Deploying Palo Alto Traps

khey
Contributor

Hi guys,

Anyone know where is the plist for Traps Settings or way to set up the settings at all?

Been scanning for plist and any config file to set up the settings but couldnt find any.

Thanks

86 REPLIES 86

matin_everquote
New Contributor

Palo Alto Traps For Mac is not like a standard application.

Here is where the Palo Alto Traps For Mac installs on the local computer:
3218a1dd43eb43f9b7be2d06098cf1c7

However within Traps for Mac Client Agent, there are no static/local configurations. The specific location where there are configurations which is in config folder is synced with the Palo Alto Server that manages the client. So if you are updating these xml files, it will get over written when the Traps client checks in with the server. The only configurations that you can edit during installation time is the Palo Alto Traps Server address Traps Client should initially connect (server.xml) to which is located in the install zip file provided by the person that manage your Palo Alto Servers:

6d38713fb32641cd9e21a1893bd5981c

dng
New Contributor

Has anyone deployed this properly with JAMF?

matin
New Contributor III

Yes, I have the Traps for Mac working with jamf. There are 2 options that you can use to deploy traps with jamf.

  • Option 1 - Create a custom package that lays down the installer, .version file, and custom xml file (custom client settings to set traps server addresses) in a static location on the clients computer along with a postinstall script that runs the install via the command line then put this into a policy.
  • Option 2 - Create policy with the following
    • a custom package that lays lays down the installer, .version file, and custom xml file (custom client settings to set traps server addresses) in a static location on the clients computer
    • script that triggers the install via the command line

I prefer the pkg with postinstall script because if we have to manually install traps, the experience is the same.

matin
New Contributor III

Thought I would add to my original response since I had to make documentation for my company on how to build this installer:

Prerequisites - Traps for Mac Installer from console. Usually comes in a ZIP file.
- Custom XML file provided by Traps Administrator with organization server addresses in xml format

Process
1. Place Traps installer, .version, xml file in a folder named Traps_macOS_installer and move folder to a temporary location on your computer. I usually use /tmp (/private/tmp). This way it will be removed at next restart.
2. Open Composer.
3. Create a new package by dragging and droping the Traps folder located in your temporary location into composer.
82e67cc30fa1403391b398c63470efd5
4. Go to the Scripts folder within your new Traps Source Package in Composer and create a postinstall script. 871b825baaa24d93ac167e7300e8778b
- Enter the following as shown in screenshot:

#!/bin/sh
## postinstall
wait 10
/usr/sbin/installer -allowUntrusted -pkg /private/tmp/Traps_macOS_installer/Traps.pkg -target /
exit 0

5. Build as PKG file since you have setup the postinstall script other wise the script will be stripped from the compiled installer/dmg.

Note: As long as you keep the Traps_macOS_installer consistant and all the file names are the same then you will just need to updated the .version file and traps.pkg file and recompile.

dng
New Contributor

Thank you so much! I was almost on the right track to do so with packages.app instead of composer. I didn't think about using Composer in this way.

FastGM3
Contributor

@matin Thanks for sharing, worked perfectly and saved me some time!

noahblair
New Contributor II

Such a good post. Thanks man.

kiwillia
New Contributor II

Thank you!

aoxley
New Contributor

Hey,
Thanks so much for this article, its super helpful. Where do I find the .version file? Also is Config.xml the new Server.xml?
Thanks!

matin
New Contributor III

The following files are create from the Traps Console. Unfortunately, I do not have access and these files are provided to me by my IT Security Team:
- .version
- Servers.xml

mm13
New Contributor II

Thank you @matin ! Issue right now is that Gatekeeper seems to be preventing the extension from running, which borks the install initially. Do you have any advice on how to disable or enable this app from running in Gatekeeper? A little cloudy on the process.

