Deploying Sophos Enterprise Anti-Virus for Mac OS X 9.x

For the past few major releases, Sophos used a standard installer package to install both their free and paid antivirus solution. With the release of Sophos Anti-Virus 9.x though, Sophos changed how their antivirus solution for Macs was installed. Sophos has now switched to using an application to install their antivirus. However, for their customers using Sophos Enterprise Console, Sophos still provides an installer metapackage. This is good news for Mac admins, but the configuration and login credentials that used to be stored in /Library/Preferences/com.sophos.sau.plist in Sophos 8.x has been overhauled in Sophos 9.x. /Library/Preferences/com.sophos.sau.plist in Sophos 9.x now no longer contains login information, only server locations.

The login credentials no longer being available in /Library/Preferences/com.sophos.sau.plist meant that the Sophos Anti-Virus client was not able to connect back to the Sophos enterprise console and receive either management or updates. Since those login credentials were working in my shop for machines in Active Directory OUs that the Sophos enterprise console was managing, that meant that those credentials were available somewhere on the system. After working on the problem in his own shop, Tim Kimpton figured out that both of the following files were needed:

/Library/Preferences/com.sophos.sau.plist

/Library/Sophos Anti-Virus/Sophos.keychain

Once I had this information and understood what was going on, I was able to build and deploy a Sophos Enterprise Anti-Virus for Mac OS X 9.x installer that was able to install a pre-configured set of auto-update settings. For more details, see below the jump.

Prerequisites

Packages

A copy of the Sophos Anti-Virus.mpkg installer package from your Sophos enterprise server.

A copy of the Sophos.keychain file, which will need to be taken from the following location on a Sophos Enterprise-managed machine:

/Library/Sophos Anti-Virus/Sophos.keychain

A copy of the com.sophos.sau.plist file, which will need to be taken from the following location on a Sophos Enterprise-managed machine:

/Library/Preferences/com.sophos.sau.plist

1. Set up a new Packages project and select Raw Package.

2. In this case, I’m naming the project Sophos Enterprise AntiVirus 9.1.6.

3. Once the Packages project opens, click on the Project tab. You’ll want to make sure that the your information is correctly set here (if you don’t know what to put in, check the Help menu for the Packages User Guide. The information you need is in Chapter 4 – Configuring a project.)

In this example, I’m not changing any of the options from what is set by default.

4. Next, click on the Settings tab. In the case of my project, I want to install with root privileges and not require a logout, restart or shutdown.

To accomplish this, I’m choosing the following options in the Settings section:

In the Post-Installation Behavior section, set On Success: to Do Nothing

In the Options section, check the box for Require admin password for installation

5. Click on the Scripts tab in your Packages project.

6. Select the Sophos installer metapackage and drag it into the Additional Resources section of your Packages project.

7. Select the Sophos.keychain file and drag it into the Additional Resources section of your Packages project.

8. The last piece is doing an automated uninstall of any existing Sophos installations, then installing a fresh copy of Sophos with the pre-configured autoupdate settings. For this, you’ll need a preinstall script and postinstall script.

Here are the preinstall and postinstall scripts that I’m using:

Preinstall

	#!/bin/bash
	LOGGER="/usr/bin/logger"
	# Determine working directory
	install_dir=`dirname $0`
	# Uninstall existing copy of Sophos 8.x by checking for the
	# Sophos Antivirus uninstaller package in /Library/Sophos Anti-Virus.
	# If present, the uninstallation process is run.
	if [ -d "$3/Library/Sophos Anti-Virus/Remove Sophos Anti-Virus.pkg" ]; then
	${LOGGER} "Sophos AV present on Mac. Uninstalling before installing new copy."
	/usr/sbin/installer -pkg "$3/Library/Sophos Anti-Virus/Remove Sophos Anti-Virus.pkg" -target "$3"
	killall SophosUIServer
	elif [ -d "$3/Library/Application Support/Sophos Anti-Virus/Remove Sophos Anti-Virus.pkg" ]; then
	${LOGGER} "Sophos AV present on Mac. Uninstalling before installing new copy."
	/usr/sbin/installer -pkg "$3/Library/Application Support/Sophos Anti-Virus/Remove Sophos Anti-Virus.pkg" -target "$3"
	killall SophosUIServer
	else
	${LOGGER} "Sophos Anti-Virus 8.x Uninstaller Not Present"
	fi
	# Uninstall existing copy of Sophos 9.x by checking for the InstallationDeployer application
	# in the following locations:
	#
	# /Library/Application Support/Sophos/he/Installer.app/Contents/MacOS
	# /Library/Application Support/Sophos/opm-sa/Installer.app/Contents/MacOS
	# /Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS
	#
	# If the InstallationDeployer application is present, the uninstallation process is run.
	if [[ -f "$3/Library/Application Support/Sophos/he/Installer.app/Contents/MacOS/InstallationDeployer" ]]; then
	${LOGGER} "Sophos AV Home Edition present on Mac. Uninstalling before installing new copy."
	"$3/Library/Application Support/Sophos/he/Installer.app/Contents/MacOS/InstallationDeployer" –remove
	else
	${LOGGER} "Sophos Anti-Virus 9.x Home Edition Uninstaller Not Present"
	fi
	if [[ -f "$3/Library/Application Support/Sophos/opm-sa/Installer.app/Contents/MacOS/InstallationDeployer" ]]; then
	${LOGGER} "Sophos AV Standalone present on Mac. Uninstalling before installing new copy."
	"$3/Library/Application Support/Sophos/opm-sa/Installer.app/Contents/MacOS/InstallationDeployer" –remove
	else
	${LOGGER} "Sophos Anti-Virus 9.x Standalone Uninstaller Not Present"
	fi
	if [[ -f "$3/Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer" ]]; then
	${LOGGER} "Sophos AV Enterprise present on Mac. Uninstalling before installing new copy."
	"$3/Library/Application Support/Sophos/opm/Installer.app/Contents/MacOS/tools/InstallationDeployer" –remove
	else
	${LOGGER} "Sophos Anti-Virus 9.x Enterprise Uninstaller Not Present"
	fi
	exit 0

