We should start a support group for this disaster!
We recently received a series of Certificate Authority, proxy server certs and Firefox prefs that our in-house security team mandated be a part of Firefox. There was one new CA cert, a handful of prefs and twelve certs, the latter needing to go under Servers in Firefox certificates view.
We DO NOT have the ability to add these prefs/certs for new users - Users that have not yet run Firefox so that the initial FF user profile is generated. We're working on a means of doing this.
<Shaking fists at sky>
Many moons ago, you could take a pref.js/firefox.cfg and cert8.db file from a working, test Firefox instance - inject these into /Applications/Firefox.app/Contents/Resources, and both new and existing users were good to go.
Mozilla, in their infinite wisdom and apparent sadism towards enterprise admins, did away with so many of these sanity-driven features around FF 45 or so. Not only did the centralized profile defaults structure go away, but the injection of Servers certificates has been deprecated.
I used CCK2 to create a small framework of desired prefs and adding the Certificate Authority piece. Other than that, CCK2 is just disastrous to any kind of enterprise-related use with Firefox.
</Fists>
Our JSS Firefox policy consists of two packages and one script.
Package 1: A DMG with the Firefox app directly from Mozilla. We quick start the app, run it so initial settings, etc. are in place and them use Composer to build the DMG
Package 2: A DMG containing Firefox prefs, Mozilla's NSS tools (compiled from their source code) and certificates
The script is run after the package have been deployed. Here are highlights of the script:
#!/bin/sh
#Pull a list of bona fide users present on the machine. Excludes admin and daemon/service accounts
#User names outputted to a temp file
dscl . -list /Users UniqueID | grep -v Old | awk '$2 >= 500 { print $1; }' > /Library/Application Support/JAMF/userlist.txt
##
#Firefox Certificate Update Routine
#The code below traverses the user's 'Application Support' directory
#Where a Firefox profile is located, the script extracts the unique profile foldername
#Certificates are updated using an in-house compile of Mozilla's open source NSS/NSPR toolset
#The toolset is deleted from the machine once updates are complete
#
#1. Add the new CA root certificate
#2. Add certificates for new, local Intranet proxy hosts
##
while read i
do
# The loop will be processed for all user FF profiles found
# stderr omitted from results to keep the results clean
searchResult="$(find /Users/$i/Library/Application Support/Firefox -type f -name cert8.db 2> /dev/null)"
if [ -e "$searchResult" ]
then
# Capture user name where FF profile path found
# Capture name of Mozilla's randomly-generated profile directory
# Both values are ECHOed to stdout so that the info will be included in the policy's installation logs
# For quicker troubleshooting
UserName="$(echo $i)"
ProfilePath="$(echo $searchResult | awk -F "/" '{print $8}')"
echo "User Name: $i"
echo "Profile Path: $ProfilePath"
# We had a couple of older, expired CA certs that needed to be deleted before the new one gets added
# Even if multiple certs have the exact same CN or other attributes, Mozilla tools still make you delete them in serial fashion
/opt/local/bin/nss-certutil -D -n "CN=*OMITTED*" -d /Users/$i/Library/Application Support/Firefox/Profiles/$ProfilePath/
/opt/local/bin/nss-certutil -D -n "CN=*OMITTED*" -d /Users/$i/Library/Application Support/Firefox/Profiles/$ProfilePath/
/opt/local/bin/nss-certutil -A -n "CN=*OMITTED*" -t "CT,C,C" -d /Users/$i/Library/Application Support/Firefox/Profiles/$ProfilePath/ -i /Library/Application Support/JAMF/certs/client/CAcert1.cer
/opt/local/bin/nss-certutil -A -n "*OMITTED*" -t "P,P,P" -d /Users/$i/Library/Application Support/Firefox/Profiles/$ProfilePath/ -i /Library/Application Support/JAMF/certs/client/ServerCert2.cer
/opt/local/bin/nss-certutil -A -n "*OMITTED*" -t "P,P,P" -d /Users/$i/Library/Application Support/Firefox/Profiles/$ProfilePath/ -i /Library/Application Support/JAMF/certs/client/ServerCert3.cer
cp -r /Library/Application Support/JAMF/JamfCustomapps/prefs/* /Applications/Firefox.app/Contents/Resources/
# Run a quick check of installed certs in the user's Firefox profile path. Query run against cert8.db
# Values ECHOed to stdout for inclusion in the policy's installation logs
certCheck="$(/opt/local/bin/nss-certutil -L -d /Users/$i/Library/Application Support/Firefox/Profiles/$ProfilePath)"
prefsCheck="$(cat /Users/$i/Library/Application Support/Firefox/Profiles/$ProfilePath/prefs.js | grep ntlm)"
echo $certCheck
echo $prefsCheck
fi
done < /Library/Application Support/JAMF/userlist.txt
#Clean up temp stores for certificates and NSS toolset
rm -fr /Library/Application Support/JAMF/JamfCustomApps/prefs
rm -fr /Library/Application Support/JAMF/JamfCustomApps/certsHere are some example values related to the script:
bash-3.2# pwd
/Users
bash-3.2# find . -type f -name cert8.db 2> /dev/null
./administrator/Library/Application Support/Firefox/Profiles/i8kfah8z.default/cert8.db
./mharper/Library/Application Support/Firefox/Profiles/9k5orbbs.default/cert8.db
bash-3.2# /opt/local/bin/nss-certutil -L -d /Users/mharper/Library/Application Support/Firefox/Profiles/9k5orbbs.default/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Google Internet Authority G2 ,,
<OMITTED>-Auth P,P,P
CN=<OMITTED> CT,C,C
DigiCert SHA2 Extended Validation Server CA ,,
DigiCert SHA2 Secure Server CA ,,Below is a screenshot of the folders/files taken from our customized FF instance and injected into the target machine's installed instance.
FWIW I have no issues with CCK and ESR 45.2.0. The instructions are vague for macOS but putting the output in the following locations works. I have noted in testing this I needed to open Firefox.app once before injecting the cck2 output, code signing was pitching a fit otherwise. Was able to drop this into a pkg and install it on another machine successfully.
I have switched to the autopkgr method which has been working well but I wanted to make sure I could still get this method working.
