SentinalOne Install on Catalina

ekarazhov
New Contributor III

Here are the steps I took to package it. I put installer and site token file in var/temp and then dragged the entire folder in to composer. created a package. created a policy with that package and the following command to install the package
usr/sbin/installer -pkg /var/tmp/SentinelAgent_macos_v3_6_1_2964.pkg -target /Applications

Result of command:
installer: Package name is SentinelOne
installer: Installing at base path /
installer: The install failed. (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. An error occurred while running scripts from the package “SentinelAgent_macos_v3_6_1_2964.pkg”.)
I am at a loos, I have been playing with this for a whole day now and none of the commands I put work... ;(

1 ACCEPTED SOLUTION

AdamCraig
Contributor III

From the main screen click on Computers>Management Settings(bottom left). Then "Extension Attributes"
Click "New" Give it a name like "SentinelOne Version"
Inventory Display controls which menu on a computer's record it shows up in. I generally change that to "Extension Attributes"
Change Input Type to Script and then paste the script you have above.

When the computers run inventory after this it will collect the version of SentinelOne in addition to the other information that it collects. This does mean it'll take a few days for all your computers to report the information to Jamf
You also can make smart groups based on this information once it is set up.

View solution in original post

22 REPLIES 22

ooshnoo
Valued Contributor

are you upgrading a Mac that already has S1 installed, or installing new?

I found that updating an existing agent fails...just as you're seeing...yet installing new works fine. I ended up having to upgrade all 10.15.3 clients via the S1 admin console.

gforsyth
New Contributor III

Agree, we do all updating through the S1 console and haven’t had issues with that.

John_McCarthy
New Contributor

Hey ekarazhov, I had the same issue and worked with Sentinalone on it. I have the installer cache to the waiting room and run this script in the same policy.

#!/bin/sh

sudo echo "Site Token Goes Here" > /Library/Application Support/JAMF/Waiting Room/com.sentinelone.registration-token
sudo /usr/sbin/installer -pkg /Library/Application Support/JAMF/Waiting Room/SentinelAgent_macos_v3_6_1_2964.pkg -target /

AdamCraig
Contributor III

I've screwed around with this for a bit and came up with this that seems to be consistently working.
I pkg up the sentinel one installer so it gets installed into /tmp/sentinelagent_macos_v_########.pkg
then install that, and run this script after.

This will install on computers that don't have sentinel one and upgrade on computers that do. My issue with updating through the console is that there always seem to be a few that i can't get to update. Jamf has been more consistent once I've gotten it to work.

EDIT: for the record this is a mishmash of like 3 different scripts from the macadmin #sentinelone slack channel.

#! /bin/bash

#I package up the S1 installer and put it install it to /tmp/
#Then i run this script after that pkg has been installed

PKG_NAME="$4"

## ex: SentinelAgent_macos_v3_0_4_2657.pkg
## ex: SentinelAgent_macos_v3_2_0_2671.pkg

INSTALL_PKG="/tmp/$PKG_NAME"
S1_BINARY="/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentinelctl"

if [ `id -u` != 0 ]; then
    /bin/echo "Error: You must run this command as root"
    exit 1
fi

if [[ "$PKG_NAME" == "" ]]; then 
    /bin/echo "Error: The parameter 'SentinelOne .pkg Name' is blank. Please specify a value." 
    exit 1 
fi

if [ ! -f "${INSTALL_PKG}" ]; then
    /bin/echo "Error: ${INSTALL_PKG} does not exist, exiting"
    exit 1
fi

cd /tmp/

## if sentinelctl exists Upgrade sentinel one
if [[ -f ${S1_BINARY} ]]; then
    echo "sentinel on computer. Upgrading sentinel"
    /usr/local/bin/sentinelctl upgrade-pkg ${INSTALL_PKG}
else
    #if not then install sentinel one
    ## create registration token
    cat > /tmp/com.sentinelone.registration-token << END
your registration token goes here==
END
chmod -R 777 "/tmp/com.sentinelone.registration-token"
    /bin/echo "sentinel not on computer, beginning sentinel install"
    /usr/sbin/installer -pkg ${INSTALL_PKG} -target /

    #clean up registration token
    sleep 10
    rm /tmp/com.sentinelone.registration-token

fi


#Clean up the installer
rm ${INSTALL_PKG}

exit 0

ekarazhov
New Contributor III

@ooshnoo I am not upgrading, this would be a new install.
@gforsyth For some reason our S1 admin decided to dump this on me. i'll ask him if he even tried to do that upgrade via console.
@John.McCarthy i'd have to try that method, thank you. @strayer so is this script does install if not installed, and does upgrade if the version is lower? Do you install .pkj file along with the site toke file?

