lovely stuff, job done -
kernel http://fog/listing/centos7_1804/images/pxeboot/vmlinuz ks=http://fog/listing/centos7_1804/ks.cfg
initrd http://fog/listing/centos7_1804/images/pxeboot/initrd.img
boot || goto MENU
lovely stuff, job done -
kernel http://fog/listing/centos7_1804/images/pxeboot/vmlinuz ks=http://fog/listing/centos7_1804/ks.cfg
initrd http://fog/listing/centos7_1804/images/pxeboot/initrd.img
boot || goto MENU
@george1421 made it into all one script, even the mkkeys.sh
#!/bin/bash
apt-get update
apt-get upgrade -y
apt-get install -y openssl efitools gnu-efi git build-essential help2man libssl-dev
perl -e'use CPAN; install "File::Slurp"'
mkdir -p /opt/fog/secureboot/efikeys
cat << EOF > /opt/fog/secureboot/mkkeys.sh
#!/bin/bash
# Copyright (c) 2015 by Roderick W. Smith
# Updated 26-Nov-2021 by George1421 for the FOG Project
# Licensed under the terms of the GPL v3
NAME=FOGProjectSB
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME PK/" -keyout efikeys/PK.key \
-out efikeys/PK.crt -days 3650 -nodes -sha256
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME KEK/" -keyout efikeys/KEK.key \
-out efikeys/KEK.crt -days 3650 -nodes -sha256
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME DB/" -keyout efikeys/DB.key \
-out efikeys/DB.crt -days 3650 -nodes -sha256
openssl x509 -in efikeys/PK.crt -out efikeys/PK.cer -outform DER
openssl x509 -in efikeys/KEK.crt -out efikeys/KEK.cer -outform DER
openssl x509 -in efikeys/DB.crt -out efikeys/DB.cer -outform DER
GUID=`python3 -c 'import uuid; print(str(uuid.uuid1()))'`
echo $GUID > efikeys/myGUID.txt
cert-to-efi-sig-list -g $GUID efikeys/PK.crt efikeys/PK.esl
cert-to-efi-sig-list -g $GUID efikeys/KEK.crt efikeys/KEK.esl
cert-to-efi-sig-list -g $GUID efikeys/DB.crt efikeys/DB.esl
rm -f efikeys/noPK.esl
touch efikeys/noPK.esl
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k efikeys/PK.key -c efikeys/PK.crt PK efikeys/PK.esl efikeys/PK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k efikeys/PK.key -c efikeys/PK.crt PK efikeys/noPK.esl efikeys/noPK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k efikeys/PK.key -c efikeys/PK.crt KEK efikeys/KEK.esl efikeys/KEK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k efikeys/KEK.key -c efikeys/KEK.crt db efikeys/DB.esl efikeys/DB.auth
chmod 0600 efikeys/*.key
echo ""
echo ""
echo "For use with KeyTool, copy the *.auth and *.esl files to a FAT USB"
echo "flash drive or to your EFI System Partition (ESP)."
echo "For use with most UEFIs' built-in key managers, copy the *.cer files;"
echo "but some UEFIs require the *.auth files."
echo ""
EOF
chmod a+x /opt/fog/secureboot/mkkeys.sh
cd /opt/fog/secureboot/
./mkkeys.sh
git clone git://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git
cd /opt/fog/secureboot/efitools
make
mkdir -p /opt/fog/secureboot/hwkeys
cd /opt/fog/secureboot/
efi-readvar -v PK -o /opt/fog/secureboot/hwkeys/hw_PK.esl
efi-readvar -v KEK -o /opt/fog/secureboot/hwkeys/hw_KEK.esl
efi-readvar -v db -o /opt/fog/secureboot/hwkeys/hw_db.esl
efi-readvar -v dbx -o /opt/fog/secureboot/hwkeys/hw_dbx.esl
chmod 666 /opt/fog/secureboot/hwkeys/*
cp /opt/fog/secureboot/efikeys/* /opt/fog/secureboot/efitools/
cp /opt/fog/secureboot/hwkeys/* /opt/fog/secureboot/efitools/
cd /opt/fog/secureboot/efitools
cat hw_db.esl > DB.esl
cat hw_KEK.esl > KEK.esl
cat hw_dbx.esl > dbx.esl
rm LockDown*efi LockDown.so LockDown.o
make
cp LockDown-signed.efi EnrollKeys.efi
mkdir -p /tftpboot
cp /opt/fog/secureboot/efitools/EnrollKeys.efi /tftpboot
mv /var/www/html/fog/service/ipxe/bzImage /var/www/html/fog/service/ipxe/bzImage-unsigned
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /var/www/html/fog/service/ipxe/bzImage /var/www/html/fog/service/ipxe/bzImage-unsigned
mv /var/www/html/fog/service/ipxe/bzImage32 /var/www/html/fog/service/ipxe/bzImage32-unsigned
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /var/www/html/fog/service/ipxe/bzImage32 /var/www/html/fog/service/ipxe/bzImage32-unsigned
mv /var/www/html/fog/service/ipxe/refind.efi /var/www/html/fog/service/ipxe/refind-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /var/www/html/fog/service/ipxe/refind.efi /var/www/html/fog/service/ipxe/refind-unsigned.efi
mv /tftpboot/ipxe.efi /tftpboot/ipxe-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /tftpboot/ipxe.efi /tftpboot/ipxe-unsigned.efi
mv /tftpboot/snponly.efi /tftpboot/snponly-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /tftpboot/snponly.efi /tftpboot/snponly-unsigned.efi
mv /tftpboot/snp.efi /tftpboot/snp-unsigned.efi
sbsign --key /opt/fog/secureboot/efikeys/DB.key --cert /opt/fog/secureboot/efikeys/DB.crt --output /tftpboot/snp.efi /tftpboot/snp-unsigned.efi
@robertkwild good news, its worked!
