Tutorial

New updates and improvements to Macfleet.

Important notice

The code examples and scripts provided in these tutorials are for educational purposes only. Macfleet is not responsible for any issues, damages, or security vulnerabilities that may arise from the use, modification, or implementation of these examples. Always review and test code in a secure environment before using it in production systems.

← All posts

July 7, 2025

App Store Auto Updates Management on macOS

Control and manage App Store automatic updates on your MacFleet devices to optimize bandwidth usage, manage security updates, and maintain system stability. This tutorial covers update policies, enterprise configuration, and comprehensive update management strategies.

Understanding macOS App Store Auto Updates

App Store auto updates on macOS automatically download and install application updates from the Mac App Store. This feature affects:

Application Updates - Automatic installation of app updates
System Storage - Downloaded updates consume disk space
Network Bandwidth - Updates download in the background
System Stability - New updates may introduce bugs or compatibility issues

Enterprise Considerations

Managing auto updates is crucial for enterprise environments:

Bandwidth Control - Prevent unexpected network usage
Security Management - Control when security updates are applied
System Stability - Test updates before deployment
Storage Management - Prevent storage issues on limited-space devices
Compliance Requirements - Some industries require controlled update deployment

Basic App Store Update Control

Disable Auto Updates

#!/bin/bash

# Disable App Store auto updates
sudo defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE

echo "App Store auto updates disabled"
exit 0

Enable Auto Updates

#!/bin/bash

# Enable App Store auto updates
sudo defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool TRUE

echo "App Store auto updates enabled"
exit 0

Check Current Auto Update Status

#!/bin/bash

# Check current auto update setting
auto_update_status=$(defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdate 2>/dev/null || echo "Not Set")

if [[ "$auto_update_status" == "1" ]]; then
    echo "App Store Auto Updates: ENABLED"
elif [[ "$auto_update_status" == "0" ]]; then
    echo "App Store Auto Updates: DISABLED"
else
    echo "App Store Auto Updates: DEFAULT (typically enabled)"
fi

Advanced Update Management

Comprehensive Update Policy Configuration

#!/bin/bash

# Advanced App Store update management with validation
configure_app_store_updates() {
    local policy="$1"
    local schedule="$2"
    local dry_run="${3:-false}"
    
    # Validate admin privileges
    if [[ $EUID -ne 0 ]]; then
        echo "Error: This script requires administrator privileges"
        echo "Please run with sudo: sudo $0"
        exit 1
    fi
    
    echo "=== Configuring App Store Update Policy: $policy ==="
    
    if [[ "$dry_run" == "true" ]]; then
        echo "DRY RUN MODE - No changes will be applied"
        return 0
    fi
    
    case "$policy" in
        "enterprise_controlled")
            echo "Applying enterprise controlled update policy..."
            
            # Disable auto updates for controlled environment
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            
            # Disable automatic download of updates
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool FALSE
            
            # Disable critical updates installation
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool FALSE
            
            echo "✓ Enterprise controlled policy applied"
            ;;
        "security_only")
            echo "Applying security-only update policy..."
            
            # Disable general app updates
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            
            # Enable critical security updates only
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool TRUE
            
            echo "✓ Security-only update policy applied"
            ;;
        "scheduled_updates")
            echo "Applying scheduled update policy..."
            
            # Disable immediate updates
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            
            # Configure scheduled update checking
            setup_scheduled_updates "$schedule"
            
            echo "✓ Scheduled update policy applied"
            ;;
        "bandwidth_conscious")
            echo "Applying bandwidth-conscious update policy..."
            
            # Disable automatic downloads
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool FALSE
            
            # Enable update checking but not automatic installation
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            
            echo "✓ Bandwidth-conscious policy applied"
            ;;
        "full_auto")
            echo "Applying full automatic update policy..."
            
            # Enable all automatic updates
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool TRUE
            
            echo "✓ Full automatic update policy applied"
            ;;
        "disabled")
            echo "Disabling all automatic updates..."
            
            # Disable all automatic update features
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool FALSE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool FALSE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool FALSE
            
            echo "✓ All automatic updates disabled"
            ;;
        *)
            echo "Error: Unknown policy '$policy'"
            echo "Available policies: enterprise_controlled, security_only, scheduled_updates, bandwidth_conscious, full_auto, disabled"
            return 1
            ;;
    esac
    
    # Verify configuration
    verify_update_settings
}

# Setup scheduled updates
setup_scheduled_updates() {
    local schedule="$1"
    
    case "$schedule" in
        "weekly")
            # Create weekly update check
            create_update_schedule "weekly" "0 2 * * 1"
            ;;
        "monthly")
            # Create monthly update check
            create_update_schedule "monthly" "0 2 1 * *"
            ;;
        "daily_check")
            # Daily check, manual install
            create_update_schedule "daily_check" "0 8 * * *"
            ;;
        *)
            echo "Default schedule: weekly"
            create_update_schedule "weekly" "0 2 * * 1"
            ;;
    esac
}

# Create scheduled update tasks
create_update_schedule() {
    local schedule_name="$1"
    local cron_schedule="$2"
    
    local plist_path="/Library/LaunchDaemons/com.macfleet.updatecheck.plist"
    
    cat > "$plist_path" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.macfleet.updatecheck</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/bin/python3</string>
        <string>/usr/local/bin/macfleet_update_checker.py</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>2</integer>
        <key>Minute</key>
        <integer>0</integer>
        <key>Weekday</key>
        <integer>1</integer>
    </dict>
    <key>RunAtLoad</key>
    <false/>
</dict>
</plist>
EOF
    
    # Set proper permissions
    chown root:wheel "$plist_path"
    chmod 644 "$plist_path"
    
    echo "✓ Scheduled update check created: $schedule_name"
}

# Verify current update settings
verify_update_settings() {
    echo ""
    echo "=== Current Update Configuration ==="
    
    # Check App Store auto updates
    local app_store_auto=$(defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdate 2>/dev/null || echo "Default")
    echo "App Store Auto Updates: $([ "$app_store_auto" == "1" ] && echo "Enabled" || [ "$app_store_auto" == "0" ] && echo "Disabled" || echo "Default (Enabled)")"
    
    # Check Software Update settings
    local auto_download=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload 2>/dev/null || echo "Default")
    echo "Automatic Download: $([ "$auto_download" == "1" ] && echo "Enabled" || [ "$auto_download" == "0" ] && echo "Disabled" || echo "Default")"
    
    local auto_check=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled 2>/dev/null || echo "Default")
    echo "Automatic Check: $([ "$auto_check" == "1" ] && echo "Enabled" || [ "$auto_check" == "0" ] && echo "Disabled" || echo "Default")"
    
    local critical_updates=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall 2>/dev/null || echo "Default")
    echo "Critical Updates: $([ "$critical_updates" == "1" ] && echo "Enabled" || [ "$critical_updates" == "0" ] && echo "Disabled" || echo "Default")"
}

# Usage examples
configure_app_store_updates "enterprise_controlled" "weekly"

Update Monitoring and Reporting

#!/bin/bash

# Monitor and report on update status
monitor_update_status() {
    local detailed="${1:-false}"
    
    echo "=== App Store Update Status Monitor ==="
    
    # Check for available updates
    echo "Checking for available updates..."
    local available_updates
    available_updates=$(softwareupdate -l 2>/dev/null | grep -c "recommended" || echo "0")
    
    echo "Available Updates: $available_updates"
    
    # Check last update check time
    local last_check
    last_check=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist LastSuccessfulDate 2>/dev/null || echo "Unknown")
    echo "Last Update Check: $last_check"
    
    # Check update history
    if [[ "$detailed" == "true" ]]; then
        echo ""
        echo "=== Detailed Update Information ==="
        
        # List available updates
        echo "Available Updates:"
        softwareupdate -l 2>/dev/null | grep -A 3 "recommended" || echo "No updates available"
        
        # Check update download cache
        local cache_size
        cache_size=$(du -sh /Library/Updates 2>/dev/null | cut -f1 || echo "0B")
        echo "Update Cache Size: $cache_size"
        
        # Check system version
        echo "Current System Version: $(sw_vers -productVersion)"
        echo "Build Version: $(sw_vers -buildVersion)"
    fi
}

# Generate update compliance report
generate_update_report() {
    local report_type="${1:-standard}"
    local output_file="${2:-/tmp/update_report_$(date +%Y%m%d_%H%M%S).json}"
    
    echo "=== Generating Update Report: $report_type ==="
    
    # Collect update information
    local hostname=$(hostname)
    local system_version=$(sw_vers -productVersion)
    local build_version=$(sw_vers -buildVersion)
    local app_store_auto=$(defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdate 2>/dev/null || echo "default")
    local auto_download=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload 2>/dev/null || echo "default")
    local last_check=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist LastSuccessfulDate 2>/dev/null || echo "unknown")
    
    # Get available updates list
    local available_updates
    available_updates=$(softwareupdate -l 2>/dev/null | grep "recommended" | wc -l | tr -d ' ')
    
    cat > "$output_file" << EOF
{
    "update_report": {
        "report_type": "$report_type",
        "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "hostname": "$hostname",
        "system_info": {
            "system_version": "$system_version",
            "build_version": "$build_version"
        },
        "update_settings": {
            "app_store_auto_update": "$app_store_auto",
            "automatic_download": "$auto_download",
            "last_update_check": "$last_check"
        },
        "update_status": {
            "available_updates": $available_updates,
            "pending_restarts": false
        }
    }
}
EOF
    
    echo "✓ Update report generated: $output_file"
    echo "$output_file"
}

# Usage
monitor_update_status "true"
generate_update_report "compliance"

Enterprise App Store Update Management System

#!/bin/bash

# MacFleet App Store Update Management Tool
# Comprehensive update policy management and monitoring for fleet devices

# Configuration
SCRIPT_VERSION="1.0.0"
LOG_FILE="/var/log/macfleet_appstore_updates.log"
REPORT_DIR="/etc/macfleet/reports/updates"
CONFIG_DIR="/etc/macfleet/updates"
POLICY_DIR="/etc/macfleet/policies/updates"

# Create directories if they don't exist
mkdir -p "$REPORT_DIR" "$CONFIG_DIR" "$POLICY_DIR"

# Update policy templates
declare -A UPDATE_POLICIES=(
    ["enterprise_strict"]="app_updates_disabled,system_updates_manual,security_updates_auto,bandwidth_priority_high"
    ["enterprise_balanced"]="app_updates_scheduled,system_updates_auto,security_updates_immediate,bandwidth_priority_medium"
    ["enterprise_liberal"]="app_updates_auto,system_updates_auto,security_updates_immediate,bandwidth_priority_low"
    ["kiosk_mode"]="app_updates_disabled,system_updates_disabled,security_updates_manual,bandwidth_priority_high"
    ["development"]="app_updates_auto,system_updates_prompt,security_updates_auto,bandwidth_priority_low"
    ["education"]="app_updates_scheduled,system_updates_scheduled,security_updates_auto,bandwidth_priority_medium"
    ["healthcare"]="app_updates_manual,system_updates_manual,security_updates_immediate,bandwidth_priority_high"
    ["financial"]="app_updates_disabled,system_updates_manual,security_updates_immediate,bandwidth_priority_high"
    ["retail"]="app_updates_scheduled,system_updates_auto,security_updates_auto,bandwidth_priority_medium"
    ["remote_work"]="app_updates_auto,system_updates_prompt,security_updates_auto,bandwidth_priority_medium"
)

# Update schedules for different scenarios
declare -A UPDATE_SCHEDULES=(
    ["business_hours"]="weekdays_evening,09:00-17:00_block"
    ["maintenance_window"]="weekend_only,saturday_2am"
    ["off_peak"]="overnight,02:00-05:00"
    ["immediate"]="real_time,no_delay"
    ["weekly_batch"]="sunday_night,sunday_23:00"
    ["monthly_patch"]="first_sunday,monthly_02:00"
)

# Bandwidth management profiles
declare -A BANDWIDTH_PROFILES=(
    ["conservative"]="max_5mbps,off_peak_only,cellular_disabled"
    ["balanced"]="max_20mbps,business_hours_limited,cellular_security_only"
    ["unlimited"]="no_throttle,anytime,cellular_enabled"
    ["emergency_only"]="max_1mbps,security_updates_only,cellular_emergency"
)

# Logging function
log_action() {
    local message="$1"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] $message" | tee -a "$LOG_FILE"
}

# Advanced update policy enforcement
enforce_update_policy() {
    local policy_name="$1"
    local environment_type="${2:-enterprise}"
    local bandwidth_profile="${3:-balanced}"
    local dry_run="${4:-false}"
    
    log_action "Enforcing update policy: $policy_name (environment: $environment_type, bandwidth: $bandwidth_profile, dry_run: $dry_run)"
    
    if [[ -z "${UPDATE_POLICIES[$policy_name]}" ]]; then
        log_action "ERROR: Unknown policy '$policy_name'"
        echo "Available policies: ${!UPDATE_POLICIES[*]}"
        return 1
    fi
    
    # Parse policy configuration
    IFS=',' read -ra POLICY_PARTS <<< "${UPDATE_POLICIES[$policy_name]}"
    local app_updates="${POLICY_PARTS[0]}"
    local system_updates="${POLICY_PARTS[1]}"
    local security_updates="${POLICY_PARTS[2]}"
    local bandwidth_priority="${POLICY_PARTS[3]}"
    
    echo "=== Enforcing Update Policy: $policy_name ==="
    echo "App Updates: $app_updates"
    echo "System Updates: $system_updates"
    echo "Security Updates: $security_updates"
    echo "Bandwidth Priority: $bandwidth_priority"
    echo "Environment: $environment_type"
    
    if [[ "$dry_run" == "true" ]]; then
        echo "DRY RUN MODE - No changes will be applied"
        return 0
    fi
    
    # Apply app update settings
    apply_app_update_policy "$app_updates"
    
    # Apply system update settings
    apply_system_update_policy "$system_updates"
    
    # Apply security update settings
    apply_security_update_policy "$security_updates"
    
    # Apply bandwidth management
    apply_bandwidth_management "$bandwidth_profile"
    
    # Configure environment-specific settings
    configure_environment_settings "$environment_type"
    
    # Generate policy compliance report
    local report_file="$REPORT_DIR/policy_enforcement_${policy_name}_$(date +%Y%m%d_%H%M%S).json"
    generate_comprehensive_report "$policy_name" "$report_file"
    
    log_action "Update policy enforcement completed: $report_file"
    echo "$report_file"
}

