Rahman DURAN

rdr

@Tom-Elliott As always, thanks for the answer and quick fix

rdr

Hi,

I am using FOG working-1.6 branch. Even I did not modified anything installer/updater complains about “Detected a web certificate managed outside FOG” every time. Is this a problem? How can I fix it?

Regards,

Rahman

root@xxxxxx:~# /root/fogproject/bin/updatefog.sh
 * FOG Update
   Git path: /root/fogproject
   Channel:  beta (working-1.6)

 * Continue with this update? (Y/N) y
 * Fetching FOG (working-1.6)..................................OK
 * Checking out working-1.6....................................OK
 * Fast-forwarding to origin/working-1.6.......................OK
Installing LSB_Release as needed
 * Attempting to get release information.......................Done

  ==================================
  ===        ====    =====      ====
  ===  =========  ==  ===   ==   ===
  ===  ========  ====  ==  ====  ===
  ===  ========  ====  ==  =========
  ===      ====  ====  ==  =========
  ===  ========  ====  ==  ===   ===
  ===  ========  ====  ==  ====  ===
  ===  =========  ==  ===   ==   ===
  ===  ==========    =====      ====
  ==================================
  ===== Free Opensource Ghost ======
  ==================================
  ============ Credits =============
  = https://fogproject.org/Credits =
  ==================================
  == Released under GPL Version 3 ==
  ==================================

   Version: 1.6.0-beta.5650 Installer/Updater


 * Found FOG Settings from previous install at: /opt/fog/.fogsettings

 * Performing upgrade using these settings


  Starting Debian based Installation



   ######################################################################
   #     FOG now has everything it needs for this setup, but please     #
   #   understand that this script will overwrite any setting you may   #
   #   have setup for services like DHCP, apache, pxe, tftp, and NFS.   #
   ######################################################################
   # It is not recommended that you install this on a production system #
   #        as this script modifies many of your system settings.       #
   ######################################################################
   #             This script should be run by the root user.            #
   #      It will prepend the running with sudo if root is not set      #
   ######################################################################
   #            Please see our wiki for more information at:            #
   ######################################################################
   #             https://wiki.fogproject.org/wiki/index.php             #
   ######################################################################

 * Here are the settings FOG will use:
 * Base Linux: Debian
 * Detected Linux Distribution: Debian GNU/Linux
 * Interface: ens18
 * Server IP Address: 10.xxxxx
 * Server Subnet Mask: 255.255.255.0
 * Hostname: xxxxxx

 * Installation Type: Normal Server
 * Internationalization: No
 * Image Storage Location: /images
 * Using FOG DHCP: No
 * DHCP will NOT be setup but you must setup your
 | current DHCP server to use FOG for PXE services.

 * On a Linux DHCP server you must set: next-server and filename

 * On a Windows DHCP server you must set options 066 and 067

 * Option 066/next-server is the IP of the FOG Server: (e.g. 10.xxxxx)
 * Option 067/filename is the bootfile, per client architecture:
 |   BIOS / legacy   undionly.kkpxe
 |   32-bit UEFI     i386-efi/snponly.efi
 |   64-bit UEFI     secureboot/snponly-shimx64.efi
 |   ARM64 UEFI      secureboot/arm64-efi/snponly-shimaa64.efi

 * The secureboot/ files are the signed chain. They boot the same
 | whether Secure Boot is enabled or not, so they are the right
 | answer for every 64-bit UEFI client, not just the ones enforcing
 | it. There is no signed 32-bit chain -- those clients must have
 | Secure Boot disabled to netboot at all.
 | See https://docs.fogproject.org/en/latest/secure-boot-netboot
 * Send OS Name, OS Version, and FOG Version: No
 * Web protocol: https
 * Netboot (PXE) protocol: http
 * Force HTTP->HTTPS redirect: No
 * Web certificate chains to a public root: No
 * Rebuild iPXE with your CA: No


