Upgrade to Pro — share decks privately, control downloads, hide ads and more …

APNS + MDM: A Technical Update for an Elite Squ...

Jamf
November 13, 2019
160

APNS + MDM: A Technical Update for an Elite Squadron of Mac Administrators

Jamf

November 13, 2019
Tweet

Transcript

  1. © JAMF Software, LLC APNS + MDM: 2:45 - 3:30

    PM UP NEXT A technical update for elite squadrons
 of Mac administrators
  2. © JAMF Software, LLC APNS + MDM: A technical update

    for elite squadrons of Mac administrators Brad Chapman Systems Engineer
  3. © JAMF Software, LLC APNS + MDM A technical update

    for elite squadrons
 of Mac administrators
  4. © JAMF Software, LLC Looking Back… To the Future! See

    for Yourself What’s Possible Last Words Outline
  5. © JAMF Software, LLC Push notifications are small packets of

    data with instructions for a device. APNS uses Akamai Global Traffic Management for peak performance. APNS has multiple security factors for integrity and authenticity. APNS is required for secure delivery of configuration profiles. Devices expect a direct, persistent path to the Internet. You must permit outbound connections to Apple. Apple does not make inbound connections. Looking Back… The 7 Principles of APNS
  6. © JAMF Software, LLC † 443 is used as a

    fallback over Wi-Fi only. The protocol is HTTPS. Function Server Address : Port Sending Notifications gateway.push.apple.com : 2195 Receiving Feedback feedback.push.apple.com : 2196 Initialization (Devices) init-p01st.push.apple.com : 80 Notifications (Devices) ##-courier.push.apple.com : 5223† New http/2 API api.push.apple.com : 443 Looking Back… APNS Hosts and Ports
  7. © JAMF Software, LLC Looking Back… 1 2 3 4

    5 6 7 8 9 10 11 12 13 14 15 16 1 sjc 5 pop-namer-se 9 pop-eur-uk 13 pop-apac-india 2 us 6 pop-namer-south 10 pop-eur-benelux 14 pop-apac-aus 3 pop-namer-north 7 pop-namer-central 11 pop-eur-scan 15 china 4 pop-namer-ne 8 pop-namer-nw 12 pop-eur-central 16 asia APNS Points of Presence (2017) [pop]-courier.push-apple.com.akadns.net ~1,750 IPs
  8. © JAMF Software, LLC Looking Back… 1 2 3 4

    5 6 7 8 9 10 11 12 13 14 15 16 1 us-nw 5 us-south 9 eu-nw 13apac-taiwan 2 us-sw 6 us-ne 10 eu-central 14apac-in 3 us-north 7 us-se 11 af-sa 15apac-asia 4 us-central 8 gb 12 apac-china 16apac-au APNS Points of Presence (2019) [pop]-courier-4.push-apple.com.akadns.net ! ~2,000 IPs
  9. © JAMF Software, LLC Apple still owns 17.0.0.0/8 Apple services

    uses certificate pinning Jamf uses APNS binary (2195-2196) Looking Back… Rules of the road
  10. © JAMF Software, LLC Looking Back… Things hosted outside 17.0.0.0/8:

    • Init bag files • Software CDNs • OCSP Cert Validation • others… …we don’t need roads.
  11. © JAMF Software, LLC To the Future! What’s New since

    JNUC 2017 JMortonPhoto.comOtoGodfrey.com — CC-BY-SA 4.0
  12. © JAMF Software, LLC To the Future! Binary protocol ends

    November 2020 Move to HTTP/2-based API • High speed, parallel processing • Improved error handling • Per-notification feedback Big news about APNS: Apple Developer News: Apple Push Notification Service Update
  13. © JAMF Software, LLC To the Future! What’s new for

