Topics created by brakcounty

@brakcounty Well is there a technical reason… none that I can think of. NFS and SMB are similar protocols. They have similar pitfalls in (in)security. But off the top of my head I think it would work. Why isn’t fog using it? Because NFS is built into linux and nothing extra is needed., NFS IS a very fast protocol. too.

You would need to install and enable samba on the FOG server. Two shares will be needed /images and /images/dev.

You will need to rebuild FOS Linux initrd to include the smbclient program. The you will need to update the fog.mount script (in FOS) to use the smbclient to mount the remote storage instead of using the linux mount command.

This thread will give you clues where to look for the tweaks for smb: https://forums.fogproject.org/topic/14791/feature-request-for-fog-1-6-x-configure-image-capture-to-use-nfsv4-instead-of-nfsv3

@brakcounty Pretty sure it’s not required.

@george1421 As you said those ports are dynamic, however I found a way to lock some ports to make sure they don’t change from this thread

I did everything except RPCRQUOTADOPTS and the post init scripts ran fine without delay. I’m assuming this won’t change as I had to restart the nfs-kernel-server.service to apply the changes. Hopefully this will stick.

Small note at the bottom of the linked thread, make sure you allow the ports in ufw.

@p4cm4n ipxe is loaded from the USB drive, EFI/BOOT/bootx64.efi. This file is actually the ipxe.efi kernel file taken from my FOG server in /tftproot/

@george1421 Got it. I set up the rules using ufw with the ports from that list. I only tested a Full Reg and Inv so far. It hangs on Running Init Scripts for while then skips it, I think that is the script that pulls the serial number from the bios and auto-populates it as the hostname. I confirmed this when I disabled ufw and that step went right through without delay.

@george1421 If I do everything manually as I’ve been doing, it works fine. Just looking to save some keystrokes. The boot.wim I’m building using MS Endpoint Config Manager Console does not have any task sequences but instead contacts the MG/DP for available task sequences and goes from there. Its easier this way. If we start to make stand-alone TS ISOs the wim files will become too large for ipxe.

@george1421 Right. I won’t mess with it since we have it set up and working.

@brakcounty I guess you will have to look into implementing NFSv4 then: https://forums.fogproject.org/topic/14791/feature-request-for-fog-1-6-x-configure-image-capture-to-use-nfsv4-instead-of-nfsv3

@george1421 said in Possible to secure /var/www/* ipxe boot contents?:

apache stop file browsing

Yes I will place this here to save a search for anyone who stumbles upon this post.
https://www.vultr.com/docs/how-to-disable-directory-browsing-on-apache/

@sebastian-roth Where do I “use –recreate-CA and –recreate-keys keys” switches? Like this?
.\installfog.sh --recreate-CA --recreate-keys?

@brakcounty said in Newly captured images are being owned by "root" instead of "fogproject":

Well all of my other images in /images are owned by fogproject:root. If this isn’t a problem then I’ll leave it alone.

That’s done when you re-run the FOG installer. Just don’t worry about it. They’ll work either way.

@george1421 That worked! I added the two additional tables to the export command and the “test” host was imported.

Just cross linking github issues here:
https://github.com/FOGProject/fogproject/issues/454
https://github.com/FOGProject/fogproject/issues/453

@brakcounty Well done!!

Where I also see value in this is if someone wanted to hard drive boot into iPXE then from iPXE into the hard drive or FOG without using PXE booting. Instead of a usb drive, everything could happen off the efi partition on the local hard drive. It would not solve the secure boot part of it, but its an option.

Also lets say someone wanted to setup a preboot menu (such as for dual booting) using refind. Your idea could be tweaked slightly to boot into refind menu manager and then pick to boot windows, linux or something else from the refind menu. There are a number of options this method opens up. Again, well done!

@george1421 I just tested it out on a PC outside of our IT vlan with success. I hard coded it already, but I have a habit of not disclosing our IP addresses even if they’re private. I get the Press ESC to show the menu option for one second, then it boots to the hard drive. Now I took the modified bootx64.efi from my usb drive and copied it to the Windows EFI partition, replacing the existing one (renamed the old to bootx64.efi.bak), made sure that the UEFI is pointing to the file, and now the PC boots the fog process without USB.

@sebastian-roth 1.5.9. What is also strange about how FOG behaves across subnets is the USB boot method. I’ve explained in another post about how booting from USB on the same subnet and/or same switch stack on my floor will not prompt me to enter the tftp server but booting from a completely different vlan or subnet physically outside of our own network will prompt for it. See this line in the ipxescript:

:setserv echo -n Please enter tftp server: && read next-server && goto netboot || goto setserv

I tried changing it to and this time it configures net0 then does nothing and the PC returned to it’s own (Dell) boot menu:

:setserv set next-server 10.x.x.x && goto netboot || goto serserv

I know this is off OP but it seems related to different subnet behavior in FOG.

@brakcounty said in Can a FOG Server setup as a Storage Node serve tftp files?:

I could always do a mysqldump export and import from the primary fog server to the secondary right?

Sure thing!