Casper Suite Administrator's Guide v8.7 - JAMF Software

More documents

Recommendations

Info

Security This section explains the primary security measures in the Casper Suite: • Passwords Communication protocols • Public key infrastructure Signed applications Passwords The Casper Suite allows you to store individual accounts for client computers and reset the passwords if necessary. Passwords stored in the database are encrypted using a standard 128-bit RSA encryption with a 1024-bit key. Communication Protocols The Casper Suite has security built into its design. Connections between the JAMF Software Server (JSS), the other applications in the Casper Suite, and mobile devices take place over Secure Sockets Layer (SSL). The Casper Remote application and the network scanner in the Recon application connect to clients over Secure Shell (SSH), or remote login. Secure Shell (SSH) SSH is a network security protocol built into Mac OS X. For more information, go to: http://openssh.org/ Secure Sockets Layer (SSL) SSL is a security protocol for Internet communication. For more information, go to: https://www.openssl.org/ Public Key Infrastructure A public key infrastructure (PKI) is the design by which digital certificates are obtained, managed, stored, and distributed to ensure a secure exchange of data over a public network. For more information on PKI, go to: https://en.wikipedia.org/wiki/Public_key_infrastructure 14
Certificate Authority A certificate authority (CA) is a trusted entity that signs and issues the certificates required for certificatebased authentication. It is the central component of the PKI. The JSS has a built-in CA that is enabled by default, but you can integrate it with third-party CA if you prefer. For more information on CAs, go to: https://en.wikipedia.org/wiki/Certificate_authority Simple Certificate Enrollment Protocol Simple Certificate Enrollment Protocol (SCEP) obtains certificates from the CA and distributes them to enrolled mobile devices, allowing over-the-air management tasks to take place. The CA hosted by the JSS is SCEP-enabled by default. If you plan to use a third-party CA, it must be SCEPenabled. Certificates Certificates are electronic documents that validate the identity of a public key to ensure the encryption of data and establish trust. Web Server Certificate This certificate validates the identity of the JSS and establishes trust between the JSS and clients. Choosing to install this certificate prevents possible man-in-the-middle attacks by allowing clients to validate the certificate when connecting to the JSS. Clock skew can also be reduced to prevent the replay of messages from the JSS to client computers. If you are using the Casper Suite for mobile device management, you need a web server certificate to ensure that the devices are communicating with a valid JSS. CA Certificate This certificate establishes trust between the CA and Mac OS X clients, and between the CA and enrolled mobile devices. Signing Certificate This certificate is used to sign messages passed between the between the JSS and Mac OS X clients, and between the JSS and enrolled mobile devices. Apple Push Notification Service Certificate This certificate authenticates the JSS to Apple Push Notification service (APNs). Device Certificate This certificate validates the identity of Mac OS X clients and enrolled mobile devices each time they communicate with the JSS. 15
Page 1 and 2: Casper Suite Administrator’s Guid
Page 3 and 4: MySQL Mac Windows OS iOS X Applicat
Page 5 and 6: Compatibility Understanding with Do
Page 7 and 8: Chapter 1: Administering the JSS 7
Page 9 and 10: Mac OS X Applications Casper Admin
Page 11 and 12: Self Service Web Clip The Self Serv
Page 13: On the Mac platform, the JSS runs o
Page 17 and 18: Requirements This section lists the
Page 19 and 20: • OS X v10.7.x OS X v10.8.x Wind
Page 21 and 22: Installing and Managing the JSS Req
Page 23 and 24: To create the jamfsoftware database
Page 25 and 26: Allocating Additional Memory to Tom
