Casper Extension Attribute scripts to report Java browser plug-in info

To help Casper admins identify which Macs should be getting the new Oracle Java 7 browser plug-in update, I’ve posted a couple of Casper extension attributes to my GitHub repo. The first one detects if a Mac’s Java browser plug-in in /Library/Internet Plug-Ins was supplied by Apple or Oracle. If no Java plug-in is detected, a No Java Plug-In Available message is displayed.

#!/bin/bash

javaVendor=`/usr/bin/defaults read /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleIdentifier`

if [ "$javaVendor" = "com.oracle.java.JavaAppletPlugin" ]; then
        result=Oracle
elif [ "$javaVendor" = "com.apple.java.JavaAppletPlugin" ]; then
        result=Apple
elif [ "$javaVendor" = "" ]; then
        result="No Java Plug-In Available"
fi

echo "<result>$result</result>"

The other one was shared on JAMF Nation by Christoph von Gabler-Sahm. This script detects the version of the active JavaAppletPlugin plug-in in /Library/Internet Plug-Ins.

#!/bin/bash

# Christoph von Gabler-Sahm (email-redacted)
# Version 1.0

# checks installed version of Java Applet Plugin
# returns values like "Not installed", "JavaInstallOnDemand: 14.5.0", "JavaJDK16: 14.5.0" or "Java 7 Update 09"

PLUGINPATH="/Library/Internet Plug-Ins/JavaAppletPlugin.plugin"

# Plugin version
S_VERSION=$( /usr/bin/defaults read "${PLUGINPATH}/Contents/Info" CFBundleShortVersionString 2>/dev/null )

# JavaInstallOnDemand or empty
S_PROJECT=$( /usr/bin/defaults read "${PLUGINPATH}/Contents/version" ProjectName 2>/dev/null )

if [[ -e "${PLUGINPATH}" ]]; then
    if [[ "${S_PROJECT}" == "" ]]; then
        EA_RESULT="${S_VERSION}"
    else
        EA_RESULT="${S_PROJECT}: ${S_VERSION}"
    fi
else
    EA_RESULT="Not installed"
fi

echo "<result>${EA_RESULT}</result>"

For Macs that have had the Java for OS X 2012-006 update installed, Christoph’s script above will report the following version status:

JavaInstallOnDemand: 14.5.0

Both scripts are available on my GitHub repo:

https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/Casper_Extension_Attributes/java_browser_plug-in_version

https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/Casper_Extension_Attributes/java_vendor

Re-enable the Apple Java 6 plug-in for use with web browsers

Once the Java for OS X 2012-006 update has been installed, the Apple-provided Java applet plug-in from /Library/Internet Plug-Ins is removed, which means that web browsers will not be able to launch Java applets from inside the browser. The update also removes the Java Preferences application from /Applications/Utilities.

However, the rest of the Java 6 framework is still installed and it is possible to re-enable the Apple-provided Java plug-in and browser functionality. Apple has provided a KBase article showing how to do this process manually, which allowed me to build a script that automates the process of removing the Oracle Java 7 plug-in and replace it with the Apple-built Java 6 plug-in.

#!/bin/sh

# Checks for backup directory for Java 7 plug-in
# and creates it if needed.

if [ -d "/Library/Internet Plug-Ins (Disabled)" ]; then
     echo "Backup Directory Found"
  else
     mkdir "/Library/Internet Plug-Ins (Disabled)"
     chown -R root:wheel "/Library/Internet Plug-Ins (Disabled)"
fi

# If a previous version of the Java 7 plug-in is already 
# in the backup directory, the previously backed up Java 7 
# plug-in is removed.

if [ -d "/Library/Internet Plug-Ins (Disabled)/JavaAppletPlugin.plugin" ]; then
      rm -rf "/Library/Internet Plug-Ins (Disabled)/JavaAppletPlugin.plugin"
fi

