Using a login script for
EXECUTIVE SUMMARY
This document describes how an administrator can configure a login script to deploy Kaspersky Lab Network Agent as conveying tool to install further the Kaspersky Endpoint Security 8 for Mac. This login script can be utilized with Apple Remote Desktop, or similar Mac management platforms, to assist in remote deployment.
At the completion of the tasks outlined target Apple systems will have the Kaspersky Network Agent installed. With the Network Agent installed deployment of Kaspersky Security for Mac can be completed through the Administration Kit
Please Note: Kaspersky Lab provides this document “as-is” as a courtesy to interested parties.
The accuracy of the information is solely the author’s responsibility. Neither Kaspersky Lab nor its partners support this document.
TARGET AUDIENCE AND PREREQUISITES
This document is for end users and resellers who are responsible for administering the Kaspersky
Security for Mac product.
It is recommended that you have:
• Working knowledge of the Apple Mac OS X operating system • Working knowledge of the Terminal application
• Working knowledge of Apple Remote Desktop
PROBLEM
Often administrators need flexible options for deployment of endpoint security. Although an installation package can be delivered via Apple Remote Desktop, Administrators can have a difficult task in determining when to roll out a software package. Utilizing a Login Script ensures that the security software is installed at login with minimal business impact.
SOLUTION
This solution provides administrators with a shell script which determines during the login process if the user has the Kaspersky Network Agent installed, and if not, automatically installs the software. If Kaspersky Anti-Virus for Mac (standalone version) is present it will be uninstalled as well.
PREPARATION STEPS
1. Download the associate scripts for modification from: http://support.kasperskyamericas.com/eval
2. Create a folder on a web server for the packages you want to get downloaded to your target machines. Note: The folder must be accessible via a URL.
3. In the script file (klscript.sh), edit the name of the download location to the variable downloadloc.
4. Copy the Kaspersky Anti-Virus for Mac (kavuninstaller.zip) file to the download folder prepared in Step 1. Note: This step is required for the removal of the Kaspersky Anti-Virus for Mac (standalone version) application.
5. Copy the Kaspersky Network Agent installation package (klnagentmac9.0.0.##mlg_en_ru_de_ fr.zip) to the same folder.
6. In the script file (klscript.sh), edit the name of the installation package to the variable
downloadNa. Also, add the IP address of your Kaspersky Administration Server to the variable IP_ADDRESS.
SCRIPT CONFIGURATION PROCEDURE
1. Copy the klscript.sh file to your home directory and rename the file kloginscript.sh.
2. Launch the Mac OS X Terminal application. Type the following command to edit the script file:
pico kloginscript.sh
4. Confirm and adjust the settings for the installation packages names and the Kaspersky Administration Kit server address.
5. You can optionally change other actions of the script like the installation of the Kaspersky Endpoint Security for Mac installation package.
6. Indicate that you want to exit the text editor by pressing CONTROL + X. 7. Save the file by pressing Y and then RETURN.
8. From the OS X terminal, type the following command to convert the file into an executable script:
sudo chmod 755 kloginscript.sh
LOGIN HOOK SETUP PROCEDURE
1. From the Mac OS X terminal, create a directory to store the login script.
sudo mkdir /etc/loginhook
2. Navigate to the directory with the kloginscript.sh file, and type:
sudo cp kloginscript.sh /etc/loginhook/kloginscript.sh
3. To trigger the login hook, type the following:
REMOVING THE LOGIN HOOK
1. From the Mac OS X terminal, type the following to remove the login hook:
sudo defaults delete com.apple.loginwindow LoginHook
DEPLOYING THE SCRIPT USING APPLE REMOTE DESKTOP
1. In Finder, press COMMAND + SHIFT + G (Go to Folder) and type: /etc/loginhook
7. Click Copy.
8. Select the same client machines as contained in the kloginscript.sh file. 9. Open Send UNIX Command.
10. Set Run command as: to “User:” and type “root”. 11. Type the following into the command field:
sudo defaults write com.apple.loginwindow LoginHook /etc/loginhook/kloginscript.sh
12. Press Send to complete the configuration.
REMOVING THE SCRIPT USING APPLE REMOTE DESKTOP
1. Repeat steps 1 – 12 as in the previous section Deploying the Script using Apple Remote
Desktop. However, in step 11 use the following command:
sudo defaults delete com.apple.loginwindow LoginHook