Page 27 and 28: Setting Up the JSS The first time y
Page 29 and 30: 9. Choose whether or not to create
Page 31 and 32: Upgrading the JSS This section expl
Page 33 and 34: Backing Up the Database The JSS Dat
Page 35 and 36: To stop scheduled database backups:
Page 37 and 38: Deleting Logs from the Database Ove
Page 39 and 40: Migrating to Another Server The ins
Page 41 and 42: 7. Enter the DNS name or IP address
Page 43 and 44: 3. If the external drive is already
Page 45 and 46: 6. Use the Encryption Method pop-up
Page 47 and 48: 6. Click Save. Change Management lo
Page 49 and 50: 6. Enter your GSX account number in
Page 51 and 52: Enabling Clustering Clustering allo
Page 53 and 54: Configuring Tomcat to Work with a L
Page 55 and 56: 6. Select a limited access option.
Page 57 and 58: server.xml The JSS Installer instal
Page 59 and 60: Memory Issues If there is a large a
Page 61 and 62: Chapter 2: Client Management 61
Page 63 and 64: Creating Package Sources A package
Page 65 and 66:
6. Install and configure your softw
Page 67 and 68:
Creating Package Sources from Pre-I
Page 69 and 70:
There are a few ways Composer handl
Page 71 and 72:
Managing Package Manifests Package
Page 73 and 74:
Updating Package Manifests Periodic
Page 75 and 76:
Restoring Deleted Files or Folders
Page 77 and 78:
To add a postflight script that rem
Page 79 and 80:
Description.plist File The descript
Page 81 and 82:
3. Control-click (or right-click) t
Page 83 and 84:
Building DMGs When used in conjunct
Page 85 and 86:
Configuring the OS Before building
Page 87 and 88:
Managing Composer Preferences Compo
Page 89 and 90:
Remove .DS_Store Files in Common Lo
Page 91 and 92:
Building Your Client Management Fra
Page 93 and 94:
d. Verify the changes are correct a
Page 95 and 96:
Authentication Type If the LDAP ser
Page 97 and 98:
To look up computer list informatio
Page 99 and 100:
Managing JSS User Accounts The JAMF
Page 101 and 102:
8. Click the Notifications tab and
Page 103 and 104:
4. Click the Add Group from LDAP bu
Page 105 and 106:
10. Click the Save button. To edit
Page 107 and 108:
5. Select the NetBoot option and cl
Page 109 and 110:
To edit a NetBoot server: 1. Log in
Page 111 and 112:
5. Click Delete to confirm. Departm
Page 113 and 114:
10. Click the Save button. To edit
Page 115 and 116:
3. Click the Settings tab. 4. Click
Page 117 and 118:
Info Pane This pane allows you to m
Page 119 and 120:
Fill Existing User Home Directories
Page 121 and 122:
3. Click the Info tab and select th
Page 123 and 124:
Step 3: Create a New Adobe Installa
Page 125 and 126:
Suppress Registration Ensures that
Page 127 and 128:
When this process is complete, choo
Page 129 and 130:
3. Click the Casper Admin link. 4.
Page 131 and 132:
Enabling the Self Healing Feature S
Page 133 and 134:
3. Click OK to confirm the deletion
Page 135 and 136:
5. Click the New Script button and
Page 137 and 138:
Page 139 and 140:
OS Requirements If certain operatin
Page 141 and 142:
Managing Printers This section expl
Page 143 and 144:
Page 145 and 146:
2. Select the printers that you wan
Page 147 and 148:
Creating Directory Bindings Directo
Page 149 and 150:
12. If you are binding client compu
Page 151 and 152:
8. Enter the username and password
Page 153 and 154:
6. Choose a type of recovery key ty
Page 155 and 156:
Configuring the Computer Management
Page 157 and 158:
5. Select Use External Certificate
Page 159 and 160:
• If the server hosting the JSS
Page 161 and 162:
Check for policies triggered by sta
Page 163 and 164:
Hide account from OS X Login Window
Page 165 and 166:
3. Click the Computer Management Fr
Page 167 and 168:
Managing Removable MAC Addresses Co
Page 169 and 170:
Policies Policies allow you to auto
Page 171 and 172:
• Uninstall a package. Add a pri
Page 173 and 174:
Self Service Pane This pane allows
Page 175 and 176:
Dock Pane This pane allows you to c
Page 177 and 178:
• Flush user caches. Verify star
Page 179 and 180:
7. Click Continue. Clients execute
Page 181 and 182:
Note: These numbers are based on a