 * Are you sure you wish to continue (Y/N) y

 * Installation Started

 * Testing internet connection.................................Done
 * Adjusting repository (can take a long time for cleanup).....OK
 * Preparing Package Manager...................................OK
 * Reading package state.......................................OK
 * Packages to be installed:

        apache2 attr bc build-essential cpp curl efitools g++ gawk gcc gcc-aarch64-linux-gnu genisoimage git gzip htmldoc isolinux jq lftp libapache2-mod-php libc6 libcurl4t64 liblzma-dev m4 mariadb-client mariadb-server net-tools nfs-kernel-server openssh-server php php-bcmath php-cli php-curl php-fpm php-gd php-json php-ldap php-mbstring php-mysql php-ssh2 sbsigntool sudo tar tftpd-hpa tftp-hpa unzip vsftpd wget zlib1g 


 * Skipping package:   apache2.................................(Already Installed)
 * Skipping package:   attr....................................(Already Installed)
 * Skipping package:   bc......................................(Already Installed)
 * Skipping package:   build-essential.........................(Already Installed)
 * Skipping package:   cpp.....................................(Already Installed)
 * Skipping package:   curl....................................(Already Installed)
 * Skipping package:   efitools................................(Already Installed)
 * Skipping package:   g++.....................................(Already Installed)
 * Skipping package:   gawk....................................(Already Installed)
 * Skipping package:   gcc.....................................(Already Installed)
 * Skipping package:   gcc-aarch64-linux-gnu...................(Already Installed)
 * Skipping package:   genisoimage.............................(Already Installed)
 * Skipping package:   git.....................................(Already Installed)
 * Skipping package:   gzip....................................(Already Installed)
 * Skipping package:   htmldoc.................................(Already Installed)
 * Skipping package:   isolinux................................(Already Installed)
 * Skipping package:   jq......................................(Already Installed)
 * Skipping package:   lftp....................................(Already Installed)
 * Skipping package:   libapache2-mod-php......................(Already Installed)
 * Skipping package:   libc6...................................(Already Installed)
 * Skipping package:   libcurl4t64.............................(Already Installed)
 * Skipping package:   liblzma-dev.............................(Already Installed)
 * Skipping package:   m4......................................(Already Installed)
 * Skipping package:   mariadb-client..........................(Already Installed)
 * Skipping package:   mariadb-server..........................(Already Installed)
 * Skipping package:   net-tools...............................(Already Installed)
 * Skipping package:   nfs-kernel-server.......................(Already Installed)
 * Skipping package:   openssh-server..........................(Already Installed)
 * Skipping package:   php.....................................(Already Installed)
 * Skipping package:   php-bcmath..............................(Already Installed)
 * Skipping package:   php-cli.................................(Already Installed)
 * Skipping package:   php-curl................................(Already Installed)
 * Skipping package:   php-fpm.................................(Already Installed)
 * Skipping package:   php-gd..................................(Already Installed)
 * Skipping package:   php-json................................(Already Installed)
 * Skipping package:   php-ldap................................(Already Installed)
 * Skipping package:   php-mbstring............................(Already Installed)
 * Skipping package:   php-mysql...............................(Already Installed)
 * Skipping package:   php-ssh2................................(Already Installed)
 * Skipping package:   sbsigntool..............................(Already Installed)
 * Skipping package:   sudo....................................(Already Installed)
 * Skipping package:   tar.....................................(Already Installed)
 * Skipping package:   tftpd-hpa...............................(Already Installed)
 * Skipping package:   tftp-hpa................................(Already Installed)
 * Skipping package:   unzip...................................(Already Installed)
 * Skipping package:   vsftpd..................................(Already Installed)
 * Skipping package:   wget....................................(Already Installed)
 * Skipping package:   zlib1g..................................(Already Installed)
 * Updating packages as needed.................................OK
 * Installing package: php8.4-ssh2.............................OK