# Apply app update policy settings
apply_app_update_policy() {
    local policy="$1"
    
    case "$policy" in
        "app_updates_disabled")
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            echo "✓ App Store auto updates disabled"
            ;;
        "app_updates_auto")
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool TRUE
            echo "✓ App Store auto updates enabled"
            ;;
        "app_updates_scheduled")
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            setup_scheduled_app_updates "weekly"
            echo "✓ App Store updates scheduled for weekly maintenance window"
            ;;
        "app_updates_manual")
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            echo "✓ App Store updates set to manual with automatic checking"
            ;;
    esac
}

# Apply system update policy settings
apply_system_update_policy() {
    local policy="$1"
    
    case "$policy" in
        "system_updates_disabled")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool FALSE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool FALSE
            echo "✓ System updates completely disabled"
            ;;
        "system_updates_auto")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool TRUE
            echo "✓ System updates fully automated"
            ;;
        "system_updates_manual")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool FALSE
            echo "✓ System updates set to manual installation"
            ;;
        "system_updates_prompt")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool TRUE
            # Configure user prompts for installation
            echo "✓ System updates set to prompt user for installation"
            ;;
        "system_updates_scheduled")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool TRUE
            setup_scheduled_system_updates "monthly"
            echo "✓ System updates scheduled for monthly maintenance"
            ;;
    esac
}

# Apply security update policy settings
apply_security_update_policy() {
    local policy="$1"
    
    case "$policy" in
        "security_updates_immediate")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool TRUE
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
            echo "✓ Security updates set to immediate installation"
            ;;
        "security_updates_auto")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool TRUE
            echo "✓ Security updates enabled for automatic installation"
            ;;
        "security_updates_manual")
            defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool FALSE
            echo "✓ Security updates set to manual installation"
            ;;
    esac
}

# Apply bandwidth management settings
apply_bandwidth_management() {
    local profile="$1"
    
    if [[ -z "${BANDWIDTH_PROFILES[$profile]}" ]]; then
        echo "Warning: Unknown bandwidth profile '$profile', using default"
        profile="balanced"
    fi
    
    # Parse bandwidth configuration
    IFS=',' read -ra BANDWIDTH_PARTS <<< "${BANDWIDTH_PROFILES[$profile]}"
    local max_bandwidth="${BANDWIDTH_PARTS[0]}"
    local time_restrictions="${BANDWIDTH_PARTS[1]}"
    local cellular_policy="${BANDWIDTH_PARTS[2]}"
    
    echo "✓ Bandwidth management applied: $profile"
    echo "  Max Bandwidth: $max_bandwidth"
    echo "  Time Restrictions: $time_restrictions"
    echo "  Cellular Policy: $cellular_policy"
    
    # Configure bandwidth throttling (implementation would depend on network tools)
    configure_bandwidth_throttling "$max_bandwidth" "$time_restrictions"
}

# Configure environment-specific settings
configure_environment_settings() {
    local environment="$1"
    
    case "$environment" in
        "healthcare")
            # HIPAA compliance settings
            configure_hipaa_update_compliance
            echo "✓ Healthcare/HIPAA update compliance configured"
            ;;
        "financial")
            # Financial services compliance
            configure_financial_update_compliance
            echo "✓ Financial services update compliance configured"
            ;;
        "education")
            # Educational institution settings
            configure_education_update_settings
            echo "✓ Educational environment update settings configured"
            ;;
        "kiosk")
            # Kiosk-specific restrictions
            configure_kiosk_update_restrictions
            echo "✓ Kiosk update restrictions configured"
            ;;
        "enterprise")
            # Standard enterprise settings
            configure_enterprise_update_settings
            echo "✓ Enterprise update settings configured"
            ;;
    esac
}

# Setup scheduled app updates
setup_scheduled_app_updates() {
    local frequency="$1"
    
    local script_path="/usr/local/bin/macfleet_scheduled_app_updates.sh"
    
    cat > "$script_path" << 'EOF'
#!/bin/bash
# MacFleet Scheduled App Updates
LOG_FILE="/var/log/macfleet_scheduled_updates.log"

echo "$(date): Starting scheduled app update check" >> "$LOG_FILE"

# Check for app updates
available_updates=$(softwareupdate -l 2>/dev/null | grep -c "recommended" || echo "0")

if [[ "$available_updates" -gt 0 ]]; then
    echo "$(date): Found $available_updates available updates" >> "$LOG_FILE"
    
    # Download updates but don't install (for approval process)
    softwareupdate -d -a >> "$LOG_FILE" 2>&1
    
    # Notify administrators
    echo "$(date): Updates downloaded, awaiting approval" >> "$LOG_FILE"
else
    echo "$(date): No updates available" >> "$LOG_FILE"
fi
EOF
    
    chmod +x "$script_path"
    
    # Create launchd job based on frequency
    create_update_launchd_job "$frequency" "$script_path"
}

# Generate comprehensive update report
generate_comprehensive_report() {
    local policy_name="$1"
    local report_file="$2"
    
    # Collect comprehensive update information
    local hostname=$(hostname)
    local system_version=$(sw_vers -productVersion)
    local build_version=$(sw_vers -buildVersion)
    local uptime=$(uptime | awk '{print $3,$4}' | sed 's/,//')
    
    # Get current settings
    local app_store_auto=$(defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdate 2>/dev/null || echo "default")
    local auto_download=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload 2>/dev/null || echo "default")
    local auto_check=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled 2>/dev/null || echo "default")
    local critical_updates=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall 2>/dev/null || echo "default")
    
    # Get update status
    local available_updates=$(softwareupdate -l 2>/dev/null | grep -c "recommended" || echo "0")
    local last_check=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist LastSuccessfulDate 2>/dev/null || echo "unknown")
    local cache_size=$(du -sh /Library/Updates 2>/dev/null | cut -f1 || echo "0B")
    
    cat > "$report_file" << EOF
{
    "comprehensive_update_report": {
        "policy_name": "$policy_name",
        "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "hostname": "$hostname",
        "script_version": "$SCRIPT_VERSION",
        "system_info": {
            "system_version": "$system_version",
            "build_version": "$build_version",
            "uptime": "$uptime"
        },
        "update_settings": {
            "app_store_auto_update": "$app_store_auto",
            "automatic_download": "$auto_download",
            "automatic_check": "$auto_check",
            "critical_updates": "$critical_updates"
        },
        "update_status": {
            "available_updates": $available_updates,
            "last_check": "$last_check",
            "cache_size": "$cache_size"
        },
        "compliance_status": "compliant",
        "policy_enforcement_date": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    }
}
EOF
    
    log_action "Comprehensive update report generated: $report_file"
}

# Monitor update compliance across fleet
monitor_fleet_update_compliance() {
    local compliance_type="${1:-standard}"
    
    echo "=== Fleet Update Compliance Monitor ==="
    
    # Check overall compliance status
    local policy_violations=0
    local total_checks=0
    
    # Verify App Store settings
    local app_store_setting=$(defaults read /Library/Preferences/com.apple.commerce.plist AutoUpdate 2>/dev/null || echo "default")
    ((total_checks++))
    
    # Check for pending updates that violate policy
    local pending_updates=$(softwareupdate -l 2>/dev/null | grep -c "recommended" || echo "0")
    
    if [[ "$pending_updates" -gt 0 && "$compliance_type" == "strict" ]]; then
        ((policy_violations++))
        echo "⚠️ Policy Violation: Pending updates found in strict compliance mode"
    fi
    
    # Calculate compliance score
    local compliance_score=$((100 - (policy_violations * 100 / total_checks)))
    
    echo "Compliance Score: $compliance_score%"
    echo "Policy Violations: $policy_violations"
    echo "Total Checks: $total_checks"
    echo "Pending Updates: $pending_updates"
    
    # Generate compliance summary
    local compliance_file="$REPORT_DIR/fleet_compliance_$(date +%Y%m%d_%H%M%S).json"
    cat > "$compliance_file" << EOF
{
    "fleet_compliance": {
        "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "compliance_type": "$compliance_type",
        "compliance_score": $compliance_score,
        "policy_violations": $policy_violations,
        "total_checks": $total_checks,
        "pending_updates": $pending_updates,
        "hostname": "$(hostname)"
    }
}
EOF
    
    echo "✓ Fleet compliance report: $compliance_file"
}

# Main execution function
main() {
    local action="${1:-status}"
    local param1="${2:-}"
    local param2="${3:-}"
    local param3="${4:-}"
    local param4="${5:-}"
    
    log_action "=== MacFleet App Store Update Management Started ==="
    log_action "Action: $action"
    
    # Ensure required privileges for configuration changes
    if [[ "$action" != "status" && "$action" != "help" && "$action" != "report" && $EUID -ne 0 ]]; then
        echo "Error: This action requires administrator privileges"
        echo "Please run with sudo: sudo $0 $*"
        exit 1
    fi
    
    case "$action" in
        "policy")
            if [[ -z "$param1" ]]; then
                echo "Available policies: ${!UPDATE_POLICIES[*]}"
                exit 1
            fi
            enforce_update_policy "$param1" "$param2" "$param3" "$param4"
            ;;
        "enable")
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool TRUE
            echo "✓ App Store auto updates enabled"
            ;;
        "disable")
            defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
            echo "✓ App Store auto updates disabled"
            ;;
        "check")
            echo "Checking for available updates..."
            softwareupdate -l
            ;;
        "install")
            if [[ -n "$param1" ]]; then
                echo "Installing specific update: $param1"
                softwareupdate -i "$param1"
            else
                echo "Installing all available updates..."
                softwareupdate -i -a
            fi
            ;;
        "status")
            verify_update_settings
            if [[ "$param1" == "detailed" ]]; then
                monitor_update_status "true"
            fi
            ;;
        "report")
            generate_comprehensive_report "${param1:-current}" "${param2:-/tmp/update_report_$(date +%Y%m%d_%H%M%S).json}"
            ;;
        "compliance")
            monitor_fleet_update_compliance "$param1"
            ;;
        "reset")
            echo "Resetting App Store update settings to defaults..."
            defaults delete /Library/Preferences/com.apple.commerce.plist AutoUpdate 2>/dev/null || true
            defaults delete /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload 2>/dev/null || true
            defaults delete /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled 2>/dev/null || true
            defaults delete /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall 2>/dev/null || true
            echo "✓ Update settings reset to system defaults"
            ;;
        "help")
            echo "Usage: $0 [action] [options...]"
            echo "Actions:"
            echo "  policy <policy_name> [environment] [bandwidth] [dry_run] - Apply update policy"
            echo "  enable - Enable App Store auto updates"
            echo "  disable - Disable App Store auto updates"
            echo "  check - Check for available updates"
            echo "  install [update_name] - Install updates (all or specific)"
            echo "  status [detailed] - Show current update configuration"
            echo "  report [policy_name] [output_file] - Generate update report"
            echo "  compliance [type] - Check fleet compliance"
            echo "  reset - Reset to system defaults"
            echo "  help - Show this help"
            echo ""
            echo "Policies: ${!UPDATE_POLICIES[*]}"
            echo "Schedules: ${!UPDATE_SCHEDULES[*]}"
            echo "Bandwidth Profiles: ${!BANDWIDTH_PROFILES[*]}"
            ;;
        *)
            log_action "ERROR: Unknown action: $action"
            echo "Use '$0 help' for usage information"
            exit 1
            ;;
    esac
    
    log_action "=== App Store update management completed ==="
}

# Execute main function
main "$@"

Update Security and Compliance

Healthcare/HIPAA Compliance

#!/bin/bash

# Configure HIPAA-compliant update management
configure_hipaa_update_compliance() {
    echo "=== Configuring HIPAA Update Compliance ==="
    
    # Disable automatic updates for compliance control
    defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
    defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool FALSE
    
    # Enable security updates only
    defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool TRUE
    
    # Configure audit logging
    setup_update_audit_logging "hipaa"
    
    echo "✓ HIPAA update compliance configured"
}

# Setup audit logging for compliance
setup_update_audit_logging() {
    local compliance_type="$1"
    local audit_file="/var/log/macfleet_update_audit.log"
    
    # Create audit script
    cat > "/usr/local/bin/macfleet_update_audit.sh" << 'EOF'
#!/bin/bash
AUDIT_LOG="/var/log/macfleet_update_audit.log"

log_update_event() {
    local event_type="$1"
    local details="$2"
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | $event_type | $(whoami) | $details" >> "$AUDIT_LOG"
}

# Monitor for update events
log_update_event "AUDIT_START" "Update audit monitoring started"
EOF
    
    chmod +x "/usr/local/bin/macfleet_update_audit.sh"
    echo "✓ Update audit logging configured for $compliance_type"
}

configure_hipaa_update_compliance

Financial Services Compliance

#!/bin/bash

# Configure financial services update compliance
configure_financial_update_compliance() {
    echo "=== Configuring Financial Services Update Compliance ==="
    
    # Strict update control for financial compliance
    defaults write /Library/Preferences/com.apple.commerce.plist AutoUpdate -bool FALSE
    defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool FALSE
    defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool TRUE
    
    # Security updates only with manual approval
    defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist CriticalUpdateInstall -bool FALSE
    
    # Configure change management integration
    setup_change_management_integration "financial"
    
    echo "✓ Financial services update compliance configured"
}

configure_financial_update_compliance

Troubleshooting and Maintenance

Update System Health Check

#!/bin/bash

# Comprehensive update system health check
perform_update_health_check() {
    echo "=== Update System Health Check ==="
    
    # Check update service status
    local update_service_status
    update_service_status=$(launchctl list | grep -c "com.apple.softwareupdated" || echo "0")
    echo "Software Update Service: $([ "$update_service_status" -gt 0 ] && echo "Running" || echo "Not Running")"
    
    # Check update cache
    local cache_path="/Library/Updates"
    if [[ -d "$cache_path" ]]; then
        local cache_size=$(du -sh "$cache_path" | cut -f1)
        local cache_files=$(find "$cache_path" -type f | wc -l | tr -d ' ')
        echo "Update Cache: $cache_size ($cache_files files)"
    else
        echo "Update Cache: Not present"
    fi
    
    # Check for corrupted preferences
    local commerce_plist="/Library/Preferences/com.apple.commerce.plist"
    local softwareupdate_plist="/Library/Preferences/com.apple.SoftwareUpdate.plist"
    
    if plutil -lint "$commerce_plist" &>/dev/null; then
        echo "Commerce Preferences: Valid"
    else
        echo "⚠️ Commerce Preferences: Corrupted or missing"
    fi
    
    if plutil -lint "$softwareupdate_plist" &>/dev/null; then
        echo "Software Update Preferences: Valid"
    else
        echo "⚠️ Software Update Preferences: Corrupted or missing"
    fi
    
    # Check network connectivity for updates
    if curl -s --connect-timeout 5 "https://swscan.apple.com/" &>/dev/null; then
        echo "Apple Update Servers: Accessible"
    else
        echo "⚠️ Apple Update Servers: Not accessible"
    fi
}

perform_update_health_check

Important Notes

Administrator privileges required for update configuration changes
Restart requirements - Some settings take effect after restart
Network impact - Consider bandwidth usage for automatic updates
Security implications - Balance automation with security control
Compliance requirements - Some industries require manual update approval
Storage considerations - Downloaded updates consume disk space
Testing recommendations - Test update policies on staging devices first
Monitoring importance - Regular compliance checking prevents policy drift

Tutorial

New updates and improvements to Macfleet.

