Tutorial

New updates and improvements to Macfleet.
Follow us on X.com

Important notice

The code examples and scripts provided in these tutorials are for educational purposes only. Macfleet is not responsible for any issues, damages, or security vulnerabilities that may arise from the use, modification, or implementation of these examples. Always review and test code in a secure environment before using it in production systems.

← All posts

Battery Charging Limit Management on macOS

Manage battery charging limits across your MacFleet devices to optimize battery health and implement enterprise power management policies. This tutorial covers installation of battery management tools, charging limit configuration, persistence settings, and comprehensive fleet-wide battery health monitoring.

Understanding Battery Charging Limits

Battery charging limits help preserve battery health by preventing overcharging, especially beneficial for devices that remain plugged in continuously:

Why Set Charging Limits?

  • Battery Longevity - Prevents degradation from constant 100% charge
  • Heat Reduction - Lower charge levels generate less heat during operation
  • Enterprise Cost Savings - Extended battery life reduces replacement costs
  • Power Management - Optimized charging for stationary workstations
  • Environmental Benefits - Longer battery life reduces electronic waste

Battery Management Tools

  • bclm - Battery Charge Limit Max (primary tool)
  • SMC - System Management Controller (hardware interface)
  • Homebrew - Package manager for macOS tools
  • Power Management - Built-in macOS power controls

Prerequisites and Installation

Install Homebrew Package Manager

#!/bin/bash

# Install Homebrew package manager
echo "đŸē Installing Homebrew package manager..."

# Check if Homebrew is already installed
if command -v brew >/dev/null 2>&1; then
    echo "ℹī¸ Homebrew is already installed"
    echo "Homebrew version: $(brew --version | head -1)"
else
    echo "Installing Homebrew..."
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Homebrew installed successfully"
    else
        echo "❌ Homebrew installation failed"
        exit 1
    fi
fi

# Verify installation and add to PATH if needed
if [[ -f /opt/homebrew/bin/brew ]]; then
    echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
    eval "$(/opt/homebrew/bin/brew shellenv)"
elif [[ -f /usr/local/bin/brew ]]; then
    echo 'eval "$(/usr/local/bin/brew shellenv)"' >> ~/.zprofile
    eval "$(/usr/local/bin/brew shellenv)"
fi

echo "Homebrew location: $(which brew)"

Install BCLM (Battery Charge Limit Max)

#!/bin/bash

# Install bclm (Battery Charge Limit Max)
echo "🔋 Installing bclm (Battery Charge Limit Max)..."

# Ensure Homebrew is available
if ! command -v brew >/dev/null 2>&1; then
    echo "❌ Homebrew not found. Please install Homebrew first."
    exit 1
fi

# Install bclm
echo "Adding zackelia/formulae tap..."
if brew tap zackelia/formulae; then
    echo "✅ Tap added successfully"
else
    echo "❌ Failed to add tap"
    exit 1
fi

echo "Installing bclm..."
if brew install bclm; then
    echo "✅ bclm installed successfully"
else
    echo "❌ bclm installation failed"
    exit 1
fi

# Verify installation
if command -v bclm >/dev/null 2>&1; then
    echo "bclm location: $(which bclm)"
    echo "Testing bclm access..."
    
    # Test read access (doesn't require sudo)
    if bclm read >/dev/null 2>&1; then
        echo "✅ bclm is working correctly"
        echo "Current charging limit: $(bclm read)%"
    else
        echo "⚠ī¸ bclm installed but may require additional permissions"
    fi
else
    echo "❌ bclm not found in PATH"
    exit 1
fi

Basic Charging Limit Management

Set Charging Limit

#!/bin/bash

# Set battery charging limit
LIMIT="$1"

if [[ -z "$LIMIT" ]]; then
    echo "❌ Usage: $0 <percentage>"
    echo "Example: $0 80"
    echo "Valid range: 50-100"
    exit 1
fi

# Validate limit range
if [[ "$LIMIT" -lt 50 || "$LIMIT" -gt 100 ]]; then
    echo "❌ Invalid limit: $LIMIT"
    echo "Charging limit must be between 50% and 100%"
    exit 1
fi

echo "🔋 Setting battery charging limit to $LIMIT%..."

# Get current limit for comparison
CURRENT_LIMIT=$(bclm read 2>/dev/null)
if [[ -n "$CURRENT_LIMIT" ]]; then
    echo "Current limit: $CURRENT_LIMIT%"
fi

# Set new charging limit
if sudo bclm write "$LIMIT"; then
    echo "✅ Charging limit set to $LIMIT%"
    
    # Verify the setting
    NEW_LIMIT=$(bclm read 2>/dev/null)
    if [[ "$NEW_LIMIT" == "$LIMIT" ]]; then
        echo "✅ Setting verified: $NEW_LIMIT%"
    else
        echo "⚠ī¸ Warning: Verification shows $NEW_LIMIT% instead of $LIMIT%"
    fi
else
    echo "❌ Failed to set charging limit"
    exit 1
fi

echo "ℹī¸ Note: Restart may be required for changes to take effect"

