Category: Agent

How to Deploy Agent/Smart Installer with MDM

A frequently asked question of Mac-using McAfee customers is how do I deploy a .sh script to Macs? MDMs generally can only only deploy .pkg or .dmg files to Mac. The answer is to use a packaging utility to wrap the .sh file inside a .pkg file. MDMs typically provide a packaging tool, or you can use of the many open-source packaging utilities.

McAfee has posted instructions on how to build a .pkg for use with Jamf Pro MDM – KB94262 – Deploying McAfee products with Jamf Pro software.

For others, the basic steps are:

  1. Obtain the agentpackages.zip (contains install.sh) or McAfeeSmartInstall.sh from your ePO admin.
  2. Place the file where you want it installed – I recommend /tmp as the file will get cleaned up after a reboot.
  3. Open your packaging tool and drag-n-drop the file into the tool window. This will place the file in the appropriate installed location.
  4. Change the owner to root, group to wheel, and permissions to 755 (owner – all, group – read and execute, others – read and execute).
  5. Add version number to package filename. In on-prem epo, version numbers are important, while in MVISION ePO, version numbers aren’t so important. You will be upgrading your agent package at some point and it helps to be able to tell the current version from the new version!
  6. Build your package and upload to your MDM for distribution. We always recommend signing packages but doing so is outside the scope of this post.

The MDM will need to execute the script that the package wrote to disk. You can either do this by running the command in a policy from MDM or via a .pkg postinstall script. The postinstall script is outside the scope of this post, but Rich Trouton has an excellent post here that dives into the technical aspects of installer packages.

As for the run command method, the MDM will need to run:
• For install.sh: /private/tmp/install.sh -i
• For McAfeeSmartInstall.sh: /private/tmp/McAfeeSmartInstall.sh

NOTE: There is currently a bug in the smart installer script – you must update the script in a text editor to get it to install. The workaround is available here and also in the above Jamf Pro link.