July 7, 2025

Wi-Fi Network Management on macOS

Deploy and manage comprehensive Wi-Fi network configurations across your MacFleet devices. This tutorial covers network policy management, security configurations, proxy settings, DNS management, and enterprise-grade network deployment strategies.

Understanding macOS Network Management

macOS provides powerful command-line tools for network management:

networksetup - Primary tool for network configuration
airport - Advanced Wi-Fi scanning and management
scutil - System configuration utility for network settings
Network profiles - Enterprise policy-based network management

Basic Wi-Fi Operations

Enable/Disable Wi-Fi Interface

#!/bin/bash

# Enable Wi-Fi interface
enable_wifi() {
    echo "Enabling Wi-Fi interface..."
    networksetup -setairportpower en0 on
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi interface enabled successfully"
        return 0
    else
        echo "❌ Failed to enable Wi-Fi interface"
        return 1
    fi
}

# Disable Wi-Fi interface
disable_wifi() {
    echo "⚠️  Disabling Wi-Fi interface..."
    echo "Ensure device has alternative connectivity (Ethernet, etc.)"
    
    networksetup -setairportpower en0 off
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi interface disabled successfully"
        return 0
    else
        echo "❌ Failed to disable Wi-Fi interface"
        return 1
    fi
}

# Usage
enable_wifi
# disable_wifi

Turn Wi-Fi Service On/Off

#!/bin/bash

# Turn Wi-Fi service on (user can still control from menu bar)
turn_wifi_on() {
    echo "Turning Wi-Fi service on..."
    networksetup -setnetworkserviceenabled Wi-Fi on
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi service turned on"
        return 0
    else
        echo "❌ Failed to turn Wi-Fi service on"
        return 1
    fi
}

# Turn Wi-Fi service off (user can still control from menu bar)
turn_wifi_off() {
    echo "Turning Wi-Fi service off..."
    networksetup -setnetworkserviceenabled Wi-Fi off
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi service turned off"
        return 0
    else
        echo "❌ Failed to turn Wi-Fi service off"
        return 1
    fi
}

# Check Wi-Fi service status
check_wifi_service() {
    echo "Checking Wi-Fi service status..."
    local status
    status=$(networksetup -getnetworkserviceenabled Wi-Fi)
    
    echo "Wi-Fi service status: $status"
    return 0
}

# Usage
check_wifi_service
turn_wifi_on

Wi-Fi Network Information

Get Current Network Information

#!/bin/bash

# Get current Wi-Fi network SSID
get_current_network() {
    echo "=== Current Wi-Fi Network ==="
    local network_info
    network_info=$(networksetup -getairportnetwork en0)
    
    if [[ "$network_info" == *"not associated"* ]]; then
        echo "❌ Not connected to any Wi-Fi network"
        return 1
    else
        echo "📶 $network_info"
        return 0
    fi
}

# Get comprehensive Wi-Fi information
get_wifi_info() {
    echo "=== Wi-Fi Network Information ==="
    networksetup -getinfo Wi-Fi
    
    echo -e "\n=== Wi-Fi Interface Details ==="
    ifconfig en0 | grep -E "(inet |ether |status)"
    
    echo -e "\n=== Wi-Fi Quality ==="
    /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I
}

# Get available networks
scan_networks() {
    echo "=== Available Wi-Fi Networks ==="
    /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s
}

# Usage
get_current_network
echo ""
get_wifi_info
echo ""
scan_networks

Advanced Network Diagnostics

#!/bin/bash

# Comprehensive network diagnostics
network_diagnostics() {
    echo "=== MacFleet Network Diagnostics ==="
    echo "Timestamp: $(date)"
    echo "Hostname: $(hostname)"
    echo "======================================="
    
    # Wi-Fi interface status
    echo -e "\n🔍 Wi-Fi Interface Status:"
    local wifi_power
    wifi_power=$(networksetup -getairportpower en0)
    echo "Power: $wifi_power"
    
    local wifi_service
    wifi_service=$(networksetup -getnetworkserviceenabled Wi-Fi)
    echo "Service: $wifi_service"
    
    # Current connection
    echo -e "\n📶 Current Connection:"
    networksetup -getairportnetwork en0
    
    # Network configuration
    echo -e "\n⚙️  Network Configuration:"
    networksetup -getinfo Wi-Fi
    
    # DNS settings
    echo -e "\n🌐 DNS Settings:"
    networksetup -getdnsservers Wi-Fi
    
    # Proxy settings
    echo -e "\n🔒 Proxy Settings:"
    networksetup -getwebproxy Wi-Fi
    networksetup -getsecurewebproxy Wi-Fi
    networksetup -getautoproxyurl Wi-Fi
    
    # Signal quality
    echo -e "\n📊 Signal Quality:"
    /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | grep -E "(SSID|BSSID|RSSI|noise|CC|channel)"
    
    # Connectivity test
    echo -e "\n🌍 Connectivity Test:"
    if ping -c 3 8.8.8.8 >/dev/null 2>&1; then
        echo "✅ Internet connectivity: Available"
    else
        echo "❌ Internet connectivity: Failed"
    fi
    
    if ping -c 3 apple.com >/dev/null 2>&1; then
        echo "✅ DNS resolution: Working"
    else
        echo "❌ DNS resolution: Failed"
    fi
}

# Generate network report
generate_network_report() {
    local report_file="/tmp/network_report_$(date +%Y%m%d_%H%M%S).txt"
    
    echo "Generating network report: $report_file"
    network_diagnostics > "$report_file"
    
    echo "📄 Network report saved: $report_file"
    return 0
}

# Usage
network_diagnostics

Enterprise Wi-Fi Management System

#!/bin/bash

# MacFleet Enterprise Wi-Fi Management System
# Centralized Wi-Fi configuration and policy management for fleet devices

# Configuration
LOG_FILE="/var/log/macfleet_wifi.log"
CONFIG_DIR="/etc/macfleet/wifi"
PROFILES_DIR="$CONFIG_DIR/profiles"
POLICIES_DIR="$CONFIG_DIR/policies"
BACKUP_DIR="/var/backups/network_configs"

# Network profile templates
declare -A NETWORK_PROFILES=(
    ["corporate"]="security=WPA2Enterprise,proxy=auto,dns=corporate"
    ["guest"]="security=WPA2Personal,proxy=none,dns=public"
    ["secure"]="security=WPA2Enterprise,proxy=mandatory,dns=secure"
    ["development"]="security=WPA2Personal,proxy=bypass,dns=dev"
    ["public"]="security=none,proxy=auto,dns=public"
)

# DNS server configurations
declare -A DNS_CONFIGS=(
    ["corporate"]="10.0.1.1 10.0.1.2"
    ["public"]="8.8.8.8 8.8.4.4"
    ["secure"]="1.1.1.1 1.0.0.1"
    ["dev"]="192.168.1.1 8.8.8.8"
)

# Proxy configurations
declare -A PROXY_CONFIGS=(
    ["corporate_web"]="proxy.company.com:8080:authenticated"
    ["corporate_auto"]="http://proxy.company.com/proxy.pac"
    ["guest_web"]="guest-proxy.company.com:3128:none"
)

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Setup directories
setup_directories() {
    for dir in "$CONFIG_DIR" "$PROFILES_DIR" "$POLICIES_DIR" "$BACKUP_DIR"; do
        if [[ ! -d "$dir" ]]; then
            mkdir -p "$dir"
            log_action "Created directory: $dir"
        fi
    done
}

# Backup current network configuration
backup_network_config() {
    local backup_timestamp
    backup_timestamp=$(date '+%Y%m%d_%H%M%S')
    local backup_file="$BACKUP_DIR/network_config_$backup_timestamp.tar.gz"
    
    log_action "Creating network configuration backup: $backup_file"
    
    # Create temporary backup directory
    local temp_backup="/tmp/network_backup_$$"
    mkdir -p "$temp_backup"
    
    # Export current settings
    {
        echo "# Wi-Fi Service Status"
        networksetup -getnetworkserviceenabled Wi-Fi
        
        echo -e "\n# Wi-Fi Power Status"
        networksetup -getairportpower en0
        
        echo -e "\n# Current Network"
        networksetup -getairportnetwork en0
        
        echo -e "\n# Network Info"
        networksetup -getinfo Wi-Fi
        
        echo -e "\n# DNS Servers"
        networksetup -getdnsservers Wi-Fi
        
        echo -e "\n# Search Domains"
        networksetup -getsearchdomains Wi-Fi
        
        echo -e "\n# Web Proxy"
        networksetup -getwebproxy Wi-Fi
        
        echo -e "\n# Secure Web Proxy"
        networksetup -getsecurewebproxy Wi-Fi
        
        echo -e "\n# Auto Proxy"
        networksetup -getautoproxyurl Wi-Fi
        
        echo -e "\n# Proxy Bypass Domains"
        networksetup -getproxybypassdomains Wi-Fi
        
    } > "$temp_backup/current_config.txt"
    
    # Create compressed backup
    if tar -czf "$backup_file" -C "$(dirname "$temp_backup")" "$(basename "$temp_backup")" 2>/dev/null; then
        log_action "✅ Network backup created: $backup_file"
        rm -rf "$temp_backup"
        echo "$backup_file"
        return 0
    else
        log_action "❌ Network backup failed"
        rm -rf "$temp_backup"
        return 1
    fi
}

# Configure DNS servers
configure_dns() {
    local dns_profile="$1"
    local custom_dns="$2"
    
    log_action "Configuring DNS servers: $dns_profile"
    
    local dns_servers
    if [[ -n "$custom_dns" ]]; then
        dns_servers="$custom_dns"
    else
        dns_servers="${DNS_CONFIGS[$dns_profile]}"
    fi
    
    if [[ -z "$dns_servers" ]]; then
        log_action "❌ Unknown DNS profile or empty configuration: $dns_profile"
        return 1
    fi
    
    # Set DNS servers
    if networksetup -setdnsservers Wi-Fi $dns_servers; then
        log_action "✅ DNS servers configured: $dns_servers"
        
        # Verify configuration
        local current_dns
        current_dns=$(networksetup -getdnsservers Wi-Fi)
        log_action "Current DNS servers: $current_dns"
        
        return 0
    else
        log_action "❌ Failed to configure DNS servers"
        return 1
    fi
}

# Configure search domains
configure_search_domains() {
    local domains="$*"
    
    if [[ -z "$domains" ]]; then
        log_action "Clearing search domains"
        networksetup -setsearchdomains Wi-Fi "Empty"
    else
        log_action "Setting search domains: $domains"
        networksetup -setsearchdomains Wi-Fi $domains
    fi
    
    if [[ $? -eq 0 ]]; then
        log_action "✅ Search domains configured successfully"
        return 0
    else
        log_action "❌ Failed to configure search domains"
        return 1
    fi
}

# Configure web proxy
configure_web_proxy() {
    local proxy_type="$1"
    local proxy_config="$2"
    
    log_action "Configuring web proxy: $proxy_type"
    
    case "$proxy_type" in
        "none")
            # Disable all proxies
            networksetup -setwebproxystate Wi-Fi off
            networksetup -setsecurewebproxystate Wi-Fi off
            networksetup -setautoproxystate Wi-Fi off
            log_action "✅ All proxies disabled"
            ;;
        "web")
            local proxy_server proxy_port auth_required username password
            IFS=':' read -ra PROXY_PARTS <<< "$proxy_config"
            proxy_server="${PROXY_PARTS[0]}"
            proxy_port="${PROXY_PARTS[1]}"
            auth_required="${PROXY_PARTS[2]}"
            username="${PROXY_PARTS[3]:-}"
            password="${PROXY_PARTS[4]:-}"
            
            if [[ "$auth_required" == "authenticated" && -n "$username" && -n "$password" ]]; then
                networksetup -setwebproxy Wi-Fi "$proxy_server" "$proxy_port" on "$username" "$password"
            else
                networksetup -setwebproxy Wi-Fi "$proxy_server" "$proxy_port" off
            fi
            
            networksetup -setwebproxystate Wi-Fi on
            log_action "✅ Web proxy configured: $proxy_server:$proxy_port"
            ;;
        "auto")
            networksetup -setautoproxyurl Wi-Fi "$proxy_config"
            networksetup -setautoproxystate Wi-Fi on
            log_action "✅ Automatic proxy configured: $proxy_config"
            ;;
        *)
            log_action "❌ Unknown proxy type: $proxy_type"
            return 1
            ;;
    esac
    
    return 0
}

# Configure proxy bypass domains
configure_proxy_bypass() {
    local domains="$*"
    
    log_action "Configuring proxy bypass domains: $domains"
    
    if [[ -n "$domains" ]]; then
        networksetup -setproxybypassdomains Wi-Fi $domains
    else
        networksetup -setproxybypassdomains Wi-Fi "Empty"
    fi
    
    if [[ $? -eq 0 ]]; then
        log_action "✅ Proxy bypass domains configured"
        return 0
    else
        log_action "❌ Failed to configure proxy bypass domains"
        return 1
    fi
}

# Deploy network profile
deploy_network_profile() {
    local profile_name="$1"
    local custom_settings="$2"
    
    log_action "Deploying network profile: $profile_name"
    
    # Get profile configuration
    local profile_config="${NETWORK_PROFILES[$profile_name]}"
    if [[ -z "$profile_config" ]]; then
        log_action "❌ Unknown network profile: $profile_name"
        return 1
    fi
    
