Deploying Bomgar JumpClient to Macs using Casper

[rldehaven]

Hey All,

It took me a while to figure out how best to do this, but thought I would share it for everyone here just incase someone else uses Bomgar to support their Org. I am somewhat novice when working with Policies and Casper Admin, but the Bomgar client did not make it easy to just 'install'...

1. Create a JumpClient Deployment Package in the Bomgar WebUI
2. Download the bomgar-scc-SERIALIZEDNUMBER.dmg
3. Upload that dmg to your Distribution Point
4. Create and upload a script installBomgarJump.sh (Mark as 'After' in Casper Admin)
5. ```

   !/bin/sh

Attach the Cached DMG from the Waiting Room

hdiutil attach /Library/Application Support/JAMF/Waiting Room/bomgar-scc-SERIALIZEDNUMBER.dmg

Install the client from the standard mount location for the bomgar-scc client installer.

/Volumes/bomgar-scc/Double-Click To Start Support Session.app/Contents/MacOS/sdcust&
```
1. Create Policy
1. On the General tab, set the trigger to "None (Self Service only)" and the execution frequency to "Ongoing".
1. On the Packages tab, add the DMG as CACHE, and ensure that the FUT and FEU options are deselected.
1. On the Scripts tab, add your script as 'After'.

I will probably continue playing with this and automating it so it can just get pushed out. But for now, having users be able to Pin themselves to our Bomgar appliance is a great help with remote support.

*Part of the Bomgar deploy script 'sdcust' un-mounts and delete's the original DMG when it is done deploying, it also requires the original DMG to be mounted so far as I can tell in testing. *My JumpClient is not configured to install with Elevated privileges, this allows the client to be pinned without prompting for user password.
*I am on Casper 8

[mbatchelder]

@Jimbo Hi Jimmy,

Yeah, it's as quick as that. Open a terminal window and put that command in and then you can drag your bomgar .dmg file into the window to append it and hit enter. That should remove the quarantine attribute and you should be good to go to upload it to your Jamf server. I don't know what triggered in Catalina for this to start happening. Even after upgrading our BeyondTrust appliance to the supported Catalina build it was a no go. I just wish they made it so we didn't have to disc jockey the files out every year.

If you haven't already, you may need to configure a payload for the privacy preferences policy control. We had to do this because the screen sharing wasn't working since Mojave

[Jimbo]

@mbatchelder Hey, I think I got it working, thank you! Still doing some testing.

I have created a privacy preferences policy using the PPPC Utility tool from jamf. But for the Screen Recording privacy preferences it only allows you to select "Deny". Which means our users will need to manually check the checkbox when attempting to connect to them.

Your comment about created a payload for those privacy settings make it sound like you've found a way around this? From what I understand, Apple has blocked the ability to allow, and therefore must require user input.

[jtrant]

Has anyone managed to make the client installation truly silent? The 'sdcust --silent' switch still results in the "two computers connecting" splash screen appearing after the agent is installed. We'd obviously prefer for this not to happen.

[dwshore]

Has anyone figured out how to use the flags other than --silent to do anything? I'd love to have the computer 'name' field show up with the user's name who was logged in during install. Would make it easier to identify my endpoints.

[cwaldrip]

Does the client software show up for anyone after installation? Version 19 (we jumped from version 16) is installing in /Applications/.com.bomgar.scc.<uniqueid>/Remote Support Customer Client.app, but doesn't show up in the machine's inventory afterwards? Is this going to require an EA to look for it specifically? Or is this just me...

[dwshore]

@cwaldrip Short answer: Yes. I created an EA that checks if it's running since I've had to remove and reinstall the agent a number of times during my testing and didn't want to mess with the uniqueid in the folder name. Here's what I use:

#!/bin/bash

count=$(ps aux | grep bomgar | wc -l)
if [ $count -gt 1 ]; then
    echo "<result>YES</result>"
else
    echo "<result>NO</result>"
fi

For testing I added the $count variable to the result. You have to check for more than 1 running because it appears that with failed installations you'll still report back that one service is running. But if you get more than one, it's actually up and running.

[wILLwILL2]

Thank you everyone for sharing, its very helpful. I used a combination of all the above suggestions and I thought I ll share what I did in case someone else needs it:
1. Download the DMG and run the following commands:

xattr -rd com.apple.quarantine /Users/user/Downloads/bomgar-scc-w0idc30jfd5661jwzj8i7we1z1gzeg868f15hw1c40jc90.dmg

hdiutil internet-enable -no /Users/user/Downloads/bomgar-scc-w0idc30jfd5661jwzj8i7we1z1gzeg868f15hw1c40jc90.dmg

2. Upload the DMG to JAMF Pro
3. Create a policy to "cache" this DMG and the below script "after":

#!/bin/bash

# The Bomgar DMG should have been installed cached prior to this script running, but we should make sure...

if [ -a "/Library/Application Support/JAMF/Waiting Room/bomgar-scc-w0edc308j7ghizzgz6x588zy7ei88zzegexzew6c40hc90.dmg" ]; then

# Attach the Disk Image
    hdiutil attach /Library/Application Support/JAMF/Waiting Room/bomgar-scc-w0edc308j7ghizzgz6x885zy7ei88zzegexzew6c40hc90.dmg

# Run the installer
    /Volumes/bomgar-scc/Double-Click To Start Support Session.app/Contents/MacOS/sdcust

# Wait a minute for it to finish up
    sleep 60

# Unmount the disk image
#    hdiutil detach /Volumes/bomgar-scc

# Wait for the unmount to complete
#    sleep 15

# Delete the disk image
#    rm -R /Library/Application Support/JAMF/Waiting Room/bomgar-scc-w0edc308j7ghizzgz6x885zy7ei88zzegexzew6c40hc90.dmg


else

echo "Bomgar NOT Present"

fi

4 . Create an EA to report if BeyondTrust is installed and hook it up to a smartgroup:

#!/bin/bash

count=$(ps aux | grep bomgar | wc -l)
if [ $count -gt 1 ]; then
    echo "<result>YES</result>"
else
    echo "<result>NO</result>"
fi

[techdan]

This works: 

If you're on the MacAdmins Slack, join the Bomgar channel. A BeyondTrust employee posted a PDF that will eventually replace the KB article on the BeyondTrust site for mass deployment.

Here's a direct link: https://macadmins.slack.com/archives/CEH9Y26D6/p1606838240060700

There is misinformation in this document. The process is correct, however the file path specified for the DMG file is incorrect. The workflow of caching a package (or in this case a DMG file) start by downloading into "/Library/Application Support/JAMF/Downloads" and then once completed the file moves to "/Library/Application Support/JAMF/Waiting Room". The document specifies the Downloads folder, however the actual path is in the Waiting Room folder. 

[dwynn]

I spent a lot of time trying to create a policy to deploy BeyondTrust Remote using the above methods. Here is what worked for me. Thank you to the #bomgar Slack channel. Page 21

Deploying the Jump Client