Proxy Management on macOS

Configure and manage enterprise proxy settings across your MacFleet devices using advanced networksetup commands. This tutorial covers all proxy types including web, secure web, streaming, Gopher, and SOCKS firewall proxies with enterprise-grade management capabilities.

Understanding macOS Proxy Management

macOS provides comprehensive proxy configuration through the networksetup command-line utility, supporting:

• Web Proxy (HTTP) - Standard HTTP traffic routing
• Secure Web Proxy (HTTPS) - Encrypted HTTPS traffic with end-to-end security
• Streaming Proxy - Multimedia content optimization (deprecated in macOS 13.0+)
• Gopher Proxy - Legacy Gopher protocol support (deprecated in macOS 13.0+)
• SOCKS Firewall Proxy - Generic protocol supporting most applications

Web Proxy Configuration

Basic Web Proxy Setup

#!/bin/bash

# Configure HTTP web proxy
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="proxy.company.com"
PROXY_PORT="8080"
AUTHENTICATED="on"
USERNAME="proxyuser"
PASSWORD="proxypass"

# Set web proxy configuration
networksetup -setwebproxy "$NETWORK_SERVICE" "$PROXY_SERVER" "$PROXY_PORT" "$AUTHENTICATED" "$USERNAME" "$PASSWORD"

# Enable web proxy
networksetup -setwebproxystate "$NETWORK_SERVICE" on

echo "Web proxy configured successfully for $NETWORK_SERVICE"

Advanced Web Proxy Management

#!/bin/bash

# Enterprise Web Proxy Configuration System
NETWORK_SERVICE="Wi-Fi"
CONFIG_FILE="/etc/macfleet/proxy_config.conf"
LOG_FILE="/var/log/macfleet_proxy.log"

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Load proxy configuration from file
load_proxy_config() {
    if [[ -f "$CONFIG_FILE" ]]; then
        source "$CONFIG_FILE"
        log_action "Loaded proxy configuration from $CONFIG_FILE"
    else
        echo "Configuration file not found: $CONFIG_FILE"
        exit 1
    fi
}

# Configure web proxy with validation
configure_web_proxy() {
    local server="$1"
    local port="$2"
    local auth="$3"
    local username="$4"
    local password="$5"
    
    # Validate network service exists
    if ! networksetup -listallnetworkservices | grep -q "^$NETWORK_SERVICE$"; then
        log_action "ERROR: Network service '$NETWORK_SERVICE' not found"
        return 1
    fi
    
    # Test proxy connectivity
    if ! nc -z "$server" "$port" 2>/dev/null; then
        log_action "WARNING: Cannot reach proxy server $server:$port"
    fi
    
    # Configure proxy
    if networksetup -setwebproxy "$NETWORK_SERVICE" "$server" "$port" "$auth" "$username" "$password"; then
        networksetup -setwebproxystate "$NETWORK_SERVICE" on
        log_action "Web proxy configured: $server:$port (Auth: $auth)"
        return 0
    else
        log_action "ERROR: Failed to configure web proxy"
        return 1
    fi
}

# Verify proxy configuration
verify_proxy_config() {
    local proxy_info
    proxy_info=$(networksetup -getwebproxy "$NETWORK_SERVICE")
    
    echo "Current Web Proxy Configuration:"
    echo "$proxy_info"
    
    if echo "$proxy_info" | grep -q "Enabled: Yes"; then
        log_action "Web proxy verification successful"
        return 0
    else
        log_action "Web proxy verification failed"
        return 1
    fi
}

# Main execution
main() {
    log_action "Starting web proxy configuration"
    
    # Example configuration (replace with actual values)
    configure_web_proxy "proxy.company.com" "8080" "on" "proxyuser" "proxypass"
    
    # Verify configuration
    verify_proxy_config
    
    log_action "Web proxy configuration completed"
}

# Execute if script is run directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

Secure Web Proxy (HTTPS)

Basic HTTPS Proxy Setup

#!/bin/bash

# Configure HTTPS secure web proxy
networksetup -setsecurewebproxy "Wi-Fi" "secure-proxy.company.com" "8443" on "secureuser" "securepass"
networksetup -setsecurewebproxystate "Wi-Fi" on

echo "Secure web proxy configured successfully"

Enterprise HTTPS Proxy Management

#!/bin/bash

# Enterprise Secure Web Proxy Configuration
configure_secure_proxy() {
    local network_service="$1"
    local proxy_server="$2"
    local proxy_port="$3"
    local username="$4"
    local password="$5"
    
    echo "Configuring secure web proxy for $network_service..."
    
