Tutorial

Nuevas actualizaciones y mejoras para Macfleet.
Síguenos en X.com

Aviso importante

Los ejemplos de código y scripts proporcionados en estos tutoriales son solo para propósitos educativos. Macfleet no es responsable de ningún problema, daño o vulnerabilidad de seguridad que pueda surgir del uso, modificación o implementación de estos ejemplos. Siempre revisa y prueba el código en un entorno seguro antes de usarlo en sistemas de producción.

← Todas las publicaciones

Cisco Umbrella Roaming Client Management on macOS

Deploy and manage Cisco Umbrella roaming clients across your MacFleet with enterprise-grade security DNS protection, automated deployment workflows, and comprehensive monitoring capabilities. This tutorial transforms the basic deployment process into a robust enterprise security solution.

Understanding Enterprise Cisco Umbrella Management

Enterprise Cisco Umbrella deployment requires more than basic client installation, demanding:

  • Automated deployment workflows with organization-specific configurations
  • Centralized security policy management with DNS filtering controls
  • Real-time monitoring and reporting of security threats and activities
  • Certificate management for advanced security features
  • Compliance tracking for security posture management
  • Integration capabilities with existing security infrastructure

Core Cisco Umbrella Deployment Process

Basic Deployment Components

  1. Configuration Push - Deploy OrgInfo.plist with organization parameters
  2. PKG Installation - Install the Umbrella roaming client application
  3. Certificate Distribution - Deploy root certificates for advanced features
  4. Policy Application - Configure security policies and monitoring

Core Configuration Script

# Basic configuration script
mkdir "/Library/Application Support/OpenDNS Roaming Client/"
cat <<EOF > "/Library/Application Support/OpenDNS Roaming Client/OrgInfo.plist"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>APIFingerprint</key>
    <string>xxxxxxxxxxx</string>
    <key>APIOrganizationID</key>
    <string>xxxxxx</string>
    <key>APIUserID</key>
    <string>xxxxx</string>
    <key>InstallMenubar</key>
    <false/>
</dict>
</plist>
EOF

Enterprise Cisco Umbrella Management System

#!/bin/bash

# MacFleet Enterprise Cisco Umbrella Management System
# Comprehensive security DNS deployment with enterprise controls and monitoring

# Configuration
SCRIPT_NAME="MacFleet Cisco Umbrella Manager"
VERSION="1.0.0"
LOG_FILE="/var/log/macfleet_umbrella.log"
AUDIT_LOG="/var/log/macfleet_umbrella_audit.log"
CONFIG_DIR="/Library/Application Support/OpenDNS Roaming Client"
UMBRELLA_CONFIG="$CONFIG_DIR/OrgInfo.plist"
CERTS_DIR="/etc/macfleet/umbrella/certificates"
POLICIES_DIR="/etc/macfleet/umbrella/policies"
TEMP_DIR="/tmp/macfleet_umbrella"
BACKUP_DIR="/var/backups/umbrella"
MONITORING_INTERVAL=300  # 5 minutes
HEALTH_CHECK_TIMEOUT=30
ORGANIZATION_NAME="MacFleet Enterprise"
DEPLOYMENT_MODE="enterprise"
ENABLE_ADVANCED_FEATURES=true
ENABLE_THREAT_MONITORING=true
AUTO_CERTIFICATE_RENEWAL=true

# Umbrella Configuration Parameters (to be customized per organization)
declare -A UMBRELLA_CONFIG_PARAMS=(
    ["APIFingerprint"]=""           # To be populated from Cisco dashboard
    ["APIOrganizationID"]=""        # To be populated from Cisco dashboard
    ["APIUserID"]=""                # To be populated from Cisco dashboard
    ["InstallMenubar"]="false"
    ["EnableLogging"]="true"
    ["LogLevel"]="INFO"
    ["UpdateInterval"]="3600"
    ["BackupDNS"]="8.8.8.8,1.1.1.1"
    ["EnforceSecureDNS"]="true"
    ["BlockMalware"]="true"
    ["BlockPhishing"]="true"
    ["BlockAdware"]="true"
    ["ContentFiltering"]="true"
    ["SafeSearch"]="true"
    ["YouTubeFiltering"]="strict"
)

# Security Policy Templates
declare -A SECURITY_POLICIES=(
    ["executive"]="high_security_minimal_blocking"
    ["standard"]="balanced_security_moderate_blocking"
    ["guest"]="basic_security_extensive_blocking"
    ["developer"]="medium_security_minimal_blocking"
    ["kiosk"]="maximum_security_extensive_blocking"
)

# Create necessary directories
mkdir -p "$CONFIG_DIR"
mkdir -p "$CERTS_DIR"
mkdir -p "$POLICIES_DIR"
mkdir -p "$TEMP_DIR"
mkdir -p "$BACKUP_DIR"
mkdir -p "$(dirname "$LOG_FILE")"
mkdir -p "$(dirname "$AUDIT_LOG")"