    Mac? Dec 2017 T2 Secure Boot Jun 2018 TCC + PPPC Dec 2017 UAMDM Jul 2018 Remote Desktop Apr 2018 Jamf 10.3 Jun 2019 AppleSeed for IT Apr 2018 UAKEL Aug 2019 Certifications Apr 2018 ABM/ASM Oct 2019 Catalina
  14. © JAMF Software, LLC To the Future! Complex, powerful security

    module Requires local admin user to modify Plan deployments for “Full Security.” T2 Secure Boot HT208330: Secure Boot HT208198: Secure Startup Utility PDF: T2 Security Chip Overview
  15. © JAMF Software, LLC To the Future! MDM had to

    be approved manually. Could not be clicked remotely. UAMDM HT208019: Prepare for changes … in High Sierra Admin tested; user approved.
  16. © JAMF Software, LLC To the Future! QuickAdd package deprecated

    Enrollment loads CA + MDM profiles APNS required to establish trust with MDM Config profiles are auto-approved Jamf Pro 10.3 JN 499: Managing User Approved MDM
  17. © JAMF Software, LLC To the Future! User has 30

    min. to approve KEXT’s Whitelisting requires approved profile Testing: install & collect Team IDs UAKEL DerFlounder: Whitelisting third-party kernel extensions
  18. © JAMF Software, LLC To the Future! Replaces Device Enrollment

    Program Automated Device Enrollment Multiple tokens / pre-stage workflows MDM Profiles are auto-approved ABM / ASM HT208817: Upgrade your organization to ABM HT206960: Upgrade your institution to ASM
  19. © JAMF Software, LLC To the Future! Users prompted once

    by every app requesting specific permissions. Whitelist* with approved MDM profile Jamf updates often to support new TCC permissions TCC + PPPC macOS User Guide: Change privacy preferences on Mac JNUC 2018: PPPC, TCC, User Data Protection and You
  20. © JAMF Software, LLC To the Future! kickstart command Control

    & observe was removed during 10.14 beta cycle Enable with configuration profile
 (requires UAMDM) While shadowing with senior SE, I attended a meeting at Hooli & The Social Network. They asked about how to provision 1000s of headless Mac Minis. Q: How do you verify if Macs are able to utilize this? A: Look at Jamf record for User Approved MDM. Remote Desktop HT209161: Use the kickstart CLI in 10.14 and later
  21. © JAMF Software, LLC To the Future! Admins can invite

    testers via ABM / ASM …or let a “staff admin” do it for you! Ongoing testing + feedback to Apple AppleSeed for IT MobCo: AppleSeed for IT is now available for everybody
  22. © JAMF Software, LLC HT202739:
 Security certifications, validations, guidance ISO

    27001, ISO 27018, T2 Firmware, SEP Key Store, macOS To the Future! ISO 27001:2013 (ISMS) ISO 27018:2019 (Cloud / PII) Industrial Strength
  23. © JAMF Software, LLC To the Future! App Notarization Mac

    supervision New TCC & Notification controls Activation Lock for T2 Macs only MDM can only bypass if Mac is supervised Catalina HT202804: Use MDM to manage Activation Lock & Lost Mode
  24. © JAMF Software, LLC …to the Future! Apple: MDM Settings

    for IT Administrators Apple: Mac Deployment Overview Apple: WWDC 2019 Session 303
 What’s new in Managing Apple Devices Additional Reading
  25. © JAMF Software, LLC See for Yourself Exclusively for Mac

    : obdev.at Rich UI with powerful filtering Checks app code signatures PCAP: Individual apps / services OSI layers 3-7 Little Snitch
  26. © JAMF Software, LLC See for Yourself Ultra-compact DNS server

    Built for the Raspberry Pi platform Also works on VMs and Dockers Great for SoHo & test networks Black + white lists, detailed logging Free & Open Source: pi-hole.net Pi-Hole
  27. © JAMF Software, LLC See for Yourself The ultimate packet

    inspector Captures all traffic on an interface
 (OSI Layers 2-7) Detailed analysis & export functions ⚠ Can be overwhelming at first Free & open source: www.wireshark.org Wireshark
  28. © JAMF Software, LLC See for Yourself GUI bogs down

    during long, heavy sessions Use the CLI tools:
 /Applications/Wireshark.app/Contents/MacOS/ dumpcap -D dumpcap -i en# [-w outfile] editcap -c ### infile outfile Wireshark
  29. © JAMF Software, LLC Demo Show all DNS requests from

    a fresh macOS install See for Yourself
  30. © JAMF Software, LLC See for Yourself Wireshark Demo 1.

