We have an annual PCI audit that we have to run on randomly selected Macs once a year. After the Macs have been selected, I scope those Macs to a policy that runs the script below. Everything works up to the point of uploading the resulting .zip file to the computer record on the Jamf server. I keep getting a "curl: (26) Failed to open/read local data from file/application" error. Unfortunately my curl skills are weak and I can't figure out what I'm doing wrong. I think I'm doing something wrong with the -F option or I'm not using the variables correctly in the curl command (line 91).
#!/bin/bash
# this script s used to collect a full system profiler dump in txt format
# as well as user accounts, groups, crowdstrike info, open ports
# it will put all the files in /Library/company/PCI/<computername>/
# for later retrieval and submission for PCI audit
# Set variables for the JAMF API
jamf_url="https://company.jamfcloud.com"
jamf_user="API-only-account"
jamf_password="password_here"
computer_id=$(jamf recon | grep '<computer_id>' | awk -F'[<>]' '{print $3}')
echo $computer_id
SERIAL=`ioreg -l | awk '/IOPlatformSerialNumber/ { print $4;}' | sed 's/"//g'`
echo $SERIAL
PCI_PATH="/Library/company/PCI/$SERIAL"
timestamp=$(date "+%Y.%m.%d")
year=$(date "+%Y")
auditlog="$SERIAL-$timestamp.zip"
echo $auditlog
# if there is already a folder in the target location (probably from an earlier capture) this will delete it
if [[ -d /Library/company/PCI/$SERIAL ]] ; then
rm -Rf /Library/company/PCI/$SERIAL
fi
# Creates the ./PCI/<serial number> folder
mkdir -p $PCI_PATH
# Local user accounts
# dscl . list /Users | grep -v '_' > /Library/company/PCI/$SERIAL/User.txt
# All accounts (human and system) and Directory with Name
# dscacheutil -q user > /Library/company/PCI/$SERIAL/UserDirectory.txt
# Groups
# dscacheutil -q group > /Library/company/PCI/$SERIAL/groups.txt
# All user and system accounts that do not start with _
dscacheutil -q user | perl -00ne 'print if !/name: _/' > $PCI_PATH/Users.txt
echo "user and system accounts saved
"
# All groups that do not start with _
dscacheutil -q group | perl -00ne 'print if !/name: _/' > $PCI_PATH/Groups.txt
echo "all non invisible groups saved"
# Generates a plain text list of applications and version info
system_profiler SPApplicationsDataType > $PCI_PATH/Applications.txt
echo "list of all applications saved"
# Crowdstrike Status
/Applications/Falcon.app/Contents/Resources/falconctl stats > $PCI_PATH/crowdstrike.txt
echo "Crowdstrike status saved"
# Lists Services in a similar manner to what is listed in the computer record in Jamf
cat << 'EOT' > /Library/company/PCI/$SERIAL/SERVICES_NOTE.txt
the list of services was generated by the following command:
/bin/launchctl list | /usr/bin/awk '{print substr($0, index($0, $3))}' | /usr/bin/sed '1d'
EOT
echo "" > $PCI_PATH/Services.txt
/bin/launchctl list | /usr/bin/awk '{print substr($0, index($0, $3))}' | /usr/bin/sed '1d' >> $PCI_PATH/Services.txt
echo "list of services saved"
# full system profiler dump
system_profiler -xml -detailLevel full > $PCI_PATH/system_profiler_full.xml
echo "The system_profiler_full.xml file can be renamed with .spx extension and can then be opened directly with the System Information.app found in macOS of all versions" > /Library/company/PCI/$SERIAL/SYSTEM_PROFILER_NOTE.TXT
echo "System Profiler dump saved
"
# Open ports listening
lsof -i -P | grep -i "listen" > $PCI_PATH/openports.txt
echo "list of open ports saved"
# evidence of time sync
touch /var/db/ntp-kod
chmod 666 /var/db/ntp-kod
sntp -sS time.apple.com > $PCI_PATH/timesync.txt
echo "" >> $PCI_PATH/timesync.txt
echo "" >> $PCI_PATH/timesync.txt
echo "commands used to generate this data: touch /var/db/ntp-kod ; chmod 666 /var/db/ntp-kod ; sntp -sS time.apple.com" >>$PCI_PATH/timesync.txt
echo "time sync info saved"
# Zips up all the files generated in the /PCI/<serial number>/ folder
zip -r $auditlog $PCI_PATH
# Upload file to computer record using JAMF API
curl -X POST -u "${jamf_user}:${jamf_password}" "${jamf_url}/JSSResource/fileuploads/computers/id/${computer_id}" -F name=@auditlog -F file=@$PCI_PATH-$timestamp.zip
echo "Evidence gathered for the $year Audit. Done"Can someone a little more curl-savvy point out where I went wrong?