Thanks!

matin
New Contributor III

@mm13 - I think you are referring to User Approved Kernel Extension Loading. My company has a hybrid of mac hardware that have been imaged via Apple DEP and QuickAdd/Jamf Imaging. We manually authorize the User Approved Kernel Extension via Security and Privacy > General tab and manually approve the User Approved MDM via profiles. For Apple DEP and Jamf 10, we are whitelisting these Kernel Extension via Configuration Profile. Hope that helps.

tguyers360
New Contributor III

thanks @matin you have saved me a whole load of time ! much appreciated

bcbackes
Contributor

@matin Thank you for all your information. It's been a great deal of help. I did get stuck on the Kernel Extension via Configuration Profile. I did look at the links you provided, however, I can't seem to figure out how to create the profile and upload it into Jamf. We are not using a Mac Server. I do apologize since I'm really new to Jamf and Apple products in general.

All the documentation I've been reading through referred to using Profile Manager, which, appears to only be available on MacOS Server? Any tips you have will be helpful. FYI, I created a package following your instruction above and found that it would download locally to the Mac, however, never installed. Again, I suspect that the Kernel Extension Loading is what prevented that, even though nothing prompted about allowing it. In the private mp folder I see it there, however, it has a red circle with a line in the circle (similar to a hyphen).

Whatever help you can lend will be greatly appreciated. Thanks again!

matin
New Contributor III

@bcbackes - If you are using jamf (like I am), you would use the built in options to create a white list configuration profile in Jamf as described by @rtrouton article Whitelisting third-party kernel extensions using profiles. You would need to scrolling down the bottom of the article on how to create one in Jamf Pro.

Note, You must be running Jamf Pro 10.3.1 or higher I think for these configuration profile options to be available.

bcbackes
Contributor

Thanks @matin ! That was my issue all along. I'm running Jamf Pro 10.0.0. We are in the process of migrating our server and updating Jamf, however, we are not there yet. I've just setup a DEV Server and installed the latest Jamf Pro 10.7.0. I found the "Approved Kernel Extensions" you were talking about. I'm excited to test this out. Thanks again!

bcbackes
Contributor

@matin Hello, I'm running Jamf 10.7 and have setup the Kernel Extension via Configuration Profile. I followed your instructions above as well. Palo Traps does install automatically, however, it doesn't appear to have any of the server settings in it.

I did verify that the "Servers.xml" is present with the Traps.pkg and the version file. I did create the postinstall script using the settings below:

!/bin/sh

postinstall

wait 10
/usr/sbin/installer -allowUntrusted -pkg /private/tmp/Traps_macOS_installer/Traps.pkg -target /
exit 0

I've packaged this as a PKG using Composer and uploaded this to the Jamf DP. I created a Policy to deploy this to all computers (doing this in my Dev environment). It deploys out when the computer checks in, however, after it installs and I open the Traps Console, there isn't anything in there. If I try to check-in I get an error. I'm not sure what I'm missing. Any ideas?

matin
New Contributor III

@bcbackes - Is the target client a DEP computer, user-enrolled computer or QuickAdd/Casper imaging client? Can you also verify that the target client MDM Profile is approved? This is required for the Kernel Approved Configuration Profile to deploy properly to macOS 10.13 or above clients. However, Traps for Mac install process sounds like all the components installed on the target system fine. Traps just cannot connect initially to the Traps Server. I would suggest trying the installation process on a 10.12 target client or below to verify the process.

Note, We are still utilizing the process that I wrote out in this document for 10.13 however we had to add Palo Alto to the kernel white list. Note, after the initial installation the client may require a restart.

bcbackes
Contributor

Just to follow up with everyone. I did get Traps to install correctly and contain all our server information. I've even tested using @matin's suggestion on making the package name generic (versionless). Then, I drop in the new pkg, save it in Composer, then, upload it using Jamf Admin. I've deployed out newer versions to existing installations and found that they upgrade without issues. I've even created an uninstaller that seems to work just fine.

Thanks for all the help!!! This was my first successful package that I've created in Composer!

cbanfield0818
New Contributor II

EDIT- Nevermind I just noticed it was a hidden file!

Hi Everyone,

So our zip folder does not contain a .version can anyone confirm this is the new normal with version 5 or am I missing something?

cbanfield0818
New Contributor II

So I was struggling in just about every way to get this working. Both using composer and also the solution shared by Martin.

I decided to get have a zoom meeting with Palo Alto and wanted to share my findings and what got it working for me so others don't go through my pain.