# Set secure permissions
chmod 755 "$CONFIG_DIR"
chmod 700 "$CERTS_DIR"
chmod 750 "$POLICIES_DIR"
chmod 700 "$TEMP_DIR"
chmod 750 "$BACKUP_DIR"

# Logging functions
log_operation() {
    local level="$1"
    local message="$2"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local admin_user=$(whoami)
    echo "[$timestamp] [$level] [$admin_user] $message" | tee -a "$LOG_FILE"
}

log_security_event() {
    local event_type="$1"
    local details="$2"
    local severity="$3"
    local admin_user=$(whoami)
    
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local source_ip=$(who am i | awk '{print $5}' | tr -d '()')
    echo "SECURITY|$timestamp|$event_type|$severity|$admin_user|$source_ip|$details" >> "$AUDIT_LOG"
}

# Validate Cisco Umbrella configuration parameters
validate_umbrella_config() {
    local errors=()
    
    # Check required API parameters
    if [[ -z "${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}" ]]; then
        errors+=("APIFingerprint is required")
    fi
    
    if [[ -z "${UMBRELLA_CONFIG_PARAMS[APIOrganizationID]}" ]]; then
        errors+=("APIOrganizationID is required")
    fi
    
    if [[ -z "${UMBRELLA_CONFIG_PARAMS[APIUserID]}" ]]; then
        errors+=("APIUserID is required")
    fi
    
    # Validate fingerprint format (basic check)
    if [[ -n "${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}" ]] && [[ ! "${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}" =~ ^[A-Fa-f0-9]{40,}$ ]]; then
        errors+=("APIFingerprint format appears invalid")
    fi
    
    if [[ ${#errors[@]} -gt 0 ]]; then
        echo "Umbrella configuration validation failed:"
        printf '  - %s\n' "${errors[@]}"
        return 1
    fi
    
    return 0
}

# Generate enterprise Umbrella configuration
generate_umbrella_config() {
    local user_profile="${1:-standard}"
    local custom_settings="${2:-}"
    local admin_user=$(whoami)
    
    log_security_event "CONFIG_GENERATION" "profile=$user_profile" "INFO"
    
    echo "=== Generating Cisco Umbrella Configuration ==="
    echo "User Profile: $user_profile"
    echo "Deployment Mode: $DEPLOYMENT_MODE"
    echo "Administrator: $admin_user"
    echo ""
    
    # Validate configuration before generation
    if ! validate_umbrella_config; then
        log_operation "ERROR" "Configuration validation failed"
        return 1
    fi
    
    # Backup existing configuration
    if [[ -f "$UMBRELLA_CONFIG" ]]; then
        local backup_file="$BACKUP_DIR/OrgInfo_$(date +%Y%m%d_%H%M%S).plist"
        cp "$UMBRELLA_CONFIG" "$backup_file"
        log_operation "INFO" "Existing configuration backed up to: $backup_file"
    fi
    
    # Apply profile-specific security settings
    case "$user_profile" in
        "executive")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="WARN"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="false"
            ;;
        "standard")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="INFO"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            ;;
        "guest")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="WARN"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            UMBRELLA_CONFIG_PARAMS["SafeSearch"]="true"
            ;;
        "developer")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="DEBUG"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="true"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="false"
            ;;
        "kiosk")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="ERROR"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            UMBRELLA_CONFIG_PARAMS["EnforceSecureDNS"]="true"
            ;;
    esac
    
    # Generate the configuration file
    cat > "$UMBRELLA_CONFIG" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Core Cisco Umbrella API Configuration -->
    <key>APIFingerprint</key>
    <string>${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}</string>
    <key>APIOrganizationID</key>
    <string>${UMBRELLA_CONFIG_PARAMS[APIOrganizationID]}</string>
    <key>APIUserID</key>
    <string>${UMBRELLA_CONFIG_PARAMS[APIUserID]}</string>
    
    <!-- Enterprise UI Configuration -->
    <key>InstallMenubar</key>
    <${UMBRELLA_CONFIG_PARAMS[InstallMenubar]}/>
    <key>ShowNotifications</key>
    <true/>
    <key>AutoStart</key>
    <true/>
    
    <!-- Logging and Monitoring -->
    <key>EnableLogging</key>
    <${UMBRELLA_CONFIG_PARAMS[EnableLogging]}/>
    <key>LogLevel</key>
    <string>${UMBRELLA_CONFIG_PARAMS[LogLevel]}</string>
    <key>LogRotationDays</key>
    <integer>30</integer>
    
    <!-- Network Configuration -->
    <key>UpdateInterval</key>
    <integer>${UMBRELLA_CONFIG_PARAMS[UpdateInterval]}</integer>
    <key>BackupDNS</key>
    <string>${UMBRELLA_CONFIG_PARAMS[BackupDNS]}</string>
    <key>EnforceSecureDNS</key>
    <${UMBRELLA_CONFIG_PARAMS[EnforceSecureDNS]}/>
    
