State Management In The Era Of MDM

Presentation from JNUC 2018, the world's largest rally of Apple IT administrators.

Session:
State Management In The Era Of MDM

Presented by:
Sergio Aviles

View all session slides, recordings and more at https://www.jamf.com/events/jamf-nation-user-conference/2018/.

Transcript

1. View Slide

2. © JAMF Software, LLC
   Sergio Aviles
   Systems Engineer, Unified Endpoint Management
   
   Comcast Corporation
   275x275
   
   head shot
   

   View Slide

3. © JAMF Software, LLC
   Introduction
   Born the seventh son
   of a seventh son, on a
   cold night under a
   blood moon….
   

   View Slide

4. © JAMF Software, LLC
   Introduction
   • Using Apple Computers circa 1985
   
   • Majored in Illustration at UArts in Philly
   
   • Bass player in several unknown bands
   
   • Has an album in iTunes and Spotify
   Things to know about me
   

   View Slide

5. © JAMF Software, LLC
   Introduction
   • Worked in several Pre-Press shops
   
   • Worked for an Apple Reseller
   
   • Worked in Managed Services
   
   • Hired to focus on Mac management
   Things to know about me
   

   View Slide

6. © JAMF Software, LLC
   State Management in the Era of MDM
   Overview
   What is State Management?
   
   Why is it important?
   
   How is State Management done?
   
   What are the challenges DEP/MDM introduce?
   
   Where do we go from here?
   

   View Slide

7. © JAMF Software, LLC
   What is State Management?
   • State = desired set of apps, configurations, files,
   services and users
   
   • Maintenance of that desired state in an
   idempotent way
   Managing a desired state of a device.
   

   View Slide

8. © JAMF Software, LLC
   What is State Management?
   Idempotence is…
   

   View Slide

9. © JAMF Software, LLC
   What is State Management?
   Idempotence is…
   • Not actually a word
   

   View Slide

10. © JAMF Software, LLC
    What is State Management?
    Idempotent is…
    

    View Slide

11. © JAMF Software, LLC
    What is State Management?
    Idempotence, then, is…
    • Consistent, repeatable results from a
    process or workflow
    
    • “An essential property for reliable 

    systems”
    

    View Slide

12. © JAMF Software, LLC
    What is State Management?
    Also known as Configuration Management
    • More apt term when applied to client devices
    
    • Interchangeable
    
    • Invokes initial deployment
    

    View Slide

13. © JAMF Software, LLC
    What is State Management?
    Like matter, devices can have different states
    • Initial, Current, Frozen, Desired, Ideal
    
    • The state of a device changes
    
    • Verifies current state vs. desired state
    
    • Control how, when, why and rate
    

    View Slide

14. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Types of States
    Initial:
    State of the device
    before you apply or
    install anything to the
    device.
    

    View Slide

15. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Types of States
    Current:
    State of the device as it
    exists at the time last
    reported.
    

    View Slide

16. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Types of States
    Current:
    State of the device as it
    exists at the time you’re
    checking.
    (Heisenberg’s
    uncertainty principle)
    

    View Slide

17. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Types of States
    Current:
    State of the device as it
    exists at the time you’re
    checking.
    (Heisenberg’s
    uncertainty principle)
    

    View Slide

18. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Types of States
    Desired:
    State of the device
    compliant with your
    environment.
    

    View Slide

19. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Types of States
    Frozen:
    Desired state that
    doesn’t change or
    reverts.
    

    View Slide

20. © JAMF Software, LLC
    Types of States
    • Current should always match Desired
    
    • An idempotent system ensures that
    
    • Doesn’t preclude changes
    Ideal:
    

    View Slide

21. © JAMF Software, LLC
    There is nothing permanent
    except change.
    -Heraclitus
    
    

    View Slide

22. © JAMF Software, LLC
    Change is constant
    • Software needs to be updated
    
    • New software needs to be installed
    
    • Profiles need to be changed or pulled
    
    • Settings need to be tweaked
    Device states will change.
    

    View Slide

23. © JAMF Software, LLC
    Change is constant
    • Users customize and/or install extra software
    
    • Software needs to be uninstalled
    
    • Device becomes unmanaged
    
    • Device needs to be re-deployed
    Device states will change.
    