Page 183 and 184:
8. (Optional) Enter a description.
Page 185 and 186:
Adding Custom Search Paths By defau
Page 187 and 188:
6. Select the Default checkbox to d
Page 189 and 190:
Managing Peripheral Types You can t
Page 191 and 192:
Acquiring Mac OS X Computers Acquis
Page 193 and 194:
6. (Optional) Select Purchasing in
Page 195 and 196:
Enrolling Mac OS X Computers with t
Page 197 and 198:
5. Enter the email addresses that y
Page 199 and 200:
You can also sign the QuickAdd pack
Page 201 and 202:
11. Click the Create button. 12. Sa
Page 203 and 204:
9. Click the Scan button. Once you
Page 205 and 206:
3. Select Local Inventory in the si
Page 207 and 208:
Enrolling Computers by Editing Comp
Page 209 and 210:
Acquiring Windows Computers Acquisi
Page 211 and 212:
5. (Optional) Click the Purchasing
Page 213 and 214:
Acquiring Mobile Devices You can ac
Page 215 and 216:
Performing Advanced Computer Search
Page 217 and 218:
Display Fields Pane This pane allow
Page 219 and 220:
Viewing Computer Search Results By
Page 221 and 222:
• Total count of each version of
Page 223 and 224:
Application Distribution Report (PD
Page 225 and 226:
Viewing Computer Details After perf
Page 227 and 228:
Searching Peripherals Once peripher
Page 229 and 230:
Page 231 and 232:
Peripheral reports are broken down
Page 233 and 234:
General Pane This pane allows you t
Page 235 and 236:
6. Using the View As pop-up menu, c
Page 237 and 238:
Performing Mass Actions on Computer
Page 239 and 240:
5. If you want to edit the Autorun
Page 241 and 242:
5. Use the options and fields provi
Page 243 and 244:
7. Add or modify information as nee
Page 245 and 246:
Creating Computer Groups Computer g
Page 247 and 248:
10. Repeat steps 7 through 9 as nee
Page 249 and 250:
Viewing Receipts The JAMF Software
Page 251 and 252:
6. Click the Inventory Options link
Page 253 and 254:
Imaging Overview of the Imaging Pro
Page 255 and 256:
Managing Configurations This sectio
Page 257 and 258:
7. Click the Contents tab and use t
Page 259 and 260:
d. Click OK. 11. Repeat steps 2 thr
Page 261 and 262:
c. If you want the partition to be
Page 263 and 264:
5. Click OK. Note: You may be promp
Page 265 and 266:
9. Click Install. To view Imaging l
Page 267 and 268:
4. In the list of packages, locate
Page 269 and 270:
4. In the list of directory binding
Page 271 and 272:
5. Choose the network configuration
Page 273 and 274:
Managing Autorun Preferences Autoru
Page 275 and 276:
4. Click Autorun across from the co
Page 277 and 278:
PreStage Imaging PreStage imaging a
Page 279 and 280:
. Enter a prefix, starting number,
Page 281 and 282:
Target Mode Imaging Target Mode Ima
Page 283 and 284:
10. Boot a target computer to targe
Page 285 and 286:
10. Click the Packages tab and sele
Page 287 and 288:
Installing Adobe CS3/CS4 Updaters T
Page 289 and 290:
13. Click Save. Client computers ru
Page 291 and 292:
5. Select the Install or uninstall
Page 293 and 294:
To install a package using Casper R
Page 295 and 296:
7. Click the Continue button and fo
Page 297 and 298:
Once you complete these steps, Casp
Page 299 and 300:
7. Click the Continue button and fo
Page 301 and 302:
6. Click Go. Once you complete thes
Page 303 and 304:
Uninstalling Packages You can unins
Page 305 and 306:
10. Click the Packages tab and clic
Page 307 and 308:
Using the Self Healing Feature In o
Page 309 and 310:
Remote Control Overview of Remote C
Page 311 and 312:
Using Screen Sharing This section e
Page 313 and 314:
Settings and Security Management Ma
Page 315 and 316:
The following table shows how Manag
Page 317 and 318:
8. Click the Settings tab. 9. Selec
Page 319 and 320:
3. Click the Managed Preferences li
Page 321 and 322:
5. Select the Import from Manifest
Page 323 and 324:
14. Select a value for the preferen
Page 325 and 326:
Creating and Installing Mac OS X Co
Page 327 and 328:
11. Click the Scope tab and assign
Page 329 and 330:
9. Click the Edit link across from
Page 331 and 332:
Running Remote Commands for Mac OS
Page 333 and 334:
Canceling Remote Commands The JSS a