    # Validate SSL/TLS connectivity
    if openssl s_client -connect "$proxy_server:$proxy_port" -verify_return_error < /dev/null 2>/dev/null; then
        echo "✅ SSL connectivity verified for $proxy_server:$proxy_port"
    else
        echo "⚠️  WARNING: SSL connectivity issues detected"
    fi
    
    # Configure secure proxy
    if networksetup -setsecurewebproxy "$network_service" "$proxy_server" "$proxy_port" on "$username" "$password"; then
        networksetup -setsecurewebproxystate "$network_service" on
        echo "✅ Secure web proxy configured successfully"
        
        # Verify configuration
        echo "Configuration details:"
        networksetup -getsecurewebproxy "$network_service"
        
        return 0
    else
        echo "❌ Failed to configure secure web proxy"
        return 1
    fi
}

# Certificate validation for secure proxies
validate_proxy_certificate() {
    local proxy_server="$1"
    local proxy_port="$2"
    
    echo "Validating proxy certificate..."
    
    local cert_info
    cert_info=$(openssl s_client -connect "$proxy_server:$proxy_port" -servername "$proxy_server" < /dev/null 2>/dev/null | openssl x509 -text -noout)
    
    if [[ -n "$cert_info" ]]; then
        echo "Certificate validation successful"
        echo "Certificate subject: $(echo "$cert_info" | grep "Subject:" | head -1)"
        echo "Certificate issuer: $(echo "$cert_info" | grep "Issuer:" | head -1)"
        return 0
    else
        echo "Certificate validation failed"
        return 1
    fi
}

# Usage example
configure_secure_proxy "Wi-Fi" "secure-proxy.company.com" "8443" "secureuser" "securepass"
validate_proxy_certificate "secure-proxy.company.com" "8443"

SOCKS Firewall Proxy

Basic SOCKS Proxy Configuration

#!/bin/bash

# Configure SOCKS firewall proxy
networksetup -setsocksfirewallproxy "Wi-Fi" "socks-proxy.company.com" "1080" on "socksuser" "sockspass"
networksetup -setsocksfirewallproxystate "Wi-Fi" on

echo "SOCKS firewall proxy configured successfully"

Advanced SOCKS Proxy Management

#!/bin/bash

# Enterprise SOCKS Proxy Configuration System
setup_socks_proxy() {
    local network_service="$1"
    local socks_server="$2"
    local socks_port="$3"
    local auth_required="$4"
    local username="$5"
    local password="$6"
    
    echo "Setting up SOCKS proxy: $socks_server:$socks_port"
    
    # Test SOCKS connectivity
    if command -v nc >/dev/null 2>&1; then
        if nc -z "$socks_server" "$socks_port" 2>/dev/null; then
            echo "✅ SOCKS proxy connectivity verified"
        else
            echo "⚠️  WARNING: Cannot reach SOCKS proxy"
        fi
    fi
    
    # Configure SOCKS proxy
    if networksetup -setsocksfirewallproxy "$network_service" "$socks_server" "$socks_port" "$auth_required" "$username" "$password"; then
        networksetup -setsocksfirewallproxystate "$network_service" on
        echo "✅ SOCKS firewall proxy configured"
        
        # Verify configuration
        echo "SOCKS proxy details:"
        networksetup -getsocksfirewallproxy "$network_service"
        
        return 0
    else
        echo "❌ Failed to configure SOCKS proxy"
        return 1
    fi
}

# Test SOCKS proxy functionality
test_socks_proxy() {
    local test_url="http://httpbin.org/ip"
    
    echo "Testing SOCKS proxy functionality..."
    