 * Confirming package installation

 * Checking package: apache2...................................OK
 * Checking package: attr......................................OK
 * Checking package: bc........................................OK
 * Checking package: build-essential...........................OK
 * Checking package: cpp.......................................OK
 * Checking package: curl......................................OK
 * Checking package: efitools..................................OK
 * Checking package: g++.......................................OK
 * Checking package: gawk......................................OK
 * Checking package: gcc.......................................OK
 * Checking package: gcc-aarch64-linux-gnu.....................OK
 * Checking package: genisoimage...............................OK
 * Checking package: git.......................................OK
 * Checking package: gzip......................................OK
 * Checking package: htmldoc...................................OK
 * Checking package: isolinux..................................OK
 * Checking package: jq........................................OK
 * Checking package: lftp......................................OK
 * Checking package: libapache2-mod-php........................OK
 * Checking package: libc6.....................................OK
 * Checking package: libcurl4t64...............................OK
 * Checking package: liblzma-dev...............................OK
 * Checking package: m4........................................OK
 * Checking package: mariadb-client............................OK
 * Checking package: mariadb-server............................OK
 * Checking package: net-tools.................................OK
 * Checking package: nfs-kernel-server.........................OK
 * Checking package: openssh-server............................OK
 * Checking package: php.......................................OK
 * Checking package: php-bcmath................................OK
 * Checking package: php-cli...................................OK
 * Checking package: php-curl..................................OK
 * Checking package: php-fpm...................................OK
 * Checking package: php-gd....................................OK
 * Checking package: php-json..................................OK
 * Checking package: php-ldap..................................OK
 * Checking package: php-mbstring..............................OK
 * Checking package: php-mysql.................................OK
 * Checking package: php8.4-ssh2...............................OK
 * Checking package: sbsigntool................................OK
 * Checking package: sudo......................................OK
 * Checking package: tar.......................................OK
 * Checking package: tftpd-hpa.................................OK
 * Checking package: tftp-hpa..................................OK
 * Checking package: unzip.....................................OK
 * Checking package: vsftpd....................................OK
 * Checking package: wget......................................OK
 * Checking package: zlib1g....................................OK

 * Configuring services

 * Setting up fogproject user..................................Skipped
 * Ensuring fogproject home directory..........................OK
 * Locking fogproject as a system account......................OK
 * Setting up fogproject password..............................OK
 * Stopping FOGMulticastManager.service Service................OK
 * Stopping FOGImageReplicator.service Service.................OK
 * Stopping FOGSnapinReplicator.service Service................OK
 * Stopping FOGScheduler.service Service.......................OK
 * Stopping FOGPingHosts.service Service.......................OK
 * Stopping FOGSnapinHash.service Service......................OK
 * Stopping FOGImageSize.service Service.......................OK
 * Stopping FOGFileDeleter.service Service.....................OK
 * Stopping FOGPluginRunner.service Service....................OK
 * Stopping FOGRetentionRunner.service Service.................OK
 * Stopping FOGAgentReleaseSync.service Service................OK
 * Setting up and starting MySQL...............................OK
 * Testing connection to database..............................OK
 * Setting up MySQL user and database..........................Skipped
 * Backing up user reports.....................................Done
 * Backing up customizations...................................OK
 * Downloading plugins (v1.6.27)...............................OK
 * Stopping web service........................................OK
 * Setting up Apache and PHP files.............................OK
 * Testing and removing symbolic links if found................OK
 * Backing up old data.........................................OK
 * Copying new files to web folder.............................OK
 * Dropping the stale class file lists.........................OK
 * Creating config file........................................OK
 * Creating paths file.........................................OK
 * Creating redirection index file.............................Skipped
 * Downloading kernel, init and fog-client binaries............Done
 * Copying binaries to destination paths.......................OK
 * Signing FOS kernels and Memtest86+ for Secure Boot..........Done
 * Installing Secure Boot signing helper.......................Done
 * Publishing Secure Boot enrollment kit.......................Done
 * Publishing Secure Boot variable updates.....................Done
 * Enabling apache2 and fpm services on boot...................OK
 * Detected a web certificate managed outside FOG:
     the vhost serves /etc/fog/pki/web/leaf/.webLeaf.pem, outside FOG's /opt/fog/snapins/ssl and PKI tree
 * FOG will keep managing this vhost, but will not re-issue or
   re-key that certificate. Undo by pointing
   /etc/fog/pki/web/leaf/.webLeaf.pem back inside /etc/fog/pki/web.
 * Publishing client communication certificate.................OK
 * Creating auth pub key and cert..............................OK
 * Resetting SSL Permissions...................................OK
 * Setting up Apache virtual host (normal).....................OK
 * Testing Apache configuration................................OK
 * Configuring PHP FPM.........................................Done
 * Starting and checking status of web services................OK
 * Changing permissions on apache log files....................OK
 * Setting up FOG Services.....................................OK
 * Creating FOG plugin runner log directory....................OK
 * Creating FOG retention runner log directory.................OK
 * Creating FOG agent release sync log directory...............OK
 * Creating FOS report log directory...........................OK
 * Creating FOG fault log directory............................OK
 * Setting FOG service master log ownership....................OK
 * Creating FOG cache directory................................OK
 * Creating FOG agent directory................................OK
 * Creating FOG agent versions directory.......................OK
 * Creating FOG session directory..............................OK
 * Creating FOG plugin directory...............................OK
 * Checking web server serves FOG..............................Done
 * Backing up database.........................................Done