Read Current Charging Limit

#!/bin/bash

# Read current battery charging limit
echo "🔍 Reading current battery charging limit..."

if command -v bclm >/dev/null 2>&1; then
    CURRENT_LIMIT=$(bclm read 2>/dev/null)
    
    if [[ -n "$CURRENT_LIMIT" ]]; then
        echo "Current charging limit: $CURRENT_LIMIT%"
        
        # Provide context about the limit
        if [[ "$CURRENT_LIMIT" -eq 100 ]]; then
            echo "ℹī¸ Battery charges to maximum capacity (no limit set)"
        elif [[ "$CURRENT_LIMIT" -ge 80 ]]; then
            echo "ℹī¸ Conservative charging limit for battery longevity"
        elif [[ "$CURRENT_LIMIT" -ge 60 ]]; then
            echo "ℹī¸ Moderate charging limit for extended battery life"
        else
            echo "ℹī¸ Aggressive charging limit for maximum battery preservation"
        fi
    else
        echo "❌ Unable to read charging limit"
        echo "This may indicate bclm is not properly installed or lacks permissions"
        exit 1
    fi
else
    echo "❌ bclm not found. Please install bclm first."
    exit 1
fi

Make Charging Limit Persistent

#!/bin/bash

# Make charging limit persistent across reboots
echo "💾 Making charging limit persistent..."

if ! command -v bclm >/dev/null 2>&1; then
    echo "❌ bclm not found. Please install bclm first."
    exit 1
fi

# Get current limit
CURRENT_LIMIT=$(bclm read 2>/dev/null)
if [[ -z "$CURRENT_LIMIT" ]]; then
    echo "❌ Unable to read current charging limit"
    exit 1
fi

echo "Current charging limit: $CURRENT_LIMIT%"

# Make persistent
if sudo bclm persist; then
    echo "✅ Charging limit ($CURRENT_LIMIT%) is now persistent"
    echo "The limit will be maintained across system reboots"
else
    echo "❌ Failed to make charging limit persistent"
    exit 1
fi

echo "ℹī¸ To remove persistence, run: sudo bclm unpersist"

Remove Charging Limit Persistence

#!/bin/bash

# Remove charging limit persistence
echo "🔄 Removing charging limit persistence..."

if ! command -v bclm >/dev/null 2>&1; then
    echo "❌ bclm not found. Please install bclm first."
    exit 1
fi

# Get current limit before removing persistence
CURRENT_LIMIT=$(bclm read 2>/dev/null)
if [[ -n "$CURRENT_LIMIT" ]]; then
    echo "Current charging limit: $CURRENT_LIMIT%"
fi

# Remove persistence
if sudo bclm unpersist; then
    echo "✅ Charging limit persistence removed"
    echo "The limit may reset to 100% after next reboot"
else
    echo "❌ Failed to remove charging limit persistence"
    exit 1
fi

echo "ℹī¸ To restore persistence, run: sudo bclm persist"

Advanced Battery Management

Enterprise Battery Health Check

#!/bin/bash

# Comprehensive battery health assessment
echo "🔋 Performing comprehensive battery health check..."

# Check if battery is present
if ! system_profiler SPPowerDataType | grep -q "Battery Information"; then
    echo "❌ No battery found on this system"
    exit 1
fi

echo "=== Battery Health Assessment ==="

# Get battery information
BATTERY_INFO=$(system_profiler SPPowerDataType)

# Extract key metrics
CYCLE_COUNT=$(echo "$BATTERY_INFO" | grep "Cycle Count" | awk '{print $3}')
CONDITION=$(echo "$BATTERY_INFO" | grep "Condition" | awk '{print $2}')
MAX_CAPACITY=$(echo "$BATTERY_INFO" | grep "Maximum Capacity" | awk '{print $3}' | sed 's/%//')

echo "Battery Condition: $CONDITION"
echo "Cycle Count: $CYCLE_COUNT"
echo "Maximum Capacity: $MAX_CAPACITY%"

# Check charging limit if bclm is available
if command -v bclm >/dev/null 2>&1; then
    CHARGING_LIMIT=$(bclm read 2>/dev/null)
    if [[ -n "$CHARGING_LIMIT" ]]; then
        echo "Charging Limit: $CHARGING_LIMIT%"
    else
        echo "Charging Limit: Not set (100%)"
    fi
fi

# Power adapter information
POWER_ADAPTER=$(echo "$BATTERY_INFO" | grep -A5 "AC Charger Information" | grep "Wattage" | awk '{print $2}')
if [[ -n "$POWER_ADAPTER" ]]; then
    echo "Power Adapter: ${POWER_ADAPTER}W"
fi