    View Slide

24. © JAMF Software, LLC
    Change is constant
    • A continuous, relentless cycle of changes,
    big and small, constantly threatening to
    overwhelm you
    Device states will change.
    

    View Slide

25. © JAMF Software, LLC
    Managing Changes
    • Does $jawn need to change?
    
    • Why?
    
    • How do you want to change it?
    
    • When do you want to change it?
    Decide/define when changes will happen
    

    View Slide

26. © JAMF Software, LLC
    Managing Changes
    • How do you implement?
    
    • How do you track?
    
    • What is success or failure?
    
    • Who is responsible?
    Verifying changes
    

    View Slide

27. © JAMF Software, LLC
    Why is State Management Important?
    • Control
    
    • Automation
    
    • Reporting
    The way to lazy admin nirvana
    

    View Slide

28. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Why is State Management Important?
    Control
    • Ensure compliance
    
    • Manage changes
    
    • Manage who is
    responsible for changes
    

    View Slide

29. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Why is State Management Important?
    Automation
    • Do more with less
    
    • Idempotency
    
    • Quality of Life
    

    View Slide

30. © JAMF Software, LLC
    780 px
    650 px
    Max image dimensions
    Why is State Management Important?
    Reporting
    • Know your environment
    
    • Answer questions
    
    • Justification
    
    • Manager friendly
    

    View Slide

31. © JAMF Software, LLC
    Standard State Management
    How it’s typically done
    • Your desired state exists as text file
    

    View Slide

32. © JAMF Software, LLC
    Standard State Management
    How it’s typically done
    • Text file lives in a repo somewhere
    

    View Slide

33. © JAMF Software, LLC
    Standard State Management
    How it’s typically done
    • Commit changes to file in the repo
    

    View Slide

34. © JAMF Software, LLC
    Standard State Management
    How it’s typically done
    • Commit changes to file in the repo
    

    View Slide

35. © JAMF Software, LLC
    Standard State Management
    How it’s typically done
    • Commit changes to file in the repo
    

    View Slide

36. © JAMF Software, LLC
    Standard State Management
    How it’s typically done
    • Clients make changes to match
    

    View Slide

37. © JAMF Software, LLC
    Standard State Management
    • “Infrastructure as code”
    
    • Change control
    
    • Versioning
    
    • Bulk of work is done client side
    How it’s typically done
    

    View Slide

38. © JAMF Software, LLC
    Standard State Management
    How it’s typically done
    

    View Slide

39. © JAMF Software, LLC
    How MDM changes the equation
    • User driven
    
    • 3rd party actions should be approved
    
    • No distinction for intent
    
    • MDM is exception mechanism
    Apple’s Security Posture
    

    View Slide

40. © JAMF Software, LLC
    How MDM changes the equation
    • UAMDM/Supervised mode
    
    • UAKEL
    
    • User Privacy in macOS Mojave
    
    • MDM is now mandatory
    Apple’s Security Posture
    

    View Slide

41. © JAMF Software, LLC
    How MDM changes the equation
    • User data in certain directories now protected
    
    • AppleEvents and inter-app exchanges
    
    • Admin tools that subprocess out
    
    • May fail or not run if not approved
    Privacy Preferences Policy Control
    

    View Slide

42. © JAMF Software, LLC
    How MDM changes the equation
    MDM is not an idempotent service
    

    View Slide

43. © JAMF Software, LLC
    How MDM changes the equation
    • Best Effort
    
    • External service
    
    • Lack of insight/logging
    
    • “UDP of Management”
    MDM is not an idempotent service.
    

