#mac management

[theenterprisemac]

SaaS Management - JumpCloud

There is an often discussed topic of Shadow IT and in that context you often hear this idea of SaaS management. The idea is that you can find people using SaaS products and what SaaS products they happen to be using. Many of these tools even allow some level of blocking.

I am going to pick on JumpCloud here, but the issue is not unique to them. Keep in your mind that this is a tool that relies on a browser extension to have any hope of working.

Source: https://jumpcloud.com/support/get-started-jumpcloud-go

Now let's consider:

Firefox is only supported on Mac and Windows (not super surprising that Linux desktop is not well represented to be fair)

What is the default browser on the Mac? Safari–what browser is specifically not mentioned–Safari.

So I want to ask the question how is this a serious solve for SaaS management on the Mac platform if the default Mac browser is not even supported. Ignoring the fact that the extension is defeated by incognito mode–you can just use Safari.

To me this is an hilarious oversight and just begs the question of how did this decision get made. Because effectively what I have to do as a Mac admin is now block Safari usage all together. That's like telling a Windows admin: "Sorry Edge isn't supported so you can just block that right?"

There is a YouTube video where a JumpCloud representative makes the hand wave that the bypass of incognito mode is just something that some small percentage will try as a bypass and you can't get perfect results. I'd agree if it weren't for the fact that the default browser on the Mac is just not even supported.

To be clear I really like the JumpCloud user management tools and virtual directory. This is just a shake your head moment on some of their other products.

[trophywifemac]

IT'S ALWAYS SUNNY IN PHILADELPHIA ↳ S16E04 “Frank vs. Russia”

[trouticide]

gang studies

[lazycranberrydoodles]

modern AU where they meet again at the fast food place Xie Lian works at and Hua Cheng has to figure out how to romance a customer service employee

[st4rstudent]

Happy New Years! From...uh...the schoolhouse...again.

[larrylimericks]

12Jul24

Three hundred and fifty-six days Since last we saw Harry on stage, But tonight a duet! For Ms. Nicks’ Hyde Park set, And a Songbird who’s now flown away.

[kokoasci]

picked up genshin finally. sorry guys

i have a Lot of venti stuff ill post it tomorrow 😭

[yourlocaltoad]

Some recent stupid doodles

the purple kiwi toon belongs to @phoandori

[punchouthottakes]

Anyone who thinks Little Mac and Birdie are the same person is either really gullible or they have something going on with their eyesight. Unironically what was Nintendo smoking when they tried to gaslight the internet into thinking that?

[charmac]

*Slaps this one down on top of the Mac has a small dick evidence pile*

[theenterprisemac]

Jamf - Extension Attribute Dark Arts

I am sure many who may read this blog may already know this, but this isn't for you. This post is for people who don't know the dark arts of extension attributes.

Extension Attributes and Recon

As you should know extension attributes run during recon, and the more recons you run the more times this data is collected. You should also be aware that the more attributes you have, and the more complex they are the slower recon can get. Take it from someone who ran a Jamf server with over 100 extension attributes–recon can become unusable.

So how we can do better?

Well the first thing is you need to make your extension attributes fast. You should be optimizing what you are running and how it's being run to make the attribute as fast as possible. One of the easy button methods is using tools like OSQuery to collect the data you need.

An example of this would be collecting installed Chrome extensions into an extension attribute. You could do this via script, but it's much faster to use OSQuery. See this example.

Another thing to consider is that you have various ways of getting the data into Jamf. You can of course simply have the script run and output a value into the attribute. You can also leave the value in a file that Jamf can collect later. Keep that in mind–we will use it.

This takes us to the real dark art of extension attributes: the delayed attribute. If you have lots of attributes you likely also have attributes that don't need to be run every time.

Fortunately, you have options–just run them as recurring policies on whatever interval makes sense. You can then collect the information from some form of on device file or database during recon at speed.

A note on the database using sqlite3 here is hugely powerful because you can keep a historical log of the value overtime and that can be valuable for troubleshooting. This is not the easiest, but it is very powerful.

The most important thing to note is that you need to have the ability to call these policies–beyond just the recurring event. Here is why: imagine the user deletes your data or something goes wrong–you want to make sure that those values are recaptured.

There are a wide range of ways to do this, but the easy way is to have a policy that runs the script to collect the data which is called by either a policy that runs on a recurring basis or by an immediate run policy to catch things up. You are simply scoping the catch up policy to computers with some consistent "not present" value.

You will note in the example attribute I linked to if it can't run OSQuery it will put "Error" in the attribute field. You can use this and is empty to scope your catch up policy against.

Yes, this is more policies, but now you can have policies run on a non standard interval. Your computation times are relaxed, and if you are clever you don't even have to collect the value on every machine, or all the time.

Do note that if you have lots of these policies, then you will potentially need to run them via an orchestrator script. Sometimes having a single policy that calls the other ones and does dependency checking (discussed later) can be a better experience.

API?

A note on using API calls to write attributes: this is not optimal because you are now passing authentication data around to the endpoints. Nothing in your extension attributes stored on the machine should be sensitive–so by using the API you are introducing more risk. You can of course build some manner of middle-ware etc, but that is beyond the scope here.

The bottom line is thinking about security the data collected needs to be low risk if its being stored in a file, and you don't want to be passing sensitive credentials or keys in your attributes.

Calling Policies in Extension Attributes

Something you may never have considered is that you can actually call a policy from an extension attribute–I have done this. Will this work–yes. Should you do it–absolutely not! You will create all manner of horrible corner cases when you do. Jamf gets very unhappy when you slow recon down, and this will do just that. Furthermore, when you start having multiple Jamf processes nested together things get pretty unstable around level four or five. I have had as many seven layers and it is pretty much hit or miss as to if it works.

At that point you need to build a Jamf process orchestrator, and then at that point you really are going off the deep end most likely and need to bring things back down to earth a bit.

I raise this specter not to encourage, but to head off anyone who thinks this could be the right way to do catch ups on your extension attributes.

Consider the Dependancies

If you have dependencies such as OSQuery etc required for your extension attributes, then each of those tools need rapid working and present extension attributes to make sure your attributes all work. Furthermore, those dependencies should also have corrective actions baked into your delayed run policies.

[jetski23]

Loki: …

Mobius: *frowning, standing in the middle of a VERY smokey kitchen*

Loki: why… how… our microwave.

*a very broken microwave*

Mobius: I wanted some poptarts :(

Loki: YOU CANT PUT FOIL IN THE MICROWAVE.

[nightcourtcaps]

Night Court - The Apartment (S3:E15)

[st4rstudent]

people seemed to like the last design so here's another drawing. this time featuring a surprise guest. haha wow whos that guy...

no dialogue ver

[spotaus]

Y'all are so lucky I'm incompetent at Mac software.

[jubijumbo]

*Slams fists on table* Company party outfits ft. the minor circuit boxers! (Feat. Mac and the manager, Orville!)