Using a login script for deployment of Kaspersky Network Agent to Mac OS X clients

Using a login script for deployment of Kaspersky Network Agent to Mac OS X clients

EXECUTIVE SUMMARY This document describes how an administrator can configure a login script to deploy Kaspersky Lab Network Agent as conveying tool to install further the Kaspersky Endpoint Security 8 for Mac. This login script can be utilized with Apple Remote Desktop, or similar Mac management platforms, to assist in remote deployment. At the completion of the tasks outlined target Apple systems will have the Kaspersky Network Agent installed. With the Network Agent installed deployment of Kaspersky Security for Mac can be completed through the Administration Kit Please Note: Kaspersky Lab provides this document as-is as a courtesy to interested parties. The accuracy of the information is solely the author s responsibility. Neither Kaspersky Lab nor its partners support this document. TARGET AUDIENCE AND PREREQUISITES This document is for end users and resellers who are responsible for administering the Kaspersky Security for Mac product. It is recommended that you have: Working knowledge of the Apple Mac OS X operating system Working knowledge of the Terminal application Working knowledge of Apple Remote Desktop PROBLEM Often administrators need flexible options for deployment of endpoint security. Although an installation package can be delivered via Apple Remote Desktop, Administrators can have a difficult task in determining when to roll out a software package. Utilizing a Login Script ensures that the security software is installed at login with minimal business impact. SOLUTION This solution provides administrators with a shell script which determines during the login process if the user has the Kaspersky Network Agent installed, and if not, automatically installs the software. If Kaspersky Anti-Virus for Mac (standalone version) is present it will be uninstalled as well. Additionally, there is an option to install the Kaspersky Endpoint Security for Mac (managed version) as an extra step in the process. This guide walks the administrator though the basic steps of configuring the script. It also contains the steps for configuring a hook to trigger the script at login. Administrators looking to integrate this script using a directory service should refer to Apple s Mac OS X Server User Management guide which contains information on configuring a login hook using Apple Workgroup Manager. Additionally, administrators can modify the script to perform other commands and execute other scripts at login, if necessary. Page 2

PREPARATION STEPS 1. Download the associate scripts for modification from: http://support.kasperskyamericas.com/eval 2. Create a folder on a web server for the packages you want to get downloaded to your target machines. Note: The folder must be accessible via a URL. 3. In the script file (klscript.sh), edit the name of the download location to the variable downloadloc. 4. Copy the Kaspersky Anti-Virus for Mac (kavuninstaller.zip) file to the download folder prepared in Step 1. Note: This step is required for the removal of the Kaspersky Anti-Virus for Mac (standalone version) application. 5. Copy the Kaspersky Network Agent installation package (klnagentmac9.0.0.##mlg_en_ru_de_ fr.zip) to the same folder. 6. In the script file (klscript.sh), edit the name of the installation package to the variable downloadna. Also, add the IP address of your Kaspersky Administration Server to the variable IP_ADDRESS. 7. If needed, copy the Kaspersky Endpoint Security for Mac (managed version) installation package (wksmac8.0.4.###mlg_en_ru_de_fr.zip) to the deployment folder prepared in Step 1. In the script file (klscript.sh), edit the name of the installation package to the variable downloadkes. Page 3

SCRIPT CONFIGURATION PROCEDURE 1. Copy the klscript.sh file to your home directory and rename the file kloginscript.sh. 2. Launch the Mac OS X Terminal application. Type the following command to edit the script file: pico kloginscript.sh 3. Using the arrow keys, navigate to the top of the document and insert the packages URL where they should be published prior to this process in the on the line starting with downlodaloc=. Page 4

4. Confirm and adjust the settings for the installation packages names and the Kaspersky Administration Kit server address. 5. You can optionally change other actions of the script like the installation of the Kaspersky Endpoint Security for Mac installation package. 6. Indicate that you want to exit the text editor by pressing CONTROL + X. 7. Save the file by pressing Y and then RETURN. 8. From the OS X terminal, type the following command to convert the file into an executable script: sudo chmod 755 kloginscript.sh LOGIN HOOK SETUP PROCEDURE 1. From the Mac OS X terminal, create a directory to store the login script. sudo mkdir /etc/loginhook 2. Navigate to the directory with the kloginscript.sh file, and type: sudo cp kloginscript.sh /etc/loginhook/kloginscript.sh 3. To trigger the login hook, type the following: sudo defaults write com.apple.loginwindow LoginHook /etc/loginhook/kloginscript.sh Page 5

REMOVING THE LOGIN HOOK 1. From the Mac OS X terminal, type the following to remove the login hook: sudo defaults delete com.apple.loginwindow LoginHook DEPLOYING THE SCRIPT USING APPLE REMOTE DESKTOP 1. In Finder, press COMMAND + SHIFT + G (Go to Folder) and type: /etc/loginhook 2. Open Apple Remote Desktop, and select the machines to which you would like to copy the file. 3. Create a new Copy Items task. 4. Drag the kloginscript.sh script from the Finder to the Copy Items directory. 5. Set Place Items in: to Same relative Location. 6. Configure Set item ownership to: to Preserve current owner. Page 6

7. Click Copy. 8. Select the same client machines as contained in the kloginscript.sh file. 9. Open Send UNIX Command. 10. Set Run command as: to User: and type root. 11. Type the following into the command field: sudo defaults write com.apple.loginwindow LoginHook /etc/loginhook/kloginscript.sh 12. Press Send to complete the configuration. REMOVING THE SCRIPT USING APPLE REMOTE DESKTOP 1. Repeat steps 1 12 as in the previous section Deploying the Script using Apple Remote Desktop. However, in step 11 use the following command: sudo defaults delete com.apple.loginwindow LoginHook Kaspersky Lab 500 Unicorn Park Woburn, MA 01801 866.563.3099 smbsales@kaspersky.com www.kaspersky.com www.threatpost.com Page 7