    <!-- Security Policies -->
    <key>BlockMalware</key>
    <${UMBRELLA_CONFIG_PARAMS[BlockMalware]}/>
    <key>BlockPhishing</key>
    <${UMBRELLA_CONFIG_PARAMS[BlockPhishing]}/>
    <key>BlockAdware</key>
    <${UMBRELLA_CONFIG_PARAMS[BlockAdware]}/>
    
    <!-- Content Filtering -->
    <key>ContentFiltering</key>
    <${UMBRELLA_CONFIG_PARAMS[ContentFiltering]}/>
    <key>SafeSearch</key>
    <${UMBRELLA_CONFIG_PARAMS[SafeSearch]}/>
    <key>YouTubeFiltering</key>
    <string>${UMBRELLA_CONFIG_PARAMS[YouTubeFiltering]}</string>
    
    <!-- Enterprise Metadata -->
    <key>OrganizationName</key>
    <string>$ORGANIZATION_NAME</string>
    <key>DeploymentMode</key>
    <string>$DEPLOYMENT_MODE</string>
    <key>ConfigurationVersion</key>
    <string>$(date +%Y%m%d%H%M%S)</string>
    <key>DeployedBy</key>
    <string>$admin_user</string>
    <key>DeploymentDate</key>
    <string>$(date)</string>
    <key>UserProfile</key>
    <string>$user_profile</string>
</dict>
</plist>
EOF
    
    # Set secure permissions
    chmod 644 "$UMBRELLA_CONFIG"
    chown root:wheel "$UMBRELLA_CONFIG"
    
    # Validate generated configuration
    if plutil -lint "$UMBRELLA_CONFIG" &>/dev/null; then
        echo "✅ Configuration generated successfully"
        log_operation "INFO" "Umbrella configuration generated for profile: $user_profile"
        log_security_event "CONFIG_DEPLOYED" "profile=$user_profile,file=$UMBRELLA_CONFIG" "INFO"
        return 0
    else
        echo "❌ Configuration validation failed"
        log_operation "ERROR" "Generated configuration file is invalid"
        return 1
    fi
}

# Install Cisco Umbrella certificates
install_umbrella_certificates() {
    local cert_source="${1:-auto}"
    local admin_user=$(whoami)
    
    log_security_event "CERT_INSTALLATION" "source=$cert_source" "INFO"
    
    echo "=== Installing Cisco Umbrella Certificates ==="
    echo "Certificate Source: $cert_source"
    echo "Administrator: $admin_user"
    echo ""
    
    local cert_files=()
    
    case "$cert_source" in
        "auto")
            # Download certificates from Cisco (requires authentication)
            echo "Downloading latest Cisco Umbrella root certificates..."
            
            # Note: In production, these would be downloaded from Cisco portal
            # For this example, we'll check for pre-downloaded certificates
            if [[ -f "$CERTS_DIR/cisco_umbrella_root.pem" ]]; then
                cert_files+=("$CERTS_DIR/cisco_umbrella_root.pem")
            else
                echo "⚠️  Certificate files not found in $CERTS_DIR"
                echo "Please download certificates from Cisco Umbrella portal:"
                echo "Deployments > Configuration > Root Certificate"
                return 1
            fi
            ;;
        "local")
            # Use locally provided certificates
            cert_files=($(find "$CERTS_DIR" -name "*.pem" -o -name "*.crt" -o -name "*.cer"))
            ;;
        *)
            # Specific certificate file
            if [[ -f "$cert_source" ]]; then
                cert_files=("$cert_source")
            else
                echo "Certificate file not found: $cert_source"
                return 1
            fi
            ;;
    esac
    
    if [[ ${#cert_files[@]} -eq 0 ]]; then
        echo "No certificate files found"
        return 1
    fi
    
    # Install certificates
    local installed_count=0
    for cert_file in "${cert_files[@]}"; do
        echo "Installing certificate: $(basename "$cert_file")"
        
        # Verify certificate before installation
        if openssl x509 -in "$cert_file" -text -noout &>/dev/null; then
            # Install to system keychain
            if security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$cert_file"; then
                echo "✅ Certificate installed successfully"
                installed_count=$((installed_count + 1))
                log_operation "INFO" "Certificate installed: $(basename "$cert_file")"
            else
                echo "❌ Failed to install certificate: $(basename "$cert_file")"
                log_operation "ERROR" "Certificate installation failed: $(basename "$cert_file")"
            fi
        else
            echo "❌ Invalid certificate format: $(basename "$cert_file")"
            log_operation "ERROR" "Invalid certificate format: $(basename "$cert_file")"
        fi
    done
    
    echo ""
    echo "Certificate installation completed: $installed_count/${#cert_files[@]} successful"
    
    if [[ $installed_count -gt 0 ]]; then
        log_security_event "CERTS_INSTALLED" "count=$installed_count" "INFO"
        return 0
    else
        log_security_event "CERT_INSTALL_FAILED" "all_failed=true" "ERROR"
        return 1
    fi
}