    Display Filter: dns and dns.flags.response == 0 and dns.qry.type == 1 2. Export specified packets as a CSV file. 3. Process in Terminal for unique entries…
  31. © JAMF Software, LLC See for Yourself awk -F"," '{

    print $7 }' pcap.csv \ | sed 's_"_ _ g' | cut -c 25- \ | awk '!x[$0]++' | grep -v .net No. Time Source Destination Protocol Length Info 44 30:00.1 192.168.2.6 192.168.2.1 DNS 84 Standard query 0x15f9 A 1-courier.push.apple.com
  32. © JAMF Software, LLC See for Yourself awk -F"," '{

    print $7 }' pcap.csv \ | sed 's_"_ _ g' | cut -c 25- \ | awk '!x[$0]++' | grep -v .net No. Time Source Destination Protocol Length Info 44 30:00.1 192.168.2.6 192.168.2.1 DNS 84 Standard query 0x15f9 A 1-courier.push.apple.com
  33. © JAMF Software, LLC See for Yourself awk -F"," '{

    print $7 }' pcap.csv \ | sed 's_"_ _ g' | cut -c 25- \ | awk '!x[$0]++' | grep -v .net Standard query 0x15f9 A 1-courier.push.apple.com " " Standard query 0x15f9 A 1-courier.push.apple.com
  34. © JAMF Software, LLC See for Yourself awk -F"," '{

    print $7 }' pcap.csv \ | sed 's_"_ _ g' | cut -c 25- \ | awk '!x[$0]++' | grep -v .net Standard query 0x3b5e A bag.itunes.apple.com Standard query 0x4690 A cf.iadsdk.apple.com Standard query 0xa975 A iadsdk.apple.com Standard query 0x1b6a A itunes.apple.com Standard query 0x6e74 A init.push.apple.com Standard query 0x48ff A 14-courier.push.apple.com Standard query 0xdf15 A iprofiles-st.apple.com.akadns.ne Standard query 0x7ed9 A e673.dsce9.akamaiedge.net Standard query 0x0d9b A e673.dsce9.akamaiedge.net Standard query 0x0f17 A humb.apple.com.akadns.net Standard query 0xf853 A iprofiles.apple.com.akadns.net Standard query 0x4fc0 A e673.dsce9.akamaiedge.net Standard query 0xd524 A appleid.apple.com Standard query 0xc6a2 A e6858.dsce9.akamaiedge.net Standard query 0x15f9 A 1-courier.push.apple.com Standard query 0x5a68 A 14.courier-push-apple.com.akadns Standard query 0x3717 A 1.courier-sandbox-push-apple.com Standard query 0x0e75 A mesu.apple.com Standard query 0xd3e1 A swdist.apple.com.edgekey.net Standard query 0xf65b A gateway.fe.apple-dns.net Standard query 0xe939 A gsa.apple.com.akadns.net Standard query 0xa702 A radarsubmissions.apple.com Standard query 0xb8a8 A swdist.apple.com.akadns.net Standard query 0xb83b A a239.gi3.akamai.net Standard query 0x3f99 A init-p01md-lb.push-apple.com.aka Standard query 0x15f9 A 1-courier.push.apple.com
  35. © JAMF Software, LLC See for Yourself awk -F"," '{

    print $7 }' pcap.csv \ | sed 's_"_ _ g' | cut -c 25- \ | awk '!x[$0]++' | grep -v .net bag.itunes.apple.com cf.iadsdk.apple.com iadsdk.apple.com itunes.apple.com init.push.apple.com 14-courier.push.apple.com iprofiles-st.apple.com.akadns.ne e673.dsce9.akamaiedge.net e673.dsce9.akamaiedge.net humb.apple.com.akadns.net iprofiles.apple.com.akadns.net e673.dsce9.akamaiedge.net appleid.apple.com e6858.dsce9.akamaiedge.net 1-courier.push.apple.com 14.courier-push-apple.com.akadns 1.courier-sandbox-push-apple.com mesu.apple.com swdist.apple.com.edgekey.net gateway.fe.apple-dns.net gsa.apple.com.akadns.net radarsubmissions.apple.com swdist.apple.com.akadns.net a239.gi3.akamai.net init-p01md-lb.push-apple.com.aka 1-courier.push.apple.com
  36. © JAMF Software, LLC See for Yourself awk -F"," '{

