Topics created by DBCountMan

@brakcounty Well is there a technical reason… none that I can think of. NFS and SMB are similar protocols. They have similar pitfalls in (in)security. But off the top of my head I think it would work. Why isn’t fog using it? Because NFS is built into linux and nothing extra is needed., NFS IS a very fast protocol. too.

You would need to install and enable samba on the FOG server. Two shares will be needed /images and /images/dev.

You will need to rebuild FOS Linux initrd to include the smbclient program. The you will need to update the fog.mount script (in FOS) to use the smbclient to mount the remote storage instead of using the linux mount command.

This thread will give you clues where to look for the tweaks for smb: https://forums.fogproject.org/topic/14791/feature-request-for-fog-1-6-x-configure-image-capture-to-use-nfsv4-instead-of-nfsv3

@brakcounty Pretty sure it’s not required.

@george1421 As you said those ports are dynamic, however I found a way to lock some ports to make sure they don’t change from this thread

I did everything except RPCRQUOTADOPTS and the post init scripts ran fine without delay. I’m assuming this won’t change as I had to restart the nfs-kernel-server.service to apply the changes. Hopefully this will stick.

Small note at the bottom of the linked thread, make sure you allow the ports in ufw.

@p4cm4n ipxe is loaded from the USB drive, EFI/BOOT/bootx64.efi. This file is actually the ipxe.efi kernel file taken from my FOG server in /tftproot/

@george1421 Got it. I set up the rules using ufw with the ports from that list. I only tested a Full Reg and Inv so far. It hangs on Running Init Scripts for while then skips it, I think that is the script that pulls the serial number from the bios and auto-populates it as the hostname. I confirmed this when I disabled ufw and that step went right through without delay.

@george1421 pls ignore, internal network issue. thank you.

@george1421 Right. I won’t mess with it since we have it set up and working.

@brakcounty I guess you will have to look into implementing NFSv4 then: https://forums.fogproject.org/topic/14791/feature-request-for-fog-1-6-x-configure-image-capture-to-use-nfsv4-instead-of-nfsv3

@george1421 said in Possible to secure /var/www/* ipxe boot contents?:

apache stop file browsing

Yes I will place this here to save a search for anyone who stumbles upon this post.
https://www.vultr.com/docs/how-to-disable-directory-browsing-on-apache/

@sebastian-roth Where do I “use –recreate-CA and –recreate-keys keys” switches? Like this?
.\installfog.sh --recreate-CA --recreate-keys?

@brakcounty said in Newly captured images are being owned by "root" instead of "fogproject":

Well all of my other images in /images are owned by fogproject:root. If this isn’t a problem then I’ll leave it alone.

That’s done when you re-run the FOG installer. Just don’t worry about it. They’ll work either way.

@george1421 That worked! I added the two additional tables to the export command and the “test” host was imported.

Just cross linking github issues here:
https://github.com/FOGProject/fogproject/issues/454
https://github.com/FOGProject/fogproject/issues/453

@brakcounty Well done!!

Where I also see value in this is if someone wanted to hard drive boot into iPXE then from iPXE into the hard drive or FOG without using PXE booting. Instead of a usb drive, everything could happen off the efi partition on the local hard drive. It would not solve the secure boot part of it, but its an option.

Also lets say someone wanted to setup a preboot menu (such as for dual booting) using refind. Your idea could be tweaked slightly to boot into refind menu manager and then pick to boot windows, linux or something else from the refind menu. There are a number of options this method opens up. Again, well done!

@george1421 I just tested it out on a PC outside of our IT vlan with success. I hard coded it already, but I have a habit of not disclosing our IP addresses even if they’re private. I get the Press ESC to show the menu option for one second, then it boots to the hard drive. Now I took the modified bootx64.efi from my usb drive and copied it to the Windows EFI partition, replacing the existing one (renamed the old to bootx64.efi.bak), made sure that the UEFI is pointing to the file, and now the PC boots the fog process without USB.