# Monitor Cisco Umbrella service health
monitor_umbrella_health() {
    local check_type="${1:-basic}"
    local admin_user=$(whoami)
    
    echo "=== Cisco Umbrella Health Monitoring ==="
    echo "Check Type: $check_type"
    echo "Monitor: $admin_user"
    echo ""
    
    local health_status="HEALTHY"
    local issues=()
    
    # Check if configuration file exists and is valid
    if [[ ! -f "$UMBRELLA_CONFIG" ]]; then
        health_status="CRITICAL"
        issues+=("Configuration file missing")
    elif ! plutil -lint "$UMBRELLA_CONFIG" &>/dev/null; then
        health_status="CRITICAL"
        issues+=("Configuration file corrupted")
    fi
    
    # Check if Umbrella process is running
    if ! pgrep -f "Umbrella" &>/dev/null; then
        health_status="WARNING"
        issues+=("Umbrella client not running")
    fi
    
    # Check DNS resolution through Umbrella
    echo "Testing DNS resolution through Cisco Umbrella..."
    local test_domains=("cisco.com" "umbrella.com" "google.com")
    local dns_failures=0
    
    for domain in "${test_domains[@]}"; do
        if timeout "$HEALTH_CHECK_TIMEOUT" nslookup "$domain" &>/dev/null; then
            echo "✅ DNS resolution successful: $domain"
        else
            echo "❌ DNS resolution failed: $domain"
            dns_failures=$((dns_failures + 1))
        fi
    done
    
    if [[ $dns_failures -gt 0 ]]; then
        health_status="WARNING"
        issues+=("DNS resolution issues ($dns_failures failed)")
    fi
    
    # Check certificate validity
    echo ""
    echo "Checking Cisco Umbrella certificates..."
    local expired_certs=0
    
    # Get Umbrella-related certificates from system keychain
    local umbrella_certs=$(security find-certificate -a -c "Cisco" /Library/Keychains/System.keychain 2>/dev/null | grep "alis" | wc -l)
    
    if [[ $umbrella_certs -eq 0 ]]; then
        health_status="WARNING"
        issues+=("No Cisco certificates found")
    else
        echo "✅ Found $umbrella_certs Cisco certificates"
    fi
    
    # Advanced checks
    if [[ "$check_type" == "comprehensive" ]]; then
        echo ""
        echo "Running comprehensive health checks..."
        
        # Check log file for errors
        if [[ -f "/Library/Logs/OpenDNSRoamingClient.log" ]]; then
            local recent_errors=$(tail -100 "/Library/Logs/OpenDNSRoamingClient.log" 2>/dev/null | grep -i "error" | wc -l)
            if [[ $recent_errors -gt 5 ]]; then
                health_status="WARNING"
                issues+=("High error count in logs ($recent_errors)")
            fi
        fi
        
        # Check network connectivity to Umbrella servers
        local umbrella_servers=("208.67.222.222" "208.67.220.220")
        for server in "${umbrella_servers[@]}"; do
            if timeout 5 ping -c 1 "$server" &>/dev/null; then
                echo "✅ Connectivity to Umbrella server: $server"
            else
                echo "❌ Cannot reach Umbrella server: $server"
                health_status="WARNING"
                issues+=("Connectivity issues to $server")
            fi
        done
    fi
    
    # Generate health report
    echo ""
    echo "=== Health Status Report ==="
    echo "Overall Status: $health_status"
    echo "Timestamp: $(date)"
    
    if [[ ${#issues[@]} -gt 0 ]]; then
        echo "Issues Found:"
        printf '  - %s\n' "${issues[@]}"
    else
        echo "✅ All systems operational"
    fi
    
    # Log health status
    log_operation "INFO" "Health check completed: $health_status (${#issues[@]} issues)"
    log_security_event "HEALTH_CHECK" "status=$health_status,issues=${#issues[@]}" "INFO"
    
    # Return appropriate exit code
    case "$health_status" in
        "HEALTHY") return 0 ;;
        "WARNING") return 1 ;;
        "CRITICAL") return 2 ;;
        *) return 3 ;;
    esac
}

# Generate Umbrella deployment report
generate_umbrella_report() {
    local report_type="${1:-summary}"
    local admin_user=$(whoami)
    local report_file="/var/reports/umbrella_report_$(date +%Y%m%d_%H%M%S).txt"
    
    mkdir -p "$(dirname "$report_file")"
    
    log_security_event "REPORT_GENERATION" "type=$report_type" "INFO"
    
    {
        echo "MacFleet Cisco Umbrella Deployment Report"
        echo "========================================="
        echo "Report Type: $report_type"
        echo "Generated: $(date)"
        echo "Generated By: $admin_user"
        echo "Hostname: $(hostname)"
        echo ""
        
        case "$report_type" in
            "summary")
                echo "== Deployment Summary =="
                echo "Organization: $ORGANIZATION_NAME"
                echo "Deployment Mode: $DEPLOYMENT_MODE"
                echo "Configuration File: $UMBRELLA_CONFIG"
                
                if [[ -f "$UMBRELLA_CONFIG" ]]; then
                    echo "Configuration Status: Deployed"
                    local config_date=$(stat -f %Sm "$UMBRELLA_CONFIG")
                    echo "Last Modified: $config_date"
                else
                    echo "Configuration Status: Not Deployed"
                fi
                
