I'm working on setting up a policy for GlobalProtect 5.1.4 which switches to System Extension from Kernel Extensions.
I've set up a config profile to approve the system extension.
First I tried just the team ID, then I added the ALLOWED SYSTEM EXTENSIONS as well.
but when I run systemextensionsctl list I get
1 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
* PXPZ95SK77 com.paloaltonetworks.GlobalProtect.client.extension (5.1.4-45/1) GlobalProtectExtension [activated waiting for user]and System Preferences>Security & Privacy still has this prompt
How can I approve this for the user?
I tried a blanket PPPC config profile that just gave it all access, but still have that prompt.
Anyone know how to solve this?
I can get the extension trusted
but my issue is that end users will now receive a prompt stating ""GlobalProtect" Would like to Add VPN Configurations" with an Allow or Don't Allow button. I'd like to suppress that or automate the choice of "Allow"
We started having issues with 5.0.8-4 and Catalina where any O365 traffic was having issues with Autosave (Word, Excel, PPT), syncing with OneDrive, Sharepoint (sites not loading), websites not loading completely, and Teams not sending messages. If the Gateway was changed or the GPCS was refreshed then the behavior briefly went away until the Gateway reconnected. Some days it was impossible to work, so I was able to disable VPN, but for end users, it's set to be always on.
I imagine that most users will just bypass autosave and save locally, which defeats the purpose of having OneDrive.
We opened a case with Palo Alto, Microsoft, and Apple. Palo Alto said it was a Safari issue. Microsoft confirmed that they use Webkit in their apps, Apple said, hey we'd love to help (and I don't know what behind the scenes things might be happening, but there is no partnership that I know of between Palo Alto and Apple, so its a crapshoot?)
One user got this from his ISP (COX Communications) along with his system warning him of his apps running out of memory.
So Moving to 5.1.4-45 was supposed to fix this issue, except that at the time our version of Jamf didn't support the System Extension payload and there was little or very hard to find documentation for Mac on Palo Alto's site. Until this weekend when we upgraded from Jamf Pro 10.13.1 to 10.22.1 (yeah, I know). Still, now that we have the payload, we reached out to Palo Alto once again for documentation on how to configure their stuff, and I feel bad for the engineer, who was very helpful, even though he ended up finding this same article. (Personally, I think the devs don't know that MDM also applies for Mac, but whatever.)
Because of this oversight, they shared with us that the kext would be removed but don't account for the fact that it being whitelisted by MDM stays put, until the device is taken out of scope for the KEXT whitelist config profile. To me it would appear that support for Catalina may have been dropped altogether.
I tested 5.1.4-45 on a 13" 2018 MBP with 10.15.5 by completely uninstalling GPCS (with their uninstaller). Allowed the system Extension, manually, and still had issues with Teams. All other o365 products works as expected. Once I un-scoped the KEXT Profile, Teams and the Office apps worked without issue.
So now all that's left is to test this payload and address the issue @daniel.behan regarding ""GlobalProtect" Would like to Add VPN Configurations" with an Allow or Don't Allow button.
But there is also one other issue that I am chasing a screenshot of, which is a Keychain login prompt. I should be talking to the engineer again before the week is out. I'll post my findings here once I hear back.
@strayer @daniel.behan Our challenge is the business wants this to be Always On and have as little user interaction as possible. Basically they want it totally automated.
I've found the article that talks about the Keychain login prompt.
https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-release-notes/gp-app-release-information/globalprotect-app-upgrade-downgrade-considerations.html
Among other things, it says: "The following Keychain pop-up prompt can appear if the Save User Credentials option is enabled in the portal configuration"
As for my test results from setting those two payloads, some of the issues came back that were experienced with Teams:
@daniel.behan I'm really not sure why your experience is much different than mine, That prompt has only happened for us a few times, and each time our Reset GlobalProtect policy has fixed it.
I've attached screenshots of the 2 GlobalProtect related config profiles that are pushed to every Catalina Machine.
Our "Reset GlobalProtect" Self service option triggers 3 other policies in a row.
First is the uninstall global protect
then it installs the relevant GlobalProtect settings (a .plist that presets the portal). (we initially developed this to switch users from one portal to another automatically, but it has become a useful troubleshooting step for us.)
then it reinstalls the GlobalProtect application.
Here is the script that I use to uninstall, I used suspicious package to take it out of the GlobalProtect install package.
