• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login
    1. Home
    2. Tom Elliott
    • Profile
    • Following 27
    • Followers 83
    • Topics 117
    • Posts 19,208
    • Groups 0

    Tom Elliott

    @Tom Elliott

    5.1k
    Reputation
    39.0k
    Profile views
    19.2k
    Posts
    83
    Followers
    27
    Following
    Joined
    Last Online

    Tom Elliott Unfollow Follow

    Best posts made by Tom Elliott

    • Gratitudes

      I know I’ve been out of this for a little bit. I check in here or there, but just been extremely busy.

      I don’t want to stop contributing, I just am taking time for myself after my workly duties.

      I have to give a big gratitude and thanks for everyone here trying to help out whether by code, by helping the rest of the community, or documentation.

      @Sebastian-Roth I know you’re busy but you’ve kept the project rolling even with the minimal availability you have. Thank you.
      @george1421 I’m sure you’re busy, but I still see you posting and helping where possible and amenible. Thank you.
      @Wayne-Workman I know you’re helping where you can as well. (Of course I can’t exactly post everybody because I’ve been busy and honestly not keeping up with the forums as much as I probably should.)

      @everyone Thank you. Thank you for still believing in this project. We’re doing the best with what we have. Please understand in we’re lacking, it’s most likely unintentional. I know I’m just busy.

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • FOG 1.3.5 and Client 0.11.11 Officially Released

      https://news.fogproject.org/fog-1-3-5-and-client-0-11-11-officially-released/

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • FOG 1.5.0 RC 11

      https://news.fogproject.org/fog-1-5-0-rc-11/

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • Ubuntu is FOG's enemy

      TLDR; Rerun the fog installer if you have lost “Database Connectivity” to your fog server, or run the ALTER USER syntax shown below.

      So Ubuntu 16, among others I suppose, enable a “security updates” to be applied automatically as a “default” to things. Why, well it makes it simpler to ensure your Ubuntu systems are in compliance and patched for any potential exploits. This causes unknown and unexpected issues.

      I figured it’d be a safe thing to express that there could be problems (as many of you have already experienced) that when these updates go up (with or without your knowledge) it can break functionality in unexpected and inopportune ways.

      The quickest fix is to simply rerun the fog installer which should correct the problem.

      As a note, it seems this problem is specific only when the mysql account is the 'root' user AND the password is blank.

      The “fix” if you must do it manually is to open a terminal and obtain root:
      Super (Windows Key) + T then sudo -i (in most cases).

      From there, open mysql with mysql -u root

      NOTE: MySQL MUST be run with ROOT.

      Run:

      ALTER USER 'root'@'127.0.0.1' IDENTIFIED WITH mysql_native_password BY ''; AND
      ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '';

      It’s okay if one of them fails. This is going to fix Most people’s issues.

      I would highly recommend removing the unattended-upgrades as many of these “sudden” issues came as a security patch ubuntu pushed out. By default Ubuntu typically set’s this for you as enabled and it can cause havoc on you as you (the admin) may not have “done” anything.

      To prevent this problem from happening in the future you could run:

      apt-get -y remove unattended-upgrades (AS Root again).

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • FOG Activity - Status

      FOG is still actively being developed. It’s not necessarily readily apparent, but we can assure you things are still being worked on. These updates may not be communicated in a way that everybody just knows, but can easily be seen if one were to look at our repository site.

      Between our own schedules and lives, we can get very busy. We try to keep things updated and help out on the forums even during lull periods. This might mean we aren’t pushing an RC or release as frequently. It may mean we’re working on other things for the project, such as can be seen if looking at our github site.

      Our forums are heavily active, and this should point as an indicator to our “status” as well.

      If anybody would like to see an increase in developers donating their time to making this free software, consider donating either with monetary support or by spending personal time to help with development.

      FOG is an open source project - it’s even in the name. It is driven by people donating their time and resources. The releases of FOG revolve around when developers can spare a few hours throughout the week. Sometimes that will mean releases will be further, sometimes that will mean releases will be faster. That’s just the nature of our project, and many other open source projects.