# Moves current Java 7 plug-in to the backup directory

if [ -d "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin" ]; then
     mv "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin" "/Library/Internet Plug-Ins (Disabled)/JavaAppletPlugin.plugin"
fi

# Create symlink to the Apple Java 6 plug-in in
# /Library/Internet Plug-Ins 

ln -sf /System/Library/Java/Support/Deploy.bundle/Contents/Resources/JavaPlugin2_NPAPI.plugin "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin"

# Re-enable Java SE 6 Web Start, which allows Java 
# applets to run in web browsers

ln -sf /System/Library/Frameworks/JavaVM.framework/Commands/javaws /usr/bin/javaws

exit 0

This script is available here on my GitHub repo.

Update – 11-4-2012: I’ve received some emails asking for assistance with running this script. To help make this process easier, I’ve built and posted a payload-free installer package to my GitHub repo. If you need it, download the installer package and run it to execute the script on your own Mac.

Slides from the FileVault 2 Session at JAMF Nation User Conference 2012

For those who wanted a copy of my FileVault 2 talk at JAMF’s JAMF Nation User Conference 2012, here are links to the slides in PDF and Keynote format.

PDF: http://tinyurl.com/jnuc2012fv2PDF

Keynote slides: http://tinyurl.com/jnuc2012fv2keynote

Slides from the FileVault 2 Session at MacTech 2012

For those who wanted a copy of my FileVault 2 and fdesetup talk at MacTech 2012, here are links to the slides in PDF and Keynote format.

PDF: http://tinyurl.com/mt2012fv2PDF

Keynote slides: http://tinyurl.com/mt2012fv2keynote

Java for OS X 2012-006 and Java for Mac OS X 10.6 Update 11

Apple has released Java updates for Mac OS X 10.6, 10.7.x and 10.8.x. There’s good news and bad news with these updates, so I’m going to lead off with the good news.

Good news:

Java for Mac OS X 10.6 Update 11 updates Java SE 6 to 1.6.0_37 and otherwise has the same behavior of Java for Mac OS X 10.6 Update 10.

If you’re using my Java enabler script to make sure that the Java plug-in is active for your web browsers, I’ve verified that this script continues to work.

Bad news:

Java for OS X 2012-006 uninstalls the Apple-provided Java applet plug-in from /Library/Internet Plug-Ins, which means that web browsers will not be able to launch Java applets from inside the browser. It also removes the Java Preferences application from /Applications/Utilities.

The rest of the Java 6 framework is still installed, so CrashPlan and other applications that use Java 6 outside of a browser will still work fine.

However, if you try to access a Java application in a web browser, you will see a Missing Plug-In message.

The fix is to click on the Missing Plug-In message and be directed to Oracle’s Java download page for Mac OS X. From there, the Java installer will need to be downloaded and installed.

It’s important to note that this process no longer taps into Apple’s Software Update mechanism to install Java. Instead, you would download a disk image from the Oracle website and install an installer package stored inside the disk image.

Update – 10-22-2012:

Apple has released a KBase article on how to re-enable the Apple-provided Java SE 6 applet plug-in and Web Start functionality: http://support.apple.com/kb/HT5559

Deployment:

Oracle’s installer can be installed silently from the command line and does not require a reboot. Oracle has built in a Sparkle-based update mechanism to handle Java updates from Oracle.

If you need to update multiple Macs, you should be able to distribute the Oracle Java installer package using your system management tools. Any tool that can install a standard Apple installer package should be able to distribute the new Java installer.

FileVault 2 session at MacTech Conference 2012

I’ll be speaking at MacTech Conference 2012, which is happening this week from October 17th – 19th in Los Angeles. I’ll be talking about managing FileVault 2 with fdesetup and also covering how FileVault 2’s cryptographic keys work together underneath the hood.

This session is in place of my previously announced session on providing security in a BYOD environment. For those wanting to discuss that topic while at MacTech, please bring your questions to the Security lab on Thursday.

You can see the entire list of speakers at http://www.mactech.com/conference/sessions.