#!/bin/sh
is_debug=1
if [[ "$1" ]] && [ $1 = "-d" ]; then
is_debug=1
fi
echo "is_debug=$is_debug"
USER_ID=`id -u`
if [ "$USER_ID" -ne 0 ]; then
echo "You must be root to run the script. Use sudo $0"
exit
fi
CONSOLE_USER=`stat -f "%Su" /dev/console`
CONSOLE_HOME=`eval echo ~${CONSOLE_USER}`
run_as_console_user=1
console_user_id=`id -u ${CONSOLE_USER}`
if [ $CONSOLE_USER = "root" ]; then
run_as_console_user=0
fi
install_dir=/Applications/GlobalProtect.app/Contents/Resources
app_log_dir=/Library/Logs/PaloAltoNetworks/GlobalProtect
mkdir -p "$app_log_dir"
uninstall_log_dir=$app_log_dir/PanGPInstall.log
if [ $is_debug -eq 1 ]; then
uninstall_log_dir=/var/log/PanGPUninstall.log
fi
exit_code=0
((
checkAndWaitProcess()
{
if [[ "$2" ]]; then
T="$2"
else
T=5
fi
C=0
while [[ C -lt $T ]] &&
( killall -s "$1" >/dev/null 2>/dev/null )
do
let C=C+1
sleep 1
done
killall -s $1 >/dev/null 2>/dev/null
return $?
}
pan_info()
{
curtime=`date`
echo $curtime ' ' $1 >> ${uninstall_log_dir}
}
curver=`defaults read ${install_dir}/../Info CFBundleShortVersionString`
echo "
"
pan_info "Uninstalling GlobalProtect version ${curver}, console user ${CONSOLE_USER}, home ${CONSOLE_HOME}"
pan_info "unloading gp agent"
if [ $run_as_console_user -eq 1 ]; then
launchctl bootout gui/$console_user_id /Library/LaunchAgents/com.paloaltonetworks.gp.pangps.plist
launchctl bootout gui/$console_user_id /Library/LaunchAgents/com.paloaltonetworks.gp.pangpa.plist
else
launchctl remove com.paloaltonetworks.gp.pangps
launchctl remove com.paloaltonetworks.gp.pangpa
fi
pan_info "unloading gp daemon"
launchctl remove com.paloaltonetworks.gp.pangpsd
#wait for 15 sec. while PanGPS quits
if checkAndWaitProcess "PanGPS" 60; then
pan_info "PanGPS didn't quit within 60 sec. Killing"
killall -15 PanGPS
if checkAndWaitProcess "PanGPS" 30; then
pan_info "PanGPS didn't quit after SIGTERM within 30 sec."
fi
fi
#wait for 5 sec. while GlobalProtect quits
if checkAndWaitProcess "GlobalProtect" 5; then
pan_info "GlobalProtect didn't quit within 5 sec. Killing"
killall -15 GlobalProtect
if checkAndWaitProcess "GlobalProtect" 5; then
pan_info "GlobalProtect didn't quit after kill within 5 sec."
fi
fi
ps aux | grep "/Applications/GlobalProtect.app/Contents/Resources/PanGPS" | grep -v grep
if [ $? -eq 0 ]; then
pan_info "PanGPS is still running, force exit"
killall -9 PanGPS
else
pan_info "PanGPS has stopped"
fi
ps aux | grep "/Applications/GlobalProtect.app/Contents/MacOS/GlobalProtect" | grep -v grep
if [ $? -eq 0 ]; then
pan_info "GlobalProtect is still running, force exit"
killall -9 GlobalProtect
else
pan_info "GlobalProtect has stopped"
fi
#check if agent and daemon has been removed from launchd
if [ $run_as_console_user -eq 1 ]; then
if launchctl print gui/$console_user_id/com.paloaltonetworks.gp.pangps > /dev/null 2>&1; then
pan_info "pangps agent not be removed"
exit_code=249
else
pan_info "pangps agent has been removed"
fi
if launchctl print gui/$console_user_id/com.paloaltonetworks.gp.pangpa > /dev/null 2>&1; then
pan_info "pangpa agent not be removed"
exit_code=249
else
pan_info "pangpa agent has been removed"
fi
fi
if launchctl print system/com.paloaltonetworks.gp.pangpsd > /dev/null 2>&1; then
pan_info "pangpsd daemon not be removed"
exit_code=249
else
pan_info "pangpsd agent has been removed"
fi
pan_info "Unloading driver"
ifconfig gpd0 down > /dev/null 2>&1
kextstat -b com.paloaltonetworks.kext.pangpd | grep com.paloaltonetworks.kext.pangpd | grep -v grep
if [ $? -eq 0 ]; then
pan_info "unloading pangpd driver."