                # Client status
                if pgrep -f "Umbrella" &>/dev/null; then
                    echo "Client Status: Running"
                else
                    echo "Client Status: Not Running"
                fi
                ;;
            "security")
                echo "== Security Assessment =="
                echo "Security Features Enabled:"
                
                if [[ -f "$UMBRELLA_CONFIG" ]]; then
                    local malware_blocking=$(plutil -extract BlockMalware xml1 -o - "$UMBRELLA_CONFIG" 2>/dev/null | grep -o "<true/>" && echo "Enabled" || echo "Disabled")
                    local phishing_blocking=$(plutil -extract BlockPhishing xml1 -o - "$UMBRELLA_CONFIG" 2>/dev/null | grep -o "<true/>" && echo "Enabled" || echo "Disabled")
                    local content_filtering=$(plutil -extract ContentFiltering xml1 -o - "$UMBRELLA_CONFIG" 2>/dev/null | grep -o "<true/>" && echo "Enabled" || echo "Disabled")
                    
                    echo "  Malware Blocking: $malware_blocking"
                    echo "  Phishing Blocking: $phishing_blocking"
                    echo "  Content Filtering: $content_filtering"
                else
                    echo "  Configuration not available for analysis"
                fi
                
                # Certificate status
                local cisco_certs=$(security find-certificate -a -c "Cisco" /Library/Keychains/System.keychain 2>/dev/null | grep "alis" | wc -l)
                echo "  Cisco Certificates Installed: $cisco_certs"
                ;;
            "audit")
                echo "== Audit Information =="
                if [[ -f "$AUDIT_LOG" ]]; then
                    echo "Recent security events (last 10):"
                    tail -10 "$AUDIT_LOG"
                else
                    echo "No audit log available"
                fi
                ;;
        esac
        
        echo ""
        echo "== Configuration Details =="
        if [[ -f "$UMBRELLA_CONFIG" ]]; then
            echo "Configuration file contents:"
            cat "$UMBRELLA_CONFIG"
        else
            echo "No configuration file found"
        fi
        
    } > "$report_file"
    
    echo "Umbrella deployment report generated: $report_file"
    log_operation "INFO" "Umbrella report generated: $report_file"
}

# Set organization-specific parameters
set_organization_params() {
    local api_fingerprint="$1"
    local api_org_id="$2"
    local api_user_id="$3"
    
    if [[ -z "$api_fingerprint" || -z "$api_org_id" || -z "$api_user_id" ]]; then
        echo "Usage: set_organization_params <api_fingerprint> <api_org_id> <api_user_id>"
        echo ""
        echo "These parameters can be obtained from:"
        echo "Cisco Umbrella Portal > Deployments > Core Identities > Roaming Computers"
        return 1
    fi
    
    UMBRELLA_CONFIG_PARAMS["APIFingerprint"]="$api_fingerprint"
    UMBRELLA_CONFIG_PARAMS["APIOrganizationID"]="$api_org_id"
    UMBRELLA_CONFIG_PARAMS["APIUserID"]="$api_user_id"
    
    echo "Organization parameters updated successfully"
    log_security_event "ORG_PARAMS_SET" "org_id=$api_org_id" "INFO"
}

# Main Cisco Umbrella management function
main() {
    local action="${1:-help}"
    
    case "$action" in
        "configure")
            local user_profile="${2:-standard}"
            local custom_settings="$3"
            
            generate_umbrella_config "$user_profile" "$custom_settings"
            ;;
        "install-certs")
            local cert_source="${2:-auto}"
            
            install_umbrella_certificates "$cert_source"
            ;;
        "health")
            local check_type="${2:-basic}"
            
            monitor_umbrella_health "$check_type"
            ;;
        "report")
            local report_type="${2:-summary}"
            
            generate_umbrella_report "$report_type"
            ;;
        "set-params")
            local api_fingerprint="$2"
            local api_org_id="$3"
            local api_user_id="$4"
            
            set_organization_params "$api_fingerprint" "$api_org_id" "$api_user_id"
            ;;
        "deploy")
            local user_profile="${2:-standard}"
            
            echo "=== Full Cisco Umbrella Deployment ==="
            echo "Starting comprehensive deployment..."
            echo ""
            
            # Step 1: Generate configuration
            if generate_umbrella_config "$user_profile"; then
                echo "✅ Configuration deployment successful"
            else
                echo "❌ Configuration deployment failed"
                exit 1
            fi
            
            echo ""
            
            # Step 2: Install certificates
            if install_umbrella_certificates "auto"; then
                echo "✅ Certificate installation successful"
            else
                echo "⚠️  Certificate installation had issues"
            fi
            
            echo ""
            
