Posted on 01-04-2019 01:57 PM
I am having issues deploying AnyConnect through JSS due to it installing all of the extras that come with it when we only need to install the VPN portion of the application. I am trying to find a way to have none of the extras when pushing this to our machines via policy.
Posted on 01-04-2019 02:02 PM
Did you package it with just the parts necessary and not the other parts, such as DART?
The way I've done it is a run a capture on what I want then a post script to kickstart the service. We use the VPN and DART only.
Posted on 01-04-2019 02:25 PM
Check out the responses on this post...
I used parts of @pmcgurn 's script and it works perfectly.
Posted on 01-04-2019 02:46 PM
Posted on 01-04-2019 03:27 PM
Yeah, set your choicechanges.xml, create a package to install the AnyConnect installer and the choicechanges.xml into a temp directory (or wherever you want), then run this:
#!/bin/sh /usr/sbin/installer -pkg /Library/Application Support/JAMF/CiscoApp/AnyConnect.pkg -target / -applyChoiceChangesXML /Library/Application Support/JAMF/CiscoApp/Choice.xml rm -r /Library/Application Support/JAMF/CiscoApp/
Posted on 01-05-2019 04:14 PM
If its any help, this is how I do it...
This is a snippet of my script which creates the XML file. This will install AnyConnect and DART, so simply add the items you don't want or remove the ones you do based on the <string>feature</string> format...
#!/bin/sh cat <<EOF > "/var/tmp/Custom_Install-AnyConnect.xml" <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <array> <string>choice_websecurity</string> <string>choice_fireamp</string> <string>choice_posture</string> <string>choice_iseposture</string> <string>choice_nvm</string> </array> </plist> EOF
Posted on 01-08-2019 06:49 AM
I don't yet have my Jamf server running -
Can I utilize something like this in AutoDMG to build my image? I've had to configure a system and make an image of - it - only because of the AnyConnect installer....
Posted on 01-08-2019 02:59 PM
This is what I use
#!/bin/bash /opt/cisco/anyconnect/bin/amp_uninstall.sh /opt/cisco/anyconnect/bin/iseposture_uninstall.sh /opt/cisco/anyconnect/bin/nvm_uninstall.sh /opt/cisco/anyconnect/bin/umbrella_uninstall.sh /opt/cisco/anyconnect/bin/websecurity_uninstall.sh
Posted on 01-09-2019 07:13 AM
Posted on 01-09-2019 07:37 AM
Posted on 01-09-2019 09:49 AM
There is also an easy way to fix the pkg file to install just what you want. Here bis what i do. And this solution was posted by cosmo-slug
Expand the AnyConnect.pkg
Pkgutil --expand AnyConnect.pkg ~/Documents/AnyConnectVPN
then I opened the Distribution file inside of the expanded package and look for these type entries
<choices-outline> <line choice="choice_vpn"/>
Leave what you want and delete the ones you don't
After saving the Distribution file, I flattened the package.
pkgutil --flatten ~/Documents/AnyConnectVPN ~/Desktop/AnyConnect 4.7.00136.pkg
This way has been working for me for a while. @cosmo-slug posted this on JAMF but I could not locate the post.
Posted on 01-09-2019 10:49 AM
@MikeF Which "AnyConnect.pkg" are you using for 4.7? anyconnect-macos-4.7.00136-webdeploy-k9.pkg?
I just posted on another post...so a quick repost of my errors trying to use your method:
I couldn't open them with pkgutil either (pkgutil --verbose --expand <filename> <dir>). I get this error:
"Could not open package for expansion: anyconnect-macos-4.7.00136-webdeploy-k9.pkg"
I tried to chmod +777 the file to see if it was a permissions issue there, but no dice.
The md5 of my pkg file is: MD5 (anyconnect-macos-4.7.00136-webdeploy-k9.pkg) = 5b41987662967d64d98d02106955f4a7
Can you tell me if I'm using the right package file and if yes, do our MD5 hashes match?
Posted on 01-09-2019 10:59 AM
@dfriedlander you'll want to use the AnyConnect ”predeploy” package to push via jamf.
Webdeploy is the version installed automatically by the ASA.
Posted on 01-09-2019 01:49 PM
Okay, I consolidated the advice I got here into a step by step for those who read this post days, months, years from now.
Posted on 11-06-2021 11:44 AM
Thank you! This worked nicely.
I changed the directories to: cd /Library/Application\ Support/tmp - instead of the Desktop
Posted on 01-09-2019 06:00 PM
I highly suggest using this little puppy... Makes life so much easier!
installPKGfromDMG with extra parameters for supplying an xml answer file within your DMG container
Create your xml file, add it into your DMG next to your PKG... Supply parameters
dmgName="" # Required eg anyconnect.dmg
forcesuccessflag="" # Optional
useinstallerapp="" # Optional eg YES
allowUntrusted="" # Optional
applyChoiceChangesXMLFile="" # Optional eg myfileinsidethedmg.xml
Supplying parameter 5/forcesuccessflag with "YES" without quotes and case sensitive allows PKG exit code to be bypassed and returns a forced exit code of 0 to the JSS (if needed).
Supplying parameter 6/useinstallerapp with "YES" without quotes and case sensitive forces the use of macOS native installer binary to install the PKG.
Supplying parameter 7/allowUntrusted with "YES" without quotes and case sensitive allows to bypass an invalid or expired certificate embedded within the PKG.
Supplying parameter 8/applyChoiceChangesXMLFile with an XML filename allows the PKG to be supplied an xml answerfile. The xml file MUST be beside the PKG wrapped in your DMG.
Please take careful note, that parameters 7 (allowUntrusted) and 8 (applyChoiceChangesXMLFile) are dependent on parameter 6 (useinstallerapp) being YES. I've also added mpkg if no pkg is found within the DMG. Additionally all parameters will be parsed in the logs so one can see if, when, and where something went wrong.
Posted on 12-20-2021 12:14 PM
This link has been eaten by link rot. Here is a more sturdy link courtesy of bsuggett
Posted on 01-09-2019 06:13 PM
Just keep in mind that if you use the expand/flatten methodology I believe you lose the signed certificate that comes with the original package, and that depending on Mac security settings installing unsigned packages can sometimes be difficult.
I've used both and settled on the XML answer file method because it's easier. A lot easier editing the xml file and building a one time script to apply it rather then editing those packages from Cisco every few weeks or so when the latest AnyConnect is released.
Posted on 03-29-2020 03:06 PM
Ted, how are you deploying updates? My office wants to deploy them using the web-deploy package from the ASA. Problem is that it asks for an admin username and password.