    print $7 }' pcap.csv \ | sed 's_"_ _ g' | cut -c 25- \ | awk '!x[$0]++' | grep -v .net swdist.apple.com bag.itunes.apple.com cf.iadsdk.apple.com iadsdk.apple.com init.push.apple.com 14-courier.push.apple.com iprofiles-st.apple.com.akadns.ne humb.apple.com.akadns.net iprofiles.apple.com.akadns.net appleid.apple.com e6858.dsce9.akamaiedge.net 1-courier.push.apple.com mesu.apple.com gateway.fe.apple-dns.net gsa.apple.com.akadns.net radarsubmissions.apple.com swdist.apple.com.akadns.net a239.gi3.akamai.net init-p01md-lb.push-apple.com.aka setup.fe.apple-dns.net cf.iadsdk.apple.com iadsdk.apple.com 1-courier.push.apple.com
  37. © JAMF Software, LLC See for Yourself awk -F"," '{

    print $7 }' pcap.csv \ | sed 's_"_ _ g' | cut -c 25- \ | awk '!x[$0]++' | grep -v .net swdist.apple.com bag.itunes.apple.com cf.iadsdk.apple.com iadsdk.apple.com init.push.apple.com 14-courier.push.apple.com appleid.apple.com 1-courier.push.apple.com mesu.apple.com radarsubmissions.apple.com init-p01md-lb.push-apple.com.aka cf.iadsdk.apple.com iadsdk.apple.com gspe1-ssl.ls.apple.com 1-courier.push.apple.com
  38. © JAMF Software, LLC See for Yourself All DNS records

    - first 10 minutes (with enrollment) www.apple.com 1-courier.push.apple.com 1-courier.sandbox.push.apple.com gspe35-ssl.ls.apple.com gspe1-ssl.ls.apple.com appleid.apple.com mesu.apple.com swscan.apple.com gsa.apple.com radarsubmissions.apple.com lcdn-locator.apple.com pancake.apple.com updates-http.cdn-apple.com swdist.apple.com gateway.icloud.com bag.itunes.apple.com g.symcd.com ocsp.digicert.com cf.iadsdk.apple.com iadsdk.apple.com humb.apple.com ocsp.apple.com init.ess.apple.com init-p01md.apple.com iprofiles.apple.com setup.icloud.com configuration.ls.apple.com gspe21-ssl.ls.apple.com init.push.apple.com 8-courier.push.apple.com gsp64-ssl.ls.apple.com itunes.apple.com jamf.acme.com updates-http.g.aaplimg.com smp-device-content.apple.com init.itunes.apple.com api.apple-cloudkit.com world-gen.g.aaplimg.com *Not a complete list
  39. © JAMF Software, LLC See for Yourself Content distribution network

    Follow DNS and whitelist accordingly *.akamaiedge.net *.edgekey.net *.edgesuite.net Remember the Akamai… Akamai: Edge Hostnames API
  40. © JAMF Software, LLC See for Yourself MacEval Utility PS

    + Mac Solutions Architects Evaluates your network’s readiness to deploy and manage Apple devices Concise report with action items Contact an Apple SE for details
  41. © JAMF Software, LLC See for Yourself A Deep Dive

    into macOS MDM
 Jesse Endahl & Max Bélanger Apple Device Management
 Charles Edge & Rich Trouton Additional Reading
  42. © JAMF Software, LLC What’s Possible Mac: the ultimate unboxing

    Automatic enrollment & supervision Rapid deployment of apps Delightful user experiences
  43. © JAMF Software, LLC What’s possible Ceremony Inspired by DEPNotify

    and Splashbuddy GetCeremony.app Slack: #ceremony Demo: GitHub Gallery @ JNUC
  44. © JAMF Software, LLC Houston, we have a problem When

    devices can’t contact Apple IF-Adrift © 2009 Eric Battaglia
  45. © JAMF Software, LLC Houston, we have a problem Auto