    # Test with curl through SOCKS proxy
    if command -v curl >/dev/null 2>&1; then
        local proxy_response
        proxy_response=$(curl -s --socks5 "socks-proxy.company.com:1080" "$test_url" 2>/dev/null)
        
        if [[ -n "$proxy_response" ]]; then
            echo "✅ SOCKS proxy test successful"
            echo "Response: $proxy_response"
        else
            echo "❌ SOCKS proxy test failed"
        fi
    else
        echo "curl not available for testing"
    fi
}

# Usage
setup_socks_proxy "Wi-Fi" "socks-proxy.company.com" "1080" "on" "socksuser" "sockspass"
test_socks_proxy

Legacy Proxy Support (macOS < 13.0)

Streaming Proxy Configuration

#!/bin/bash

# Configure streaming proxy (deprecated in macOS 13.0+)
check_macos_version() {
    local version
    version=$(sw_vers -productVersion)
    local major_version
    major_version=$(echo "$version" | cut -d. -f1)
    
    if [[ "$major_version" -ge 13 ]]; then
        echo "⚠️  Streaming proxy not supported on macOS 13.0+"
        return 1
    fi
    return 0
}

configure_streaming_proxy() {
    if check_macos_version; then
        networksetup -setstreamingproxy "Wi-Fi" "stream-proxy.company.com" "8080" on "streamuser" "streampass"
        networksetup -setstreamingproxystate "Wi-Fi" on
        echo "✅ Streaming proxy configured"
    else
        echo "❌ Streaming proxy not available on this macOS version"
    fi
}

configure_gopher_proxy() {
    if check_macos_version; then
        networksetup -setgopherproxy "Wi-Fi" "gopher-proxy.company.com" "70" on "gopheruser" "gopherpass"
        networksetup -setgopherproxystate "Wi-Fi" on
        echo "✅ Gopher proxy configured"
    else
        echo "❌ Gopher proxy not available on this macOS version"
    fi
}

# Execute legacy proxy setup
configure_streaming_proxy
configure_gopher_proxy

Enterprise Proxy Management System

#!/bin/bash

# MacFleet Enterprise Proxy Management System
# Comprehensive proxy configuration and monitoring

# Configuration
PROXY_CONFIG_DIR="/etc/macfleet/proxy"
LOG_FILE="/var/log/macfleet_proxy.log"
BACKUP_DIR="/var/backups/macfleet/proxy"
API_ENDPOINT="https://api.macfleet.com/v1/proxy"

# Create directory structure
setup_directories() {
    mkdir -p "$PROXY_CONFIG_DIR" "$BACKUP_DIR"
    touch "$LOG_FILE"
}

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Get all network services
get_network_services() {
    networksetup -listallnetworkservices | grep -v "^An asterisk"
}

# Backup current proxy settings
backup_proxy_settings() {
    local backup_file="$BACKUP_DIR/proxy_backup_$(date +%Y%m%d_%H%M%S).json"
    
    echo "{" > "$backup_file"
    echo "  \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"," >> "$backup_file"
    echo "  \"hostname\": \"$(hostname)\"," >> "$backup_file"
    echo "  \"network_services\": {" >> "$backup_file"
    
    local first=true
    while IFS= read -r service; do
        if [[ "$first" == "false" ]]; then
            echo "," >> "$backup_file"
        fi
        first=false
        
        echo "    \"$service\": {" >> "$backup_file"
        echo "      \"web_proxy\": $(networksetup -getwebproxy "$service" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")" >> "$backup_file"
        echo "      \"secure_web_proxy\": $(networksetup -getsecurewebproxy "$service" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")" >> "$backup_file"
        echo "      \"socks_proxy\": $(networksetup -getsocksfirewallproxy "$service" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")" >> "$backup_file"
        echo "    }" >> "$backup_file"
    done < <(get_network_services)
    
    echo "  }" >> "$backup_file"
    echo "}" >> "$backup_file"
    
    log_action "Proxy settings backed up to: $backup_file"
}

# Configure proxy from JSON configuration
configure_from_json() {
    local config_file="$1"
    
    if [[ ! -f "$config_file" ]]; then
        log_action "ERROR: Configuration file not found: $config_file"
        return 1
    fi
    
    log_action "Applying proxy configuration from: $config_file"
    