            # Step 3: Health check
            echo "Running post-deployment health check..."
            monitor_umbrella_health "basic"
            
            echo ""
            echo "🎉 Cisco Umbrella deployment completed!"
            echo "Next steps:"
            echo "1. Install Cisco Umbrella PKG file via JAMF or manual installation"
            echo "2. Verify client is running and connected"
            echo "3. Test DNS filtering and security features"
            ;;
        "help"|*)
            echo "$SCRIPT_NAME v$VERSION"
            echo "Enterprise Cisco Umbrella Roaming Client Management"
            echo ""
            echo "Usage: $0 <action> [options]"
            echo ""
            echo "Actions:"
            echo "  configure [profile]                         - Generate Umbrella configuration"
            echo "  install-certs [source]                      - Install Cisco certificates"
            echo "  health [type]                               - Monitor Umbrella health"
            echo "  report [type]                               - Generate deployment reports"
            echo "  set-params <fingerprint> <org_id> <user_id> - Set organization parameters"
            echo "  deploy [profile]                            - Full deployment workflow"
            echo "  help                                        - Show this help message"
            echo ""
            echo "User Profiles:"
            echo "  executive   - High security, minimal blocking"
            echo "  standard    - Balanced security and usability (default)"
            echo "  guest       - Basic security, extensive blocking"
            echo "  developer   - Medium security, minimal blocking"
            echo "  kiosk       - Maximum security, extensive blocking"
            echo ""
            echo "Certificate Sources:"
            echo "  auto        - Download from Cisco (default)"
            echo "  local       - Use certificates in $CERTS_DIR"
            echo "  <file>      - Specific certificate file"
            echo ""
            echo "Health Check Types:"
            echo "  basic       - Basic connectivity and configuration checks"
            echo "  comprehensive - Extended monitoring and diagnostics"
            echo ""
            echo "Report Types:"
            echo "  summary     - Deployment overview (default)"
            echo "  security    - Security configuration analysis"
            echo "  audit       - Audit trail and events"
            echo ""
            echo "Features:"
            echo "  • Automated Cisco Umbrella client deployment"
            echo "  • Profile-based security configuration"
            echo "  • Enterprise certificate management"
            echo "  • Real-time health monitoring and diagnostics"
            echo "  • Comprehensive audit logging and compliance"
            echo "  • Integration with MacFleet security infrastructure"
            echo "  • Advanced threat protection and DNS filtering"
            ;;
    esac
}

# Execute main function with all arguments
main "$@"

Quick Reference Commands

Initial Setup

# Set organization parameters (obtained from Cisco dashboard)
./umbrella_manager.sh set-params "your_api_fingerprint" "your_org_id" "your_user_id"

# Deploy with standard profile
./umbrella_manager.sh deploy standard

# Deploy with executive profile
./umbrella_manager.sh deploy executive

Configuration Management

# Generate configuration for different user profiles
./umbrella_manager.sh configure standard
./umbrella_manager.sh configure executive
./umbrella_manager.sh configure guest
./umbrella_manager.sh configure developer
./umbrella_manager.sh configure kiosk

Certificate Management

# Install certificates automatically
./umbrella_manager.sh install-certs auto

# Install from local directory
./umbrella_manager.sh install-certs local

# Install specific certificate file
./umbrella_manager.sh install-certs /path/to/cisco_cert.pem

Health Monitoring

# Basic health check
./umbrella_manager.sh health

# Comprehensive health check
./umbrella_manager.sh health comprehensive

Reporting Operations

# Generate summary report
./umbrella_manager.sh report

# Generate security assessment
./umbrella_manager.sh report security

# Generate audit report
./umbrella_manager.sh report audit

Integration Examples

JAMF Pro Integration

#!/bin/bash

# JAMF Pro script for Cisco Umbrella deployment
# Parameters: $4 = user_profile, $5 = api_fingerprint, $6 = api_org_id, $7 = api_user_id

USER_PROFILE="$4"
API_FINGERPRINT="$5"
API_ORG_ID="$6"
API_USER_ID="$7"

# Download Umbrella manager if not present
if [[ ! -f "/usr/local/bin/macfleet_umbrella_manager.sh" ]]; then
    curl -o "/usr/local/bin/macfleet_umbrella_manager.sh" \
         "https://scripts.macfleet.com/umbrella_manager.sh"
    chmod +x "/usr/local/bin/macfleet_umbrella_manager.sh"
fi

# Set organization parameters
/usr/local/bin/macfleet_umbrella_manager.sh set-params \
    "$API_FINGERPRINT" "$API_ORG_ID" "$API_USER_ID"

# Deploy Umbrella configuration
/usr/local/bin/macfleet_umbrella_manager.sh deploy "$USER_PROFILE"

# Report status back to JAMF
if [[ $? -eq 0 ]]; then
    echo "Cisco Umbrella deployed successfully"
    exit 0
else
    echo "Cisco Umbrella deployment failed"
    exit 1
fi