# Health assessment
echo -e "\n=== Health Assessment ==="

if [[ "$CONDITION" == "Normal" ]]; then
    echo "✅ Battery condition is normal"
elif [[ "$CONDITION" == "Replace Soon" ]]; then
    echo "⚠ī¸ Battery should be replaced soon"
elif [[ "$CONDITION" == "Replace Now" ]]; then
    echo "❌ Battery needs immediate replacement"
else
    echo "ℹī¸ Battery condition: $CONDITION"
fi

if [[ -n "$CYCLE_COUNT" ]]; then
    if [[ "$CYCLE_COUNT" -lt 500 ]]; then
        echo "✅ Cycle count is healthy ($CYCLE_COUNT cycles)"
    elif [[ "$CYCLE_COUNT" -lt 1000 ]]; then
        echo "⚠ī¸ Moderate cycle count ($CYCLE_COUNT cycles)"
    else
        echo "❌ High cycle count ($CYCLE_COUNT cycles)"
    fi
fi

if [[ -n "$MAX_CAPACITY" ]]; then
    if [[ "$MAX_CAPACITY" -ge 90 ]]; then
        echo "✅ Maximum capacity is excellent ($MAX_CAPACITY%)"
    elif [[ "$MAX_CAPACITY" -ge 80 ]]; then
        echo "✅ Maximum capacity is good ($MAX_CAPACITY%)"
    elif [[ "$MAX_CAPACITY" -ge 70 ]]; then
        echo "⚠ī¸ Maximum capacity is declining ($MAX_CAPACITY%)"
    else
        echo "❌ Maximum capacity is poor ($MAX_CAPACITY%)"
    fi
fi

# Recommendations
echo -e "\n=== Recommendations ==="

if [[ -z "$CHARGING_LIMIT" || "$CHARGING_LIMIT" -eq 100 ]]; then
    echo "💡 Consider setting a charging limit (80-90%) for better battery health"
fi

if [[ "$CYCLE_COUNT" -gt 1000 && "$MAX_CAPACITY" -lt 80 ]]; then
    echo "💡 Battery replacement may be needed soon"
fi

Optimized Charging Limit Recommendations

#!/bin/bash

# Provide charging limit recommendations based on usage patterns
echo "đŸŽ¯ Analyzing optimal charging limit recommendations..."

# Get device model and usage information
DEVICE_MODEL=$(system_profiler SPHardwareDataType | grep "Model Name" | awk -F': ' '{print $2}')
UPTIME=$(uptime | awk '{print $3}' | sed 's/,//')

echo "Device: $DEVICE_MODEL"
echo "Current uptime: $UPTIME"

# Check if device is primarily plugged in
AC_POWER_COUNT=$(pmset -g log | grep -c "Using AC" 2>/dev/null || echo "0")
BATTERY_POWER_COUNT=$(pmset -g log | grep -c "Using Batt" 2>/dev/null || echo "0")

echo -e "\n=== Usage Pattern Analysis ==="

if [[ "$AC_POWER_COUNT" -gt "$BATTERY_POWER_COUNT" ]]; then
    USAGE_TYPE="Desktop/Stationary"
    RECOMMENDED_LIMIT=80
    echo "Usage pattern: Primarily AC powered"
    echo "Recommendation: Set charging limit to $RECOMMENDED_LIMIT%"
else
    USAGE_TYPE="Mobile/Portable"
    RECOMMENDED_LIMIT=90
    echo "Usage pattern: Frequently on battery"
    echo "Recommendation: Set charging limit to $RECOMMENDED_LIMIT%"
fi

# Get current battery health
BATTERY_CONDITION=$(system_profiler SPPowerDataType | grep "Condition" | awk '{print $2}')
MAX_CAPACITY=$(system_profiler SPPowerDataType | grep "Maximum Capacity" | awk '{print $3}' | sed 's/%//')

if [[ -n "$MAX_CAPACITY" && "$MAX_CAPACITY" -lt 85 ]]; then
    RECOMMENDED_LIMIT=75
    echo "⚠ī¸ Battery health is declining, recommended limit: $RECOMMENDED_LIMIT%"
fi

# Check current setting
if command -v bclm >/dev/null 2>&1; then
    CURRENT_LIMIT=$(bclm read 2>/dev/null)
    
    if [[ -n "$CURRENT_LIMIT" ]]; then
        echo "Current limit: $CURRENT_LIMIT%"
        
        if [[ "$CURRENT_LIMIT" -eq "$RECOMMENDED_LIMIT" ]]; then
            echo "✅ Current setting is optimal"
        else
            echo "💡 Consider adjusting to $RECOMMENDED_LIMIT% for optimal battery health"
        fi
    else
        echo "Current limit: Not set (100%)"
        echo "💡 Recommended action: Set charging limit to $RECOMMENDED_LIMIT%"
    fi
fi

echo -e "\n=== Implementation Command ==="
echo "To set recommended limit: sudo bclm write $RECOMMENDED_LIMIT"
echo "To make persistent: sudo bclm persist"

