@kallum-redgrave I recomend to do an unattended installation of fog-client from the setupcomplete.cmd instead install it on the image:
https://docs.fogproject.org/en/latest/getting_started/install_fog_client.html
and execute this commands, after installation:
sc.exe config FOGService start=delayed-auto
sc.exe failure FOGService actions= restart/60000/restart/60000/restart/ reset= 120
net start fogservice
this configure the service to start delayed and restart on failure.
@dpullin verify that all the macs are registered on the same host,
@florent All the uefi systems need to be in custom/setup/user mode to add keys or file hashes, the hint is to implement an adequate security level…
@lee-rowlett very interested, maybe i can do something if you can send me the information…
@yeet you must enroll the hash file from de UEFI interface; mok manager is capable to trust on 2 ways,
1º.- MOK can trust on files by hash when you enroll the file by de firmware interface, if you want you can send me the motherboard/pc manual and i can see if i can help to explain how you can do it.
2º.- I know, but i dont know how by the moment, that an efi application can be signed by a developer, (selfsigned or not), and the ca or ca intermediate can be added to the certificate database of efi firmware, to validate the file and that can be used…
3º.- I’m not sure, I’m studing about, but i think that you can do all from mok manager on uefi shell, or with some efi aplication designed for that.
I’m sure that all this is possible, but I’m searching information about how can be do it…
some references that I’m reading are:
https://www.rodsbooks.com/efi-bootloaders/controlling-sb.html
https://media.defense.gov/2020/Sep/15/2002497594/-1/-1/0/CTR-UEFI-Secure-Boot-Customization-UOO168873-20.PDF
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance
https://ubuntu.com/blog/how-to-sign-things-for-secure-boot
https://jfearn.fedorapeople.org/fdocs/en-US/Fedora_Draft_Documentation/0.1/html-single/UEFI_Secure_Boot_Guide/index.html
https://www.qualcomm.com/media/documents/files/secure-boot-and-image-authentication-technical-overview-v1-0.pdf
@sebastian-roth
No problem…
I go to Host management -> Create new hosts.
I Fill the hosts field under new host section.
I fill the fields under Active Directory section
Click on Add button
The information under new host is stored on DDBB
The information under Active Directory Section are not stored on DDBB.
I inspect the web page from Firefox, and I can see that the fields under Active Diretory section are writted out of the form… then they don’t be added to the $_POST array and are stored as empty values…
On last development branch the “Name Change/AD Join Forced reboot?” don’t store value on host creation… and on version 1.5.6
The active directory section is added out of form
@sonic136 @Sebastian-Roth
You can try too with the development efi files, it worked for me
You can get it from here:
https://github.com/FOGProject/fogproject/tree/dev-branch/packages/tftp
I update the server to dev-branch and and again, it happens.
Editing Snapins:
On Add/Remove/Update Storage Groups
On Add/Remove hosts on Membership
as a dirty temporal patch I add this code to solve it:
$this->obj->set('description', htmlspecialchars_decode($this->obj->get('description')));
$this->obj->set('name', htmlspecialchars_decode($this->obj->get('name')));
$this->obj->set('args', htmlspecialchars_decode($this->obj->get('args')));
$this->obj->set('hash', htmlspecialchars_decode($this->obj->get('hash')));
$this->obj->set('runWith', htmlspecialchars_decode($this->obj->get('runWith')));
$this->obj->set('runWithArgs', htmlspecialchars_decode($this->obj->get('runWithArgs')));
$this->obj->set('timeout', htmlspecialchars_decode($this->obj->get('timeout')));
On file /fog/lib/pages/snapinmanagementpage.class.php between lines 1653 and 1654.
On file /fog/lib/fog/fogpage.class.php between lines lines 3604 and 3065
When I add/remove storage groups, and modify the membership of a snapin, from snapins management page, the values on textbox are replaced changing special characters by html entities, for example where i have " is changed by " where I have " is replaced by "
Verified on versions 1.5.6 and 1.5.9 clean installations.
@yeet @george1421 @Sebastian-Roth
Need to test it again, there are a lot of time that I test it, but the uefi firmware takes de capabilty to add trusted files, so, i you add the efi files to that database you can boot the pc from that file and continue using fog
the most of the problem is to update the .efi files
take this as example, when i can i try it again to certify it
@sebastian-roth @TC10284 Exactly, but like vlans acts as separated networks, the easiest solution is to configure a node on local vlan and open comunications through firewall between node and master using the Location plugin, so you have configured your system working on the two vlans.
@kbell I only see that problem when i use incorrect ipxe file, uefi/legacy independent. the pxe file must match with nic drivers, and firmware type, (.efi for efi systems), (.pxe, .kpxe, .kkpxe for legacy systems), and not all ipxe files have all nic drivers, some realtek cards not works with undionly.kkpxe and you need to use realtek.kpxe, same on uefi i have nics that require snp.efi instead of ipxe.efi.
I think the easiest solution is to install a node on that vlan and routing between master/node, and configure a dhcp to use that node as bootserver.
@yoshideoeuf NO, you must configure dhcp for UEFI/BIOS Coexistence, take care because efi clients don’t work on all machines, each machine type has his efi client, with NIC chip dependency, the same for legacy.
I don’t work with Windows dhcp server, (are you using it?) so I don’t know how to do it exactly
You must do that when client has UEFI archs send the correct efi file, filtering by Arch and by vendor…, when client has BIOS Archs, you must send the correctl legacy file, filtering by Arch and vendor too.
Read the urls before posted with attention, i think that it has a how-to to solve your problem… with Windows 2012/2008 dhcp server, if it’s your case…
Read this with attention, and if you can post a photo showing the error:
@fargat you are using a legacy boot iPXE file, when your computer is booting on network as UEFI firmware.
I don’t know sophos firewall dhcp, but you must configure it to send correct file Arch based, if it’s not posible consider use dnsmasq as dhcp-proxy.
take this urls as guide
@sebastian-roth For your knowledge, I submit the information that you provides me to ACER, it seems like they go to help us with this, I continue the post with the solution if we reach it, at the same time if you have time I like to continue with this problem…