Security Monitoring Integration

#!/bin/bash

# Continuous monitoring script for Cisco Umbrella
monitor_umbrella_continuous() {
    local monitoring_interval=300  # 5 minutes
    local alert_threshold=3
    local consecutive_failures=0
    
    while true; do
        # Run health check
        if /usr/local/bin/macfleet_umbrella_manager.sh health basic &>/dev/null; then
            consecutive_failures=0
            echo "$(date): Umbrella health check passed"
        else
            consecutive_failures=$((consecutive_failures + 1))
            echo "$(date): Umbrella health check failed ($consecutive_failures)"
            
            # Alert after consecutive failures
            if [[ $consecutive_failures -ge $alert_threshold ]]; then
                send_security_alert "Cisco Umbrella service degraded" "CRITICAL"
                consecutive_failures=0
            fi
        fi
        
        sleep "$monitoring_interval"
    done
}

Advanced Security Features

Threat Intelligence Integration

# Enhanced security monitoring with threat intelligence
enhanced_threat_monitoring() {
    local threat_feeds=("malware" "phishing" "botnet" "ransomware")
    
    echo "=== Advanced Threat Monitoring ==="
    
    for feed in "${threat_feeds[@]}"; do
        local blocked_count=$(grep -c "$feed" /Library/Logs/OpenDNSRoamingClient.log 2>/dev/null || echo 0)
        echo "$feed threats blocked: $blocked_count"
        
        if [[ $blocked_count -gt 100 ]]; then
            log_security_event "HIGH_THREAT_ACTIVITY" "feed=$feed,count=$blocked_count" "WARNING"
        fi
    done
}

Policy Automation

# Automated policy updates based on security events
automated_policy_updates() {
    local threat_level="$1"
    
    case "$threat_level" in
        "high")
            # Enable maximum security
            UMBRELLA_CONFIG_PARAMS["BlockAdware"]="true"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            UMBRELLA_CONFIG_PARAMS["SafeSearch"]="true"
            generate_umbrella_config "kiosk"
            ;;
        "medium")
            # Standard security
            generate_umbrella_config "standard"
            ;;
        "low")
            # Reduced security for business needs
            generate_umbrella_config "executive"
            ;;
    esac
    
    # Restart Umbrella client to apply changes
    sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist 2>/dev/null
    sudo launchctl load /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist 2>/dev/null
}

Best Practices

  1. Secure API credentials and use environment variables for sensitive data
  2. Implement profile-based configurations for different user types
  3. Enable comprehensive logging for security monitoring and compliance
  4. Automate certificate management and renewal processes
  5. Monitor service health continuously with alerting
  6. Integrate with SIEM systems for centralized security monitoring
  7. Regular policy updates based on threat intelligence
  8. Test DNS filtering and security features after deployment

This enterprise Cisco Umbrella management system provides comprehensive security DNS protection with automated deployment, monitoring capabilities, and enterprise-grade controls for effective MacFleet security management.

Tutorial

Nuevas actualizaciones y mejoras para Macfleet.
Síguenos en X.com

Configurando un Runner de GitHub Actions en un Mac Mini (Apple Silicon)

Runner de GitHub Actions

GitHub Actions es una plataforma poderosa de CI/CD que te permite automatizar tus flujos de trabajo de desarrollo de software. Aunque GitHub ofrece runners hospedados, los runners auto-hospedados proporcionan mayor control y personalización para tu configuración de CI/CD. Este tutorial te guía a través de la configuración y conexión de un runner auto-hospedado en un Mac mini para ejecutar pipelines de macOS.

Prerrequisitos

Antes de comenzar, asegúrate de tener:

  • Un Mac mini (regístrate en Macfleet)
  • Un repositorio de GitHub con derechos de administrador
  • Un gestor de paquetes instalado (preferiblemente Homebrew)
  • Git instalado en tu sistema

Paso 1: Crear una Cuenta de Usuario Dedicada

Primero, crea una cuenta de usuario dedicada para el runner de GitHub Actions:

# Crear la cuenta de usuario 'gh-runner'
sudo dscl . -create /Users/gh-runner
sudo dscl . -create /Users/gh-runner UserShell /bin/bash
sudo dscl . -create /Users/gh-runner RealName "GitHub runner"
sudo dscl . -create /Users/gh-runner UniqueID "1001"
sudo dscl . -create /Users/gh-runner PrimaryGroupID 20
sudo dscl . -create /Users/gh-runner NFSHomeDirectory /Users/gh-runner

# Establecer la contraseña para el usuario
sudo dscl . -passwd /Users/gh-runner tu_contraseña

# Agregar 'gh-runner' al grupo 'admin'
sudo dscl . -append /Groups/admin GroupMembership gh-runner

Cambia a la nueva cuenta de usuario:

su gh-runner

Paso 2: Instalar Software Requerido

Instala Git y Rosetta 2 (si usas Apple Silicon):

# Instalar Git si no está ya instalado
brew install git

# Instalar Rosetta 2 para Macs Apple Silicon
softwareupdate --install-rosetta

Paso 3: Configurar el Runner de GitHub Actions

  1. Ve a tu repositorio de GitHub
  2. Navega a Configuración > Actions > Runners

Runner de GitHub Actions

  1. Haz clic en "New self-hosted runner" (https://github.com/<username>/<repository>/settings/actions/runners/new)
  2. Selecciona macOS como imagen del runner y ARM64 como arquitectura
  3. Sigue los comandos proporcionados para descargar y configurar el runner

Runner de GitHub Actions

Crea un archivo .env en el directorio _work del runner:

# archivo _work/.env
ImageOS=macos15
XCODE_15_DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
  1. Ejecuta el script run.sh en tu directorio del runner para completar la configuración.
  2. Verifica que el runner esté activo y escuchando trabajos en la terminal y revisa la configuración del repositorio de GitHub para la asociación del runner y el estado Idle.

