Deploying Sophos Anti-Virus for Mac

There is. The /tools/ directory contains the com.sophos.bootstrap.helper file that is launched when invoking '--install'.

OK. In other Sophos installers, there's another copy of the Sophos InstallationDeployer install application located inside of tools, and ../tools/InstallationDeployer is the one that can be used by an installer package.

@brysontyrrell what version of the Sophos Installer.app are you using in your custom pkg?

I checked out the Home app and I see that. I'm guessing that the Enterprise version has that as well?~

Their Cloud installer doesn't seem to line up with the other two.

[upload](f03ae0088f184762b2e80cbaf60e5b85)

@lionelgruenberg

The app's version is 9.3.1

@brysontyrrell Can you try installing from a different directory? I use the JAMF Waiting Room for Sophos Cloud.
This is in my postinstall script:

/Library/Application Support/JAMF/Waiting Room/SophosInstall/Sophos Installer.app/Contents/MacOS/Sophos Installer --install

I just use the instructions provided by Sophos -

https://www.sophos.com/en-us/support/knowledgebase/33050.aspx

Launch Composer before I start the install and configuration. Must not be connected to network when setting up the update preferences. Quit Sophos and reconnect to network, then add to the Admin and then push out to a test MBP. The final package is almost 200mb, so take that in consideration.

Corbin

@brysontyrrell I literally repackaged our Sophos installer 2 days ago...

+1 to @lionelgruenberg about using a different directory.

I started by trying to package the installer in /private/tmp so it would be cleared on a reboot and it would just sit for hours and hang.

Ended up repackaging so it was in /Users/Shared/Downloads with a postflight script:

sudo /Users/Shared/Downloads/SophosInstall/Sophos Installer.app/Contents/MacOS/Sophos Installer --install

and it worked first go. Installed in a matter of minutes. Hope that helps! Our old package was a pre and post capture of a full install and it was a bit of a hit and miss on some of our Macs. This is much cleaner.

Cheers

@lionelgruenberg @mkremic

Can someone save my sanity and explain to my why executing the Sophos silent install from /Users/Shared/ is different from /private/tmp/? This doesn't make any sense to me!

(yes, that worked moving it out of /private/tmp/)

@brysontyrrell Can't explain why but hopefully this saves your sanity... Here is a rough way to execute the silent install from /private/tmp

Create a custom Sophos Install package and include a script to kick off the silent install at /private/tmp/SophosInstall/install_sophos.sh:

#!/bin/bash
/private/tmp/SophosInstall/Sophos Installer.app/Contents/MacOS/Sophos Installer --install

Execute the install_sophos.sh script from a postinstall script in your custom Sophos Install package:

#!/bin/bash
/private/tmp/SophosInstall/install_sophos.sh

I managed to create a Sophos package just fine, but what about changing the update server configuration on an already-installed copy of Sophos, is there a way to do that from a script? As installing the new package over the top of the old one does not have any effect.

It's built into a plist, so I would imagine you could deploy the plist to machines to update that info. Check out @rtrouton's post if you haven't already: https://derflounder.wordpress.com/2015/06/17/revisiting-sophos-enterprise-anti-virus-for-mac-9-2-x-deployment/

@DanJ_LRSFC you may want to have a look at this Sophos article on how to create a pre-configured installer:

How to create a pre-configured installer containing updating and On-Access scanning options

That's the process I use to create the PKG for our install.

@DanJ_LRSFC As @stevewood mentions you can create a pre-configured stand-alone installer as per that Sophos article. As @emily mentions @rtrouton has done an excellent job of detailing how to deploy a pre-configured managed copy of the Sophos installer.

(Is this a record for the number of people referenced ;) )

What you can do when deploying a pre-configured stand-alone copy of the Sophos installer (via a package) is to have a pre-install script which uninstalls any existing copy first, this ensures the newly installed copy is not contaminated by old settings. This is how I do it.