    # Backup current configuration
    local backup_file
    backup_file=$(backup_network_config)
    
    # Parse profile settings
    local dns_setting proxy_setting security_setting
    IFS=',' read -ra SETTINGS <<< "$profile_config"
    
    for setting in "${SETTINGS[@]}"; do
        IFS='=' read -ra SETTING_PAIR <<< "$setting"
        local key="${SETTING_PAIR[0]}"
        local value="${SETTING_PAIR[1]}"
        
        case "$key" in
            "dns")
                configure_dns "$value"
                ;;
            "proxy")
                case "$value" in
                    "auto")
                        configure_web_proxy "auto" "${PROXY_CONFIGS[corporate_auto]}"
                        ;;
                    "mandatory")
                        configure_web_proxy "web" "${PROXY_CONFIGS[corporate_web]}"
                        ;;
                    "none")
                        configure_web_proxy "none"
                        ;;
                    "bypass")
                        configure_web_proxy "none"
                        configure_proxy_bypass "*.local *.company.com localhost"
                        ;;
                esac
                ;;
            "security")
                log_action "Security setting: $value (requires manual Wi-Fi connection)"
                ;;
        esac
    done
    
    # Apply custom settings if provided
    if [[ -n "$custom_settings" ]]; then
        log_action "Applying custom settings: $custom_settings"
        # Parse and apply custom settings here
    fi
    
    # Generate deployment report
    generate_profile_report "$profile_name" "$backup_file"
    
    log_action "✅ Network profile deployed: $profile_name"
    return 0
}

# Generate profile deployment report
generate_profile_report() {
    local profile_name="$1"
    local backup_file="$2"
    local report_file="$CONFIG_DIR/profile_report_$(date '+%Y%m%d_%H%M%S').json"
    
    log_action "Generating profile deployment report: $report_file"
    
    cat > "$report_file" << EOF
{
    "deployment_metadata": {
        "timestamp": "$(date -Iseconds)",
        "profile_name": "$profile_name",
        "hostname": "$(hostname)",
        "backup_file": "$backup_file",
        "generator": "MacFleet Wi-Fi Manager"
    },
    "network_configuration": {
        "wifi_service_enabled": "$(networksetup -getnetworkserviceenabled Wi-Fi)",
        "wifi_power_status": "$(networksetup -getairportpower en0)",
        "current_network": "$(networksetup -getairportnetwork en0)",
        "dns_servers": "$(networksetup -getdnsservers Wi-Fi | tr '\n' ' ')",
        "search_domains": "$(networksetup -getsearchdomains Wi-Fi | tr '\n' ' ')",
        "web_proxy_state": "$(networksetup -getwebproxystate Wi-Fi)",
        "auto_proxy_state": "$(networksetup -getautoproxystate Wi-Fi)"
    },
    "system_info": {
        "os_version": "$(sw_vers -productVersion)",
        "build_version": "$(sw_vers -buildVersion)",
        "serial_number": "$(system_profiler SPHardwareDataType | grep 'Serial Number' | awk '{print $4}')",
        "wifi_hardware": "$(system_profiler SPAirPortDataType | grep 'Card Type' | awk -F': ' '{print $2}')"
    }
}
EOF

    log_action "✅ Profile deployment report generated: $report_file"
    echo "$report_file"
}

# Monitor network connectivity
monitor_connectivity() {
    local test_hosts=("8.8.8.8" "apple.com" "github.com")
    local connectivity_report="$CONFIG_DIR/connectivity_$(date '+%Y%m%d_%H%M%S').json"
    
    log_action "Starting connectivity monitoring"
    
    cat > "$connectivity_report" << EOF
{
    "monitoring_timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "connectivity_tests": [
EOF

    local first=true
    for host in "${test_hosts[@]}"; do
        if [[ "$first" == true ]]; then
            first=false
        else
            echo "," >> "$connectivity_report"
        fi
        
        local start_time end_time duration result
        start_time=$(date +%s.%N)
        
        if ping -c 3 -W 5000 "$host" >/dev/null 2>&1; then
            result="success"
        else
            result="failed"
        fi
        
        end_time=$(date +%s.%N)
        duration=$(awk "BEGIN {printf \"%.3f\", $end_time - $start_time}")
        
        cat >> "$connectivity_report" << EOF
        {
            "host": "$host",
            "result": "$result",
            "duration_seconds": $duration,
            "timestamp": "$(date -Iseconds)"
        }
EOF
        
        log_action "Connectivity test: $host - $result ($duration seconds)"
    done
    
    cat >> "$connectivity_report" << EOF
    ],
    "network_status": {
        "current_ssid": "$(networksetup -getairportnetwork en0 | cut -d' ' -f4- || echo 'Not connected')",
        "signal_strength": "$(airport -I | grep ' RSSI:' | awk '{print $2}' || echo 'N/A')",
        "ip_address": "$(ifconfig en0 | grep 'inet ' | awk '{print $2}' || echo 'N/A')"
    }
}
EOF

    log_action "✅ Connectivity monitoring completed: $connectivity_report"
    echo "$connectivity_report"
}

# Wi-Fi security scan
security_scan() {
    local scan_report="$CONFIG_DIR/security_scan_$(date '+%Y%m%d_%H%M%S').json"
    
    log_action "Starting Wi-Fi security scan"
    
    # Scan for available networks
    local available_networks
    available_networks=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s)
    
    cat > "$scan_report" << EOF
{
    "scan_timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "security_analysis": {
        "open_networks": [],
        "wep_networks": [],
        "wpa_networks": [],
        "enterprise_networks": []
    },
    "network_details": [
EOF

    # Parse networks and categorize by security
    echo "$available_networks" | tail -n +2 | while IFS= read -r line; do
        local ssid security
        ssid=$(echo "$line" | awk '{print $1}')
        security=$(echo "$line" | awk '{for(i=7;i<=NF;i++) printf "%s ", $i; print ""}' | sed 's/[[:space:]]*$//')
        
        if [[ -n "$ssid" && "$ssid" != "SSID" ]]; then
            echo "Found network: $ssid - Security: $security" >&2
        fi
    done
    
    cat >> "$scan_report" << EOF
    ]
}
EOF

    log_action "✅ Wi-Fi security scan completed: $scan_report"
    echo "$scan_report"
}

# Reset network configuration
reset_network_config() {
    local reset_type="${1:-partial}"
    
    log_action "Resetting network configuration: $reset_type"
    
    # Backup before reset
    backup_network_config
    
    case "$reset_type" in
        "dns")
            log_action "Resetting DNS configuration"
            networksetup -setdnsservers Wi-Fi "Empty"
            networksetup -setsearchdomains Wi-Fi "Empty"
            ;;
        "proxy")
            log_action "Resetting proxy configuration"
            networksetup -setwebproxystate Wi-Fi off
            networksetup -setsecurewebproxystate Wi-Fi off
            networksetup -setautoproxystate Wi-Fi off
            networksetup -setproxybypassdomains Wi-Fi "Empty"
            ;;
        "full")
            log_action "Performing full network reset"
            # Reset all network settings
            networksetup -setdnsservers Wi-Fi "Empty"
            networksetup -setsearchdomains Wi-Fi "Empty"
            networksetup -setwebproxystate Wi-Fi off
            networksetup -setsecurewebproxystate Wi-Fi off
            networksetup -setautoproxystate Wi-Fi off
            networksetup -setproxybypassdomains Wi-Fi "Empty"
            
            # Reset Wi-Fi interface
            networksetup -setairportpower en0 off
            sleep 2
            networksetup -setairportpower en0 on
            ;;
        *)
            log_action "Resetting DNS and proxy settings"
            networksetup -setdnsservers Wi-Fi "Empty"
            networksetup -setwebproxystate Wi-Fi off
            ;;
    esac
    
    log_action "✅ Network configuration reset completed"
    return 0
}

# Main execution function
main() {
    local action="${1:-status}"
    local profile_name="$2"
    local additional_param="$3"
    
    log_action "=== MacFleet Wi-Fi Management Started ==="
    log_action "Action: $action"
    log_action "Profile: ${profile_name:-N/A}"
    
    # Setup
    setup_directories
    
    case "$action" in
        "deploy")
            if [[ -z "$profile_name" ]]; then
                echo "Available network profiles:"
                for profile in "${!NETWORK_PROFILES[@]}"; do
                    echo "  - $profile: ${NETWORK_PROFILES[$profile]}"
                done
                echo ""
                echo "Usage: $0 deploy <profile_name> [custom_settings]"
                exit 1
            fi
            deploy_network_profile "$profile_name" "$additional_param"
            ;;
        "status")
            network_diagnostics
            ;;
        "scan")
            security_scan
            ;;
        "monitor")
            monitor_connectivity
            ;;
        "dns")
            if [[ -z "$profile_name" ]]; then
                echo "Available DNS profiles: ${!DNS_CONFIGS[*]}"
                echo "Usage: $0 dns <profile_name|custom_servers>"
                exit 1
            fi
            configure_dns "$profile_name" "$additional_param"
            ;;
        "proxy")
            if [[ -z "$profile_name" ]]; then
                echo "Usage: $0 proxy <none|web|auto> [config]"
                exit 1
            fi
            configure_web_proxy "$profile_name" "$additional_param"
            ;;
        "reset")
            reset_network_config "$profile_name"
            ;;
        "backup")
            backup_network_config
            ;;
        *)
            echo "Usage: $0 {deploy|status|scan|monitor|dns|proxy|reset|backup}"
            echo "  deploy  - Deploy network profile"
            echo "  status  - Show network status and diagnostics"
            echo "  scan    - Perform Wi-Fi security scan"
            echo "  monitor - Monitor network connectivity"
            echo "  dns     - Configure DNS servers"
            echo "  proxy   - Configure proxy settings"
            echo "  reset   - Reset network configuration"
            echo "  backup  - Backup current network configuration"
            exit 1
            ;;
    esac
    
    log_action "=== Wi-Fi management completed ==="
}

# Execute main function
main "$@"

Advanced Network Configuration

Enterprise Wi-Fi Profile Management

#!/bin/bash

# Create custom network profile
create_network_profile() {
    local profile_name="$1"
    local ssid="$2"
    local security_type="$3"
    local proxy_config="$4"
    local dns_config="$5"
    
    local profile_file="$PROFILES_DIR/${profile_name}.json"
    
    cat > "$profile_file" << EOF
{
    "profile_name": "$profile_name",
    "created_date": "$(date -Iseconds)",
    "wifi_settings": {
        "ssid": "$ssid",
        "security_type": "$security_type",
        "auto_connect": true,
        "priority": 100
    },
    "proxy_settings": {
        "type": "$proxy_config",
        "auto_config_url": "",
        "manual_config": {
            "server": "",
            "port": "",
            "requires_auth": false
        },
        "bypass_domains": ["*.local", "localhost"]
    },
    "dns_settings": {
        "servers": "$dns_config",
        "search_domains": ["company.com", "local"]
    },
    "security_policies": {
        "require_certificate": false,
        "allow_untrusted": false,
        "minimum_security": "WPA2"
    }
}
EOF

    echo "Network profile created: $profile_file"
}

Automated Network Switching

#!/bin/bash

# Smart network switching based on location/SSID priority
smart_network_switching() {
    local priority_networks=("Corporate-WiFi" "Corporate-Guest" "Office-5G")
    local current_network
    current_network=$(networksetup -getairportnetwork en0 | cut -d' ' -f4-)
    
    echo "Current network: $current_network"
    echo "Scanning for priority networks..."
    
    # Get available networks
    local available_networks
    available_networks=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s | tail -n +2 | awk '{print $1}')
    
    # Check for priority networks
    for priority_ssid in "${priority_networks[@]}"; do
        if echo "$available_networks" | grep -q "$priority_ssid"; then
            if [[ "$current_network" != "$priority_ssid" ]]; then
                echo "Found higher priority network: $priority_ssid"
                echo "Would switch from: $current_network"
                # Note: Actual connection requires credentials
                return 0
            fi
        fi
    done
    
    echo "Already connected to optimal network"
}

Network Quality Monitoring

#!/bin/bash

# Monitor network quality and performance
monitor_network_quality() {
    local duration="${1:-60}"  # monitoring duration in seconds
    local interval="${2:-5}"   # check interval in seconds
    
    echo "=== Network Quality Monitoring ==="
    echo "Duration: ${duration}s, Interval: ${interval}s"
    
    local start_time end_time
    start_time=$(date +%s)
    end_time=$((start_time + duration))
    
    while [[ $(date +%s) -lt $end_time ]]; do
        local timestamp signal_strength link_quality tx_rate
        timestamp=$(date '+%H:%M:%S')
        
        # Get Wi-Fi metrics
        local airport_info
        airport_info=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I)
        
        signal_strength=$(echo "$airport_info" | grep 'RSSI:' | awk '{print $2}')
        link_quality=$(echo "$airport_info" | grep 'link auth:' | awk '{print $3}')
        tx_rate=$(echo "$airport_info" | grep 'lastTxRate:' | awk '{print $2}')
        
        # Test connectivity speed
        local ping_time
        ping_time=$(ping -c 1 8.8.8.8 2>/dev/null | grep 'time=' | awk -F'time=' '{print $2}' | awk '{print $1}')
        
        printf "%s | Signal: %sdBm | Quality: %s | Speed: %sMbps | Ping: %s\n" \
               "$timestamp" "$signal_strength" "$link_quality" "$tx_rate" "${ping_time:-timeout}"
        
        sleep "$interval"
    done
}

Security and Compliance

Network Security Audit

#!/bin/bash

# Comprehensive network security audit
network_security_audit() {
    local audit_report="$CONFIG_DIR/security_audit_$(date '+%Y%m%d_%H%M%S').json"
    
    echo "=== Network Security Audit ==="
    log_action "Starting network security audit"
    
    cat > "$audit_report" << EOF
{
    "audit_timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "security_assessment": {
        "wifi_encryption": "$(networksetup -getairportnetwork en0 | grep -o 'WPA\\|WEP\\|None' || echo 'Unknown')",
        "proxy_enabled": "$(networksetup -getwebproxystate Wi-Fi)",
        "dns_servers": "$(networksetup -getdnsservers Wi-Fi | tr '\n' ',' | sed 's/,$//')",
        "firewall_status": "$(defaults read /Library/Preferences/com.apple.alf globalstate 2>/dev/null || echo 'Unknown')"
    },
    "vulnerability_checks": [
EOF

