I can always deploy a new client via GroupPolicy so that doesn’t scare me from making the change. I’ll probably hold off for now only because it’s not a huge issue to stay on http for me.
I think adding a hostname item would be great and it would make FOG much more portable and secure to make https the default
If I change that setting how do I force it to generate a new cert? Do I just run the installer again?
@Sebastian-Roth
Good to know. I’m using FOG with HTTP so it hasn’t been an issue (I’ve moved it several times as virtual environments shifted). It might be worth looking into adding a feature in the installer to ask for the DNS name of the machine so it can generate the cert with that as the CN rather than the machine’s IP.
@JimmyJ0516
Do yourself a favor and create a DNS record for your FOG server. That way if you ever change the IP of your server all it takes is updating the record to move all your clients over.
Nevermind. Found it (in my own post history no less…)
I know there is an article about this but I can’t seem to find it. I want both the unionly and ipxe boot files available to my machines (I still have a couple old machines that aren’t configured for efi as well as my virtualbox and Xen VMs).
Can anyone send me that wiki link for the configuration?
Is the domain information you put at the top a copy and paste from your config? Because I see a comma misplaced.
AD DEFAULT OU - OU=Imaged,DC=haw,DC=k,12DC=nj,DC=us
should read
AD DEFAULT OU - OU=Imaged,DC=haw,DC=k12,DC=nj,DC=us
I make a golden (just OS and staged drivers) in virtual box for each major release we intend to deploy (we only did 1607 and 1803 so far) then incremental machine updates are handled by WSUS.
Rather than send you down a path full of frustration I will say that Imaging on Macs is dead. JAMF, Deploy Studio etc are all echoing this sentiment. NetInstall/Recovery+DEP/prestage+MDM is Apple’s vision of how you set up their machines. If you are sticking with 10.12.6 and earlier and using HFS+ for the drive format I would say you should probably look at Deploy Studio, but at the same time don’t invest too much effort there as this is not going to be the move going forward.
Would System Serial be more reliable, at least with major manufacturers?
Any chance 1.6 introduces unique identifier? This is the feature I’ve been most waiting on so I can stop dancing around with MAC address settings for hosts.
Using my key isn’t really a high priority as only I and the other admin will be using it so self signed is OK.
On the install process for self signed is it just -S and -c or is there something else I need to do for the installer to generate its own key?
So if I put my domain cert.key file in /opt/fog/snapins/ssl and use the -S and -c modifiers would that take my cert?
If that doesn’t work I’m OK with making my own conf file, I’m just trying to make this as hand-offable as possible so someone doesn’t need to know a ton of unique specifics to work with my environment.
-c --ssl-file Specify the ssl path
defaults to /opt/fog/snapins/ssl
I see this in the --help does the cert need to have a particular name or will any *.crt be recognized?
@tom-elliott said in Web interface SSL:
Is there a way to add a cert post install that will survive updates or will I need to run the installer again to add my cert?
Does the modifier take both the .key and the .crt?
It would be helpful for the client to be able to pull and report inventory information on machines without needing them to reboot.
I am deploying the client to machines that are already out in the field to get them into my host list for later. Forcing a reboot is disruptive to the current users, and right now I can’t even use the PXE inventory task as they aren’t set for PXE to be their primary boot device. adding this feature to the client would be really helpful.
It would be great to add SSL for the web interface. Both self signed as a default and an option to add your own 3rd existing cert.
Perfect. I already made the script, just didn’t know if it would add the machines to my list or just install the software and then not communicate with the server. Thanks!
Hi,
I have to reimage a lab that I previously thought would be retired in a month (budget got cut). These machines were originally prepared before we were using FOG so they aren’t part of my inventory. If I push the FOG client to them with the MSI via a group policy script will they show up in my pending approval list? I would rather not have to enroll them individually when they’re already out and being used.
@tom-elliott Is this rolled into the master branch now or should i move over to the working branch?