    # Parse JSON and apply settings using jq or python
    if command -v jq >/dev/null 2>&1; then
        # Use jq for JSON parsing
        local networks
        networks=$(jq -r '.networks | keys[]' "$config_file")
        
        while IFS= read -r network; do
            local web_proxy
            web_proxy=$(jq -r ".networks[\"$network\"].web_proxy" "$config_file")
            
            if [[ "$web_proxy" != "null" ]]; then
                local server port auth username password
                server=$(echo "$web_proxy" | jq -r '.server')
                port=$(echo "$web_proxy" | jq -r '.port')
                auth=$(echo "$web_proxy" | jq -r '.authentication')
                username=$(echo "$web_proxy" | jq -r '.username')
                password=$(echo "$web_proxy" | jq -r '.password')
                
                networksetup -setwebproxy "$network" "$server" "$port" "$auth" "$username" "$password"
                networksetup -setwebproxystate "$network" on
                
                log_action "Web proxy configured for $network: $server:$port"
            fi
        done <<< "$networks"
    else
        log_action "ERROR: jq not available for JSON parsing"
        return 1
    fi
}

# Monitor proxy connectivity
monitor_proxy_connectivity() {
    log_action "Starting proxy connectivity monitoring"
    
    while IFS= read -r service; do
        local web_proxy_info
        web_proxy_info=$(networksetup -getwebproxy "$service")
        
        if echo "$web_proxy_info" | grep -q "Enabled: Yes"; then
            local server port
            server=$(echo "$web_proxy_info" | grep "Server:" | awk '{print $2}')
            port=$(echo "$web_proxy_info" | grep "Port:" | awk '{print $2}')
            
            if nc -z "$server" "$port" 2>/dev/null; then
                log_action "✅ Proxy connectivity OK: $service ($server:$port)"
            else
                log_action "❌ Proxy connectivity FAILED: $service ($server:$port)"
            fi
        fi
    done < <(get_network_services)
}

# Clear all proxy settings
clear_all_proxies() {
    log_action "Clearing all proxy settings"
    
    while IFS= read -r service; do
        # Disable all proxy types
        networksetup -setwebproxystate "$service" off
        networksetup -setsecurewebproxystate "$service" off
        networksetup -setsocksfirewallproxystate "$service" off
        
        # For older macOS versions
        networksetup -setstreamingproxystate "$service" off 2>/dev/null || true
        networksetup -setgopherproxystate "$service" off 2>/dev/null || true
        
        log_action "Proxies cleared for: $service"
    done < <(get_network_services)
}

# Generate proxy status report
generate_proxy_report() {
    local report_file="$PROXY_CONFIG_DIR/proxy_report_$(date +%Y%m%d_%H%M%S).txt"
    
    {
        echo "MacFleet Proxy Status Report"
        echo "Generated: $(date)"
        echo "Hostname: $(hostname)"
        echo "=================================="
        echo ""
        
        while IFS= read -r service; do
            echo "Network Service: $service"
            echo "--------------------------------"
            
            echo "Web Proxy:"
            networksetup -getwebproxy "$service" | sed 's/^/  /'
            echo ""
            
            echo "Secure Web Proxy:"
            networksetup -getsecurewebproxy "$service" | sed 's/^/  /'
            echo ""
            
            echo "SOCKS Firewall Proxy:"
            networksetup -getsocksfirewallproxy "$service" | sed 's/^/  /'
            echo ""
            
            echo "=================================="
            echo ""
        done < <(get_network_services)
    } > "$report_file"
    
    echo "Proxy report generated: $report_file"
    log_action "Proxy status report generated: $report_file"
}