    Device Enrollment Manual enrollment Security policies Software updates Impacted workflows Management actions User experience Return to service
  46. © JAMF Software, LLC Houston, we have a problem Can’t

    reach activation servers… Macs can skip remote management Not enrolled & unsupervised Auto Device Enrollment
  47. © JAMF Software, LLC Houston, we have a problem Mac

    installs profiles… …yet fails to validate via APNS Enrollment fails. Manual Enrollment Jamf Admin Guide: User-initiated enrollment
  48. © JAMF Software, LLC Houston, we have a problem Enforced

    with profiles Triggered by APNS Sideloaded profiles are not trusted Security policies
  49. © JAMF Software, LLC Houston, we have a problem T1

    / T2: BridgeOS validation fails Can’t defer or force software updates macOS updates cannot be verified No background + critical updates Software Updates HT207567: Make sure your MBP can connect… HT207005: About background updates
  50. © JAMF Software, LLC Houston, we have a problem Enable

    / disable: Remote desktop Bluetooth Remote lock and wipe Override Activation Lock Management
  51. © JAMF Software, LLC Houston, we have a problem User

    Experience Can’t manage privacy / notifications No Self Service notifications No remote notifications
  52. © JAMF Software, LLC Houston, we have a problem Cloud

    Services No VPP / App Store No FaceTime or iMessage No Continuity or Handoff
  53. © JAMF Software, LLC Houston, we have a problem •

    macOS (Internet) Recovery • 802.1X / RADIUS not supported • Wi-Fi: WPA2-PSK or Open • External DNS resolution • No proxies or SSL decryption • Consider a limited ‘deploy’ SSID Return to Service Error -2003F
  54. © JAMF Software, LLC Last Words What if Microsoft asked

    you to prepare for a Windows Notification Service? They did … in 2011. WNS Overview Firewall + Proxy Configuration IP addresses for MPNS + WNS Devil’s Advocate
  55. © JAMF Software, LLC Last Words If you don’t make

    changes to your network, Jamf + Apple may be unable to support you. A Warning:
  56. © JAMF Software, LLC Last Words Set baseline security with

    MDM Reinforce with education Monitor at the perimeter Avoid local security agents Think global, not local
  57. © JAMF Software, LLC Last Words Consistent, delightful experiences Streamlining

    support model Empowering end users Why care about MDM?
  58. © JAMF Software, LLC Last Words Trust people to do

    the right thing. Assume positive intent. People are awesome. Remember the Human
  59. © JAMF Software, LLC Last Words APNS = the gateway

    to MDM MDM = great experiences with Apple Apple = the best tools for work Apple means business 
  60. © JAMF Software, LLC References Apple Push Notification Service Update

    HT208330: Secure Boot HT208198: Secure Startup Utility PDF: T2 Security Chip Overview HT208019: Prepare for changes to kernel extensions… JN 499: Managing User Approved MDM DerFlounder: Whitelisting third-party kernel extensions HT208817: Upgrade your organization to ABM HT206960: Upgrade your institution to ASM HT209161: Use the kickstart CLI in 10.14 and later MobCo: AppleSeed for IT is now available for everybody macOS User Guide: Change privacy preferences on Mac JNUC 2018: PPPC, TCC, User Data Protection and You HT202739: Security certifications, validations, guidance ISO 27001, ISO 27018, T2 Firmware, SEP Key Store, macOS HT202804: Use MDM to manage Activation Lock & Lost Mode MDM Settings for IT Administrators Mac Deployment Overview WWDC 2019 Session 303 (Managing Apple Devices) Little Snitch: obdev.at Pi-Hole: pi-hole.net WireShark: www.wireshark.org Akamai: Edge Hostnames API HT210060: Use Apple products on Enterprise Networks Jamf Admin Guide: User-initiated enrollment HT207567: Make sure your MBP can connect… HT207005: About background updates WNS Overview, Firewall + Proxy Configuration IP addresses for MPNS + WNS Palo Alto: Applipedia
  61. © JAMF Software, LLC Thank you for attending! Give us

    feedback by completing the 2-question session survey in the JNUC 2019 app. UP NEXT Roll Your Own Configuration Profile 4:00 PM