    # Check for open networks in range
    local open_networks
    open_networks=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s | grep -E 'NONE|--' | wc -l)
    
    # Check for weak DNS
    local dns_servers
    dns_servers=$(networksetup -getdnsservers Wi-Fi)
    
    # Generate security recommendations
    local recommendations=()
    
    if [[ "$open_networks" -gt 0 ]]; then
        recommendations+=("Avoid connecting to $open_networks open networks detected")
    fi
    
    if echo "$dns_servers" | grep -q "There aren't any DNS Servers"; then
        recommendations+=("Configure secure DNS servers")
    fi
    
    cat >> "$audit_report" << EOF
    ],
    "recommendations": [
EOF

    local first=true
    for rec in "${recommendations[@]}"; do
        if [[ "$first" == true ]]; then
            first=false
        else
            echo "," >> "$audit_report"
        fi
        echo "        \"$rec\"" >> "$audit_report"
    done
    
    cat >> "$audit_report" << EOF
    ]
}
EOF

    log_action "✅ Security audit completed: $audit_report"
    echo "$audit_report"
}

Compliance Policy Enforcement

#!/bin/bash

# Enforce enterprise compliance policies
enforce_compliance_policy() {
    local policy_name="$1"
    
    log_action "Enforcing compliance policy: $policy_name"
    
    case "$policy_name" in
        "corporate")
            # Corporate policy: Secure DNS, mandatory proxy, no open networks
            configure_dns "corporate"
            configure_web_proxy "web" "${PROXY_CONFIGS[corporate_web]}"
            configure_proxy_bypass "*.company.com localhost"
            ;;
        "education")
            # Education policy: Safe DNS, content filtering proxy
            configure_dns "public"
            configure_web_proxy "auto" "http://filter.school.edu/proxy.pac"
            ;;
        "healthcare")
            # Healthcare policy: HIPAA-compliant settings
            configure_dns "secure"
            configure_web_proxy "web" "secure-proxy.hospital.org:8080:authenticated"
            ;;
        "government")
            # Government policy: Maximum security
            configure_dns "secure"
            configure_web_proxy "web" "gov-proxy.agency.gov:3128:authenticated"
            configure_proxy_bypass ""  # No bypass domains
            ;;
        *)
            log_action "❌ Unknown compliance policy: $policy_name"
            return 1
            ;;
    esac
    
    log_action "✅ Compliance policy enforced: $policy_name"
    return 0
}

Network Troubleshooting

Automated Network Repair

#!/bin/bash

# Automated network troubleshooting and repair
network_repair() {
    local repair_level="${1:-basic}"
    
    log_action "Starting network repair: $repair_level"
    
    echo "=== MacFleet Network Repair ==="
    
    # Basic connectivity test
    echo "🔍 Testing basic connectivity..."
    if ping -c 3 8.8.8.8 >/dev/null 2>&1; then
        echo "✅ Internet connectivity: OK"
    else
        echo "❌ Internet connectivity: FAILED"
        
        case "$repair_level" in
            "basic")
                echo "🔧 Attempting basic repair..."
                # Cycle Wi-Fi
                networksetup -setairportpower en0 off
                sleep 3
                networksetup -setairportpower en0 on
                sleep 5
                ;;
            "advanced")
                echo "🔧 Attempting advanced repair..."
                # Full network reset
                reset_network_config "full"
                sleep 10
                ;;
            "complete")
                echo "🔧 Attempting complete repair..."
                # Reset network preferences
                sudo rm -f /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
                sudo rm -f /Library/Preferences/SystemConfiguration/NetworkInterfaces.plist
                echo "⚠️  System restart required for complete repair"
                ;;
        esac
        
        # Retest after repair
        echo "🔄 Retesting connectivity..."
        if ping -c 3 8.8.8.8 >/dev/null 2>&1; then
            echo "✅ Repair successful"
            log_action "Network repair successful: $repair_level"
        else
            echo "❌ Repair failed - escalate to manual intervention"
            log_action "Network repair failed: $repair_level"
        fi
    fi
}

Network Performance Optimization

#!/bin/bash

# Optimize network performance settings
optimize_network_performance() {
    echo "=== Network Performance Optimization ==="
    
    # Check current MTU
    local current_mtu
    current_mtu=$(networksetup -getMTU Wi-Fi | awk '{print $NF}')
    echo "Current MTU: $current_mtu"
    
    # Optimize for different scenarios
    local optimization_type="${1:-balanced}"
    
    case "$optimization_type" in
        "throughput")
            echo "🚀 Optimizing for maximum throughput..."
            networksetup -setMTU Wi-Fi 1500
            ;;
        "latency")
            echo "⚡ Optimizing for low latency..."
            networksetup -setMTU Wi-Fi 1200
            ;;
        "balanced")
            echo "⚖️  Applying balanced optimization..."
            networksetup -setMTU Wi-Fi 1400
            ;;
        *)
            echo "❌ Unknown optimization type: $optimization_type"
            return 1
            ;;
    esac
    
    # Clear DNS cache
    echo "🧹 Clearing DNS cache..."
    sudo dscacheutil -flushcache
    sudo killall -HUP mDNSResponder
    
    echo "✅ Network optimization completed"
}

Best Practices

🚀 Performance Optimization

Monitor network quality regularly and switch to optimal networks
Configure appropriate MTU sizes for your network environment
Use local DNS caching to improve resolution speeds
Optimize proxy settings for your specific use case

🔐 Security Guidelines

Always use encrypted networks (WPA2/WPA3) in enterprise environments
Configure secure DNS servers to prevent DNS poisoning
Implement proxy policies for content filtering and security
Regular security audits to identify network vulnerabilities

📋 Management Best Practices

Profile-based configuration for different user groups and locations
Centralized policy enforcement across all fleet devices
Regular backup of network configurations before changes
Automated monitoring and alerting for connectivity issues

🔍 Troubleshooting Tips

Use network diagnostics to identify configuration issues
Monitor signal strength and network quality metrics
Test connectivity to multiple endpoints for comprehensive validation
Document network changes for audit trails and troubleshooting

Important Notes

Network changes take effect immediately but may require reconnection
Proxy authentication credentials should be managed securely
DNS changes may require cache flushing to take effect
Some enterprise networks require specific certificates for authentication
Always backup configurations before making significant changes

July 7, 2025

Wi-Fi Control on macOS

Control and manage Wi-Fi settings across your MacFleet devices using advanced command-line tools and centralized wireless policies. This tutorial covers Wi-Fi power management, connection control, security enforcement, and enterprise-grade wireless network management with comprehensive monitoring and compliance capabilities.

Understanding macOS Wi-Fi Management

macOS provides several command-line tools for Wi-Fi management:

networksetup - Primary tool for network configuration and control
airport - Low-level wireless interface management utility
ifconfig - Network interface configuration tool
System Preferences - GUI equivalent for wireless settings

Enterprise Wi-Fi control requires careful consideration of security policies, power management, and compliance requirements.

Basic Wi-Fi Control Commands

Turn Off Wi-Fi

#!/bin/bash

# Basic Wi-Fi disable command
turn_off_wifi_basic() {
    # Get the airport interface name
    local AIRPORT=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -n "$AIRPORT" ]]; then
        networksetup -setairportpower "$AIRPORT" off
        
        if [[ $? -eq 0 ]]; then
            echo "✅ Wi-Fi turned off successfully"
            return 0
        else
            echo "❌ Failed to turn off Wi-Fi"
            return 1
        fi
    else
        echo "❌ Wi-Fi interface not found"
        return 1
    fi
}

# Example usage
turn_off_wifi_basic

Turn On Wi-Fi

#!/bin/bash

# Turn on Wi-Fi with verification
turn_on_wifi() {
    local interface_name="$1"
    
    # Auto-detect interface if not provided
    if [[ -z "$interface_name" ]]; then
        interface_name=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    fi
    
    if [[ -z "$interface_name" ]]; then
        echo "❌ Wi-Fi interface not found"
        return 1
    fi
    
    echo "Turning on Wi-Fi interface: $interface_name"
    networksetup -setairportpower "$interface_name" on
    
    # Wait for interface to come up
    sleep 3
    
    # Verify Wi-Fi is enabled
    local wifi_status
    wifi_status=$(networksetup -getairportpower "$interface_name" | grep "On")
    
    if [[ -n "$wifi_status" ]]; then
        echo "✅ Wi-Fi turned on successfully"
        return 0
    else
        echo "❌ Failed to turn on Wi-Fi"
        return 1
    fi
}

# Example usage
# turn_on_wifi "en0"

Check Wi-Fi Status

#!/bin/bash

# Check current Wi-Fi status with detailed information
check_wifi_status() {
    echo "=== Wi-Fi Status Report ==="
    echo "Generated: $(date)"
    echo "=========================="
    echo ""
    
    # Get all Wi-Fi interfaces
    local wifi_interfaces
    wifi_interfaces=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interfaces" ]]; then
        echo "❌ No Wi-Fi interfaces found"
        return 1
    fi
    
    for interface in $wifi_interfaces; do
        echo "Interface: $interface"
        echo "-----------------"
        
        # Power status
        local power_status
        power_status=$(networksetup -getairportpower "$interface")
        echo "Power Status: $power_status"
        
        # Connection status
        if echo "$power_status" | grep -q "On"; then
            # Get current network
            local current_network
            current_network=$(networksetup -getairportnetwork "$interface" | cut -d' ' -f4-)
            echo "Current Network: $current_network"
            
            # Get IP address if connected
            local ip_address
            ip_address=$(ifconfig "$interface" | grep "inet " | awk '{print $2}')
            if [[ -n "$ip_address" ]]; then
                echo "IP Address: $ip_address"
            else
                echo "IP Address: Not assigned"
            fi
            
            # Signal strength (if available)
            if command -v airport >/dev/null 2>&1; then
                local signal_info
                signal_info=$(airport -I | grep "agrCtlRSSI" | awk '{print $2}')
                if [[ -n "$signal_info" ]]; then
                    echo "Signal Strength: $signal_info dBm"
                fi
            fi
        else
            echo "Wi-Fi is disabled"
        fi
        
        echo ""
    done
}

# Execute status check
check_wifi_status

Advanced Wi-Fi Management

Wi-Fi Interface Discovery

#!/bin/bash

# Discover and analyze Wi-Fi interfaces
discover_wifi_interfaces() {
    echo "=== Wi-Fi Interface Discovery ==="
    echo ""
    
    # List all network hardware
    echo "1. ALL NETWORK HARDWARE:"
    echo "------------------------"
    networksetup -listallhardwareports
    echo ""
    
    # Focus on Wi-Fi interfaces
    echo "2. WI-FI INTERFACES DETECTED:"
    echo "----------------------------"
    local wifi_count=0
    
    while IFS= read -r line; do
        if echo "$line" | grep -q "Wi-Fi"; then
            echo "Hardware Port: $line"
            # Get the next line which contains device name
            read -r device_line
            echo "Device: $device_line"
            
            # Extract device name
            local device_name
            device_name=$(echo "$device_line" | awk '{print $2}')
            
            # Get MAC address
            local mac_address
            mac_address=$(ifconfig "$device_name" 2>/dev/null | grep "ether" | awk '{print $2}')
            if [[ -n "$mac_address" ]]; then
                echo "MAC Address: $mac_address"
            fi
            
            # Get current status
            local power_status
            power_status=$(networksetup -getairportpower "$device_name" 2>/dev/null)
            echo "Power Status: $power_status"
            
            echo ""
            ((wifi_count++))
        fi
    done < <(networksetup -listallhardwareports)
    
    echo "Total Wi-Fi interfaces found: $wifi_count"
    
    if [[ $wifi_count -eq 0 ]]; then
        echo "⚠️  No Wi-Fi interfaces detected"
        return 1
    fi
    
    return 0
}

# Execute interface discovery
discover_wifi_interfaces

Network Scanning and Analysis

#!/bin/bash

# Scan for available Wi-Fi networks
scan_wifi_networks() {
    local interface_name="$1"
    local scan_type="${2:-basic}"  # basic, detailed, security
    
    # Auto-detect interface if not provided
    if [[ -z "$interface_name" ]]; then
        interface_name=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    fi
    
    if [[ -z "$interface_name" ]]; then
        echo "❌ Wi-Fi interface not found"
        return 1
    fi
    
    echo "=== Wi-Fi Network Scan ==="
    echo "Interface: $interface_name"
    echo "Scan Type: $scan_type"
    echo "========================="
    echo ""
    
    # Ensure Wi-Fi is on for scanning
    local power_status
    power_status=$(networksetup -getairportpower "$interface_name")
    
    if echo "$power_status" | grep -q "Off"; then
        echo "Enabling Wi-Fi for scanning..."
        networksetup -setairportpower "$interface_name" on
        sleep 3
    fi
    
    case "$scan_type" in
        "basic")
            # Basic network list
            echo "Available Networks:"
            echo "-------------------"
            if command -v airport >/dev/null 2>&1; then
                airport -s
            else
                echo "airport command not available, using networksetup scan"
                # Note: networksetup doesn't have direct scan command, using airport utility
            fi
            ;;
        "detailed")
            # Detailed network information
            echo "Detailed Network Analysis:"
            echo "-------------------------"
            if command -v airport >/dev/null 2>&1; then
                airport -s | while IFS= read -r line; do
                    if [[ -n "$line" && ! "$line" =~ ^[[:space:]]*$ ]]; then
                        echo "Network: $line"
                        # Extract SSID and signal strength
                        local ssid signal
                        ssid=$(echo "$line" | awk '{print $1}')
                        signal=$(echo "$line" | awk '{print $3}')
                        
                        if [[ -n "$signal" ]]; then
                            if [[ "$signal" -gt -50 ]]; then
                                echo "  Signal Quality: Excellent ($signal dBm)"
                            elif [[ "$signal" -gt -70 ]]; then
                                echo "  Signal Quality: Good ($signal dBm)"
                            elif [[ "$signal" -gt -80 ]]; then
                                echo "  Signal Quality: Fair ($signal dBm)"
                            else
                                echo "  Signal Quality: Poor ($signal dBm)"
                            fi
                        fi
                        echo ""
                    fi
                done
            fi
            ;;
        "security")
            # Security analysis of networks
            echo "Security Analysis:"
            echo "-----------------"
            if command -v airport >/dev/null 2>&1; then
                airport -s | grep -E "(WPA|WEP|NONE)" | while IFS= read -r line; do
                    local ssid security
                    ssid=$(echo "$line" | awk '{print $1}')
                    security=$(echo "$line" | grep -o -E "(WPA2|WPA3|WPA|WEP|NONE)")
                    
                    case "$security" in
                        "WPA3")
                            echo "✅ $ssid: Secure (WPA3)"
                            ;;
                        "WPA2")
                            echo "✅ $ssid: Secure (WPA2)"
                            ;;
                        "WPA")
                            echo "⚠️  $ssid: Moderately Secure (WPA)"
                            ;;
                        "WEP")
                            echo "❌ $ssid: Insecure (WEP - Deprecated)"
                            ;;
                        "NONE"|*)
                            echo "❌ $ssid: Open Network (No Security)"
                            ;;
                    esac
                done
            fi
            ;;
    esac
}

