Search Results
Revisiting Sophos Enterprise Anti-Virus for Mac 9.2.x deployment
I had previously written about deploying Sophos Enterprise Anti-Virus for Mac 9.2.x, but I was recently notified that the method I had been using would stop working in a future release of Sophos.
Sophos has a KBase article about pre-configuring their installer application with the AutoUpdate settings, but I also wanted to be able to deploy Sophos using an installer package. Using the information from the KBase article, I was able to update my existing method for building an installer package for deploying Sophos Enterprise Anti-Virus for Mac 9.2.x. For the details, see below the jump.
Deploying Sophos Enterprise Anti-Virus for Mac 9.2.x
With the release of Sophos Enterprise Anti-Virus 9.2.x, Sophos changed how their enterprise antivirus solution for Macs was installed. While previous versions of Sophos Enterprise used an Apple installer metapackage, Sophos has now switched to using an application to install their enterprise antivirus software.
This switch was a problem for Mac admins who wanted to deploy Sophos Enterprise Anti-Virus 9.2.x, as the previously-available installer package had simplified the task of deployment. The new Sophos Enterprise Anti-Virus 9.2.x install application added further complexity by storing many of the installer’s files and other components outside the application in a separate Sophos Installer Components directory.
However, after doing some research and testing, it looks like it is possible to repackage Sophos Enterprise 9.2.x for deployment. For more details, see below the jump.
Deploying Sophos Anti-Virus Home Edition for Mac 9.2.x for personal use
With the release of Sophos Anti-Virus 9.x, Sophos changed how their antivirus solution for Macs was installed. Where previous versions of Sophos used an installer package, Sophos has now switched to using an application to install their antivirus.
This switch was a problem for Mac admins who wanted to deploy Sophos Home Edition 9.x for personal use, as there was not an available installer package to simplify the task of deployment. Sophos Home Edition 9.2.x added additional complexity by storing many of the installer’s files and other components outside the installer in a separate Sophos Installer Components directory.
However, after doing some research and testing, it looks like it is possible to repackage Sophos Home Edition 9.2.x for personal deployment. For more details, see below the jump.
Deploying Sophos Enterprise Anti-Virus for Mac OS X 9.x
For the past few major releases, Sophos used a standard installer package to install both their free and paid antivirus solution. With the release of Sophos Anti-Virus 9.x though, Sophos changed how their antivirus solution for Macs was installed. Sophos has now switched to using an application to install their antivirus. However, for their customers using Sophos Enterprise Console, Sophos still provides an installer metapackage. This is good news for Mac admins, but the configuration and login credentials that used to be stored in /Library/Preferences/com.sophos.sau.plist in Sophos 8.x has been overhauled in Sophos 9.x. /Library/Preferences/com.sophos.sau.plist in Sophos 9.x now no longer contains login information, only server locations.
The login credentials no longer being available in /Library/Preferences/com.sophos.sau.plist meant that the Sophos Anti-Virus client was not able to connect back to the Sophos enterprise console and receive either management or updates. Since those login credentials were working in my shop for machines in Active Directory OUs that the Sophos enterprise console was managing, that meant that those credentials were available somewhere on the system. After working on the problem in his own shop, Tim Kimpton figured out that both of the following files were needed:
/Library/Preferences/com.sophos.sau.plist
/Library/Sophos Anti-Virus/Sophos.keychain
Once I had this information and understood what was going on, I was able to build and deploy a Sophos Enterprise Anti-Virus for Mac OS X 9.x installer that was able to install a pre-configured set of auto-update settings. For more details, see below the jump.
Deploying Sophos Anti-Virus for Mac OS X 9.x
For the past few major releases, Sophos used a standard installer package to install both their free and paid antivirus solution. With the release of Sophos Anti-Virus 9.x though, Sophos changed how their antivirus solution for Macs was installed by switching to using an application to install it. For their customers using Sophos Enterprise Console, Sophos will still provide a installer metapackage, but all other customers now need to use the application to install Sophos Anti-Virus 9.x on Macs.
Curiously, Sophos went to some lengths to make their install application look like a standard installer package.
This extended to the point of naming the actual application as Installer, which is the same name as Apple’s Installer.
This switch away from using installer packages was a problem for Mac admins who wanted to deploy Sophos 9.x, but did not have Sophos’ enterprise console. After doing some research and reading a very helpful thread on JAMF Nation, it looks like it is possible to repackage Sophos 9.x for deployment. For more details, see below the jump.
Using AutoPkg to build installer packages from installer applications
One of the challenges Mac admins have to deal with are Mac application installers which don’t follow one of the following models:
In many cases, these alternate installers take the form of applications which may or may not have options for installing via command line. For those that do not have the option of command line installation, the only real option is to install the application in question, then re-package it as either a drag-and-drop install or an installer package.
However, for those installer applications that do support command line installation, this opens up the option of embedding the installer application inside an installer package and using a postinstall script to run the necessary commands for the installer application to install its files onto the Mac. I’ve used this workflow several times in the past, with some examples linked below:
- Creating a DNAStar Lasergene 13.x installer
- Revisiting Sophos Enterprise Anti-Virus for Mac 9.2.x deployment
- Deploying Sophos Anti-Virus Home Edition for Mac 9.2.x for personal use
These examples have been manually built by me on an as-needed basis as new versions are released, but wherever possible, I want to automate this process using AutoPkg. Thanks to being able to study a recently-built .pkg recipe for AccuBarcodePro created by @foigus, I was able to build recipes for AutoPkg which handle downloading and packaging the following installer applications:
For more details, see below the jump.
Fully automating installation of automatically-generated installers
As part of your Mac’s standard build process for your environment, you may need to install certain packages that are generated for you by another process. A good example may be your workplace’s central antivirus management console, or a systems management tool.
Generally, these applications are installed once and then the centralized management server takes care of managing and updating them on your Macs afterward. For that first install though, they still need to be installed on your Macs and it’s usually a manual process for Mac admins to copy the latest installer from wherever it’s stored and add it to the build process.
However, if you have access to where the installer is stored, you can script the process of installation and fully automate the process of getting the latest installer and installing it on your Mac. See below the jump for an example of how to do this with Sophos Antivirus.
<lj user="poppy_girl"> is in Atlanta and I'm sick as a dog.
My planned day of recuperation from the rather bad cold I’m currently suffering through had been Sunday. Sasser put that plan on hold, as work put out an all-hands call to get the PCs patched. Instead, I took off today to recuperate, which is one of the better ideas I’ve had in a while.
In other news, is off in Atlanta on a business trip. She called today to let me know that she got there OK and that her boss is taking her off shopping since they had some down time.
Moment of Zen
————-
Der Flounder 
Recent Comments