2 Replies Latest reply on Sep 11, 2013 4:23 AM by martin.gannon

    LDGatewayAssistant [Macintosh Version]

    Peter Massa Expert

      General:

      Subject/Problem/Symptoms:

      How to automate Macintosh agent communication for inventory scans, vulscans, and policy-based tasks through the CSA/gateway without the use of DNS.

      Description/Details:

      When an agent is out-of-band it will attempt to do a DNS lookup on the core server before directing traffic if the brokerconfig.exe is set to “Dynamically determine connection route”.  If it gets a result other than “Host not found” or “Request could not find host” then it assumes it can communicate with the core server.

       

      The issue that occurs is that many ISPs no longer allow for unlisted DNS entries, a requirement for CSA/gateway usage.  This means when you try to reach core.domain.ext it will redirect you to another host, such as your ISP’s homepage web server.  They assume you miss typed the address you are looking for and provide a re-direct.  This means that the client will never contact the CSA/gateway because it believes it has reached the core.

       

      This also resolves the issue of not being able to have a private and public DNS. (As long as your core is properly firewalled off from global traffic.)

       

      Test Problem:


      Set your DNS to use Open DNS while out-of-band – 208.67.222.222 and 208.67.220.220 – if your core is not publicly listed then it likely will experience this issue.

       

      Resolution:


      Attached to this document is an ldgatewayassistant.sh – this will install the LDGatewayAssistant daemon on your Macintosh based clients.

       

      The LDGatewayAssistant daemon can do the following tasks for you:
      1. Auto broker your Macintosh agents to the CSA/gateway. (in-band and out-of-band)
      2. Automatically toggle your inventory scans, vulscans, and policy-based tasks between direct and gateway mode.

      3. Automatically update core with latest IP when switching between direct and gateway mode.
      4. Allow for limited custom in-band and out-of-band remote control permissions.

       

      How it works:


      After it is installed on your end-point you will find an LDGatewayAssistant daemon is running (/Library/LaunchDaemons).  Every 15 minutes (configurable) the daemon will quickly run a query to validate that you are still able to communicate with your core server.  It does this by checking the file structure of the cores web services.  If you were previously in-band and the query returns in-band again then no further action is taken.  However if it returns out-of-band then the daemon will:

      1.       Write out the proper connection info for the CSA/gateway to broker.conf.xml. (This is for inventory scans, vulscans, and policy-based tasks.)

      2.       Enable the optional remote control configurations for out-of-band. (Prevents vulscan from overwriting these settings.)

      3.       Automatically broker the agent if necessary.

      4.       Start an inventory scan to sync with the core server.

       

      When the agent returns to being in-band then the service will:

      1.       Update the broker.conf.xml to automatic mode.

      2.       Set remote control configurations back to stricter settings.  (Upon the next vulscan they will be returned to your agent configuration settings.)

      3.       Automatically broker the agent if necessary.

      4.       Start an inventory scan to sync with the core server.

       

      How do I know if it is running?

       

      Under /Library/Application Support/LANDesk/data/ there is a file called: ldgatewayassistant.plist.

      With in 15 minutes of entering/leaving your network you should see the following events:

      - The "count" field in the plist should increment by 1.

       

      *Note: If any crashes occur please post them here.

       

      What it works on?

      It has been tested on 9.0.3, and 9.5.

       

       

      Installation:

       

      Basic Installation:
      1. Manually configure the settings in the attached LDGatewayAssistant.sh file.
      2. Manually install the LDGatewayAssistant on a client computer: sudo ./ldgatewayassistant.sh or sudo sh ldgatewayassistant.sh

       

       

      Advanced Deployment Options:

       

      1. Advanced Edit of Agent

      - Documentation pending.

       

      2. Custom Vulnerability

      - Documentation pending.

       

      3. Deployment package

      - The ldgatewayassistant.sh file can be bundled into a LANDesk deployment package and distributed to end points.

       

       

       

      Auto Brokering Information:

       

      In order to auto broker on the Macintosh agents you will be required to generate a configbroker.enc file.  The contents of this file will then be used in the LDGatewayAssistant to authenticate the brokering process.

