This was a recent list I was given:
Firewall on with exceptions (presently disabled)
Completed.
Manually adjusting the .plist files on the machine does adjust the exceptions in the firewall policy. However this can only be done on an application basis and it requires you auth every time you make a change. Also OSX does not respect Casper trying to update the .plist files themselves. Therefore, any firewall changes have to be pushed via a dmg that overwrites the com.apple.alf.plist file with root access and this has been done.SSH (remote login) only for admins (presently all users)
Wi-Fi off for iMacs (presently defaults to on)
Completed. I created a bash file called disablewifi.sh#!/bin/sh
OS=/usr/bin/defaults read /System/Library/CoreServices/SystemVersion ProductVersion | awk '{print substr($1,1,4)}'
#10.6 Wireless is referenced as Airport and 10.7 is referenced as Wi-Fi
if [[ "$OS" < "10.7" ]]; then
echo Turning off wireless for 10.6 iMac
/usr/sbin/networksetup -setnetworkserviceenabled Airport off
else
echo Turning off wireless for 10.7 iMac
/usr/sbin/networksetup -setnetworkserviceenabled Wi-Fi off
Fi
exit 0
From there, I created a smart group in Casper that put all of the iMacs into a single group.
Lastly, I created a policy to deploy the script to all the iMacs and ran it.
Disabling of the Internet Sharing setting across the board.
I'm not sure how to get this done. I have a script that can indeed turn it off. But that doesn't actually solve the problem. Macs with this turned on tend to exhibit weird behavior on our network, aka impersonating other computers for no reason. If you just turn this off in system preferences it doesn't actually stop impersonating. You have to check another option like firewire or bluetooth that wouldn't normally have TCP/IP traffic and then turn ICS off for the impersonation to go away. So if its off and ethernet or wi-fi is checked (and wi fi is in use) it will still behave badly.Active Patch Management (pushing, scheduling and monitoring patches)
Computers that are powered on and have network connection between the hours of 12:01AM-7:59AM and 10:01PM-11:59PM on every Saturday install patches
Computers that need to have forced patched installs can be added to a special policy as required.
o Also investigate a way to specify multiple update servers in the plist
This is not possible. The .plist for the update server is only programed to accept one variable.
Have talked to JAMF and a possible work around is we create another Casper server in the DMZ that clients can talk to and if they are outside of the TCU network have them update the .plist file back to the default setting.
On the other hand, I have created a script that will look for the en0 and en1 ip addresses, figure out if it needs to change the SUS settings and if the computer is on an external domain, delete the settings files we are pushing and set things back to default.
#!/bin/sh
#getting the first 7 bytes of the IP address to see if the address is internal or external
en0ipsuffix=$((ifconfig en0 inet) | grep inet | cut -d" " -f2 | cut -b1-7)
en1ipsuffix=$((ifconfig en1 inet) | grep inet | cut -d" " -f2 | cut -b1-7)
#get the logged in user
user=$3
if [ "$user" = "" ]; then
echo "Error: This script must be run at the login trigger. Please correct the trigger that is being used to run the policy."
exit 1
fi
#error handling to make sure we have retrieved at least one good IP address
if [ $$en0ipsuffix = "" ] && [ $$en1ipsuffix = "" ]; then
echo "Error did not retrieve an IP address"
exit 1
fi
#determine if one or more ip address is internal
if [ $en0ipsuffix = "138.237" ] || [ $en1ipsuffix = "138.237" ] ; then
echo "Computer is on the internal network, leaving SUS settings alone"
exit 0
else
echo "Computer is on an external network, changing SUS back to default"
#delete the managed preferences that set the SUS to internal servers (must be run as root)
defaults delete "/Library/Managed Preferences/com.apple.SoftwareUpdate" CatalogURL
defaults delete "/Library/Managed Preferences/$user/com.apple.SoftwareUpdate" CatalogURL
fi
exit 0Alternatively, a coworker mentioned that we could try using loadbalancer for internal and external traffic back to our internal patch server.
Active network scanning for client additions/deletions to Casper
I've been doing some thinking on this and unless Casper has some way to accept remote delete commands, I'm not sure that this is possible. As far as additions, would likely just need a script to run a newly found computer to run recon. The trick is going to be getting a script on a computer that isn't already managed...Integrate Casper groups with AD users and groups (build out a structure similar to AD where you can easily and quickly roll updates to either a single department or all departments)
Completed.
This was not possible as described because Casper does not manage user or groups. Settings are instead deployed to machines. To achieve the functionality requested a script was created that dumped the department suffix from the hostname on the machine into Casper. From there policies/updates can be deployed to one or more departments.#!/bin/sh
#get the dept suffix from the hostname (our hostnames are computername.deptcode.domainname so computer1.it.tcu.edu)
deptname=$((HOSTNAME) | cut -d. -f2)
#set the Department in the jss (note must be run as root and also requires the department to be defined in the Casper Department interface)
jamf recon -department $deptname
exit 0
8. Mount the personal shares automatically
Currently testing a script that will do this. It works on 10.7 with the user having to auth every time to the server. Does not appear to work on 10.6 in its current form.
Sadly this also includes net use commands found in the batch scripts we have for every user in Netlogon. Trying to figure out how to read from that share via a bash script has proven difficult.
Work with 10.8 pre-release to learn what settings (security and user settings) have been changed, added or removed and investigate how TCU should set these.
Have been advised that mcx type settings are going away in 10.8 and instead will use profile management. In the process of setting up a profile management server for further testing.Work to see how Casper can set the new 10.8 settings
Will not be able to do this until after 10.8 is released. JAMF states “Since Apple is known to either add or remove features at the last minute we are unable to give a specific release date or what features will be available”Provide 3rd party updates through Casper or Secunia or other platform
Casper/Apple Software Update server does not support nor have the capability to manage 3rd party updates. Secunia version 5, cannot deliver patches to OSX. Secunia support indicated this functionality could come with version 6 of the product.Learn how Casper or other MDM software can be used to deploy Apple and Android mobile devices
Needs more clarification on what “deploy” actually means.
If anyone could read over my responses and correct any wrong information I have, or would like to add anything to this please do so.