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • I'm away, but back?

      Hey everybody,

      I know you see me here on occasion from time to time. Life decisions have made it more difficult for me to do things I would normally be doing. Rest assured, I am still around, and while I’m not quite as active as I was in the past, it’s not because I don’t want to be.

      I had to move, and as part of that I have none of my normal development stuff readily available. Part of the move made me not have a laptop, until today.

      I need to setup my dev environment again, so it may take a little bit, but I will be back up.

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • FOG 1.5.10.41 and forward

      https://news.fogproject.org/fog-1-5-10-41-officially-released/

      While this maybe spur of the moment, it should officially release 1.5.10 with all relevant bug/security fixes encapsulated (among a few other features.)

      This has brought a new methodology of releases in that bug/security releases should be done much more regularly.

      dev-branch, historically, was a place where new development occurred (hence its name) but over the last couple of years or so it’s mainly been a bug/security thing, not really a true development approach.

      This is OKAY, in my head. Why:

      Well we have the master branch which is the ‘baseline’ of a verions. We have the dev-branch, which allows us to work on bugs/security issues. We have the working branches for what will eventually become master. Working is our “dev branch” but keeps proper seperation of things in my opinion.

      Basically:
      master -> basis for dev-branch (which merges into stable on a regular cadence - still being worked out)
      working -> basis of forward development

      So we effectively have:
      production
      staging
      development well seperated.

      THis may mean on the regular automated releases, no announcement or news article will be created, and I think that’s okay.

      Hopefully exciting we have a release after 1.25 years 🙂

      Thank you!

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • RE: Release plan for FOG

      That’s correct. The main reason fog is constantly moving forward is because the codebase is improved upon. Major bugs tend to be addressed for the next release. We don’t do an LTS because there’s really two main people working on fog in a consistent manor. Those two are @Joe-Schmitt and myself. Debian and Libreoffice have the team too be able to perform such a feat. Their product is Opensource but they have an employment team which can afford them that luxury. FOG has a team but we make no money and as such are required to work full time jobs. We work on FOG in our free time. I’ve had the ability to even work on it from work because we used the software.

      Maintaining many different versions is difficult. And we don’t have a support team. WYSIWYG and I think we’ve done pretty well on support, even if we don’t have the ability to do dedicated support for our product. 1.5 was a major step toward modernizing the GUI. 1.6 will vastly improve on this. It was only recently we kind of came up with a road map on how best to proceed. Of note, 1.5 will be maintained until 1.6 is released. 1.6 is focused on making he GUI much more modern. 1.7 will be focused mostly toward fixing and refactoring the FOG client. 1.8 will focus on making the FOS system more modular and usable. I don’t know yet for 1.9. 2.0 will bridge the gap for our rewrite based on the work from 1.5 and up. While we do plan to try to do backports where possible, it’s much easier to ask people to update to the latest version than it is to try to maintain many different versions with backports in mind. At least for what FOG does.

      I doubt this will appease anybody, but it’s what I think needs to be said. We are working hard and provide support for our product as best we can. The community makes fogs support system, I think, one of the best around. Add to that and you can almost always have a developer working side by side to help and fix issues as they come up, I don’t think it’s unfair to ask users to update to a specific version. Even if there are bugs, we will always try to correct what we can, when we can. (And normally it’s a pretty quick turn around).

      I’m not perfect and I’ll give you that. We don’t even have a test suite to know if things are working as intended. We have to rely on the community and suggestions are great, just understand our answers won’t always be what people want to hear.

      posted in Feature Request
      Tom ElliottT
      Tom Elliott
    • FOG 1.4.0 Officially Released

      https://news.fogproject.org/fog-1-4-0-officially-released/

      posted in Announcements
      Tom ElliottT
      Tom Elliott
    • FOG 1.4.4 Officially Released

      https://news.fogproject.org/fog-1-4-4-officially-released/

      posted in Announcements
      Tom ElliottT
      Tom Elliott

    Latest posts made by Tom Elliott

    • RE: Task 0

      @kratkale Two separate things. The first gets your PCs booting today.