Enterprise Battery Management Script

#!/bin/bash

# MacFleet Battery Management Tool
# Comprehensive battery charging limit management for enterprise environments

# Configuration
LOG_FILE="/var/log/macfleet_battery.log"
BACKUP_DIR="/var/backups/macfleet/battery"
REPORT_DIR="/var/reports/macfleet/battery"
CONFIG_FILE="/etc/macfleet/battery_policy.conf"

# Battery policy settings
DEFAULT_CHARGING_LIMIT=80
MOBILE_DEVICE_LIMIT=90
STATIONARY_DEVICE_LIMIT=75
ENFORCE_BATTERY_POLICY=false
HEALTH_CHECK_ENABLED=true
ALERT_CAPACITY_THRESHOLD=80
ALERT_CYCLE_THRESHOLD=1000

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Setup directories
setup_directories() {
    for dir in "$BACKUP_DIR" "$REPORT_DIR" "$(dirname "$CONFIG_FILE")"; do
        if [[ ! -d "$dir" ]]; then
            sudo mkdir -p "$dir"
            log_action "Created directory: $dir"
        fi
    done
}

# Check if device has a battery
check_battery_presence() {
    if system_profiler SPPowerDataType | grep -q "Battery Information"; then
        return 0
    else
        echo "❌ No battery found on this system"
        log_action "No battery detected on device"
        return 1
    fi
}

# Install battery management tools
install_battery_tools() {
    echo "🔧 Installing battery management tools..."
    log_action "Battery tools installation started"
    
    # Check and install Homebrew
    if ! command -v brew >/dev/null 2>&1; then
        echo "Installing Homebrew..."
        /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
        
        # Add to PATH
        if [[ -f /opt/homebrew/bin/brew ]]; then
            eval "$(/opt/homebrew/bin/brew shellenv)"
        elif [[ -f /usr/local/bin/brew ]]; then
            eval "$(/usr/local/bin/brew shellenv)"
        fi
    fi
    
    # Install bclm
    if ! command -v bclm >/dev/null 2>&1; then
        echo "Installing bclm..."
        brew tap zackelia/formulae && brew install bclm
        
        if command -v bclm >/dev/null 2>&1; then
            echo "✅ bclm installed successfully"
            log_action "bclm installed successfully"
        else
            echo "❌ bclm installation failed"
            log_action "bclm installation failed"
            return 1
        fi
    else
        echo "✅ bclm already installed"
    fi
    
    return 0
}

# Generate comprehensive battery report
generate_battery_report() {
    local report_file="$REPORT_DIR/battery_report_$(date +%Y%m%d_%H%M%S).txt"
    
    echo "📊 Generating comprehensive battery report..."
    
    {
        echo "MacFleet Battery Management Report"
        echo "Generated: $(date)"
        echo "Device: $(hostname)"
        echo "================================="
        echo ""
        
        # System information
        echo "=== System Information ==="
        system_profiler SPHardwareDataType | grep -E "Model Name|Model Identifier|Processor|Memory"
        echo ""
        
        # Battery hardware information
        echo "=== Battery Hardware Information ==="
        local battery_info=$(system_profiler SPPowerDataType)
        echo "$battery_info" | grep -E "Condition|Cycle Count|Maximum Capacity|Manufacturer|Device Name|Pack Lot Code|PCB Lot Code|Firmware Version|Hardware Revision"
        echo ""
        
        # Current charging limit
        echo "=== Charging Limit Configuration ==="
        if command -v bclm >/dev/null 2>&1; then
            local current_limit=$(bclm read 2>/dev/null)
            if [[ -n "$current_limit" ]]; then
                echo "Current charging limit: $current_limit%"
                
                # Check if persistent
                local smc_value=$(sudo bclm read 2>/dev/null)
                if [[ "$smc_value" == "$current_limit" ]]; then
                    echo "Persistence status: Enabled"
                else
                    echo "Persistence status: Disabled"
                fi
            else
                echo "Current charging limit: Not set (100%)"
                echo "Persistence status: N/A"
            fi
        else
            echo "bclm status: Not installed"
        fi
        echo ""
        
        # Power usage analysis
        echo "=== Power Usage Analysis ==="
        echo "Power adapter connected: $(system_profiler SPPowerDataType | grep -q "AC Charger Information" && echo "Yes" || echo "No")"
        
        # Get power adapter info if available
        local adapter_info=$(system_profiler SPPowerDataType | grep -A3 "AC Charger Information" | grep "Wattage")
        if [[ -n "$adapter_info" ]]; then
            echo "Power adapter: $(echo "$adapter_info" | awk '{print $2}')W"
        fi
        
        # Battery temperature and voltage
        echo "Battery temperature: $(ioreg -l | grep Temperature | awk '{print $3/100}' | head -1)°C"
        echo "Battery voltage: $(ioreg -l | grep Voltage | awk '{print $3/1000}' | head -1)V"
        echo ""
        