       

      To generate a configbroker.enc file follow the below steps:

       

      1. On a mac run the following commands:

           echo "username,password" > configbroker.txt

           openssl enc -aes-256-cbc -a -salt -in configbroker.txt -out configbroker.enc

       

           *When prompted enter a phrase to secure the credentials.

           *Replace username and password with the appropriate LANDesk user credentials for your brokering account.

       

      2. Copy the contents of the configbroker.enc (open it in textedit.app) and use them as the "code" in the LDGatewayAssistant.

       

      When the client completes the brokering process it will overwrite the phrase that you provide in the LDGatewayAssistant settings with phrase_overwrite in order to secure the code and prevent it from being available post brokering.  If you wish to have the LDGatewayAssistant be able to rebroker an agent if its certificate is lost then you can replace the contents of phrase_overwrite with the same contents of what you set phrase to.

       

      *DISCLAIMER*
      USE OF THE CONFIGBROKER.ENC IS SOLELY AT THE USER'S AND/OR COMPANY'S OWN RISK.  THIS APPLICATION IS AVAILABLE "AS IS", AND THE AUTHOR DISCLAIMS ALL WARRANTIES INCLUDING ANY IMPLIED WARRANTIES.
      THE FILE PRODUCED BY RUNNING THE ABOVE COMMANDS CONTAINS ACCOUNT NAME AND PASSWORD INFORMATION THAT MAY NOT BE FULLY PROTECTED UNDER CURRENT ENCRYPTION STANDARDS.  THE AUTHOR SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO DAMANGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA OR OTHER INTANGIBLE LOSSES, OR COST OF PROCUREMENT OF SUBSTITUTE SERVICES.

       

       

      Configuration Options:

       

      PList Settings:

      Address = IP Address of CSA/gateway


      code = Follow the code generation steps above under "Auto Brokering Information".

       

      phrase = phrase used to encrypt the code

       

      phrase_overwrite = used to replace phrase after brokering is completed *default is "none"


      Gateway = hostname.domain.ext of CSA/gateway


      In = If the client last was "in-band" (true/false)  *Default is false


      Out = If the client last was "out-of-band" (true/false)  *Default is false


      rc = 0 or 1
      0 = Off – Do not make any changes to client
      1 = When device is out-of-band - LDGatewayAssistant turns off remote control permission required on the agent so that you can remotely access the computer without the user having to accept remote control, it also disables the identifiers of remote control.  It automatically turns permission required and remote control identifiers back on when the client is back "in-band".  *This is useful to remotely kick off policy based tasks immediately through the CSA/gateway, but please be aware of the security draw backs when the permission required option is removed.*

       

      Scan = 0, 1
      0 = Off - Do not run any scans

      1 = Sends full inventory scans to core (works through gateway and in-band)

       

      logging = 0 or 1
      0 = Off
      1 = Enables basic logging - currently only turns on display of server responses when checking if the client is properly talking to core.  These will be displayed in the application log.

       

      interval = 1 +

      1 = 15 minutes

      2 = 30 minutes

      3 = 45 minutes (recommended)

      4 = 1 hour

      (and so on)

       

      count = 1

      # = displays current time in interval process, once this number reaches the value set in interval then it will execute 1 cycle and reset back to 1.

      Example:  If interval is set to 3 and count is set to 1, every 15 minutes count will increment by 1 make its values after 15 minutes be 2, 30 minutes be 3, and upon the 45 minutes it will execute and revert count to 1.

       

      Uninstall:

       

      Version 1.0.0.0:
      To uninstall the LDGatewayAssistant you must do it from an administrative account.

      From the terminal execute:

      sudo rm "/Library/Application Support/LANDesk/data/ldgatewayassistant.sh"

      sudo rm "/Library/Application Support/LANDesk/data/ldgatewayassistant.plist"

      sudo rm "/Library/LaunchDaemons/com.landesk.ldgatewayassistant.plist"

       

      Bug Fixes:

       

      Version 1.0.0.1:

      - Corrected an issue where the daemon would not properly start on boot-up for some OSX versions.

      - Added versioning.

       

       

      DISCLAIMER

       

      THIS SOFTWARE IS NOT A PRODUCT OF LANDESK.  THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMANGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.