    View Slide

44. © JAMF Software, LLC
    How MDM changes the equation
    • APNS, DEP, ABM/ASM, VPP, Activation
    
    • Process has been detailed extensively
    
    • Notification delivery isn’t guaranteed
    
    • Not idempotent
    Best Effort service
    

    View Slide

45. © JAMF Software, LLC
    How MDM changes the equation
    • APNS network owned by Apple
    
    • DEP/VPP requires 3rd party support
    
    • Secure Boot = DEP only deployments*
    
    • DEP not available everywhere, yet
    External Service
    

    View Slide

46. © JAMF Software, LLC
    How MDM changes the equation
    • Lack of communication around changes
    
    • Little documentation around changes
    
    • Short testing windows for all parties
    
    • Immature implementations
    External Service
    

    View Slide

47. © JAMF Software, LLC
    How MDM changes the equation
    • Lack of admin tools for DEP, MDM
    
    • Little documentation around tools
    Insight and Logging
    

    View Slide

48. © JAMF Software, LLC
    $ man mdmclient
    

    View Slide

49. © JAMF Software, LLC
    How MDM changes the equation
    • Lack of admin tools for DEP, MDM
    
    • Little documentation around tools
    
    • Logging and troubleshooting not trivial
    
    • MDM vendors and 3rd party fill in gaps
    
    Insight and Logging
    

    View Slide

50. © JAMF Software, LLC
    Screenshot or photo dimensions
    
    1080 px
    525 px
    

    View Slide

51. © JAMF Software, LLC
    How MDM changes the equation
    • Some settings can be overridden
    
    • Some Profiles only work at install time
    
    • Can’t pre-deploy some profiles
    
    • Not actively validating state
    Configuration Profiles
    

    View Slide

52. © JAMF Software, LLC
    Where do we go from here?
    • Configuration profiles dynamically generated
    
    • Installed via `profiles` command
    
    • Not User-Approved
    
    • No whitelisting
    State Management Systems lack MDM
    

    View Slide

53. © JAMF Software, LLC
    Where do we go from here?
    • Not mutually exclusive
    
    • Smart Groups and EAs
    
    • Adds additional complexity
    
    • Requires additional engineering
    Toward a Stateful Jamf Pro
    

    View Slide

54. © JAMF Software, LLC
    Where do we go from here?
    • Make clients do the work
    
    • Vary frequency
    
    • Passive over Active EAs
    
    • Simplify Smart Group Criteria
    Server-side processing
    

    View Slide

55. © JAMF Software, LLC
    Where do we go from here?
    • Search for something existing
    
    • Modify if necessary
    
    • Write your own if possible
    Tooling
    

    View Slide

56. © JAMF Software, LLC
    Where do we go from here?
    • LaunchDaemon that calls app/script
    
    • Desired State hosted
    
    • Script reads state and verifies locally
    
    • Sets local EA values and does recon
    Experiment #1
    

    View Slide

57. © JAMF Software, LLC
    Where do we go from here?
    • EA values read during recon
    
    • Smart group calculations made
    
    • Policies run at next check-in or trigger
    
    • Frequency to be determined
    Experiment #1
    

    View Slide

58. © JAMF Software, LLC
    Where do we go from here?
    • Pro: Scales
    
    • Con: Reinventing the wheel
    Experiment #1
    

    View Slide

59. © JAMF Software, LLC
    Where do we go from here?
    • Same as #1 except locally hosted state file
    
    • Pro: Less setup
    
    • Con: doesn’t scale as well
    Experiment #2
    

    View Slide

60. © JAMF Software, LLC
    Where do we go from here?
    • Conditional Access integration helps
    
    • Integrate an existing solution
    
    • File FRs
    
    • Vote for similar FRs
    Toward a Stateful Jamf Pro
    

    View Slide

61. © JAMF Software, LLC
    Website | Facebook | Twitter | #philly on MacAdmins Slack
    Greater Philadelphia Mac Admins
    

    View Slide

62. © JAMF Software, LLC
    

    View Slide

63. © JAMF Software, LLC
    Check out Philly’s own John Mahlman
    • Thursday, Oct. 25 at 9:00 AM - 9:45 AM
    
    • Nicollet Grand Ballroom
    Leveraging DEPNotify and Jamf Pro for Device
    Deployment
    

    View Slide

64. © JAMF Software, LLC
    Thanks to the following people
    The Donna
    
    MacAdmins Twitter and Slack
    
    Jamf folks
    
    Comcast folks
    
    Et al
    

    View Slide

65. © JAMF Software, LL
    THANK YOU!
    

    View Slide