search

munkireport / munkireport-php

A reporting tool for munki
MIT License
392 stars 138 forks source link

Please consider not setting BaseUrl via the postinstall script #1497

Open flammable opened 1 year ago

flammable commented 1 year ago

At my last job, we added a second postinstall script, in Munki, to the MunkiReport client installer pkg to do defaults delete /Library/Preferences/MunkiReport.plist BaseUrl because we were setting that via a configuration profile instead.

We had a few rogue users perform a Migration Assistant transfer from their work laptop to a personal one, bringing over MunkiReport and its preferences file. Without those devices checking into Munki properly (to receive an unenroll script), we were powerless to stop them from checking into MunkiReport.

By moving Munki and MunkiReport's preferences to configuration profiles, we were able to perform an enterprise wipe to remove all profiles from the device - thus, even if Munki/MunkiReport were still present on disk, they weren't actively trying to reach our servers anymore.

I know setting the BaseUrl via the built-in postinstall script makes it easier for users to get up and running, but since Munki also requires users to push a profile (or a script running defaults write) to configure a repo URL, I think it's reasonable to expect MunkiReport to do the same.

I think the code for making this happen is here, but it's possible I'm looking in the wrong place. Thanks for considering this!

tuxudo commented 1 year ago

Should be supported with the Python 3 version of MunkiReport. When building the client pkg, use -u as an option to not have the BASEURL set by the post install script.