        # Health assessment
        echo "=== Battery Health Assessment ==="
        local condition=$(echo "$battery_info" | grep "Condition" | awk '{print $2}')
        local cycle_count=$(echo "$battery_info" | grep "Cycle Count" | awk '{print $3}')
        local max_capacity=$(echo "$battery_info" | grep "Maximum Capacity" | awk '{print $3}' | sed 's/%//')
        
        echo "Overall condition: $condition"
        echo "Cycle count: $cycle_count"
        echo "Maximum capacity: $max_capacity%"
        
        # Health scoring
        local health_score=100
        
        if [[ "$condition" != "Normal" ]]; then
            health_score=$((health_score - 20))
        fi
        
        if [[ -n "$cycle_count" ]]; then
            if [[ "$cycle_count" -gt 1000 ]]; then
                health_score=$((health_score - 20))
            elif [[ "$cycle_count" -gt 500 ]]; then
                health_score=$((health_score - 10))
            fi
        fi
        
        if [[ -n "$max_capacity" ]]; then
            if [[ "$max_capacity" -lt 70 ]]; then
                health_score=$((health_score - 30))
            elif [[ "$max_capacity" -lt 80 ]]; then
                health_score=$((health_score - 20))
            elif [[ "$max_capacity" -lt 90 ]]; then
                health_score=$((health_score - 10))
            fi
        fi
        
        echo "Health score: $health_score/100"
        
        # Recommendations
        echo ""
        echo "=== Recommendations ==="
        
        if [[ "$health_score" -ge 80 ]]; then
            echo "✅ Battery health is good"
            echo "💡 Consider setting charging limit to 80% for optimal longevity"
        elif [[ "$health_score" -ge 60 ]]; then
            echo "⚠ī¸ Battery health is declining"
            echo "💡 Set charging limit to 75% and monitor closely"
        else
            echo "❌ Battery health is poor"
            echo "💡 Consider battery replacement and immediate charging limit to 70%"
        fi
        
        # Policy compliance check
        if [[ "$ENFORCE_BATTERY_POLICY" == "true" ]]; then
            echo ""
            echo "=== Policy Compliance ==="
            echo "Battery policy enforcement: ENABLED"
            echo "Default charging limit: $DEFAULT_CHARGING_LIMIT%"
            
            if [[ -n "$current_limit" ]]; then
                if [[ "$current_limit" -eq "$DEFAULT_CHARGING_LIMIT" ]]; then
                    echo "Compliance status: ✅ COMPLIANT"
                else
                    echo "Compliance status: ❌ NON-COMPLIANT"
                    echo "Current: $current_limit%, Required: $DEFAULT_CHARGING_LIMIT%"
                fi
            else
                echo "Compliance status: ❌ NON-COMPLIANT (no limit set)"
            fi
        fi
        
    } > "$report_file"
    
    echo "📊 Report saved to: $report_file"
    log_action "Battery report generated: $report_file"
}

# Set optimal charging limit based on usage pattern
set_optimal_charging_limit() {
    local force_limit="$1"
    
    echo "đŸŽ¯ Determining optimal charging limit..."
    
    if ! check_battery_presence; then
        return 1
    fi
    
    # Install tools if needed
    if ! command -v bclm >/dev/null 2>&1; then
        if ! install_battery_tools; then
            echo "❌ Failed to install required tools"
            return 1
        fi
    fi
    
    local recommended_limit="$DEFAULT_CHARGING_LIMIT"
    
    # Override with forced limit if provided
    if [[ -n "$force_limit" ]]; then
        recommended_limit="$force_limit"
        echo "Using forced limit: $recommended_limit%"
    else
        # Analyze usage pattern
        echo "Analyzing device usage pattern..."
        
        # Check if device is primarily stationary (simplified detection)
        local model=$(system_profiler SPHardwareDataType | grep "Model Name" | awk -F': ' '{print $2}')
        if echo "$model" | grep -qi "mac studio\|mac pro\|imac"; then
            recommended_limit="$STATIONARY_DEVICE_LIMIT"
            echo "Detected stationary device, recommended limit: $recommended_limit%"
        else
            recommended_limit="$MOBILE_DEVICE_LIMIT"
            echo "Detected mobile device, recommended limit: $recommended_limit%"
        fi
        
        # Adjust based on battery health
        local max_capacity=$(system_profiler SPPowerDataType | grep "Maximum Capacity" | awk '{print $3}' | sed 's/%//')
        if [[ -n "$max_capacity" && "$max_capacity" -lt 85 ]]; then
            recommended_limit=75
            echo "Adjusted for battery health: $recommended_limit%"
        fi
    fi
    
    # Set the charging limit
    echo "Setting charging limit to $recommended_limit%..."
    
    if sudo bclm write "$recommended_limit"; then
        echo "✅ Charging limit set to $recommended_limit%"
        
        # Make persistent
        if sudo bclm persist; then
            echo "✅ Charging limit made persistent"
            log_action "Charging limit set to $recommended_limit% and made persistent"
        else
            echo "⚠ī¸ Failed to make charging limit persistent"
            log_action "Charging limit set to $recommended_limit% but persistence failed"
        fi
        
