OSX Updates/Software Distribution

[cshephard]

How do others do this for multiple machines on their networks?

 

We use microsoft sccm to distribute packages to our windows machines, and read somewhere you can also use it on macs. We installed the client on a test machine and enrolled it. We were able to put a package into sccm and push that out to our mac. We found this guide telling you how to set up automatic updates but cannot make it work. I don't really know anything about scripting but when we take the script in the guide and put it straight into terminal, it won't work.

 

Has anyone else been successful with this?

 

Thanks

[jamesfed]

Munki is the freebie offering here - munki - THIS PROJECT HAS MOVED TO GITHUB: https://github.com/munki/ - Google Project Hosting

 

Just install a package on the Macs and point them at your Munki server (its just a file store/website which can be co hosted on any OSX Server or even a client); from there the management console allows you to roll out new applications to your clients.

[Norphy]

It's been a while since I've done this but iirc, in SCCM you treat OS X updates in the same way as any other application package. You repackage it to cmmac format, add it to your console, distribute it to a DP and publish it to a collection. Assuming that the update you've downloaded applies to the Mac, it should just work. There is no updates section as such for Macs.

 

Pay close attention to the detection rules. I've found that the app packager has a habit of putting far too many in. I've also found that combo updates work better than point updates.

[cshephard]

We have looked at Munki before but thought it would be good if we could get it working through SCCM. That way, we keep everything together. Norphy, does your way mean manually downloading each update and then doing that? The guide we found allowed you to make sccm run a script that checks the macs update log file and if it finds new updates, it will install them. The macs register back to sccm and package distribution works, but the updates don't and when we paste the script into terminal on the mac, it dosen't like it. So we think the problem is there. Knowing nothing about apple scripts, we are at a loose end at the moment.

 

This is the guide I have been following - System Center Configuration Manager 2012 SP1: Automatic Updates on a Mac - South Central District Client Team - Site Home - TechNet Blogs

 

and this is the script we have been playing with:

 

if [ -e testfile ]

then

if grep /usr/sbin/softwareupdate /etc/crontab

then

echo entry exist waiting for cron to run

else

echo "30 * * * * root /usr/sbin/softwareupdate -l &> /tmp/softwareupdate.log" >> /etc/crontab

 

 

fi

else

echo "SHELL=/bin/sh" > /etc/crontab

 

 

echo "PATH=/bin:/sbin:/usr/bin:/usr/sbin" >> /etc/crontab

 

 

echo "30* * * * root /usr/sbin/softwareupdate -l &> /tmp/softwareupdate.log" >> /etc/crontab

 

 

fi

 

 

/bin/cat /tmp/softwareupdate.log

 

 

Thanks

[Norphy]

That's certainly an interesting way of going about it. It wasn't one that I'd ever thought of and it has a certain elegance about it I will admit.

 

However

 

That blog post was published in May 2013. In May 2013, the current version of OS X was Mountain Lion (10.8) and we're now on 10.11. Not only that, ConfigMgr 2012 SP1 had only started supporting 10.8 in CU1 which was released only a month before that so it's unknown what version of OS X they're talking about. The update mechanism for OS X changed from 10.7 to 10.8 iirc, they went from a standalone updater to updating using the App Store. I don't know if the scripts they've got there will work with newer versions. They might but I don't have a Mac to hand to test it unfortunately.

 

There are a couple of other disadvantages that I can think of to that method as well; primarily that the Macs aren't going to report back to the MP that the software updates have installed so you have no way of telling what updates are out there. Additionally, they'd have to download the updates from the Internet or from a caching server, not one of your DPs so that could increase the pressure on your internet connection.

 

That said, it's certainly a set and forget solution unlike adding the updates to ConfigMgr.

[cshephard]

So maybe I need to do what you said before and manually download the updates and put them on sccm then I can choose when they go out. I know other people use ARD to do it. We did look into getting that as its a cheap download from the app store but someone told us you need licenses for each machine or something?

 

Do any of you use ARD, if so did you just download it on the app store and can use it with as many macs as you want?

[pete]

ARD is (IIRC) licensed per controlling (admin) Mac that uses ARD to control/connect to client Macs. The endpoint client/listener is built into OS X by default.

[AntonioRocco]

@ shepherd

 

". . . just download it on the app store and can use it with as many macs as you want?"

 

Yes.

 

@ pete

 

This used to be the case with non-App store version which came on installation media. The license was for 10 or unlimited users. The current version (3.8.1) available from the App Store has no such licensing any more and you can control as many client workstations as you like.

 

The ARD Agent (the client bit of ARD) is part of the OS. The ARD available on the App Store is the administration software and leverages what is built into the OS. ARD by itself is fine but coupled together with OS X Server, Munki and DeployStudio makes one quarter of a powerful suite of software that goes a long way in managing your Apple estate.

 

My 2p.

 

Antonio Rocco (ACSA)