 * The database schema is already at version 446 --
   no migration to apply. Checking required rows.
 * Updating Database...........................................OK
 * Verifying database schema...................................Done
 * Update fogstorage database password.........................OK
 * Granting access to fogstorage database user.................Skipped
 * Setting up storage..........................................OK
 * Downloading iPXE Secure Boot binaries (v2.0.0-fog.9)........OK
 * Setting up and starting DHCP Server.........................Skipped

 * A sample Kea DHCP config for a dedicated/external DHCP server was
 | written to: /var/www/html/fog/kea-dhcp4.conf.fog-sample
 | Copy it to your DHCP server as /etc/kea/kea-dhcp4.conf and adjust the
 | subnet/pool/routers/domain-name-servers to match that network.
 | next-server is already set to this FOG server (10.xxxxx).
 * Downloading iPXE binaries (v2.0.0-fog.9)....................OK
 * Configuring default iPXE file...............................OK
 * Setting up and starting TFTP Server.........................OK
 * Restoring customizations....................................OK
 * Signing iPXE binaries for Secure Boot.......................Done (30)
 * Publishing local ESP boot archives..........................Done (3)
 * Setting up and starting VSFTP Server........................OK
 * Setting up FOG Snapins......................................OK
 * Restricting private key access..............................OK

  ###################################################################
  # The CA private key for this server is on this server, readable  #
  # only by root:                                                   #
  #   /etc/fog/pki/root/ca/.fogCA.key                               #
  #                                                                 #
  # That protects it from a compromise of the web application, but  #
  # not from a compromise of the machine. To move it to a vault:    #
  #   /opt/fog/bin/fog-offline-ca-key /mnt/vault                    #
  #                                                                 #
  # Day to day nothing needs it. Restore it only to issue a new     #
  # intermediate, or a certificate for a new storage node.          #
  #                                                                 #
  # The Secure Boot CA private key is also on this server,          #
  # readable only by root:                                          #
  #   /etc/fog/pki/secureboot/ca/.fogSBCA.key                       #
  #                                                                 #
  # Restore it to issue a new Secure Boot intermediate, or a        #
  # new signing leaf. To move it to a vault:                        #
  #   /opt/fog/bin/fog-offline-ca-key /mnt/vault --zone secureboot  #
  ###################################################################

 * Installing node certificate signing helper..................Done
 * Installing the certificate management helper................Done
 * Trusting the FOG CA on this server..........................Done
 * Setting up UDPCast..........................................OK
 * Configuring UDPCast.........................................OK
 * Building UDPCast............................................OK
 * Installing UDPCast..........................................OK
 * Installing FOG System Scripts...............................OK