      PXE boot, now. The installer stopped before it rewrote the boot file, so the file still says https. Change it by hand:

      sed -i 's#^chain https://#chain http://#' /tftpboot/default.ipxe
      grep chain /tftpboot/default.ipxe
      

      The line must now start with chain http://192.168.0.196/. Boot one PC to test it. The next complete installer run writes this file again, with http.

      The installer failure. Your certificates were not changed. The installer stopped before it created anything. The Secure Boot signing files that your settings name are not on disk, so it tried to create new ones. That needs the private key of your FOG root CA, and the key is not at /etc/fog/pki/root/ca/.fogCA.key. Your root certificate is still there, so your FOG clients are not affected.

      Please do not delete anything, and do not run the installer with --recreate-CA. That replaces the CA that all your FOG clients trust.

      Please post the output of these commands. They show only file names and paths, no key contents:

      ls -la /etc/fog/pki /etc/fog/pki/root/ca /etc/fog/pki/secureboot /etc/fog/pki/secureboot/ca /etc/fog/pki/secureboot/leaf /opt/fog/snapins/ssl/CA
      ls -ld /opt/fog/pki
      grep -E '^PKI_(root|sb)_' /opt/fog/.fogsettings
      find / -xdev -name '.fogCA.key' 2>/dev/null
      
      posted in FOG Problems
      Tom ElliottT
      Tom Elliott
    • RE: Task 0

      @kratkale The PXE failure has one cause, and a re-run of the installer fixes it.

      On 2026-09-09 you ran the installer with --public-web-cert. The installer saved that setting. It is wrong for your server: your web certificate comes from FOG’s own CA, not from a public CA. Until yesterday, every upgrade stopped before the boot files. Yesterday the upgrade finished, and it applied the saved setting: iPXE now loads boot.php over HTTPS. iPXE cannot verify FOG’s own CA, so it stops with “Permission denied”.

      The sudoers errors have a second cause: the sudo package is not installed on your server. Those errors do not stop PXE boot.

      Update to 1.6.0-beta.5398 or newer. Then run this on the FOG server, from your fogproject/bin directory:

      ./installfog.sh -y --no-public-web-cert
      

      5398 installs sudo itself.

      Then check the boot file:

      grep chain /tftpboot/default.ipxe
      

      The line must start with chain http://192.168.0.196/. If it shows https://, post the output. Boot one PC before you switch the others back to PXE.

      The “Detected a web certificate managed outside FOG” message was wrong. 5398 fixes it. It does not affect PXE boot.

      5398 also warns if --public-web-cert is set on a certificate from FOG’s own CA.

      posted in FOG Problems
      Tom ElliottT
      Tom Elliott
    • RE: Windows 11 Fog Client install failing with HTTPS

      @astrugatch I don’t think it matters really. The issue was more about the initial pinning of the certificate during the install process. After it is pinned I think this is the correct expectation (it should only communicate to the FOG server over HTTPS).

      posted in FOG Problems
      Tom ElliottT
      Tom Elliott
    • RE: Task 0

      @kratkale Thank you, that log shows the cause.

      Your web files are new, but the service files in /opt/fog/service are old. The new web code does not provide the name “FOGCore” that the old service code uses. So every FOG service stops at start, not only the multicast manager.

      Why: on each upgrade, the installer stopped at the certificate error before the schema step. It had already copied the web files, but it had not yet copied the service files.

      Both problems are now fixed in 1.6.0-beta.5396. The installer now accepts your FOG Web CA certificate. It also copies the service files immediately after the web files, so a failed step cannot leave them behind again.