before i did “quick inventroy” it listed the vm in “hosts” and then i clicked on “capture” to the image i just created, i used the “windows 10” as the os drop down
i syspreped windows 11, it failed first time, due to some program stopping it, all i had to do was remove it in powershell
Get-AppxPackage Microsoft.BingNews* | Remove-AppxPackage
then try again
sysprep /oobe /generalize /shutdown
it captured it fine, then i deleted that vm, created a new vm, disabled “secure boot”, network booted to my fog clicked on “deploy image” chose the windows 11 image
and the end result i get a nice windows 11 vm desktop
@AlexPDX @Sebastian-Roth it was something simple in the end
BIOS > advanced > system options
i turned off/unticked - configure storage controller for VMD
basically its there version of RAID, untick it and its AHCI
hi all,
got a good way installing windows 11 on esxi, bypassing tpm check, as thats where i got the error saying “your pc doesnt meet all the requirements”
ive also on the vm disabled/unticked “secure boot” so i can still network boot my fog server
heres the how to
https://www.virten.net/2021/10/windows-11-on-vmware-esxi-this-pc-cant-run-windows-11/
basically, when you come to the “enter your key screen” press shift+f10
REG ADD HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1
my end goal is to sysprep it and capture it to fog and then see if i can deploy it to new vm!
thanks,
rob
@george1421 the good thing is, you only need to do the reg hack and app removal on the GI, once you sysprep the GI and capture it, when you deploy it, you have to do nothing and you can deploy to multiple laptops, vms etc
the pic i shows you shows a laptop with TPM enabled, using the deployed image
@AlexPDX @Sebastian-Roth it was something simple in the end
BIOS > advanced > system options
i turned off/unticked - configure storage controller for VMD
basically its there version of RAID, untick it and its AHCI
Sorry taken ages to reply, just busy this week at work
It’s fog v1.5.10 and single disk resizable
As said I can deploy image fine on other machines, just not this dam hp z2 g9
Hi all,
So I’ve deployed a windows 10 image to a hp z2 g9 pc, it’s written the image to the disk, as I saw it doing the part clone process but when it succefully completed, it then rebooted and loaded up windows, once it rebooted to load windows, I have a blue screen of death with a stop code
inaccessible boot device
I have deployed the same image to a VM and a hp laptop with success, so maybe it’s something to do with this pc
Thanks,
Rob
case closed, all good in da hood
it took ages compiling the ipxe binarys but now its been succesfully updated
thanks @Tom-Elliott @Sebastian-Roth
@Sebastian-Roth @Tom-Elliott ok i re ran the installer multiple times and its got past that stage now, its getting stuck at this stage now
Compiling iPXE binaries trusting your SSL certificate…
@Sebastian-Roth @Tom-Elliott got a problem
Downloading kernel, init and fog-client binaries… * Could not download init_32.xz properly
[root@lon-c-fog10 bin]#
@robertkwild lovely i wget the new file and it found my fog install and its now upgrading it
@Tom-Elliott when i do the git method, do i need to first cd to my fog base installation dir
rather than the tar i just can install it and it will persume see ive already got a fog installation and just update it
hi all,
yes i know i want to update on centos 7, i know its dead but how do i update from 1.5.9 to the new one 1.5.10
is it just the case of installing it again and it will know its already installed and will just update it
thanks,
rob
@tom-elliott said in deploy image oobe issue:
mmcblk
lets say if one drive is partitioned into 2 partitions will it blow all partitions away and deploy image on whole disk?