Page 335 and 336:
6. If you want to specify parameter
Page 337 and 338:
5. Choose when to run the script by
Page 339 and 340:
4. Create a policy or edit an exist
Page 341 and 342:
Managing Dock Items Before you add
Page 343 and 344:
Managing Local Accounts You can man
Page 345 and 346:
3. Casper Remote creates the accoun
Page 347 and 348:
To reset the password for a local a
Page 349 and 350:
8. Choose how often you want client
Page 351 and 352:
Binding to Directory Services Befor
Page 353 and 354:
Deploying Disk Encryption Configura
Page 355 and 356:
If you deployed a disk encryption c
Page 357 and 358:
Managing Open Firmware/EFI Password
Page 359 and 360:
5. If you want to remove the passwo
Page 361 and 362:
10. (Optional) Enter additional inf
Page 363 and 364:
9. (Optional) Enter additional info
Page 365 and 366:
To specify software definitions for
Page 367 and 368:
Reporting on Licensed Software Usin
Page 369 and 370:
General Pane This pane allows you t
Page 371 and 372:
9. Click the Display Fields tab sel
Page 373 and 374:
Sending Notifications on Licensed S
Page 375 and 376:
Usage Management Application Usage
Page 377 and 378:
8. When the list of logs is display
Page 379 and 380:
5. Click the Computer Usage Logs li
Page 381 and 382:
10. To display a message to the use
Page 383 and 384:
8. In the Username field, enter the
Page 385 and 386:
Managing User Authentication Prefer
Page 387 and 388:
Making Policies Available in Self S
Page 389 and 390:
2. Click the Management tab. 3. Cli
Page 391 and 392:
Managing Self Service Plug-ins The
Page 393 and 394:
Self Service Plug-in Bundles The Se
Page 395 and 396:
Installing Items from Self Service
Page 397 and 398:
Accessing Plug-ins Plug-ins are dis
Page 399 and 400:
Building Your MDM Framework Configu
Page 401 and 402:
3. Click the Global Management Fram
Page 403 and 404:
• If the server hosting the JSS
Page 405 and 406:
To set up or modify OTA Enrollment
Page 407 and 408:
6. Select or deselect additional op
Page 409 and 410:
Enrolling Mobile Devices OTA The JS
Page 411 and 412:
7. Customize the invitation message
Page 413 and 414:
The OTA Enrollment User Experience
Page 415 and 416:
5. When notified that the profile w
Page 417 and 418:
10. If the device has a passcode se
Page 419 and 420:
Enrolling Connected Mobile Devices
Page 421 and 422:
Downloading Enrollment Profiles Bef
Page 423 and 424:
Unenrolling Mobile Devices Unenroll
Page 425 and 426:
3. Click the Mobile Devices link ab
Page 427 and 428:
Page 429 and 430:
Viewing Mobile Device Search Result
Page 431 and 432:
Category Description Actions that y
Page 433 and 434:
A description of the information on
Page 435 and 436:
7. Click the Criteria tab and defin
Page 437 and 438:
Performing Mass Actions on Mobile D
Page 439 and 440:
2. Click the Inventory tab. 3. Perf
Page 441 and 442:
7. Add or modify information as nee
Page 443 and 444:
Deleting Mobile Devices from the JS
Page 445 and 446:
6. To send an email notification wh
Page 447 and 448:
Configuration Creating and Distribu
Page 449 and 450:
9. In the payloads list, select the
Page 451 and 452:
Distributing iOS Configuration Prof
Page 453 and 454:
Page 455 and 456:
Removing iOS Configuration Profiles
Page 457 and 458:
Security Management Running Remote
Page 459 and 460:
Viewing the Status of Remote Comman
Page 461 and 462:
Distribution Apps Understanding Unm
Page 463 and 464:
Make Available in the Self Service
Page 465 and 466:
Distributing In-House Apps In-house
Page 467 and 468:
10. Choose a hosting location for t
Page 469 and 470:
8. Enter or verify the app name, ve
Page 471 and 472:
Page 473 and 474:
5. Click the Scope tab and remove d
Page 475 and 476:
eBooks The JAMF Software Server (JS
Page 477 and 478:
9. Click Save. The eBook is distrib
Page 479 and 480:
Page 481 and 482:
Casper Focus Overview of Casper Foc
Page 483 and 484:
Managing Classes For a teacher to c
show all

Casper Suite Administrator's Guide v8.7 - JAMF Software

Create successful ePaper yourself

Delete template?

Save as template?