Splunk UF Dmg/PKG Silent Install for Mac

[jason_hotchkiss]

Hello - 

I am trying to script the installation for the Mac Splunk Universal Forwarder package.  The package is a disk image (.dmg).

I understand that we can mount the image using hidutil and access the volume to find the .pkg file.  The issue comes from where we attempt to run installer -pkg volume/splunkuf.pgk -target /Applications/SplunkUf/ the end user is prompted to answer dialog boxes, which we do not want to occur.  

Is there a switch to use to install the pkg file silently?

TIA
JH

[dkv21210]

Interesting! Thanks for this; I'll review and give this a try.

One question:  Are you creating a Splunk user and changing permissions recursively to splunk:splunk, or are you just leaving it as-is? (To this point, we've been doing the latter, but I'm wondering if creating a dedicated user might be preferable?)

[Knight_Owl]

Leaving it as is.

SplunkForwarder folder and contents within are owned by root and wheel

Applications Folder is owned by root and admin

[Knight_Owl]

Hi Jason,

Did you find a solution for this? 

[jason_hotchkiss]

Sorry, no I did not find a solution, the requirement changed, and we shifted gears.

[dkv21210]

I'd love to know as well. I've been banging my head against a wall with this, off and on, for a couple of months now. It's insane to me how impossible it is to find any solutions online (never mind this forum), and Splunk clearly doesn't care to address it.

How exactly are we to do quiet deployments of UF to a fleet of Macs managed by MDM? As it stands, the DMG is out (too much user interaction required, which apparently can't be suppressed), and the .tgz also requires a combination of scripting, permissions changes, possibly creation of a new user, setting environment variables, and moving config files into place.

Can I do this myself? Sure, but why should I have to? Even with the leverage of $GIGANTIC_FEDERAL_AGENCY, Splunk doesn't care to help us.

Godspeed to us all, I guess.

[Knight_Owl]

Hi dkv21210,

Are you using JAMF as your MDM?

[dkv21210]

Yes, I am. Previously, with an older version, we just used Jamf Composer watch the file system, then did the manual .pkg installed (user interaction and all), put in our settings files, then had Composer create the package. I really don't want to keep having to do that kind of sloppy install, but it's beginning to look like we may have to.

[Knight_Owl]

So, I was able to get it to silently deploy and it seems to be working as intended 

I built the package using Composer, making sure to set the proper R-W-X, Owner, and Group permissions for /Applications/SplunkForwarder

Then added the deploymentclient.conf file within the /Applications/SplunkForwarder/etc/system/local directory before building the package.

Then for my policy I added that package, and for the silent install I added a script which contains:

#!/bin/sh

#Accept Splunk Licenses

/Applications/SplunkForwarder/bin/splunk start --accept-license --auto-ports --no-prompt --answer-yes

# Enable boot start

/Applications/SplunkForwarder/bin/splunk enable boot-start

#Hide the folder

chflags hidden /Applications/SplunkForwarder

[Knight_Owl]

Although, I do notice that notifications are still enabled. I created a config profile that mutes Critical Alerts and Notifications for Bundle ID: aplt

Tested it once, seemed to work, but I'd like to test again on a fresh machine to verify.

[Knight_Owl]

Update, configuration profile works, no notifications are seen from the users perspective and workstation is added into Splunk 

[dkv21210]

I'm still working on this; I've made some progress on doing the .tar file install and tweaking it, but I'm getting these two alerts (see attached images) whenever I log in to the user account. Have you found a workaround (assuming you've seen this)?

[Knight_Owl]

Hey DK,

Build the PKG, then open terminal and run the command

sudo xattr -rd com.apple.quarantine /path/to/the.pkg 

This will remove the com.apple.quarantine attribute and stop the computer from checking it for malicious software. The -d option deletes the noted attribute and the -r option acts recursively.

If you would like to check which attributes the .PKG has on it, then run the command:

xattr -r /path/to/the.pkg

Hope this helps

[dkv21210]

Perfect! Thanks for the tip.