      Please update to 1.6.0-beta.5396 or newer and run the installer again. It must finish without the “TLS verification failed” message. Then run:

      sudo systemctl restart FOGMulticastManager
      sleep 5
      sudo systemctl -l status FOGMulticastManager
      

      It must show “active (running)”. Then queue the multicast task, and post the output of tail -n 40 /opt/fog/log/multicast.log if it does not start.

      posted in FOG Problems
      Tom ElliottT
      Tom Elliott
    • RE: Windows 11 image captured from VM hangs indefinitely at Dell logo on Latitude 3400 (multiple units, multiple NVMe brands) — works fine on HP

      @servicedesk-pianezza Yes, FOG writes that boot code, and I can show you where. Your finding holds up against our
      source and against a reproduction here.

      Where it comes from. On capture, saveGRUB() in funcs.sh copies the first 1 MiB of the
      source disk into d1.mbr with dd — LBA0 included, boot code and all. On deploy,
      clearPartitionTables() runs sgdisk -Z, which does clear the MBR, and then restoreGRUB()
      writes d1.mbr straight back over it. The next two commands are sgdisk -z, which destroys
      the GPT structures only and leaves the MBR bytes alone, and sgdisk -gl, which rewrites only
      the protective partition entry. So the captured Windows bootstrap survives the whole
      sequence, and gdisk supplies the entry in its own convention: EndCHS ff ff ff and the exact
      sector count.

      I replayed that sequence here on a loop-backed disk with one of our own Windows 11 resizable
      images. The result matches what you found byte for byte in shape:

      LBA0  : 33 c0 8e d0 bc 00 7c 8e ...      (Windows MBR stub)
      0x1BE : 00 00 02 00 ee ff ff ff 01 00 00 00 af 32 cf 1d
      

      Why it is not simply a bug. On a BIOS-booted GPT Linux disk that same region is GRUB’s
      boot.img, and d1.grub.mbr exists precisely so we keep it. We cannot blanket-zero LBA0 on
      every GPT restore. On a Windows GPT image it is dead weight — Windows only boots GPT through
      UEFI — so a targeted change is available to us. But we should change the right bytes.

      Which byte is it? Your diskpart disk differs from ours in three places at once, so we do
      not yet know which one the firmware chokes on. Three one-liners settle it. Start from a fresh
      deploy that hangs, run one of them, power off, power on, press F2. Redeploy between tests so
      each one is measured on its own:

      # 1 - the bootstrap, nothing else
      dd if=/dev/zero of=/dev/nvme0n1 bs=1 count=446 conv=notrunc
      
      # 2 - the size field -> sentinel
      printf '\xff\xff\xff\xff' | dd of=/dev/nvme0n1 bs=1 seek=458 conv=notrunc
      
      # 3 - EndCHS -> the diskpart value
      printf '\xfe\xff\xff' | dd of=/dev/nvme0n1 bs=1 seek=451 conv=notrunc
      

      Each writes inside LBA0 only and leaves the GPT untouched. Test 1 is the one I expect to
      matter, on the theory you already stated — a CSM path in that firmware reading or validating
      a bootstrap it should be ignoring.

      Name the byte and the fix is small: for a GPT image whose OS is Windows, clear that field
      during the restore and leave Linux images alone. That also gives the two 2020 reports on this
      hardware an explanation, which is worth having on its own.

      posted in General
      Tom ElliottT
      Tom Elliott
    • RE: Windows 11 image captured from VM hangs indefinitely at Dell logo on Latitude 3400 (multiple units, multiple NVMe brands) — works fine on HP

      @servicedesk-pianezza You are right and I was wrong. F2 hanging settles it. “Preparing to enter BIOS Setup” runs
      before any bootloader, so the firmware is the thing that stalls, and my reading of the iPXE
      test was bad. Ignore that whole post.

      Your Windows 10 control is the best evidence in this thread. Same capture pipeline, same
      FOG, same drive, same machine, and it boots. Together with “resizable and non-resizable both
      hang”, that clears our resize path and it clears FOG’s table writing as a general fault: we
      are laying down the captured disk faithfully, and this particular captured disk upsets this
      particular firmware.