        # Verify setting
        local verify_limit=$(bclm read 2>/dev/null)
        if [[ "$verify_limit" == "$recommended_limit" ]]; then
            echo "✅ Setting verified: $verify_limit%"
        else
            echo "⚠ī¸ Verification failed: expected $recommended_limit%, got $verify_limit%"
        fi
    else
        echo "❌ Failed to set charging limit"
        log_action "Failed to set charging limit to $recommended_limit%"
        return 1
    fi
}

# Monitor battery health and alert on issues
monitor_battery_health() {
    echo "🔍 Monitoring battery health..."
    
    if ! check_battery_presence; then
        return 1
    fi
    
    local battery_info=$(system_profiler SPPowerDataType)
    local condition=$(echo "$battery_info" | grep "Condition" | awk '{print $2}')
    local cycle_count=$(echo "$battery_info" | grep "Cycle Count" | awk '{print $3}')
    local max_capacity=$(echo "$battery_info" | grep "Maximum Capacity" | awk '{print $3}' | sed 's/%//')
    
    local alerts_triggered=0
    
    # Check condition
    if [[ "$condition" != "Normal" ]]; then
        echo "🚨 ALERT: Battery condition is $condition"
        log_action "ALERT: Battery condition is $condition"
        ((alerts_triggered++))
    fi
    
    # Check cycle count
    if [[ -n "$cycle_count" && "$cycle_count" -gt "$ALERT_CYCLE_THRESHOLD" ]]; then
        echo "🚨 ALERT: High cycle count - $cycle_count cycles"
        log_action "ALERT: High cycle count - $cycle_count cycles"
        ((alerts_triggered++))
    fi
    
    # Check capacity
    if [[ -n "$max_capacity" && "$max_capacity" -lt "$ALERT_CAPACITY_THRESHOLD" ]]; then
        echo "🚨 ALERT: Low maximum capacity - $max_capacity%"
        log_action "ALERT: Low maximum capacity - $max_capacity%"
        ((alerts_triggered++))
    fi
    
    if [[ "$alerts_triggered" -eq 0 ]]; then
        echo "✅ No battery health alerts"
        log_action "Battery health monitoring: No alerts"
    else
        echo "⚠ī¸ $alerts_triggered battery health alert(s) triggered"
        log_action "Battery health monitoring: $alerts_triggered alerts triggered"
    fi
    
    return $alerts_triggered
}

# Main execution function
main() {
    local action="${1:-help}"
    local target="${2:-}"
    
    log_action "=== MacFleet Battery Management Started ==="
    
    setup_directories
    
    case "$action" in
        "install"|"setup")
            install_battery_tools
            ;;
        "report"|"status")
            generate_battery_report
            ;;
        "set")
            if [[ -n "$target" ]]; then
                set_optimal_charging_limit "$target"
            else
                set_optimal_charging_limit
            fi
            ;;
        "read"|"current")
            if command -v bclm >/dev/null 2>&1; then
                local current=$(bclm read 2>/dev/null)
                if [[ -n "$current" ]]; then
                    echo "Current charging limit: $current%"
                else
                    echo "No charging limit set (100%)"
                fi
            else
                echo "❌ bclm not installed"
            fi
            ;;
        "persist")
            if command -v bclm >/dev/null 2>&1; then
                if sudo bclm persist; then
                    echo "✅ Charging limit made persistent"
                else
                    echo "❌ Failed to make charging limit persistent"
                fi
            else
                echo "❌ bclm not installed"
            fi
            ;;
        "unpersist")
            if command -v bclm >/dev/null 2>&1; then
                if sudo bclm unpersist; then
                    echo "✅ Charging limit persistence removed"
                else
                    echo "❌ Failed to remove charging limit persistence"
                fi
            else
                echo "❌ bclm not installed"
            fi
            ;;
        "monitor")
            monitor_battery_health
            ;;
        "health")
            if check_battery_presence; then
                local battery_info=$(system_profiler SPPowerDataType)
                echo "=== Battery Health Summary ==="
                echo "$battery_info" | grep -E "Condition|Cycle Count|Maximum Capacity"
                
                if command -v bclm >/dev/null 2>&1; then
                    local limit=$(bclm read 2>/dev/null)
                    echo "Charging Limit: ${limit:-100}%"
                fi
            fi
            ;;
        "help"|*)
            echo "MacFleet Battery Management Tool"
            echo "Usage: $0 [action] [options]"
            echo ""
            echo "Actions:"
            echo "  install               - Install battery management tools (Homebrew, bclm)"
            echo "  report                - Generate comprehensive battery report"
            echo "  set [limit]           - Set optimal charging limit (or specify percentage)"
            echo "  read                  - Read current charging limit"
            echo "  persist               - Make charging limit persistent"
            echo "  unpersist             - Remove charging limit persistence"
            echo "  monitor               - Monitor battery health and trigger alerts"
            echo "  health                - Show battery health summary"
            echo "  help                  - Show this help message"
            echo ""
            echo "Examples:"
            echo "  $0 install             # Install required tools"
            echo "  $0 set 80              # Set 80% charging limit"
            echo "  $0 set                 # Set optimal limit based on device type"
            echo "  $0 report              # Generate detailed report"
            echo ""
            echo "Charging Limit Guidelines:"
            echo "  50-100%     - Valid range"
            echo "  80%         - Recommended for most devices"
            echo "  75%         - For stationary/desktop Macs"
            echo "  90%         - For mobile/laptop Macs"
            ;;
    esac
    