Anywho, I am not sure if its a new thing or what, but you can literally drag the Zip file into JAMF Admin and create a new policy to deploy the Zip. As long as you have the right whitelist information done its as smooth as any other deployment. Blew my mind it was that easy.

khey
Contributor

Oh wow, I came to this page after googling for Jamf palo alto traps and i was the OP.....
I managed to get it working and just couldnt remember this thread...

Here how i got it working.
FYI, this is for the Cloud version and should be the same as ESM Version.
Composer - Put the Installer under /Users/Shared
2ff4c99ce1cd4acea4948ddcd4a0f164

Post install Script

#!/bin/bash logFile="/Users/Shared/Traps_Install.log"

Check for Log file

if [ -f $logFile ]; then echo "$(date)" >> $logFile echo "Log Present" >> $logFile else touch $logFile echo "$(date)" >> $logFile echo "Log file Created" >> $logFile fi

Install the package

echo "Installing Traps Package..." >> $logFile /usr/sbin/installer -pkg "/Users/Shared/TRAPS_Cloud_Agent_macOS_6_1.0/Traps.pkg" -target / echo "Package installed..." >> $logFile

Launch Traps Service

echo "launch Traps plist..." >> $logFile sudo launchctl load /Library/LaunchDaemons/com.paloaltonetworks.trapsd.plist

Remove installer file

sudo rm -rf "/Users/Shared/TRAPS_Cloud_Agent_macOS_6_1.0" echo "deleting Traps folder" echo "complete" >> $logFile

My Policy
de79df2b5c174656bdbc5f2833b626bc

Extension Attribute

#!/bin/bash if [ -f /Library/Application Support/PaloAltoNetworks/Traps/version.txt ]; then version=$(cat /Library/Application Support/PaloAltoNetworks/Traps/version.txt | tail -1) echo "<result>$version</result>" else echo "<result>Not Installed</result>" fi

villap5
New Contributor

0afae70f6a574f748d5021618dc5c7d8

Hi, just wanted to post in this thread to see if anyone was able to resolve the issue when deploying (using Matin's steps of making a custom package in Composer) and getting a System Extension blocked pop-up for Security & Privacy. It pops up and but still allows the install to take place. What am I doing wrong that causes the pop-up?

I have the below Configuration Profile payload for Approved Kernel Extensions that is pushed before I run the policy to install the software.

Approved Team ID
DISPLAY NAME Palo Alto Traps
TEAM ID PXPZ95SK77
Approved Kernel Extensions(Optional) Approve the following bundle IDs only
DISPLAY NAME KERNEL EXTENSION BUNDLE ID com.paloaltonetworks.GlobalProtect.gplock com.paloaltonetworks.GlobalProtect.gpsplit com.paloaltonetworks.traps-agent com.paloaltonetworks.kext.pangpd com.paloaltonetworks.driver.kproc-ctrl

RedWings
Contributor

@villap5 Add Traps to an Approved Extensions Configuration Profile.

See this list for the Team ID and other information regarding Extensions.

https://docs.google.com/spreadsheets/d/1IWrbE8xiau4rU2mtXYji9vSPWDqb56luh0OhD5XS0AM/edit#gid=1070689416

bcbackes
Contributor

@villap5 I only have the Team ID entered. I don't have anything listed under the Optional Bundle IDs. The Bundle IDs, I believe, would only allow those particular things. I've added a screenshot of my Config Profile. 9835e01dd4d24518b289564e4ecbf871

cputnam
New Contributor

Has anyone been able to get a PPPC setup for Traps? When I tested our current policy on Catalina I had to approve installation of an extension and then "allow" notifications. I would like to avoid any need for user approval of the extenision and I want all users to get notifications from Traps by default

RedWings
Contributor

@cputnam My "Approved Kernel Extensions" Config Profile I used from Mojave works in Catalina. That includes Traps.

cputnam
New Contributor

Thanks Redwings - I will compare your AKE to mine and see if there is something different.

davidhiggs
Contributor III

Has anyone done a Jamf upgrade or Palo Alto console agent upgrade to a machine sitting at loginwindow and see it fail? I'm seeing it fail and then the agent is removed altogether! Doesn't happen if a user is logged in.

bcbackes
Contributor

@davidhiggs I've just tested this myself. Mac is running Mojave 10.14.6 and Traps 6.1.0. I made sure my Mac was at the login screen with no one else logged in. Added it to the scope for my new version package in QA (Cortex 7.0.2 - name change from Traps to Cortex). I used Jamf Remote to run a "sudo jamf policy" command to the Mac to kick it off. I checked the logs and it shows as installed. I confirmed that Cortex 7.0.2 installed successfully when I logged into the Mac.