kextunload -b com.paloaltonetworks.kext.pangpd
fi
kextstat -b com.paloaltonetworks.GlobalProtect.gpsplit | grep com.paloaltonetworks.GlobalProtect.gpsplit | grep -v grep
if [ $? -eq 0 ]; then
pan_info "unloading split tunnel driver"
kextunload -b com.paloaltonetworks.GlobalProtect.gpsplit
fi
kextstat -b com.paloaltonetworks.GlobalProtect.gplock | grep com.paloaltonetworks.GlobalProtect.gplock | grep -v grep
if [ $? -eq 0 ]; then
pan_info "unloading enforcer driver"
kextunload -b com.paloaltonetworks.GlobalProtect.gplock
fi
if kextstat -b com.paloaltonetworks.kext.pangpd | grep com.paloaltonetworks.kext.pangpd | grep -v grep; then
pan_info "unload pangpd kext failed."
exit_code=250
fi
if kextstat -b com.paloaltonetworks.GlobalProtect.gpsplit | grep com.paloaltonetworks.GlobalProtect.gpsplit | grep -v grep; then
pan_info "unload gpsplit kext failed."
exit_code=250
fi
if kextstat -b com.paloaltonetworks.GlobalProtect.gplock | grep com.paloaltonetworks.GlobalProtect.gplock | grep -v grep; then
pan_info "unload gplock kext failed."
exit_code=250
fi
pan_info "cleaning up sso"
cd ${install_dir}
./PanGPS -dsso
pan_info "Cleanup Dynamic Store"
echo "remove State:/Network/Service/gpd.pan/IPv4" | scutil
echo "remove State:/Network/Service/gpd.pan/DNS" | scutil
pan_info "rm all"
rm -f "/Library/LaunchAgents/com.paloaltonetworks.gp.pangps.plist"
rm -f "/Library/LaunchAgents/com.paloaltonetworks.gp.pangpa.plist"
rm -f "/Library/LaunchDaemons/com.paloaltonetworks.gp.pangpsd.plist"
rm -rf "/Library/Application Support/PaloAltoNetworks/GlobalProtect"
rm -rf "/Applications/GlobalProtect.app"
rm -rf "/Applications/GlobalProtect.app.bak"
rm -rf "/System/Library/Extensions/gplock.kext"
rm -rf "/Library/Extensions/gplock.kext"
rm -rf "/Library/Security/SecurityAgentPlugins/gplogin.bundle"
rm -rf /Library/Preferences/com.paloaltonetworks.GlobalProtect*
rm -rf /Library/Preferences/PanGPS*
if [ $run_as_console_user -eq 1 ]; then
pan_info "removing gp user config files in (${CONSOLE_HOME})."
rm -rf "$CONSOLE_HOME/Library/Application Support/PaloAltoNetworks/GlobalProtect"
rm -rf "$CONSOLE_HOME"/Library/Preferences/com.paloaltonetworks.GlobalProtect*
rm -rf "$CONSOLE_HOME"/Library/Preferences/PanGPS*
#remove password entry from keychain
security delete-generic-password -l GlobalProtect -s GlobalProtect "${CONSOLE_HOME}/Library/Keychains/login.keychain-db"
fi
#10.9 addition to clear system preferences cache
killall -SIGTERM cfprefsd
pan_info "uninstall packages from globalprotect"
for pkg in `pkgutil --pkgs |grep com.paloaltonetworks.globalprotect`
do
pkgutil --forget "$pkg"
done
rm -rf /Library/Logs/PaloAltoNetworks/GlobalProtect/*
pan_info "Uninstallation finished."
exit $exit_code
) 2>&1) >> ${uninstall_log_dir}UPDATE:
Setting up two different Config Profiles to test with individually still has issues with connectivity with Teams and other internet connectivity. The only thing being managed at this point is the Config Profile.
The Mac is scoped.
Config Profile is verified.
Software is installed with the installer with the System Extensions box checked.
Both make no difference as it relates to performance.
CP #1
CP#2
We still see this prompt:
So then I looked in Little Snitch and I see this:
So that message is strange. I can't find any documentation on it. But I go and look at what's in that folder referenced above and I see each system extension for every time I installed GPCS. I tried uninstalling it while having it opened, and they don't come out. I tried deleting them myself and I get this message:
It was almost 1AM so I called it a night. I'm at a total loss here.
@sdagley Right, but if the set up is that you can't log into the client because the connection is needed to verify that it's you, then it's a chicken and egg situation. Meanwhile the user gets prompted with asks to allow for extensions where the buttons are not clickable and in the case of standard users they can't allow for the extension in System Prefs.