 * Configuring FOG System Services


 * Setting permissions on FOGMulticastManager.service script...OK
 * Enabling FOGMulticastManager.service Service................OK
 * Setting permissions on FOGImageReplicator.service script....OK
 * Enabling FOGImageReplicator.service Service.................OK
 * Setting permissions on FOGSnapinReplicator.service script...OK
 * Enabling FOGSnapinReplicator.service Service................OK
 * Setting permissions on FOGScheduler.service script..........OK
 * Enabling FOGScheduler.service Service.......................OK
 * Setting permissions on FOGPingHosts.service script..........OK
 * Enabling FOGPingHosts.service Service.......................OK
 * Setting permissions on FOGSnapinHash.service script.........OK
 * Enabling FOGSnapinHash.service Service......................OK
 * Setting permissions on FOGImageSize.service script..........OK
 * Enabling FOGImageSize.service Service.......................OK
 * Setting permissions on FOGFileDeleter.service script........OK
 * Enabling FOGFileDeleter.service Service.....................OK
 * Setting permissions on FOGPluginRunner.service script.......OK
 * Enabling FOGPluginRunner.service Service....................OK
 * Setting permissions on FOGRetentionRunner.service script....OK
 * Enabling FOGRetentionRunner.service Service.................OK
 * Setting permissions on FOGAgentReleaseSync.service script...OK
 * Enabling FOGAgentReleaseSync.service Service................OK
 * Starting FOGMulticastManager.service Service................OK
 * Starting FOGImageReplicator.service Service.................OK
 * Starting FOGSnapinReplicator.service Service................OK
 * Starting FOGScheduler.service Service.......................OK
 * Starting FOGPingHosts.service Service.......................OK
 * Starting FOGSnapinHash.service Service......................OK
 * Starting FOGImageSize.service Service.......................OK
 * Starting FOGFileDeleter.service Service.....................OK
 * Starting FOGPluginRunner.service Service....................OK
 * Starting FOGRetentionRunner.service Service.................OK
 * Starting FOGAgentReleaseSync.service Service................OK
 * Setting up NFS configuration file...........................OK
 * Setting up exports file.....................................OK
 * Setting up and starting RPCBind.............................OK
 * Setting up and starting NFS Server..........................OK
 * Linking FOG Service config /etc.............................OK
 * Recording FOG base path.....................................OK
 * Installing FOG utilities....................................OK
 * Ensuring node username and passwords match..................Done
 * Recording fog_git_path/update channel/extra server names....OK

 * Netboot (PXE) is using HTTP, not HTTPS.
   Your web UI and API are HTTPS; only iPXE's own fetches are not.
   iPXE validates TLS strictly and cannot be told to trust a private
   CA, so an HTTPS netboot against one simply fails. HTTP here is the
   same exposure a default install has always had, on a pre-boot
   network.

 * Secure Boot binaries ARE staged on this server, in every mode.
   That used to be skipped on any HTTPS install. To enroll a machine,
   boot it and choose 'Enroll Secure Boot Key' from the FOG menu.

 * To move netboot onto HTTPS, tell FOG which is true:
     --public-web-cert          your certificate chains to a public
                                root (needs an FQDN, not an IP)
     --rebuild-ipxe-with-my-ca  rebuild iPXE with your CA embedded
                                (slow, and its MOK must be enrolled
                                 before a client can netboot)
   Or force it outright with --netboot-proto https.


 * Setup complete

   You can now login to the FOG Management Portal using
   the information listed below.  The login information
   is only if this is the first install.

   This can be done by opening a web browser and going to:

   https://xxxxx/fog/management
   https://xxxxx/fog/management

   Either works -- the certificate covers the address as well as the
   name, so neither is a name mismatch. The address needs no DNS; the
   name it is issued for is xxxxxxxxxx.

   Default User Information
   Username: xxxxxxx
   Password: xxxxxxxx

 * Update completed successfully.
root@xxxxx:~#

rdr

Now I read the AI summary and got what I need:

It stores one row for each address in the hostNetwork table.

