This has been dogging me for a long ass time and I finally am close to solving it. I know others are in the same boat so listen up:
- You have a proxy that systems must go through in order to access the outside world.
- You have an internal SUS that you're setting on client systems through whatever means (MCX in my case).
- You're collecting receipt information and when machines recon, you get an error during receipt collection (Curl is throwing this one)
Cannot connect to swscan.apple.com. There may be a proxy in place. - The resulting error means that on machines that actually have updates available when the user runs Software Update, a machine's inventory "Software Update" section reports zero updates.
I always thought it odd that even though systems were pointed to an internal SUS they were trying to get out to Apple. Anyway, it seemed to me that an environment variable needed to be set. Because, you can do:
sudo su
http_proxy="http://my.company.proxy:port"
export http_proxy
jamf reconAnd things work fine. The available software updates on your internal SUS even show up in the machine's inventory.
So today I set out once and for all to solve this thing. In involves two lines of information in two separate files.
In your /etc/profile file add:
export http_proxy=http://my.company.proxy:portIn your /etc/suoders file add:
Defaults env_keep += "http_proxy"Essentially what this is doing is:
1. In /etc/profile setting the environment variable for all users on the system
2. MOST IMPORTANTLY when a user sudos, it does not strip out the http_proxy environment variable. This was my missing link for like the last 3 bloody years.
So now, doing
sudo jamf reconworks as expected. Nice and quick, no timeout during that receipt collection.
However, all is still not working as you'd expect. If you have the "Update Inventory" box checked in the advanced tab of a policy, it will give the proxy error during the policy's execution.
I've done 'env' and 'sudo env' as my logged in normal user, 'env' and 'sudo env' as my casper admin user and 'env' as root and all of them return my proxy information.
I feel like I'm so close to finally licking this problem. Anyone have ideas why machine-initiated recons will now work as expected but not policy-initiated ones?