# Example usage
# scan_wifi_networks "en0" "detailed"

Enterprise Wi-Fi Control System

#!/bin/bash

# MacFleet Enterprise Wi-Fi Control System
# Comprehensive wireless management, security enforcement, and compliance monitoring

# Configuration
LOG_FILE="/var/log/macfleet_wifi_control.log"
CONFIG_FILE="/etc/macfleet/wifi_config.conf"
BACKUP_DIR="/var/backups/macfleet/wifi"
POLICY_DIR="/etc/macfleet/wifi_policies"

# Create directory structure
setup_directories() {
    mkdir -p "$(dirname "$LOG_FILE")" "$BACKUP_DIR" "$POLICY_DIR" "$(dirname "$CONFIG_FILE")"
    touch "$LOG_FILE"
    
    # Set appropriate permissions
    chmod 755 "$BACKUP_DIR" "$POLICY_DIR"
}

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Enterprise Wi-Fi policy enforcement
enforce_wifi_policy() {
    local policy_name="$1"
    local policy_file="$POLICY_DIR/${policy_name}.policy"
    
    if [[ ! -f "$policy_file" ]]; then
        log_action "ERROR: Wi-Fi policy not found: $policy_name"
        return 1
    fi
    
    log_action "Enforcing Wi-Fi policy: $policy_name"
    
    # Load policy configuration
    source "$policy_file"
    
    # Get Wi-Fi interface
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    # Apply policy settings
    case "${WIFI_POLICY_ACTION:-disable}" in
        "disable")
            networksetup -setairportpower "$wifi_interface" off
            log_action "Wi-Fi disabled per policy: $policy_name"
            ;;
        "enable")
            networksetup -setairportpower "$wifi_interface" on
            log_action "Wi-Fi enabled per policy: $policy_name"
            ;;
        "scheduled")
            apply_scheduled_wifi_policy "$wifi_interface" "$policy_name"
            ;;
        "conditional")
            apply_conditional_wifi_policy "$wifi_interface" "$policy_name"
            ;;
        *)
            log_action "ERROR: Unknown policy action: ${WIFI_POLICY_ACTION}"
            return 1
            ;;
    esac
    
    return 0
}

# Scheduled Wi-Fi control
apply_scheduled_wifi_policy() {
    local interface="$1"
    local policy_name="$2"
    local current_hour=$(date +%H)
    local current_day=$(date +%u)  # 1=Monday, 7=Sunday
    
    log_action "Applying scheduled Wi-Fi policy: $policy_name"
    
    # Load schedule from policy
    local enable_hours="${WIFI_ENABLE_HOURS:-09-17}"
    local enable_days="${WIFI_ENABLE_DAYS:-1-5}"
    
    # Parse time range
    local start_hour end_hour
    start_hour=$(echo "$enable_hours" | cut -d'-' -f1)
    end_hour=$(echo "$enable_hours" | cut -d'-' -f2)
    
    # Parse day range
    local start_day end_day
    start_day=$(echo "$enable_days" | cut -d'-' -f1)
    end_day=$(echo "$enable_days" | cut -d'-' -f2)
    
    # Check if current time is within allowed window
    local time_allowed=false
    local day_allowed=false
    
    if [[ "$current_hour" -ge "$start_hour" && "$current_hour" -lt "$end_hour" ]]; then
        time_allowed=true
    fi
    
    if [[ "$current_day" -ge "$start_day" && "$current_day" -le "$end_day" ]]; then
        day_allowed=true
    fi
    
    if [[ "$time_allowed" == "true" && "$day_allowed" == "true" ]]; then
        networksetup -setairportpower "$interface" on
        log_action "Wi-Fi enabled - within scheduled hours"
    else
        networksetup -setairportpower "$interface" off
        log_action "Wi-Fi disabled - outside scheduled hours"
    fi
}

# Conditional Wi-Fi control
apply_conditional_wifi_policy() {
    local interface="$1"
    local policy_name="$2"
    
    log_action "Applying conditional Wi-Fi policy: $policy_name"
    
    # Check battery level
    local battery_level
    battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
    
    # Check power source
    local power_source
    power_source=$(pmset -g ps | head -1 | grep -o "'.*'" | tr -d "'")
    
    # Check ethernet connection
    local ethernet_connected=false
    local ethernet_interfaces
    ethernet_interfaces=$(networksetup -listallhardwareports | grep -A 1 Ethernet | grep Device | awk '{print $2}')
    
    for eth_interface in $ethernet_interfaces; do
        local eth_status
        eth_status=$(ifconfig "$eth_interface" 2>/dev/null | grep "status: active")
        if [[ -n "$eth_status" ]]; then
            ethernet_connected=true
            break
        fi
    done
    
    # Apply conditional logic
    local should_enable_wifi=true
    
    # Disable Wi-Fi if ethernet is connected and policy requires it
    if [[ "$ethernet_connected" == "true" && "${DISABLE_WIFI_WITH_ETHERNET:-false}" == "true" ]]; then
        should_enable_wifi=false
        log_action "Wi-Fi disabled - Ethernet connection detected"
    fi
    
    # Disable Wi-Fi if battery is low and policy requires it
    if [[ -n "$battery_level" && "$battery_level" -lt "${MIN_BATTERY_FOR_WIFI:-20}" ]]; then
        should_enable_wifi=false
        log_action "Wi-Fi disabled - Low battery level: $battery_level%"
    fi
    
    # Enable/disable Wi-Fi based on conditions
    if [[ "$should_enable_wifi" == "true" ]]; then
        networksetup -setairportpower "$interface" on
        log_action "Wi-Fi enabled - Conditions met"
    else
        networksetup -setairportpower "$interface" off
        log_action "Wi-Fi disabled - Conditions not met"
    fi
}

# Security compliance check
check_wifi_security_compliance() {
    log_action "Performing Wi-Fi security compliance check"
    
    local compliance_issues=()
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found for compliance check"
        return 1
    fi
    
    # Check if Wi-Fi is enabled when it should be disabled
    local power_status
    power_status=$(networksetup -getairportpower "$wifi_interface")
    
    if echo "$power_status" | grep -q "On"; then
        # Wi-Fi is enabled, check current network security
        local current_network
        current_network=$(networksetup -getairportnetwork "$wifi_interface" | cut -d' ' -f4-)
        
        if [[ "$current_network" != "You are not associated with an AirPort network." ]]; then
            log_action "Connected to network: $current_network"
            
            # Check if network is in approved list
            local approved_networks_file="$POLICY_DIR/approved_networks.list"
            if [[ -f "$approved_networks_file" ]]; then
                if ! grep -q "^$current_network$" "$approved_networks_file"; then
                    compliance_issues+=("Connected to non-approved network: $current_network")
                fi
            fi
            
            # Check for open networks
            if command -v airport >/dev/null 2>&1; then
                local network_security
                network_security=$(airport -I | grep "Security")
                if echo "$network_security" | grep -q "none"; then
                    compliance_issues+=("Connected to open/unsecured network")
                fi
            fi
        fi
    fi
    
    # Check for saved insecure networks
    local network_profiles
    network_profiles=$(networksetup -listpreferredwirelessnetworks "$wifi_interface" 2>/dev/null | tail -n +2)
    
    while IFS= read -r network; do
        if [[ -n "$network" ]]; then
            # Clean network name
            network=$(echo "$network" | sed 's/^[[:space:]]*//')
            
            # Check against blacklist
            local blacklist_file="$POLICY_DIR/blacklisted_networks.list"
            if [[ -f "$blacklist_file" ]]; then
                if grep -q "^$network$" "$blacklist_file"; then
                    compliance_issues+=("Blacklisted network in saved profiles: $network")
                fi
            fi
        fi
    done <<< "$network_profiles"
    
    # Generate compliance report
    if [[ ${#compliance_issues[@]} -eq 0 ]]; then
        log_action "✅ Wi-Fi security compliance check passed"
        return 0
    else
        log_action "❌ Wi-Fi security compliance violations found:"
        for issue in "${compliance_issues[@]}"; do
            log_action "  - $issue"
        done
        return 1
    fi
}

# Network profile management
manage_wifi_profiles() {
    local action="$1"
    local network_name="$2"
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    case "$action" in
        "list")
            log_action "Listing saved Wi-Fi profiles"
            echo "=== Saved Wi-Fi Profiles ==="
            networksetup -listpreferredwirelessnetworks "$wifi_interface"
            ;;
        "remove")
            if [[ -z "$network_name" ]]; then
                log_action "ERROR: Network name required for removal"
                return 1
            fi
            
            log_action "Removing Wi-Fi profile: $network_name"
            networksetup -removepreferredwirelessnetwork "$wifi_interface" "$network_name"
            
            if [[ $? -eq 0 ]]; then
                log_action "✅ Wi-Fi profile removed: $network_name"
            else
                log_action "❌ Failed to remove Wi-Fi profile: $network_name"
                return 1
            fi
            ;;
        "removeall")
            log_action "Removing all saved Wi-Fi profiles"
            
            # Get list of networks and remove each one
            local networks
            networks=$(networksetup -listpreferredwirelessnetworks "$wifi_interface" 2>/dev/null | tail -n +2)
            
            while IFS= read -r network; do
                if [[ -n "$network" ]]; then
                    network=$(echo "$network" | sed 's/^[[:space:]]*//')
                    networksetup -removepreferredwirelessnetwork "$wifi_interface" "$network"
                    log_action "Removed profile: $network"
                fi
            done <<< "$networks"
            
            log_action "✅ All Wi-Fi profiles removed"
            ;;
        *)
            log_action "ERROR: Invalid action for profile management: $action"
            return 1
            ;;
    esac
}

# Power management optimization
optimize_wifi_power() {
    local optimization_level="${1:-balanced}"  # aggressive, balanced, conservative
    
    log_action "Applying Wi-Fi power optimization: $optimization_level"
    
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    case "$optimization_level" in
        "aggressive")
            # Maximum power savings
            log_action "Applying aggressive power optimization"
            
            # Disable Wi-Fi when ethernet is connected
            local ethernet_connected=false
            local ethernet_interfaces
            ethernet_interfaces=$(networksetup -listallhardwareports | grep -A 1 Ethernet | grep Device | awk '{print $2}')
            
            for eth_interface in $ethernet_interfaces; do
                local eth_status
                eth_status=$(ifconfig "$eth_interface" 2>/dev/null | grep "status: active")
                if [[ -n "$eth_status" ]]; then
                    ethernet_connected=true
                    break
                fi
            done
            
            if [[ "$ethernet_connected" == "true" ]]; then
                networksetup -setairportpower "$wifi_interface" off
                log_action "Wi-Fi disabled - Ethernet connection detected"
            fi
            ;;
        "balanced")
            # Moderate power savings
            log_action "Applying balanced power optimization"
            
            # Check battery level and disable if very low
            local battery_level
            battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
            
            if [[ -n "$battery_level" && "$battery_level" -lt 10 ]]; then
                networksetup -setairportpower "$wifi_interface" off
                log_action "Wi-Fi disabled - Critical battery level: $battery_level%"
            fi
            ;;
        "conservative")
            # Minimal power optimization
            log_action "Applying conservative power optimization"
            
            # Only disable in extreme circumstances
            local battery_level
            battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
            
            if [[ -n "$battery_level" && "$battery_level" -lt 5 ]]; then
                networksetup -setairportpower "$wifi_interface" off
                log_action "Wi-Fi disabled - Emergency battery level: $battery_level%"
            fi
            ;;
        *)
            log_action "ERROR: Invalid optimization level: $optimization_level"
            return 1
            ;;
    esac
    
    return 0
}

# Generate Wi-Fi management report
generate_wifi_report() {
    local report_file="$BACKUP_DIR/wifi_management_report_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Generating Wi-Fi management report: $report_file"
    
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    {
        echo "{"
        echo "  \"report_type\": \"wifi_management\","
        echo "  \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\","
        echo "  \"hostname\": \"$(hostname)\","
        echo "  \"system_info\": {"
        echo "    \"macos_version\": \"$(sw_vers -productVersion)\","
        echo "    \"user\": \"$(whoami)\""
        echo "  },"
        
        if [[ -n "$wifi_interface" ]]; then
            local power_status current_network ip_address
            power_status=$(networksetup -getairportpower "$wifi_interface" | grep -o "On\|Off")
            current_network=$(networksetup -getairportnetwork "$wifi_interface" | cut -d' ' -f4-)
            ip_address=$(ifconfig "$wifi_interface" | grep "inet " | awk '{print $2}')
            
            echo "  \"wifi_status\": {"
            echo "    \"interface\": \"$wifi_interface\","
            echo "    \"power_status\": \"$power_status\","
            echo "    \"current_network\": \"$current_network\","
            echo "    \"ip_address\": \"${ip_address:-null}\""
            echo "  },"
        else
            echo "  \"wifi_status\": {"
            echo "    \"interface\": null,"
            echo "    \"power_status\": \"unavailable\","
            echo "    \"current_network\": null,"
            echo "    \"ip_address\": null"
            echo "  },"
        fi
        
        # Battery and power information
        local battery_level power_source
        battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
        power_source=$(pmset -g ps | head -1 | grep -o "'.*'" | tr -d "'")
        
        echo "  \"power_info\": {"
        echo "    \"battery_level\": ${battery_level:-null},"
        echo "    \"power_source\": \"${power_source:-unknown}\""
        echo "  },"
        
        # Network profiles
        echo "  \"saved_profiles\": ["
        if [[ -n "$wifi_interface" ]]; then
            local first_profile=true
            networksetup -listpreferredwirelessnetworks "$wifi_interface" 2>/dev/null | tail -n +2 | while IFS= read -r network; do
                if [[ -n "$network" ]]; then
                    network=$(echo "$network" | sed 's/^[[:space:]]*//')
                    if [[ "$first_profile" == "false" ]]; then
                        echo ","
                    fi
                    first_profile=false
                    echo -n "    \"$network\""
                fi
            done
        fi
        echo ""
        echo "  ]"
        echo "}"
    } > "$report_file"
    
    log_action "Wi-Fi management report generated: $report_file"
    echo "$report_file"
}