AdamCraig
Contributor III

@ekarazhov This script creates the site token file. You have to put your token into the script replacing the line your registration token goes here==
but yes installs if not installs. Upgrades if a lower version. This lets me use one policy for new computers and for upgrading computers with old versions.

ooshnoo
Valued Contributor

just put the token file in the same folder as the S1 installer package. Wrap it in a DMG using Composer, then when install that dmg using policy and add the installer command under Files and Processes.

ekarazhov
New Contributor III

@strayer Thank you i will try it :)
@ooshnoo I was doing .pkg but i will try making a DMG file instead.
Thank you guys for you suggestions! :)

wILLwILL2
New Contributor II

I had the same issue and @John.McCarthy suggestion to cache the pkg file and run the script worked for me. On all previous versions. I used to package the installer and run the command to apply the site token but as of SentinelAgent_macos_v3_6_1_2964 it no longer works. Thanks again John

ekarazhov
New Contributor III

@strayer Hi, i was wondering if you can take a look at my set up. I think i followed your instructions properly but when i run policy from the Self Service i get an error. my setup policy is like this.

10f8339600f641d1bc290ecb155f01a7

8ab0043c6a914288915054d9b642b818
in the same policy. and my script looks like this.

#! /bin/bash

#I package up the S1 installer and put it install it to /tmp/
#Then i run this script after that pkg has been installed

PKG_NAME="$S1_Install_Updrade v3_6_1_2964"

## ex: SentinelAgent_macos_v3_0_4_2657.pkg
## ex: SentinelAgent_macos_v3_2_0_2671.pkg

INSTALL_PKG="/tmp/$PKG_NAME"
S1_BINARY="/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentinelctl"

if [ `id -u` != 0 ]; then
    /bin/echo "Error: You must run this command as root"
    exit 1
fi

if [[ "$PKG_NAME" == "" ]]; then 
    /bin/echo "Error: The parameter 'SentinelOne .pkg Name' is blank. Please specify a value." 
    exit 1 
fi

if [ ! -f "${INSTALL_PKG}" ]; then
    /bin/echo "Error: ${INSTALL_PKG} does not exist, exiting"
    exit 1
fi

cd /tmp/

## if sentinelctl exists Upgrade sentinel one
if [[ -f ${S1_BINARY} ]]; then
    echo "sentinel on computer. Upgrading sentinel"
    /usr/local/bin/sentinelctl upgrade-pkg ${INSTALL_PKG}
else
    #if not then install sentinel one
    ## create registration token
    cat > /tmp/com.sentinelone.registration-token << END
your registration token goes here==
END
chmod -R 777 "/tmp/com.sentinelone.registration-token"
    /bin/echo "sentinel not on computer, beginning sentinel install"
    /usr/sbin/installer -pkg ${INSTALL_PKG} -target /

    #clean up registration token
    sleep 10
    rm /tmp/com.sentinelone.registration-token

fi


#Clean up the installer
rm ${INSTALL_PKG}

exit 0

AdamCraig
Contributor III

@ekarazhov To clarify the == after the site token was part of my site token that I didn't delete when I posted the script. So if that's not in your site token then delete that part.
I made the PKG_NAME="$4" so that the variable could be given to it by the Jamf Policy (see attached image)

if you are going to define the PKG_NAME variable in the script then remove the $
Also the PKG_NAME is the name of the actual sentinelone installer not the package that contains the sentinelone installer that you upload to JAMF. So unless you renamed the package it should match what I have as that is the one downloaded from the sentinelone console.
my installer goes into /private/tmp/ (i attached a screen shot of my composer package as well)
Hope that helps.