      So the question is narrow now: which bytes? Two things, and the first one you can do from
      your desk.

      Diff the two tables. You have a good drive and a bad drive from the same pipeline. In a
      debug task on each, capture:

      sfdisk -d /dev/nvme0n1
      sgdisk -v /dev/nvme0n1
      gdisk -l /dev/nvme0n1
      

      Post both sets. Partition count, order, types, attributes and the end-of-disk figures are
      the things the firmware reads at enumeration, and a diff of Win10-good against Win11-bad
      names the difference without any guessing.

      Then bisect the disk, in this order. Start from a deployed drive that reproduces the
      hang, and after each step power off, power on, press F2, and note whether Setup opens.

      Destroy the partition table only, leaving every byte of partition data where it lies:

      sgdisk -Z /dev/nvme0n1
      

      If Setup now opens, the firmware is choking on the partition table — layout, types or
      attributes — and not on anything inside the partitions. If it still hangs, the data is the
      problem, so redeploy and zero the start of the ESP, which is the only partition the firmware
      reads:

      dd if=/dev/zero of=/dev/nvme0n1p1 bs=1M count=1
      

      If Setup opens after that, it is the ESP filesystem, and we can bisect it file by file from
      there.

      Three questions while you are at it. Which Windows 11 build is the image, and which build
      was the Windows 10 one? Was the Hyper-V VM Generation 2 with Secure Boot and a vTPM
      attached? And what BIOS version are the 3400s on — Dell’s last for that model is in the 1.3x
      range, and firmware is the component under suspicion now.

      Also worth saying plainly: if this turns out to be the Latitude 3400 firmware choking on a
      partition layout it does not like, there may be nothing for FOG to fix beyond documenting
      it. Two earlier reporters on this hardware ended up rebuilding the image from a clean install
      rather than finding a cause. I would rather find it, and your Win10 control is the first
      thing anyone has produced that makes that realistic.

      posted in General
      Tom ElliottT
      Tom Elliott
    • RE: Multicast: "No Active Task found for Host" on 1.5.10.2482 despite #1391 — msClients stays 0

      @Mikeee89 Thanks for the detailed report. It pointed straight at the cause.

      Cause: when udp-sender exits, the multicast manager closed the session and marked every host’s task Complete at the same time. The clients were still post-processing (UUID reset, NTFS flag, hostname). So when each client then reported back, its task was already gone: “No Active Task found for Host”. The imaging log row stayed open, which is where the “2026 years” duration comes from. This came in with the fix for #820.

      Fix: the manager still closes the session when the sender exits, but now leaves each host’s task for that host to close itself. PR #1776 (dev-branch), #1777 (working-1.6). I reproduced your exact error against a copy of a 1.5.10 database, and the patched code returns success and closes the imaging log.

      On your other observations:

      • msClients is reset to 0 when a session completes, so 0 after the run is expected. -2 is the marker for a session created from Image Management, not a counter underflow.
      • The multicast.log.udpcast.<id> file is deleted at the end of every session, and has been for years. That is a separate question, not part of this bug.
      • “has been killed” is printed even when the sender exited by itself. The wording is misleading, but nothing is actually killed.

      Once it merges, update to the latest dev-branch and the task should close normally.

      posted in FOG Problems
      Tom ElliottT
      Tom Elliott
    • RE: Windows 11 Fog Client install failing with HTTPS

      @astrugatch Thanks, I can reproduce this.

      Cause: since 1.5.10.2253 the server signs its HTTPS certificate with a “FOG Web CA” intermediate under the FOG Server CA. The client installer only accepts an HTTPS certificate issued directly by “FOG Server CA” when it downloads ca.cert.der, so the download fails and the pin fails. The fix is in the client: https://github.com/FOGProject/zazzles/pull/48. It needs a new client release.