Just so you know, I have my policy set to Reoccurring Checkin and Once Per Computer.

davidhiggs
Contributor III

@bcbackes that's interesting, this is what i'm doing too. Are you dragging the agent update as is (zip file) into Jamf and deploying that? or repackaging as suggested above? I've done both and get the same result. macOS install.log has some information i'll be reviewing with Palo Alto soon

bcbackes
Contributor

@davidhiggs I did repackage it with Composer. The reason for that is I'm moving the Uninstaller.app to a hidden location of my choosing so the average end user can't uninstall it. Here's what I'm doing:

  1. Unzip the contents. I place the entire unzipped content folder into the /tmp directory - with the exception of the Uninstaller.app.
  2. The Uninstaller.app I place in /var/folderIcreated for safe keeping.
  3. I pull those two things into my Composer package: the folder that contains the installer located in tmp and the uninstaller located in /var/folderIcreated.
  4. Package it up and load it into Jamf Admin.
  5. Create my policy and deploy it out.

This works like a charm for me. I suppose I could create a script to run afterwards that moves the Uninstaller.app to my desired location as well, however, I have everything right where I want it with this package and no need to create a script to run. Then for the next version I just go into composer and remove the old version files and place the new versions in there. Rinse and Repeat.

NOTE: I do change the ownership and permissions on the Uninstaller.app to Root:Wheel 754

Let me know if you have any questions.

erwinm
New Contributor II

@bcbackes , @matin or anyone , do you know how to remove the notification so it won't be displayed after successful installation? I'm using newer version of Traps. I'm using Composer and Configuration Profile to Approve Kernel Extension 637becd76de640d1893b7d86d36d6976

update : Fixed using https://github.com/Jamf-Custom-Profile-Schemas/jamf-manifests/blob/master/macOS%20Notifications%20(com.apple.notificationsettings).json , thanks @talkingmoose

dmahase
New Contributor II

@cbanfield0818 dragging the zip file straight to Admin worked like a charm.

I've been deploying to Catalina machines and I have the Configuration profile to allow Palo extension and another config profile to allow Full Disk Access for Authorized, pmd, and trapsd.

davidhiggs
Contributor III

@bcbackes Looks like I hit a known issue, addressed with v7.1.0. I'm about to test and see if it's fixed.

Heads up for everyone else - major changes in 7.1.0. New system extension approval needed and changes to PPPC, I assume no more kernel extension. Make sure you have these in place before pushing the update. They even have a Jamf deployment guide now: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-1/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

davidhiggs
Contributor III

Also, anyone that wants to use a Patch definition, I've got one in Community Patch under macmacintosh. Because of recent changes since v4-6 in 7.x and 7.1.x, it needs an EA to lookups which of 3 agents might be installed on the system.

davidhiggs
Contributor III

Documentation on Palo Alto's page for 7.1.0 is wrong and missing full disk access for the system extension needed for macOS 10.15. Seems they have confused settings relevant for 10.14 and below and 10.15 and higher. Have fed this back for clarification.

udhayakumar
New Contributor

In my office most of the users facing the same after upgrading into 7.1.0 it requires full disk access pop up for every time and i have read the PA support article https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-0/cortex-xdr-agent-admin/cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-for-mac doing manually for the machines one by one, do we able to automate this process from JAMF?

davidhiggs
Contributor III

@udhayakumar on that page, select v7.1 for newer info, but some of it is incorrect. What macOS versions are you deploying to?

For macOS 10.15, the missing information is to add the following PPPC config profile:

Identifier:

com.paloaltonetworks.traps.securityextension

Identifier Type: BundleID

Code Requirement:

identifier "com.paloaltonetworks.traps.securityextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77

App or Service: SystemPolicyAllFiles, Access: Allow