Runner de GitHub Actions

Paso 4: Configurar Sudoers (Opcional)

Si tus acciones requieren privilegios de root, configura el archivo sudoers:

sudo visudo

Agrega la siguiente línea:

gh-runner ALL=(ALL) NOPASSWD: ALL

Paso 5: Usar el Runner en Flujos de Trabajo

Configura tu flujo de trabajo de GitHub Actions para usar el runner auto-hospedado:

name: Flujo de trabajo de muestra

on:
  workflow_dispatch:

jobs:
  build:
    runs-on: [self-hosted, macOS, ARM64]
    steps:
      - name: Instalar NodeJS
        run: brew install node

El runner está autenticado en tu repositorio y etiquetado con self-hosted, macOS, y ARM64. Úsalo en tus flujos de trabajo especificando estas etiquetas en el campo runs-on:

runs-on: [self-hosted, macOS, ARM64]

Mejores Prácticas

  • Mantén tu software del runner actualizado
  • Monitorea regularmente los logs del runner para problemas
  • Usa etiquetas específicas para diferentes tipos de runners
  • Implementa medidas de seguridad apropiadas
  • Considera usar múltiples runners para balanceo de carga

Solución de Problemas

Problemas comunes y soluciones:

  1. Runner no conectando:

    • Verifica conectividad de red
    • Verifica validez del token de GitHub
    • Asegúrate de permisos apropiados

  2. Fallas de construcción:

    • Verifica instalación de Xcode
    • Verifica dependencias requeridas
    • Revisa logs del flujo de trabajo

  3. Problemas de permisos:

    • Verifica permisos de usuario
    • Verifica configuración de sudoers
    • Revisa permisos del sistema de archivos

Conclusión

Ahora tienes un runner auto-hospedado de GitHub Actions configurado en tu Mac mini. Esta configuración te proporciona más control sobre tu entorno de CI/CD y te permite ejecutar flujos de trabajo específicos de macOS de manera eficiente.

Recuerda mantener regularmente tu runner y mantenerlo actualizado con los últimos parches de seguridad y versiones de software.

Aplicación Nativa

Aplicación nativa de Macfleet

Guía de Instalación de Macfleet

Macfleet es una solución poderosa de gestión de flota diseñada específicamente para entornos de Mac Mini alojados en la nube. Como proveedor de hosting en la nube de Mac Mini, puedes usar Macfleet para monitorear, gestionar y optimizar toda tu flota de instancias Mac virtualizadas.

Esta guía de instalación te llevará a través de la configuración del monitoreo de Macfleet en sistemas macOS, Windows y Linux para asegurar una supervisión integral de tu infraestructura en la nube.

🍎 macOS

  • Descarga el archivo .dmg para Mac aquí
  • Haz doble clic en el archivo .dmg descargado
  • Arrastra la aplicación Macfleet a la carpeta Aplicaciones
  • Expulsa el archivo .dmg
  • Abre Preferencias del Sistema > Seguridad y Privacidad
    • Pestaña Privacidad > Accesibilidad
    • Marca Macfleet para permitir el monitoreo
  • Inicia Macfleet desde Aplicaciones
  • El seguimiento comienza automáticamente

🪟 Windows

  • Descarga el archivo .exe para Windows aquí
  • Haz clic derecho en el archivo .exe > "Ejecutar como administrador"
  • Sigue el asistente de instalación
  • Acepta los términos y condiciones
  • Permite en Windows Defender si se solicita
  • Concede permisos de monitoreo de aplicaciones
  • Inicia Macfleet desde el Menú Inicio
  • La aplicación comienza el seguimiento automáticamente

🐧 Linux

  • Descarga el paquete .deb (Ubuntu/Debian) o .rpm (CentOS/RHEL) aquí
  • Instala usando tu gestor de paquetes
    • Ubuntu/Debian: sudo dpkg -i Macfleet-linux.deb
    • CentOS/RHEL: sudo rpm -ivh Macfleet-linux.rpm
  • Permite permisos de acceso X11 si se solicita
  • Agrega el usuario a los grupos apropiados si es necesario
  • Inicia Macfleet desde el menú de Aplicaciones
  • La aplicación comienza el seguimiento automáticamente

Nota: Después de la instalación en todos los sistemas, inicia sesión con tus credenciales de Macfleet para sincronizar datos con tu panel de control.