10.7 client .dmg creation for deployment questions.

Question

Please forgive me if this question is in the wrong forum.
I've been doing searches online and in the 10.7 Peachpit books (client and server) and I can't seem to find the info I am looking for.
I am trying to create a 10.7 .dmg to use on new Macs my company is going to deploy. We are not using 10.7 Server at the moment, we
are using 10.6.8 Server. This will not be an image we are going to deploy over the network either. I know this may not be "best practices"
but at the moment, this is the way we are going to (re)image new Macs.
Basically, I want to create a 10.7 .dmg that does NOT contain the recovery partition. I can't seem to find a way to do this. If I am correct,
even a "clean" install, when booted from a USB 10.7 recovery drive, will create the recovery partition, right?
I am running 10.7 client and i have the 10.7.3 Server Admin tools.
I apologize in advance if I am missing something glaringly obvious.
Also, any tips on best practices for creating 10.7 client .dmgs for deployment that's any different than creating 10.6 images?
thanks in advance.

Answer 1

Using information from this site and my own scripting experience I present to you a more secure way to do it which supports munki and other deployment tools without having the password to the ODM or client in clear text on the client or on packages easeliy accessable on a http server:
On server:
ssh-keygen
Save the output of ~/.ssh/id_rsa.pub to your clip board
Then create a launchd or something so that this runs at startup
nc -kl 1337 | xargs -n 1 -I host ssh -q -o StrictHostKeyChecking=no root@host /usr/local/bin/setupLDAP diradminpassword localadminpassword > /dev/null 2>&1
On client:
Create script (to use in a package as postinstall or something):
#!/bin/bash
# Turns on ssh
systemsetup -f -setremotelogin On
# Sets up passwordless login to root account from server
echo "ssh-rsa FROM_YOUR_CLIPBOARD_A_VERYLONGOUTPUTOFCHARACTERS [email protected]" >> /var/root/.ssh/authorized_keys
# installs setupLDAP
mkdir -p /usr/local/bin
cat > /usr/local/bin/setupLDAP <<'EOF'
#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin
export PATH
computerid=`scutil --get ComputerName`; yes | dsconfigldap -vfs  -a 'server.domain.no' -n 'server' -c $computerid -u 'diradmin' -p $1 -l 'l' -q $2
EOF
chmod +x /usr/local/bin/setupLDAP
End note
That was the code, now you just add the skeleton And to clearify what this does, first we let the server connect to the client as root even though root access is "disabled" (he has no password and therefore you can't log in as root as default). Then we create a small script to setup OD binding (/usr/local/bin/setupLDAP) but this script doesn't contain the passwords. Then the client send a request to the small socket server on the server with it's hostname, then the server connects to that hostname and executes /usr/local/bin/setupLDAP with the needed passwords.