    log_action "=== MacFleet Battery Management Completed ==="
}

# Execute main function
main "$@"

Battery Health Monitoring

Automated Health Checks

# Schedule daily battery health monitoring
create_health_monitoring_schedule() {
    local plist_file="$HOME/Library/LaunchAgents/com.macfleet.battery-monitor.plist"
    
    cat > "$plist_file" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.macfleet.battery-monitor</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>$(realpath "$0")</string>
        <string>monitor</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>9</integer>
        <key>Minute</key>
        <integer>0</integer>
    </dict>
    <key>RunAtLoad</key>
    <false/>
</dict>
</plist>
EOF
    
    launchctl load "$plist_file" 2>/dev/null
    echo "✅ Daily battery monitoring scheduled"
}

Charging Limit Recommendations

Device TypeRecommended LimitReasoning
Desktop Macs75-80%Always plugged in, prioritize longevity
Laptop Macs (Stationary)80%Mostly plugged in usage
Laptop Macs (Mobile)90%Need higher capacity for portability
Degraded Battery70-75%Extend remaining battery life

Important Notes

  • Supported Devices - Only works on Mac devices with batteries
  • Administrative Privileges - Requires sudo access for SMC modifications
  • System Compatibility - Compatible with modern macOS versions
  • Restart Requirements - Some changes may require system restart
  • Fleet Deployment - Test on individual devices before bulk deployment
  • Battery Health - Monitor battery condition regularly for optimal results

Tutorial

New updates and improvements to Macfleet.
Follow us on X.com

Wi-Fi Network Management on macOS

Deploy and manage comprehensive Wi-Fi network configurations across your MacFleet devices. This tutorial covers network policy management, security configurations, proxy settings, DNS management, and enterprise-grade network deployment strategies.

Understanding macOS Network Management

macOS provides powerful command-line tools for network management:

  • networksetup - Primary tool for network configuration
  • airport - Advanced Wi-Fi scanning and management
  • scutil - System configuration utility for network settings
  • Network profiles - Enterprise policy-based network management

Basic Wi-Fi Operations

Enable/Disable Wi-Fi Interface

#!/bin/bash

# Enable Wi-Fi interface
enable_wifi() {
    echo "Enabling Wi-Fi interface..."
    networksetup -setairportpower en0 on
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi interface enabled successfully"
        return 0
    else
        echo "❌ Failed to enable Wi-Fi interface"
        return 1
    fi
}

# Disable Wi-Fi interface
disable_wifi() {
    echo "⚠ī¸  Disabling Wi-Fi interface..."
    echo "Ensure device has alternative connectivity (Ethernet, etc.)"
    
    networksetup -setairportpower en0 off
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi interface disabled successfully"
        return 0
    else
        echo "❌ Failed to disable Wi-Fi interface"
        return 1
    fi
}

# Usage
enable_wifi
# disable_wifi

Turn Wi-Fi Service On/Off

#!/bin/bash

# Turn Wi-Fi service on (user can still control from menu bar)
turn_wifi_on() {
    echo "Turning Wi-Fi service on..."
    networksetup -setnetworkserviceenabled Wi-Fi on
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi service turned on"
        return 0
    else
        echo "❌ Failed to turn Wi-Fi service on"
        return 1
    fi
}

# Turn Wi-Fi service off (user can still control from menu bar)
turn_wifi_off() {
    echo "Turning Wi-Fi service off..."
    networksetup -setnetworkserviceenabled Wi-Fi off
    
    if [[ $? -eq 0 ]]; then
        echo "✅ Wi-Fi service turned off"
        return 0
    else
        echo "❌ Failed to turn Wi-Fi service off"
        return 1
    fi
}

# Check Wi-Fi service status
check_wifi_service() {
    echo "Checking Wi-Fi service status..."
    local status
    status=$(networksetup -getnetworkserviceenabled Wi-Fi)
    
    echo "Wi-Fi service status: $status"
    return 0
}

# Usage
check_wifi_service
turn_wifi_on

Wi-Fi Network Information

Get Current Network Information

#!/bin/bash

# Get current Wi-Fi network SSID
get_current_network() {
    echo "=== Current Wi-Fi Network ==="
    local network_info
    network_info=$(networksetup -getairportnetwork en0)
    
    if [[ "$network_info" == *"not associated"* ]]; then
        echo "❌ Not connected to any Wi-Fi network"
        return 1
    else
        echo "đŸ“ļ $network_info"
        return 0
    fi
}

