Enrolling the devices
The Chef Desktop management pattern allows you to manage all your macOS devices using a MicroMDM server for a fully automated experience.
If you have not done so, read The Chef Desktop Development Pattern to familiarize yourself with some of the basic steps for getting started. We will repeat a number of those steps here.
This document describes how to set up the following things:
- Install Chef Infra Server and Chef Automate
- Build your local repo and test Chef Desktop
- Build the InstallApplications package.
- Build the MDM server
- Build and deploy Munki to deploy apps to the laptops
Setting up the MDM
We need a Mobile Device Management (MDM) service to capture macOS machines as they boot, and to securely connect and push applications and configuration settings to them. In this document we use MicroMDM, but there are others on the market like VMware Airwatch, SimpleMDM, and others.
Your configuration and setup may begin like this:
Stand up a new Linux instance in Azure or AWS and ensure that you use SSH keys for authentication rather than passwords.
Once the instance is running, upgrade the installed packages:
sudo apt-get update && sudo apt-get upgrade -y sudo reboot
Create a micromdm directory on the drive.
Clone MicroMDM from Github:
curl -L https://github.com/micromdm/micromdm/releases/download/v1.6.0/micromdm_v1.6.0.zip
Open a terminal window on the Linux box.
sudo apt-get install unzip unzip micromdm_v1.6.0.zip cd /micromdm/build/linux ./mdmctl config set -name <some name> -api-token <password> -server-url https://somefqdn
- is the label you choose to identify your MicroMDM server
- is a password you will use to connect to your server to configure it
- is the publicly accessible IP or FQDN of your created server
Start the MDM and note the password you use. You will need this password with
mdmctlto configure the server.
sudo ./micromdm serve -server-url https://somefqdn/ -api-key <password>
There are three important certificates on your MDM server:
- A TLS capable certificate that allows you to connect to your MDM server via port 443.
- An APNS certificate, which is a Push certificate, that allows your MDM server to talk to your macOS clients.
- A DEP certificate that allows your MDM server to talk to deploy.apple.com and accept incoming boot requests from Apple’s servers.
Securing the MDM
Read this guide which describes the steps necessary to create both the DEP and APNS certificates that you need for your MicroMDM server.
Initial App Deployment to a Node
InstallApplication is a stage in the Apple setup process that occurs between the time the display shows up for the user and when the user reaches the desktop for the first time.
InstallApplications (plural) is a corresponding application that will install applications or settings during that stage of configuration.
Start by loading these apps on your macOS machines:
The current release of Chef Infra Client
Depnotify is an open source tool that tells users how much more time their macOS machine needs to install applications before they can starting using it.
Caffeinate keeps the desktop active so that the screensaver does not turn on during installation. The screensaver will turn off network connections and break the setup if it activates.
The last thing we pull down is a python script to configure the
chef/client.rbfile and run
chef-clientthe first time to configure the laptop to its desired state and keep it in that state.
Install the latest version of InstallApplications.
Modify the LaunchDaemon plist to look like the first example below. Notice that we updated the JSONUrl and a couple of the identity sections. Also notice that we enabled some of the commands needed to properly populate DepNotify so it displays useful information to the user.
Modify the build-info.json file on the identity line to correctly reference your developer certificate. Read the InstallApplications documentation for information about the type of accounts that Apple requires to install packages.
munkipkgto create the actual pkg file. See the munkipkg documentation for instructions.
Upload the compiled package to your MDM server.
Issue the following commands on your MDM:
~/mdm/build/linux/mdmctl apply app -pkg ~/Desktop/mdmvid/InstallApplications.pkg -sign "Developer ID Installer: groob (myid)" -upload [WARNING] package signing only implemented on macOS. An unsigned macOS package will not install with MDM.
In the example above, the developer ID should match the one you specify in the
Signing Your Apps
Sign and/or notarize everything that the MDM server touches.