# Main function
main() {
    local action="${1:-status}"
    
    setup_directories
    log_action "MacFleet Proxy Management started with action: $action"
    
    case "$action" in
        "backup")
            backup_proxy_settings
            ;;
        "configure")
            configure_from_json "$2"
            ;;
        "monitor")
            monitor_proxy_connectivity
            ;;
        "clear")
            backup_proxy_settings
            clear_all_proxies
            ;;
        "report")
            generate_proxy_report
            ;;
        "status"|*)
            generate_proxy_report
            monitor_proxy_connectivity
            ;;
    esac
    
    log_action "MacFleet Proxy Management completed"
}

# Execute main function with all arguments
main "$@"

Proxy Configuration Templates

Corporate Web Proxy Template

# /etc/macfleet/proxy/corporate_web.conf
PROXY_TYPE="web"
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="proxy.company.com"
PROXY_PORT="8080"
AUTHENTICATION="on"
USERNAME="employee_username"
PASSWORD="employee_password"
AUTO_CONFIG_URL=""
BYPASS_LIST="*.company.com,localhost,127.0.0.1"

Secure Enterprise Template

# /etc/macfleet/proxy/secure_enterprise.conf
PROXY_TYPE="secure_web"
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="secure-proxy.company.com"
PROXY_PORT="8443"
AUTHENTICATION="on"
USERNAME="secure_user"
PASSWORD="secure_password"
SSL_VERIFICATION="enabled"
CERTIFICATE_PINNING="enabled"

SOCKS Proxy Template

# /etc/macfleet/proxy/socks_proxy.conf
PROXY_TYPE="socks"
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="socks.company.com"
PROXY_PORT="1080"
AUTHENTICATION="on"
USERNAME="socks_user"
PASSWORD="socks_password"
SOCKS_VERSION="5"

Security Considerations

Proxy Authentication Security

#!/bin/bash

# Secure proxy credential management
encrypt_credentials() {
    local username="$1"
    local password="$2"
    local keychain="MacFleet-Proxy"
    
    # Store credentials in keychain
    security add-generic-password -a "$username" -s "proxy-credentials" -w "$password" -T "" "$keychain" 2>/dev/null
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Credentials stored securely in keychain"
    else
        echo "❌ Failed to store credentials in keychain"
    fi
}

# Retrieve credentials from keychain
decrypt_credentials() {
    local username="$1"
    local keychain="MacFleet-Proxy"
    
    local password
    password=$(security find-generic-password -a "$username" -s "proxy-credentials" -w "$keychain" 2>/dev/null)
    
    if [[ -n "$password" ]]; then
        echo "$password"
    else
        echo "ERROR: Could not retrieve password for $username"
        return 1
    fi
}

Important Configuration Notes

Network Service Names

• Service names are case-sensitive
• Use quotes for names with spaces: "Wi-Fi"
• Common services: "Wi-Fi", "Ethernet", "USB 10/100/1000 LAN"

Proxy Authentication

• Set authenticated to "on" to enable authentication
• Set authenticated to "off" to disable authentication
• Credentials will be prompted if authentication is enabled but not provided

macOS Version Compatibility

• Streaming Proxy: Deprecated in macOS 13.0+
• Gopher Proxy: Deprecated in macOS 13.0+
• Web/Secure Web/SOCKS: Available on all supported macOS versions

Error Handling

• Existing proxy configurations will show errors when reconfigured
• Use networksetup -setproxystate to disable before reconfiguring
• Test connectivity before applying to fleet devices

Best Practices

1. Always backup current settings before changes
2. Test connectivity after proxy configuration
3. Use secure storage for proxy credentials
4. Monitor proxy health continuously
5. Validate certificates for HTTPS proxies
6. Document configurations for compliance
7. Implement logging for audit trails
8. Test on individual devices before fleet deployment

Remember to validate all scripts on test devices before deploying across your MacFleet environment, and ensure proxy servers are accessible and properly configured for your network infrastructure.