EDIT: ALSO SUPER IMPORTANT THING! YOU CANNOT HAVE A / IN THE NAME OF A SCRIPT! It looks like your script is name install/upgrade a script named that will fail 100% regardless of what is in the script. See https://www.jamf.com/jamf-nation/discussions/33905/til-having-a-in-a-script-name-causes-it-not-to-ru...

a2db1ac7eaf248a8ab03e40758395425

c75aa72a81044f8c8fd2071b27a2d20f

ekarazhov
New Contributor III

@strayer I'll try it, thank you. silly question. i don't have access to S1 console so i can't really see what version of S1 is on a mac. is there any way i can glean that info directly on a mac itself?

AdamCraig
Contributor III

@ekarazhov Don't know where this one was sourced from. But we have an extension attribute that reports the SentinelOne Version.

if [ -f "/usr/local/bin/sentinelctl" ] ; then 
    RESULT=$( /usr/local/bin/sentinelctl version | awk '{print $2 $3}' )
else
    RESULT="not installed"
fi

echo "<result>$RESULT</result>"``

ekarazhov
New Contributor III

@strayer

#!/bin/bash

# Check to see if the SentinelOne agent is installed.
# If the agent is installed, report the agent
# version.

if [ -f "/usr/local/bin/sentinelctl" ] ; then 
    RESULT=$( /usr/local/bin/sentinelctl version | awk '{print $2 $3}' )
else
    RESULT="not installed"
fi

echo "<result>$RESULT</result>"

Found this code by accident after i read your post, lol
Now i am going to have to figure out what is extension attribute and how to configure it in jamf.. :) if you have any suggestions i am all ears. i am a bit new to jamf, so still learning.

AdamCraig
Contributor III

From the main screen click on Computers>Management Settings(bottom left). Then "Extension Attributes"
Click "New" Give it a name like "SentinelOne Version"
Inventory Display controls which menu on a computer's record it shows up in. I generally change that to "Extension Attributes"
Change Input Type to Script and then paste the script you have above.

When the computers run inventory after this it will collect the version of SentinelOne in addition to the other information that it collects. This does mean it'll take a few days for all your computers to report the information to Jamf
You also can make smart groups based on this information once it is set up.

dugnl
Contributor

Neither the old method of adding the site token in a files/process or copying the site token into a com file directly into a folder worked for me for sentinelone 4.1.1.3099 Using John.McCarthy's idea did work. Mojave and Catalina. For new installs only. I always uninstall via the Sentinelone console which thankfully I also have access.

tauruskarthick
New Contributor II

@strayer Thanks for the script. It works perfectly well.

But I've another concern to everyone that I would like to install the SentinelOne from share drive or cloud storage.

I assume, pkg location can be changed, but I don't know what will be the script for that. Kindly help on it. Thanks.

tauruskarthick
New Contributor II

@strayer Thanks for the script and it worked well.

However, I've concern that I would like to install the sentinelOne to be installed from cloud storage or shared drive.

Kindly help on the same. Thanks.

AdamCraig
Contributor III

@tauruskarthick I have an updated version of the script on my github
https://github.com/theadamcraig/jamf-scripts/blob/master/sentineone_postinstall.sh

the install directory is in like 33 of the script and you can make it whatever you want. If it's a shared drive the user will have to have it mounted first.
The new version of the script will check both the install directory and the jamf waiting room and use the installer where it finds it.

heavymeta80
New Contributor II

@strayer I'd like to use your updated script to upgrade our old SentinelOne clients but the postinstall script fails with install.log displaying ./postinstall: Error: /tmp// does not exist, exiting
I've checked and my directory containing the installer and reg file are both in /tmp so I'm not sure where the issue is.

AdamCraig
Contributor III

@heavymeta80 That's odd. Curious why there is an extra slash there. Are you providing the .pkg name as variable $4?

I've honestly stopped re-packaging things and putting them in /tmp I just cache the installer so it installs right from the waiting room.

1074e3e7deee472cad52555540e367bc

8978746f5c814747ada045c749beed01

DoctorFunkie
New Contributor

I ran into the same issue. I found in the policy that I had my packages set as install when it needed to be set as "Cache".  The script completes the download for me