      Workaround until then, either one:

      • Trust the FOG CA before you install. Download http://<fog-server>/fog/management/other/ca.cert.der (plain HTTP works), then run certutil -addstore Root ca.cert.der as administrator. Then run the HTTPS install as before.
      • Or install with HTTPS off. The client downloads the CA over HTTP, and the server redirects it to HTTPS after that.
      posted in FOG Problems
      Tom ElliottT
      Tom Elliott
    • RE: Task 0

      @kratkale 09-08-26 seems to me that the FOGMulticastManager service isn’t started or died somewhere.

      Can you run:

      sudo systemctl restart FOGMulticastManager
      sleep 5
      sudo systemctl -l status FOGMulticastManager
      

      On a separate window it might be helpful to see your php-fpm www-error logs (see my footer to see where to find that information)

      posted in FOG Problems
      Tom ElliottT
      Tom Elliott
    • RE: Windows 11 image captured from VM hangs indefinitely at Dell logo on Latitude 3400 (multiple units, multiple NVMe brands) — works fine on HP

      @servicedesk-pianezza Those are clean tests and they kill my theory. Correcting the record, and then I think your
      own last test moves this a long way.

      The stale-metadata idea is dead. A zeroed disk with a fresh deploy still hangs, and
      mdadm --examine found no superblock either side of the wipe. Drop it.

      I also replayed our GPT restore path locally against a Windows 11 resizable image, onto a
      disk deliberately smaller than the captured one — the same order FOS uses: dd of d1.mbr,
      sgdisk -z, sgdisk -gl, then the filldisk table through sfdisk. The result verifies clean:
      sgdisk -v reports no problems, the protective MBR is a single 0xEE entry spanning the whole
      device, and first/last usable sectors match the target. So a malformed partition table is not
      what we are looking at either.

      Now the part I think you undersold. You reached the FOG iPXE menu and chose “Boot from hard
      disk”, with the deployed drive fitted, and then it hung. That means the firmware finished
      POST, brought up the NIC, ran iPXE and drew a menu — all with that drive present. The
      firmware is not the thing that hangs.
      It hands off to bootmgfw.efi and the hang is after
      that point.

      Which reframes the symptom. “Stuck at the Dell logo” is not the firmware stalling. It is the
      Windows boot chain hanging before anything repaints the screen, so the OEM logo simply stays
      up. F12 being dead is expected there — the firmware gave up the keyboard at handoff. It also
      explains the missing Automatic Repair: Windows’ boot-failure counter is incremented by the
      boot manager, and a hang never reaches the code that does it.

      So the question is now why this image hangs in early Windows boot on a Whiskey Lake Latitude
      and not on a 12th-gen HP. Two things to do, in this order.

      Deploy the same image to the same Dell as Single Disk (Not Resizable). This splits the
      problem in half for the cost of one deploy. Both 2020 reports on this hardware said
      non-resizable worked where resizable did not — see banana123 in topic 14147, “Using Multiple
      Partition Image - Single Disk (Not Resizable) DOES work fine”. If non-resizable boots, the
      fault is in our resize path, it is ours, and I will want d1.minimum.partitions,
      d1.fixed_size_partitions and a full debug-deploy transcript. If it hangs too, the resize
      path is exonerated and it is the image.

      Make Windows tell you where it stops. Boot a Windows installer USB on the hung machine,
      Shift-F10 for a command prompt, find the ESP letter with diskpart, then:

      bcdedit /store X:\EFI\Microsoft\Boot\BCD /set {default} sos on
      bcdedit /store X:\EFI\Microsoft\Boot\BCD /set {globalsettings} bootmenupolicy legacy
      

      sos replaces the logo with the list of boot drivers as they load, so the screen names the
      last thing it got to instead of showing you a logo. bootmenupolicy legacy gives you the F8
      menu, and Safe Mode is itself a useful result.

      Last question, because you have not said it anywhere in the thread: was the image captured
      after sysprep /generalize /oobe /shutdown, or from a VM that had simply been shut down? An
      image captured without generalize carries the source machine’s driver and device state, and
      booting on one chipset but not another is the usual way that shows up.

      posted in General
      Tom ElliottT
      Tom Elliott