9.8 Self Service and OSX 10.11

[KebsKebs]

Hi Folks,

Just playing around with Casper 9.8 and and El Capitan GM (15A282b) and is stumbling an error. Seem to only affect the ony 10.11 I have here. Other 10.10s and iOS9 apps are fine.

Self service apps fail to install with

"Cannot install Item" There was a problem installing <package-name-here>. Contact your Administrator.

Checking /var/log/jamf.log. '

2015-09-22 20:00:16 <com.jamfsoftware.selfservice>: Policy "Remote" failed: sh: /Library/Application Support/JAMF/tmp/9496.tmp: Permission denied sh: /Library/Application Support/JAMF/tmp/9496.tmp: Permission denied cp: /Library/Preferences/SystemConfiguration/preferences.plist.old: Permission denied cp: /Library/Preferences/SystemConfiguration/preferences.plist.old: Permission denied cp: /Library/Preferences/SystemConfiguration/preferences.plist.old: Permission denied cp: /Library/Preferences/SystemConfiguration/preferences.plist.old: Permission denied cp: /Library/Preferences/SystemConfiguration/preferences.plist.old: Permission denied cp: /Library/Preferences/SystemConfiguration/preferences.plist.old: Permission denied sh: /Library/Application Support/JAMF/tmp/9496.tmp: Permission denied sh: /Library/Application Support/JAMF/tmp/9496.tmp: Permission denied sh: /Library/Application Support/JAMF/tmp/9496.tmp: Permission denied There is a problem with your syntax. Error: This application must be run as root. Try the sudo command. Type "jamf help" for more information.

Any Ideas?

[rtrouton]

I'm seeing a similar issue and have opened a support case with JAMF about it. On my 10.11 GM test boxes, I'm also receiving a Cannot Install Item message in Self Service.

I'm also not seeing entries for the relevant policies appear in /var/log/jamf.log, though other policies outside of Self Service are running.

That said, it appears that policies are being called but not necessarily running successfully. I'm seeing some policies tied to package installations running over and over again without actually installing the installer package in question.

10.10.x and earlier seem to be working normally.

Things I've tried:

• Uninstalling the Casper agent using jamf removeFramework and then reinstalling. Problem persists.
• Removing the MDM profile using jamf removeMdmProfile, followed by running jamf manage. Problem persists.
• Switching to a different Casper test server. Problem persists.

I'm using HTTP for my fileshare repo, but I've now tried both HTTP over port 80 and HTTPS over port 443 and both showed the same problem. The HTTPS certificate is one I acquired from StartSSL, just to rule out any issues with the certificate being self-signed.

[lisamcray]

We are having the exact same problem with Self Service 9.8 and 10.11. I tried the same troubleshooting steps. I also then took the 10.11.1 update and clean uninstalled and reinstalled, with the same result. The jamf.log looks clean with successful and regular policy updates, so I suspect the client is ok, it is just Self Service that is broken. Wondering if the newly released 9.8.1 will fix this problem . . .

[pblake]

9.8 I don't believe supports 10.11. It was an update to support iOS 9. The release notes said an update would follow the official release of 10.11.

[lisamcray]

@pblake - I understand, and read the release notes. I figure that that party line will be that 10.11 is still technically unsupported. (Which is what I told our 10.11 Beta testers) It is just that with only 8 days left until El Capitan drops it would be nice to have worked through some of these issues. Especially with a key feature like SelfService.

[rtrouton]

9.8's release notes include this section:

[scottb]

See this posted earlier:

Self Service Issue - possible fix

[mm2270]

@lisamcray JAMF hasn't actually been shipping a fully compatible version of Casper Suite against a pre-released version of OS X or iOS now for some years. I'm certain they have it ready to go, but need to wait until El Capitan is actually "shipped" on the Mac App Store so they can test it against that final public version. This has a history and reasoning behind it. Apple has had a habit of changing some key elements in the final version (different than the GM) that can cause issues with Casper Suite and other tools. Basically, if JAMF is stamping a version as "compatible" with the new OS, they want to be sure it actually will be when its officially released.
Once 10.11 drops from Apple, I would give it just a few hours before JAMF announces the compatible version of Casper. (unless they find some major issue that is)

[tthurman]

I was having this issue as well.