Limits of this method
The sleeping host must run fog-agent. The server uses the sleeping host’s own last report to find its subnet. A host with the legacy FOG Client, or with no client, has no rows, so the relay cannot help it. The old path still runs for it.

So If I populate the hostNetwork table for the hosts that I need manually, It will work. Thank you for the details.

rdr

@rdr I see what you mean now. I thought FOG server saves the last IP address to its database and use it to determine if the powered off host is on the same subnet. If it is using live ARP lookups via agents to determine the subnets/agents matching then I can not customize or hardcode it.

rdr

@rdr I see your point, but with “FOG_AGENT_WAKE_RELAY_ENABLED”, isn’t the FOG server requesting WOL, and the agent send WOL to the local network because the FOG server asked it? So the agent is not trying to be smart about doing things it does not know about, or I completely misunderstood how “FOG_AGENT_WAKE_RELAY_ENABLED” works

rdr

@Tom-Elliott I think you mean “FOG_AGENT_WAKE_RELAY_ENABLED” setting. I already enabled it and it works as expected without any problems. But as I understand, it needs to know the IP addresses of the powered off hosts, so server can decide which alive fog agent it will use to relay WoL requests, am I right? This is OK and I tested, it works.

What I am after is different from “FOG_AGENT_WAKE_RELAY_ENABLED”. Lets say I have PC lab with 100 hosts, I import MAC and Host name list into FOG server. Then install Windows on one of them, install all needed drivers and applications. Then I install FOG agent and approve it. Then capture image from this. Then create deployment tasks for the remaining 99 PC’s. Then I want to send Wake on LAN request via this alive agent to the remaining PC’s so without me powered them on one by one physically, they will power on remotely and start to deploy image. But as FOG server does not know their IP addresses, as they have no fog agent installed previously, is there a way to teach fog server their IP subnet?

Hope it’s clear now

Rahman

rdr

Hi,

I am testing/using FOG project to manage imaging of our 6 PC labs, ~400 PC’s. I confirmed that I can power on a PC via FOG server Web UI, if there is an PC with active FOG agent on that subnet and also if the powered of PC was checked-in with fog agent before. It is working as expected.

What I wonder is, as I am just started to use FOG server and there is no fog agents on the PC’s, can I install fog agent to the PC that I will use to capture image, then somehow I instruct FOG server that the imported hosts are on the same network, so I can power on the PC’s without visiting all of them one by one?

I hope I explained I am trying to achieve.

Regards,

Rahman

rdr

@Tom-Elliott Thank you, tested, confirmed it’s fixed.

rdr

@Tom-Elliott updated, both problems fixed. Thank you. One other feedback about installer script. Every time I run it, it notifies about modified pxe files and about keeping modified versions, even though I did not touched or modified any of them:

| next-server is already set to this FOG server (10.0.1.92).
 * Downloading iPXE binaries (v2.0.0-fog.8)....................OK
 * Kept your own copies of these iPXE files (not overwritten):
     secureboot/autoexec.ipxe
     secureboot/arm64-efi/autoexec.ipxe
     autoexec.ipxe
     arm64-efi/autoexec.ipxe
   Delete one to have FOG's version installed on the next run.
 * Configuring default iPXE file...............................OK

If I delete the corresponding files and rerun the installer, it does not complain about my own copies. But if I rerun it without doing anything, it complains about pxe files again. Is this harmless or it will not download new pxe files even it should, as it thinks I modified them.

BTW, is it OK that I am writing here? I can open separate topics here for each problem I encounter or I can open separate issues on Github.

rdr

Also other small problems:

FOG server WEb UI - > all hosts list does not show last check-in time, its empty for all hosts.
Uploading new file to existing snapin and saving it (press update button) does not update “Snapin File (exists)” input value, a CTRL + SHIFT + R updates it with correct value.

Rahman DURAN

@rdr

Latest posts made by rdr