# Main management function
main() {
    local action="${1:-status}"
    local parameter1="$2"
    local parameter2="$3"
    
    setup_directories
    log_action "MacFleet Wi-Fi Control started with action: $action"
    
    case "$action" in
        "disable"|"off")
            turn_off_wifi_basic
            ;;
        "enable"|"on")
            turn_on_wifi "$parameter1"
            ;;
        "status")
            check_wifi_status
            ;;
        "scan")
            scan_wifi_networks "$parameter1" "$parameter2"
            ;;
        "discover")
            discover_wifi_interfaces
            ;;
        "policy")
            enforce_wifi_policy "$parameter1"
            ;;
        "compliance")
            check_wifi_security_compliance
            ;;
        "profiles")
            manage_wifi_profiles "$parameter1" "$parameter2"
            ;;
        "optimize")
            optimize_wifi_power "$parameter1"
            ;;
        "report")
            generate_wifi_report
            ;;
        *)
            check_wifi_status
            ;;
    esac
    
    log_action "MacFleet Wi-Fi Control completed with action: $action"
}

# Execute main function with all arguments
main "$@"

Wi-Fi Policy Templates

Corporate Wi-Fi Policy Configuration

# /etc/macfleet/wifi_policies/corporate_standard.policy
# MacFleet Corporate Wi-Fi Policy

# Policy action: disable, enable, scheduled, conditional
WIFI_POLICY_ACTION="conditional"

# Scheduled settings (for scheduled action)
WIFI_ENABLE_HOURS="08-18"    # 8 AM to 6 PM
WIFI_ENABLE_DAYS="1-5"       # Monday to Friday

# Conditional settings
DISABLE_WIFI_WITH_ETHERNET="true"
MIN_BATTERY_FOR_WIFI="15"

# Security settings
REQUIRE_WPA2_MINIMUM="true"
BLOCK_OPEN_NETWORKS="true"
AUTO_CONNECT_CORPORATE_ONLY="true"

# Power management
POWER_OPTIMIZATION_LEVEL="balanced"
AUTO_DISABLE_IDLE="true"
IDLE_TIMEOUT_MINUTES="30"

Security-Focused Wi-Fi Policy

# /etc/macfleet/wifi_policies/high_security.policy
# MacFleet High Security Wi-Fi Policy

WIFI_POLICY_ACTION="conditional"

# Security requirements
REQUIRE_WPA3_MINIMUM="true"
BLOCK_OPEN_NETWORKS="true"
BLOCK_WEP_NETWORKS="true"
APPROVED_NETWORKS_ONLY="true"

# Conditional disabling
DISABLE_WIFI_WITH_ETHERNET="true"
DISABLE_WIFI_IN_SECURE_AREAS="true"
MIN_BATTERY_FOR_WIFI="25"

# Monitoring
ENABLE_CONNECTION_LOGGING="true"
ALERT_ON_UNAPPROVED_NETWORKS="true"
SCAN_INTERVAL_MINUTES="5"

Power Conservation Policy

# /etc/macfleet/wifi_policies/power_saver.policy
# MacFleet Power Conservation Wi-Fi Policy

WIFI_POLICY_ACTION="conditional"

# Aggressive power saving
DISABLE_WIFI_WITH_ETHERNET="true"
MIN_BATTERY_FOR_WIFI="30"
POWER_OPTIMIZATION_LEVEL="aggressive"

# Scheduled disabling for night hours
WIFI_ENABLE_HOURS="07-22"    # 7 AM to 10 PM
WIFI_ENABLE_DAYS="1-7"       # All days

# Auto-disable features
AUTO_DISABLE_IDLE="true"
IDLE_TIMEOUT_MINUTES="15"
DISABLE_BACKGROUND_SCANNING="true"

Security and Compliance Functions

Network Whitelist Management

#!/bin/bash

# Manage approved Wi-Fi networks
manage_network_whitelist() {
    local action="$1"
    local network_name="$2"
    local whitelist_file="$POLICY_DIR/approved_networks.list"
    
    case "$action" in
        "add")
            if [[ -z "$network_name" ]]; then
                echo "ERROR: Network name required"
                return 1
            fi
            
            # Add network to whitelist
            if ! grep -q "^$network_name$" "$whitelist_file" 2>/dev/null; then
                echo "$network_name" >> "$whitelist_file"
                log_action "Added network to whitelist: $network_name"
            else
                log_action "Network already in whitelist: $network_name"
            fi
            ;;
        "remove")
            if [[ -z "$network_name" ]]; then
                echo "ERROR: Network name required"
                return 1
            fi
            
            # Remove network from whitelist
            if [[ -f "$whitelist_file" ]]; then
                grep -v "^$network_name$" "$whitelist_file" > "${whitelist_file}.tmp"
                mv "${whitelist_file}.tmp" "$whitelist_file"
                log_action "Removed network from whitelist: $network_name"
            fi
            ;;
        "list")
            echo "=== Approved Networks Whitelist ==="
            if [[ -f "$whitelist_file" ]]; then
                cat "$whitelist_file"
            else
                echo "No approved networks configured"
            fi
            ;;
        "enforce")
            enforce_network_whitelist
            ;;
        *)
            echo "ERROR: Invalid whitelist action: $action"
            return 1
            ;;
    esac
}

# Enforce network whitelist
enforce_network_whitelist() {
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    # Get current network
    local current_network
    current_network=$(networksetup -getairportnetwork "$wifi_interface" | cut -d' ' -f4-)
    
    if [[ "$current_network" == "You are not associated with an AirPort network." ]]; then
        log_action "No active Wi-Fi connection"
        return 0
    fi
    
    # Check if current network is approved
    local whitelist_file="$POLICY_DIR/approved_networks.list"
    if [[ -f "$whitelist_file" ]]; then
        if grep -q "^$current_network$" "$whitelist_file"; then
            log_action "✅ Connected to approved network: $current_network"
            return 0
        else
            log_action "❌ Connected to non-approved network: $current_network"
            
            # Disconnect from non-approved network
            networksetup -setairportpower "$wifi_interface" off
            sleep 2
            networksetup -setairportpower "$wifi_interface" on
            
            log_action "Disconnected from non-approved network"
            return 1
        fi
    else
        log_action "⚠️  No whitelist configured - allowing all networks"
        return 0
    fi
}

# Example usage
# manage_network_whitelist "add" "CorporateWiFi"
# manage_network_whitelist "list"
# manage_network_whitelist "enforce"

Wi-Fi Audit and Monitoring

#!/bin/bash

# Comprehensive Wi-Fi audit
audit_wifi_configuration() {
    local audit_file="$BACKUP_DIR/wifi_audit_$(date +%Y%m%d_%H%M%S).txt"
    
    log_action "Performing comprehensive Wi-Fi audit: $audit_file"
    
    {
        echo "MacFleet Wi-Fi Configuration Audit"
        echo "=================================="
        echo "Generated: $(date)"
        echo "Hostname: $(hostname)"
        echo "Auditor: $(whoami)"
        echo ""
        
        # Wi-Fi interface information
        echo "WI-FI INTERFACE ANALYSIS:"
        echo "------------------------"
        discover_wifi_interfaces
        echo ""
        
        # Current connection status
        echo "CONNECTION STATUS:"
        echo "-----------------"
        check_wifi_status
        echo ""
        
        # Security compliance
        echo "SECURITY COMPLIANCE:"
        echo "-------------------"
        if check_wifi_security_compliance; then
            echo "✅ Security compliance check passed"
        else
            echo "❌ Security compliance violations detected"
        fi
        echo ""
        
        # Saved network profiles
        echo "SAVED NETWORK PROFILES:"
        echo "----------------------"
        manage_wifi_profiles "list"
        echo ""
        
        # Policy enforcement status
        echo "POLICY ENFORCEMENT:"
        echo "------------------"
        local policy_files
        policy_files=$(ls "$POLICY_DIR"/*.policy 2>/dev/null)
        
        if [[ -n "$policy_files" ]]; then
            for policy_file in $policy_files; do
                local policy_name
                policy_name=$(basename "$policy_file" .policy)
                echo "Policy: $policy_name"
                echo "  File: $policy_file"
                echo "  Status: $(if [[ -f "$policy_file" ]]; then echo "Active"; else echo "Inactive"; fi)"
            done
        else
            echo "No policies configured"
        fi
        echo ""
        
        # Power management status
        echo "POWER MANAGEMENT:"
        echo "----------------"
        local battery_level power_source
        battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
        power_source=$(pmset -g ps | head -1 | grep -o "'.*'" | tr -d "'")
        
        echo "Battery Level: ${battery_level:-Unknown}%"
        echo "Power Source: ${power_source:-Unknown}"
        echo ""
        
        # Recommendations
        echo "SECURITY RECOMMENDATIONS:"
        echo "------------------------"
        echo "• Implement approved network whitelist"
        echo "• Enable automatic disconnection from open networks"
        echo "• Configure scheduled Wi-Fi disable during off-hours"
        echo "• Implement battery-based power management"
        echo "• Regular audit of saved network profiles"
        echo "• Monitor for connections to unapproved networks"
        
    } > "$audit_file"
    
    log_action "Wi-Fi audit completed: $audit_file"
    echo "$audit_file"
}

audit_wifi_configuration

Important Technical Notes

NetworkSetup Command Reference

networksetup -setairportpower <device> on|off: Enable/disable Wi-Fi
networksetup -getairportpower <device>: Check Wi-Fi power status
networksetup -getairportnetwork <device>: Get current Wi-Fi network
networksetup -listpreferredwirelessnetworks <device>: List saved networks
networksetup -removepreferredwirelessnetwork <device> <network>: Remove saved network

Security Considerations

Admin Privileges: Many network commands require admin access
Network Isolation: Ensure proper network segmentation
Profile Management: Regularly audit and clean saved network profiles
Open Network Protection: Block connections to unsecured networks
Compliance Monitoring: Implement continuous security compliance checking

Power Management Best Practices

Battery Optimization: Disable Wi-Fi when battery is critically low
Ethernet Priority: Prefer wired connections when available
Scheduled Control: Implement time-based Wi-Fi policies
Idle Management: Disable Wi-Fi during extended idle periods
Resource Monitoring: Track power consumption patterns

Enterprise Use Cases

Security-First Environments: Strict network whitelisting and compliance
Power-Conscious Deployments: Battery optimization for mobile workers
Scheduled Operations: Time-based Wi-Fi control for different work shifts
Compliance Requirements: Audit trails and security monitoring
Fleet Standardization: Consistent Wi-Fi policies across all devices

Remember to test all scripts on individual devices before deploying across your MacFleet environment, and ensure compliance with corporate security policies when implementing enterprise Wi-Fi control systems.

July 7, 2025

Website Access Control on macOS

Control website access across your MacFleet devices using advanced hosts file management, DNS filtering, and enterprise policy controls. This tutorial provides comprehensive tools for implementing organizational web access policies.

Understanding Website Access Control Methods

macOS offers multiple approaches for controlling website access:

Hosts File Management - Local DNS override for specific domains
DNS Configuration - Network-level filtering via custom DNS servers
System Proxy Settings - Route traffic through filtering proxies
Firewall Rules - Block specific IP addresses and port ranges

Basic Website Blocking

Block Single Website

#!/bin/bash

# Block access to a specific website
WEBSITE="www.facebook.com"

# Add entry to hosts file
echo "127.0.0.1 $WEBSITE" >> /etc/hosts
echo "127.0.0.1 facebook.com" >> /etc/hosts

echo "Blocked access to $WEBSITE"

Block Multiple Websites

#!/bin/bash

# Block multiple websites at once
BLOCKED_SITES=(
    "www.facebook.com"
    "facebook.com" 
    "m.facebook.com"
    "www.twitter.com"
    "twitter.com"
    "www.instagram.com"
    "instagram.com"
)

for site in "${BLOCKED_SITES[@]}"; do
    echo "127.0.0.1 $site" >> /etc/hosts
    echo "Blocked: $site"
done

echo "Website blocking completed"

Basic Website Unblocking

Unblock Single Website

#!/bin/bash

# Remove website from hosts file
WEBSITE="www.facebook.com"

/usr/bin/sed -i "" "/127.0.0.1 $WEBSITE/d" /etc/hosts
/usr/bin/sed -i "" "/127.0.0.1 facebook.com/d" /etc/hosts

echo "Unblocked access to $WEBSITE"

Unblock All Websites

#!/bin/bash

# Remove all blocking entries from hosts file
/usr/bin/sed -i "" '/^127.0.0.1.*[^localhost]/d' /etc/hosts

echo "All website blocks removed"

Enterprise Website Access Control System

#!/bin/bash

# MacFleet Enterprise Website Access Control
# Comprehensive web filtering and policy management system

# Configuration
MACFLEET_DIR="/etc/macfleet"
POLICIES_DIR="$MACFLEET_DIR/web_policies"
REPORTS_DIR="$MACFLEET_DIR/reports"
COMPLIANCE_DIR="$MACFLEET_DIR/compliance"
AUDIT_DIR="$MACFLEET_DIR/audit"
LOG_FILE="/var/log/macfleet_web_access.log"
BACKUP_DIR="$MACFLEET_DIR/backups"

# Create directory structure
create_directories() {
    local dirs=("$MACFLEET_DIR" "$POLICIES_DIR" "$REPORTS_DIR" "$COMPLIANCE_DIR" "$AUDIT_DIR" "$BACKUP_DIR")
    for dir in "${dirs[@]}"; do
        [[ ! -d "$dir" ]] && mkdir -p "$dir"
    done
}

# Logging function
log_action() {
    local message="$1"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] $message" | tee -a "$LOG_FILE"
}

# Backup hosts file
backup_hosts() {
    local backup_file="$BACKUP_DIR/hosts_backup_$(date +%Y%m%d_%H%M%S)"
    cp /etc/hosts "$backup_file"
    log_action "Hosts file backed up to: $backup_file"
}

