the certificate at the reverse proxy. This way you can use a dns name that points to a machine within your dmz, that can be restricted to internal machines. And you aren’t putting your actual fog server in any risk as all things requesting your fog server from the internet won’t actually give access to your fog server files. At least not by simply pointing to your nat side ip. You could, essentially, get rid of the nat network for your fog server in this way too.

[Tom Elliott]

@marted you tell Apache using a namedvirtualhost config. So 192.x and foglabunix are handled by the fog ca certificate and the nat ip request is handled by the 3rd party certificate.