JAMF support provided this defect number. D-009498

Regards,
TJ

[reelmike]

I'm on a hosted JSS, booted a clean install of 10.11 (public release) on a VM, enrolled it in JSS 9.81.
Can confirm a JSS connection, but can't get policies to run via Self Service at all. Get the "Cannot Install Item..." dialog.

[rluk]

I am also having the same issue as reelmike. Hosted JSS, public release of 10.11, and Self Service is not working. However I cannot get my configuration profile to work as well. It says failed in the JSS with status

The operation couldn’t be completed. (ProfileDomainPluginController error 101.)

Any ideas?

[JustDeWon]

@reelmike I am having that exact issue as well.. I knew that 9.8 didn't work, but was under the assumption that 9.81 would work, however it still gets the same error.. With the public release of 10.11, so it seems the Casper release of 9.81 didn't resolve the Self Service Portal issue of "cannot install item"

[scottb]

Someone posted in another thread yesterday that those with 9.8 upgrading to 9.81 was not going to fix this issue with SS. I'll try to find that info...

[scottb]

Here is that post...

It's the one by @cbrewer

[reelmike]

Thanks @scottb for the reference there!

For hosted folks, here's what I know:
9.8 upgrade - JAMF had to migrate many key components on client machines due to Apple's new System Integrity Protection feature. During this automated migration on client machines, the migration is supposed to nuke the "com.jamfsoftware.checkForTasks.plist" file, but on some machines it did not. Like outlined in this thread:
https://jamfnation.jamfsoftware.com/discussion.html?id=16993

Symptoms were/are: client machines would not regularly check in at the intervals specified by the JSS. However, you could call the JSS manually from Terminal. Self Service was also wonky, but I think that was because our client machines install SS separately from Quick Add, so I had the older version of SS on client machines with the newer binary.

Fix: I wrote a small app w/AppleScript that auto-nukes the plist in question, forces 'sudo jamf manage' (as a safety) and auto-restarts the machine. Then, after reboot, I had a policy waiting in the wings to swap SS to the newest version. Done.

9.81 upgrade - everything seems to be fine on 10.10.5 machines and lower. I downloaded 10.11 yesterday and loaded it fresh into a VM on VMWare, then enrolled the VM fresh into the JSS. I can call the JSS manually from terminal, but policies in SS fail, or rather, don't even make it "out of the gate"... usually you get a "Policy failed to run..." but there's no logs whatsoever on what's going on behind the scenes here.

I've mailed back and forth with our tech rep this AM and they are now seeing a similar thing and reports from several other hosted users. They are updating their test machines to reproduce.

[reelmike]

UPDATE - version numbers will make you crazy!

With the help of my rep, we discovered that our hosted instance is NOT running 9.81... it's still running 9.8. If you look at the version number in your JSS, for hosted folks, it should still say: "9.8.1442327240.c". The new version will read "9.81.#########" not "9.8.1#########".

The golden nugget of news that should be really helpful to all hosted folks tho, is that shared instances are automatically upgraded the Saturday following the latest release. This happens between 6am and 12pm Central Time. Dedicated instances are upgraded per request of the customer and these inquiries can be sent to the TAM, or Technical Account Manager. So be sure to check in with your TAM to be sure what type of instance you're running.

I'll just hold off to resume testing until after the upgrade, which at that point, SS will probably work.

[JustDeWon]

Great to know.. thanks @reelmike

[cbrewer]

I'm attaching a script I wrote to remotely fix machines with this issue. The script asks for an IP address and then connects via ssh. It unloads the com.jamfsoftware.task.checkForTasks.plist launch daemon, deletes the file, then runs jamf manage and jamf policy twice. The first policy check updates everything to version 9.81. The second policy check actually gets the machine to check in for policies. Replace admin in the script with your own admin account username.

#!/bin/bash

#Jamf Fix version 1.0
#2015-10-01

read -e -p "Enter IP address: " ip_address
echo "$ip_address"

ssh -o ConnectTimeout=3 -t admin@$ip_address "sudo launchctl unload /Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist; sudo rm /Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist; sleep 3; sudo /usr/local/jamf/bin/jamf manage; sleep 3; sudo /usr/local/jamf/bin/jamf policy; sleep 3; sudo /usr/local/jamf/bin/jamf policy"

read -p "Press [Enter] key to exit..."