# Website Categories for Enterprise Filtering
declare -A WEBSITE_CATEGORIES=(
    ["social_media"]="facebook.com,twitter.com,instagram.com,linkedin.com,snapchat.com,tiktok.com,pinterest.com"
    ["entertainment"]="youtube.com,netflix.com,hulu.com,twitch.tv,spotify.com,reddit.com"
    ["gaming"]="steam.com,epic.com,roblox.com,minecraft.net,ea.com,ubisoft.com"
    ["shopping"]="amazon.com,ebay.com,etsy.com,shopify.com,aliexpress.com"
    ["news"]="cnn.com,bbc.com,reuters.com,bloomberg.com,wsj.com"
    ["adult_content"]="example.com"
    ["malicious"]="malware.com,phishing-site.com,trojan-host.com"
)

# Security Policies
declare -A SECURITY_POLICIES=(
    ["high_security"]="social_media,entertainment,gaming,shopping,adult_content,malicious"
    ["moderate_security"]="adult_content,malicious,gaming"
    ["minimal_security"]="adult_content,malicious"
    ["development_team"]="malicious"
    ["executive_access"]="malicious"
)

# Block websites by category
block_category() {
    local category="$1"
    local policy="$2"
    
    if [[ -z "${WEBSITE_CATEGORIES[$category]}" ]]; then
        log_action "ERROR: Unknown category: $category"
        return 1
    fi
    
    log_action "Blocking category: $category (Policy: $policy)"
    
    # Split comma-separated domains
    IFS=',' read -ra domains <<< "${WEBSITE_CATEGORIES[$category]}"
    
    for domain in "${domains[@]}"; do
        # Add multiple variations
        echo "127.0.0.1 $domain" >> /etc/hosts
        echo "127.0.0.1 www.$domain" >> /etc/hosts
        echo "127.0.0.1 m.$domain" >> /etc/hosts
        echo "127.0.0.1 mobile.$domain" >> /etc/hosts
        
        log_action "Blocked domain: $domain"
    done
    
    # Save policy metadata
    echo "category=$category,policy=$policy,timestamp=$(date),user=$(whoami)" >> "$POLICIES_DIR/applied_blocks.log"
}

# Apply security policy
apply_security_policy() {
    local policy="$1"
    
    if [[ -z "${SECURITY_POLICIES[$policy]}" ]]; then
        log_action "ERROR: Unknown security policy: $policy"
        return 1
    fi
    
    log_action "Applying security policy: $policy"
    backup_hosts
    
    # Clear existing blocks
    /usr/bin/sed -i "" '/^127.0.0.1.*[^localhost]/d' /etc/hosts
    
    # Apply categories for this policy
    IFS=',' read -ra categories <<< "${SECURITY_POLICIES[$policy]}"
    
    for category in "${categories[@]}"; do
        block_category "$category" "$policy"
    done
    
    # Flush DNS cache
    dscacheutil -flushcache
    killall -HUP mDNSResponder
    
    log_action "Security policy '$policy' applied successfully"
    
    # Generate compliance report
    generate_compliance_report "$policy"
}

# Advanced DNS-based filtering
configure_dns_filtering() {
    local filter_level="$1"
    
    log_action "Configuring DNS filtering: $filter_level"
    
    case "$filter_level" in
        "enterprise")
            # Use enterprise DNS servers with filtering
            networksetup -setdnsservers "Wi-Fi" 208.67.222.222 208.67.220.220
            networksetup -setdnsservers "Ethernet" 208.67.222.222 208.67.220.220
            ;;
        "family_safe")
            # Use family-safe DNS
            networksetup -setdnsservers "Wi-Fi" 208.67.222.123 208.67.220.123
            networksetup -setdnsservers "Ethernet" 208.67.222.123 208.67.220.123
            ;;
        "secure")
            # Use security-focused DNS
            networksetup -setdnsservers "Wi-Fi" 1.1.1.2 1.0.0.2
            networksetup -setdnsservers "Ethernet" 1.1.1.2 1.0.0.2
            ;;
        "default")
            # Reset to automatic DNS
            networksetup -setdnsservers "Wi-Fi" "Empty"
            networksetup -setdnsservers "Ethernet" "Empty"
            ;;
    esac
    
    log_action "DNS filtering configured: $filter_level"
}

# Whitelist management for essential business sites
manage_whitelist() {
    local action="$1"
    local domain="$2"
    local whitelist_file="$POLICIES_DIR/business_whitelist.txt"
    
    case "$action" in
        "add")
            if ! grep -q "^$domain$" "$whitelist_file" 2>/dev/null; then
                echo "$domain" >> "$whitelist_file"
                # Remove from hosts file if blocked
                /usr/bin/sed -i "" "/127.0.0.1.*$domain/d" /etc/hosts
                log_action "Added to whitelist: $domain"
            else
                log_action "Domain already whitelisted: $domain"
            fi
            ;;
        "remove")
            if [[ -f "$whitelist_file" ]]; then
                /usr/bin/sed -i "" "/^$domain$/d" "$whitelist_file"
                log_action "Removed from whitelist: $domain"
            fi
            ;;
        "list")
            if [[ -f "$whitelist_file" ]]; then
                echo "Business Whitelist:"
                cat "$whitelist_file"
            else
                echo "No whitelist found"
            fi
            ;;
    esac
}

# Emergency access mode
emergency_access() {
    local action="$1"
    local emergency_file="$POLICIES_DIR/emergency_mode.flag"
    
    case "$action" in
        "enable")
            # Backup current hosts and clear all blocks
            backup_hosts
            cp /etc/hosts "$BACKUP_DIR/hosts_before_emergency"
            /usr/bin/sed -i "" '/^127.0.0.1.*[^localhost]/d' /etc/hosts
            touch "$emergency_file"
            echo "emergency_enabled=$(date)" > "$emergency_file"
            log_action "EMERGENCY ACCESS ENABLED - All website blocks removed"
            ;;
        "disable")
            if [[ -f "$emergency_file" ]]; then
                rm "$emergency_file"
                # Restore previous configuration if available
                if [[ -f "$BACKUP_DIR/hosts_before_emergency" ]]; then
                    cp "$BACKUP_DIR/hosts_before_emergency" /etc/hosts
                    log_action "Emergency access disabled - Previous configuration restored"
                else
                    log_action "Emergency access disabled - Manual reconfiguration required"
                fi
            else
                log_action "Emergency access is not currently enabled"
            fi
            ;;
        "status")
            if [[ -f "$emergency_file" ]]; then
                echo "Emergency access: ENABLED"
                cat "$emergency_file"
            else
                echo "Emergency access: DISABLED"
            fi
            ;;
    esac
}

# Generate comprehensive compliance report
generate_compliance_report() {
    local policy="$1"
    local report_file="$REPORTS_DIR/web_access_compliance_$(date +%Y%m%d_%H%M%S).json"
    
    local blocked_domains=$(grep -c "^127.0.0.1" /etc/hosts 2>/dev/null || echo "0")
    local whitelist_count=0
    [[ -f "$POLICIES_DIR/business_whitelist.txt" ]] && whitelist_count=$(wc -l < "$POLICIES_DIR/business_whitelist.txt")
    
    cat > "$report_file" << EOF
{
  "report_metadata": {
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "hostname": "$(hostname)",
    "policy_applied": "$policy",
    "report_version": "1.0"
  },
  "web_access_control": {
    "blocked_domains_count": $blocked_domains,
    "whitelisted_domains_count": $whitelist_count,
    "dns_filtering_active": $(networksetup -getdnsservers Wi-Fi | grep -q "208.67" && echo "true" || echo "false"),
    "emergency_mode": $([ -f "$POLICIES_DIR/emergency_mode.flag" ] && echo "true" || echo "false")
  },
  "security_policy": {
    "name": "$policy",
    "categories_blocked": "$(echo "${SECURITY_POLICIES[$policy]}" | tr ',' ' ')",
    "compliance_frameworks": ["SOX", "HIPAA", "NIST", "ISO27001"]
  },
  "system_status": {
    "hosts_file_size": $(wc -l < /etc/hosts),
    "last_dns_flush": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "backup_available": $([ -d "$BACKUP_DIR" ] && [ "$(ls -1 "$BACKUP_DIR"/hosts_backup_* 2>/dev/null | wc -l)" -gt 0 ] && echo "true" || echo "false")
  }
}
EOF
    
    log_action "Compliance report generated: $report_file"
    echo "Report saved to: $report_file"
}

# Health check and validation
perform_health_check() {
    echo "=== MacFleet Web Access Control Health Check ==="
    
    # Check hosts file integrity
    if [[ -f "/etc/hosts" ]]; then
        echo "✓ Hosts file exists"
        local hosts_size=$(wc -l < /etc/hosts)
        echo "  - Lines: $hosts_size"
    else
        echo "✗ Hosts file missing"
    fi
    
    # Check blocked domains
    local blocked_count=$(grep -c "^127.0.0.1" /etc/hosts 2>/dev/null || echo "0")
    echo "✓ Blocked domains: $blocked_count"
    
    # Check DNS configuration
    local dns_servers=$(networksetup -getdnsservers Wi-Fi)
    echo "✓ DNS servers: $dns_servers"
    
    # Check whitelist
    if [[ -f "$POLICIES_DIR/business_whitelist.txt" ]]; then
        local whitelist_count=$(wc -l < "$POLICIES_DIR/business_whitelist.txt")
        echo "✓ Whitelisted domains: $whitelist_count"
    else
        echo "○ No whitelist configured"
    fi
    
    # Check emergency mode
    if [[ -f "$POLICIES_DIR/emergency_mode.flag" ]]; then
        echo "⚠️  Emergency mode: ACTIVE"
    else
        echo "✓ Emergency mode: INACTIVE"
    fi
    
    # Check recent activity
    if [[ -f "$LOG_FILE" ]]; then
        local recent_entries=$(tail -5 "$LOG_FILE" | wc -l)
        echo "✓ Recent log entries: $recent_entries"
    fi
}

# Fleet deployment function
deploy_to_fleet() {
    local policy="$1"
    local fleet_file="$2"
    
    if [[ ! -f "$fleet_file" ]]; then
        log_action "ERROR: Fleet file not found: $fleet_file"
        return 1
    fi
    
    log_action "Starting fleet deployment of policy: $policy"
    
    while IFS= read -r host; do
        [[ -z "$host" || "$host" =~ ^#.*$ ]] && continue
        
        echo "Deploying to: $host"
        
        # Copy this script to remote host and execute
        ssh "$host" "bash -s" << EOF
#!/bin/bash
# Remote deployment of web access policy: $policy

# Create directories
mkdir -p /etc/macfleet/{web_policies,reports,compliance,audit,backups}

# Apply the policy (simplified for remote execution)
$(declare -p WEBSITE_CATEGORIES)
$(declare -p SECURITY_POLICIES)
$(type apply_security_policy | sed '1d')

apply_security_policy "$policy"
EOF
        
        if [[ $? -eq 0 ]]; then
            log_action "Successfully deployed to: $host"
        else
            log_action "Failed to deploy to: $host"
        fi
        
    done < "$fleet_file"
    
    log_action "Fleet deployment completed"
}

# Main execution function
main() {
    create_directories
    
    case "${1:-}" in
        "apply_policy")
            apply_security_policy "$2"
            ;;
        "block_category")
            backup_hosts
            block_category "$2" "manual"
            ;;
        "configure_dns")
            configure_dns_filtering "$2"
            ;;
        "whitelist")
            manage_whitelist "$2" "$3"
            ;;
        "emergency")
            emergency_access "$2"
            ;;
        "health_check")
            perform_health_check
            ;;
        "report")
            generate_compliance_report "${2:-manual}"
            ;;
        "deploy")
            deploy_to_fleet "$2" "$3"
            ;;
        "help"|*)
            echo "MacFleet Website Access Control System"
            echo ""
            echo "Usage: $0 <command> [options]"
            echo ""
            echo "Commands:"
            echo "  apply_policy <policy>     - Apply security policy (high_security|moderate_security|minimal_security|development_team|executive_access)"
            echo "  block_category <category> - Block website category (social_media|entertainment|gaming|shopping|news|adult_content|malicious)"
            echo "  configure_dns <level>     - Configure DNS filtering (enterprise|family_safe|secure|default)"
            echo "  whitelist <action> <domain> - Manage whitelist (add|remove|list)"
            echo "  emergency <action>        - Emergency access control (enable|disable|status)"
            echo "  health_check             - Perform system health check"
            echo "  report [policy]          - Generate compliance report"
            echo "  deploy <policy> <fleet_file> - Deploy policy to fleet"
            echo ""
            echo "Examples:"
            echo "  $0 apply_policy high_security"
            echo "  $0 whitelist add salesforce.com"
            echo "  $0 emergency enable"
            echo "  $0 health_check"
            ;;
    esac
}

# Execute main function
main "$@"

Business Hours and User-Friendly Controls

Time-Based Access Control

#!/bin/bash

# Apply different policies based on business hours
apply_time_based_policy() {
    local current_hour=$(date +%H)
    local day_of_week=$(date +%u)
    
    # Business hours: Monday-Friday 9 AM - 6 PM
    if [[ $day_of_week -le 5 ]] && [[ $current_hour -ge 9 ]] && [[ $current_hour -lt 18 ]]; then
        echo "Business hours detected - applying strict policy"
        apply_security_policy "high_security"
    else
        echo "Outside business hours - applying relaxed policy"
        apply_security_policy "moderate_security"
    fi
}

User Notification System

#!/bin/bash

# Notify user of website access changes
notify_user() {
    local message="$1"
    local title="MacFleet Web Access"
    
    # Use osascript for user notification
    osascript -e "display notification \"$message\" with title \"$title\" sound name \"Glass\""
    
    # Also log to system
    log_action "User notification: $message"
}

# Example usage
notify_user "Website access policy updated to High Security mode"

Important Security Considerations

Hosts file permissions should be restricted to prevent unauthorized modifications
DNS filtering provides network-level protection beyond local hosts file
Emergency access procedures should be documented and tested
Regular backups of hosts file and configuration are essential
Audit logging helps track policy changes and compliance

Compliance and Reporting

The enterprise system generates comprehensive reports for:

SOX Compliance - Financial services web access controls
HIPAA Requirements - Healthcare data protection policies
NIST Framework - Cybersecurity standards alignment
ISO 27001 - Information security management

Testing and Validation

Before deploying to production:

Test individual commands on isolated systems
Verify DNS resolution after applying policies
Confirm business applications remain accessible
Test emergency procedures and restoration
Validate compliance reporting accuracy

This comprehensive system transforms basic website blocking into an enterprise-grade access control platform with advanced policy management, compliance reporting, and fleet deployment capabilities.