Skip to main content
Solved

Need help with xattr command

M
Forum|alt.badge.img+3

I need to deploy Cisco anyconnect VPN client on MAC endpoints, however post installation, it gives prompt to end user to allow the app from system preferences.

I want to bypass this step so that post deployment end user does not have to go to system pref to allow the app

Xattr command i am using is 

sudo xattr -d -r com.apple.quarantine /Users/username/Downloads/AnyConnectClient

where the AnyConnectClient is a folder where the anyconnect.dmg file resides

However, the command is not working for me. post installation, it still asks for user to allow the app from system preferences
Does xattr work on .dmg file? 
Do i need to install the app first then run the command and then give path to some app system file? 
If so, how do it create package of the installer which is free of this restriction?

Best answer by sdagley

madhavigandhi1 wrote:

Hi, i was able to create configuration profile with below payloads and post that installed anyconnect client. this time it did not prompt for allow from system preference . thank you for your support.


@madhavigandhi1 Note that you normally do not need (or want) to have both the Approved Kernel Extensions and System Extensions payloads in the same profile.

I do not have any personal experience configuring AnyConnect, and the Cisco doc I referenced indicates that the Kernel Extension is only used as a fallback for macOS 11 or later, so you might want to have 2 different Configuration Profiles - one for macOS versions <11.0 which include the Approved Kernel Extensions payload, and one for macOS 11.0 and > which does not.

You _definitely_ do not want to include an Approved Kernel Extensions payload if deploying the Configuration Profile to Macs with an Apple Silicon processor.

View original
    Did this topic help you find an answer to your question?

    6 replies

    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3537 replies
    • March 22, 2022

    @madhavigandhi1 You shouldn't need to modify the xattrs on the AnyConnectApp if you ran the installer, but you do need to install a Configuration Profile with a System Extensions payload to approve it, and the details on that can be found at: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect49/upgrade/AnyConnect_macOS_BigSur_Advisory.html

     

    M
    1 person likes this
    • M
      madhavigandhi1
    M
    Forum|alt.badge.img+3
    • madhavigandhi1
    • Author
    • New Contributor
    • 3 replies
    • March 23, 2022

    @sdagley 

    Thank you for the cisco URL shared.
    I tried to add the configuration profile with mentioned payloads, the profile is getting added to scoped computer successfully.
    However, post configuration profile being added to computer, when the anyconnect  dmg is installed, it still prompts for allowing the extension from system preference.
    do you have any other way auto allowing this "system software from application "cisco anyconnect socket filter" was blocked from loading". so that the end user does not have to do it go to sys preference to allow it

    J
    Forum|alt.badge.img+8
    • jpeters21
    • Valued Contributor
    • 108 replies
    • March 23, 2022
    madhavigandhi1 wrote:

    @sdagley 

    Thank you for the cisco URL shared.
    I tried to add the configuration profile with mentioned payloads, the profile is getting added to scoped computer successfully.
    However, post configuration profile being added to computer, when the anyconnect  dmg is installed, it still prompts for allowing the extension from system preference.
    do you have any other way auto allowing this "system software from application "cisco anyconnect socket filter" was blocked from loading". so that the end user does not have to do it go to sys preference to allow it


    If it can be done, I haven't found a way. The systems extensions for PPPC make so a non-admin user can approve, but not completely eliminate. MAC OS has an user space centric approach to security. Only good note is usually a one time deal .. as long as the vendor does not change the app or  extension names across versions it sticks. 

    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3537 replies
    • March 23, 2022
    jpeters21 wrote:

    If it can be done, I haven't found a way. The systems extensions for PPPC make so a non-admin user can approve, but not completely eliminate. MAC OS has an user space centric approach to security. Only good note is usually a one time deal .. as long as the vendor does not change the app or  extension names across versions it sticks. 


    You can definitely approve System Extensions so that the user never sees a prompt to enable them in System Preferences->Security & Privacy, but it's not a PPPC payload that does that, it the System Extensions payload.

    M
    Forum|alt.badge.img+3
    • madhavigandhi1
    • Author
    • New Contributor
    • 3 replies
    • March 24, 2022

    Hi, i was able to create configuration profile with below payloads and post that installed anyconnect client. this time it did not prompt for allow from system preference . thank you for your support.

    sdagley
    1 person likes this
    • sdagley
      sdagley
    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3537 replies
    • Answer
    • March 24, 2022
    madhavigandhi1 wrote:

    Hi, i was able to create configuration profile with below payloads and post that installed anyconnect client. this time it did not prompt for allow from system preference . thank you for your support.


    @madhavigandhi1 Note that you normally do not need (or want) to have both the Approved Kernel Extensions and System Extensions payloads in the same profile.

    I do not have any personal experience configuring AnyConnect, and the Cisco doc I referenced indicates that the Kernel Extension is only used as a fallback for macOS 11 or later, so you might want to have 2 different Configuration Profiles - one for macOS versions <11.0 which include the Approved Kernel Extensions payload, and one for macOS 11.0 and > which does not.

    You _definitely_ do not want to include an Approved Kernel Extensions payload if deploying the Configuration Profile to Macs with an Apple Silicon processor.

    P
    M
    2 people like this
    • P
      ponyboy
    • M
      madhavigandhi1

    Reply


    Most helpful members this week

    Terms & ConditionsCookie settingsAccessibility statement

    Cookie policy

    We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

     
    Cookie settings