view raw

gistfile1.sh

hosted with ❤ by GitHub

Postinstall

	#!/bin/bash
	LOGGER="/usr/bin/logger"
	FILE_DATE=`date +%Y%m%d%H%M%S`
	# Determine working directory
	install_dir=`dirname $0`
	# Location of Sophos keychain file
	sophos_keychain="$3/Library/Sophos Anti-Virus/Sophos.keychain"
	# Install Sophos Anti-Virus
	/usr/sbin/installer -dumplog -verbose -pkg "$install_dir/Sophos Anti-Virus.mpkg" -target "$3"
	# Remove existing Sophos autoupdate configuration file
	/bin/mv "/Library/Preferences/com.sophos.sau.plist" /tmp/com.sophos.sau."$FILE_DATE".plist
	# Remove and replace existing Sophos keychain file
	if [[ -f "$sophos_keychain" ]]; then
	mv "$sophos_keychain" /tmp/Sophos-"$FILE_DATE".keychain
	cp "$install_dir/Sophos.keychain" "$sophos_keychain"
	fi
	# Write Sophos autoupdate configuration file
	#
	# Note: Plist file here is only an example. You will
	# need to provide your own plist settings between the
	# following lines:
	#
	# /bin/cat > "/Library/Sophos Anti-Virus/com.sophos.sau.plist" << 'SOPHOS_CONFIG'
	#
	# ….plist data goes here….
	#
	# SOPHOS_CONFIG
	#
	/bin/cat > "/Library/Preferences/com.sophos.sau.plist" << 'SOPHOS_CONFIG'
	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
	<plist version="1.0">
	<dict>
	<key>LastUpdated</key>
	<string>September 1, 2014 11:19:09 PM EDT</string>
	<key>PrimaryServerProxy</key>
	<integer>0</integer>
	<key>PrimaryServerProxyPort</key>
	<integer>0</integer>
	<key>PrimaryServerProxyURL</key>
	<string></string>
	<key>PrimaryServerType</key>
	<integer>2</integer>
	<key>PrimaryServerURL</key>
	<string>smb://sophos_enterprise_server_name_goes_here/SophosUpdate/CIDs/S000/ESCOSX</string>
	<key>SecondaryServer</key>
	<true/>
	<key>SecondaryServerProxy</key>
	<integer>0</integer>
	<key>SecondaryServerProxyPort</key>
	<integer>0</integer>
	<key>SecondaryServerProxyURL</key>
	<string></string>
	<key>SecondaryServerType</key>
	<integer>0</integer>
	<key>SecondaryServerURL</key>
	<string></string>
	<key>UpdateFrequency</key>
	<integer>1</integer>
	<key>UpdateInterval</key>
	<integer>10</integer>
	<key>UpdateLogIntoFile</key>
	<true/>
	<key>UpdateLogIntoSyslog</key>
	<false/>
	<key>UpdateOnConnection</key>
	<false/>
	<key>UpdateUnits</key>
	<integer>1</integer>
	</dict>
	</plist>
	SOPHOS_CONFIG
	# Force Sophos to reload its configuration
	/bin/launchctl unload /Library/LaunchDaemons/com.sophos.configuration.plist
	/bin/launchctl load /Library/LaunchDaemons/com.sophos.configuration.plist
	exit 0

view raw

gistfile1.sh

hosted with ❤ by GitHub

9. Once you’ve got the preinstall and postinstall scripts built, run the following command to make the script executable:

sudo chmod a+x /path/to/preinstall

sudo chmod a+x /path/to/postinstall

10. Once completed, add the preinstall and postinstall scripts to your Packages project.

11. Last step, go ahead and build the package. (If you don’t know to build, check the Help menu for the Packages User Guide. The information you need is in Chapter 3 – Creating a raw package project and Chapter 10 – Building a project.)

Testing the installer

Once the package has been built, test it by taking it to a test machine that does not have Sophos and install it. The end result should be that Sophos Anti-Virus installs properly and has the pre-configured settings for your Sophos Enterprise server included automatically.