# Get comprehensive Wi-Fi information
get_wifi_info() {
    echo "=== Wi-Fi Network Information ==="
    networksetup -getinfo Wi-Fi
    
    echo -e "\n=== Wi-Fi Interface Details ==="
    ifconfig en0 | grep -E "(inet |ether |status)"
    
    echo -e "\n=== Wi-Fi Quality ==="
    /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I
}

# Get available networks
scan_networks() {
    echo "=== Available Wi-Fi Networks ==="
    /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s
}

# Usage
get_current_network
echo ""
get_wifi_info
echo ""
scan_networks

Advanced Network Diagnostics

#!/bin/bash

# Comprehensive network diagnostics
network_diagnostics() {
    echo "=== MacFleet Network Diagnostics ==="
    echo "Timestamp: $(date)"
    echo "Hostname: $(hostname)"
    echo "======================================="
    
    # Wi-Fi interface status
    echo -e "\n🔍 Wi-Fi Interface Status:"
    local wifi_power
    wifi_power=$(networksetup -getairportpower en0)
    echo "Power: $wifi_power"
    
    local wifi_service
    wifi_service=$(networksetup -getnetworkserviceenabled Wi-Fi)
    echo "Service: $wifi_service"
    
    # Current connection
    echo -e "\nđŸ“ļ Current Connection:"
    networksetup -getairportnetwork en0
    
    # Network configuration
    echo -e "\n⚙ī¸  Network Configuration:"
    networksetup -getinfo Wi-Fi
    
    # DNS settings
    echo -e "\n🌐 DNS Settings:"
    networksetup -getdnsservers Wi-Fi
    
    # Proxy settings
    echo -e "\n🔒 Proxy Settings:"
    networksetup -getwebproxy Wi-Fi
    networksetup -getsecurewebproxy Wi-Fi
    networksetup -getautoproxyurl Wi-Fi
    
    # Signal quality
    echo -e "\n📊 Signal Quality:"
    /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | grep -E "(SSID|BSSID|RSSI|noise|CC|channel)"
    
    # Connectivity test
    echo -e "\n🌍 Connectivity Test:"
    if ping -c 3 8.8.8.8 >/dev/null 2>&1; then
        echo "✅ Internet connectivity: Available"
    else
        echo "❌ Internet connectivity: Failed"
    fi
    
    if ping -c 3 apple.com >/dev/null 2>&1; then
        echo "✅ DNS resolution: Working"
    else
        echo "❌ DNS resolution: Failed"
    fi
}

# Generate network report
generate_network_report() {
    local report_file="/tmp/network_report_$(date +%Y%m%d_%H%M%S).txt"
    
    echo "Generating network report: $report_file"
    network_diagnostics > "$report_file"
    
    echo "📄 Network report saved: $report_file"
    return 0
}

# Usage
network_diagnostics

Enterprise Wi-Fi Management System

#!/bin/bash

# MacFleet Enterprise Wi-Fi Management System
# Centralized Wi-Fi configuration and policy management for fleet devices

# Configuration
LOG_FILE="/var/log/macfleet_wifi.log"
CONFIG_DIR="/etc/macfleet/wifi"
PROFILES_DIR="$CONFIG_DIR/profiles"
POLICIES_DIR="$CONFIG_DIR/policies"
BACKUP_DIR="/var/backups/network_configs"

# Network profile templates
declare -A NETWORK_PROFILES=(
    ["corporate"]="security=WPA2Enterprise,proxy=auto,dns=corporate"
    ["guest"]="security=WPA2Personal,proxy=none,dns=public"
    ["secure"]="security=WPA2Enterprise,proxy=mandatory,dns=secure"
    ["development"]="security=WPA2Personal,proxy=bypass,dns=dev"
    ["public"]="security=none,proxy=auto,dns=public"
)

# DNS server configurations
declare -A DNS_CONFIGS=(
    ["corporate"]="10.0.1.1 10.0.1.2"
    ["public"]="8.8.8.8 8.8.4.4"
    ["secure"]="1.1.1.1 1.0.0.1"
    ["dev"]="192.168.1.1 8.8.8.8"
)

# Proxy configurations
declare -A PROXY_CONFIGS=(
    ["corporate_web"]="proxy.company.com:8080:authenticated"
    ["corporate_auto"]="http://proxy.company.com/proxy.pac"
    ["guest_web"]="guest-proxy.company.com:3128:none"
)

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Setup directories
setup_directories() {
    for dir in "$CONFIG_DIR" "$PROFILES_DIR" "$POLICIES_DIR" "$BACKUP_DIR"; do
        if [[ ! -d "$dir" ]]; then
            mkdir -p "$dir"
            log_action "Created directory: $dir"
        fi
    done
}

# Backup current network configuration
backup_network_config() {
    local backup_timestamp
    backup_timestamp=$(date '+%Y%m%d_%H%M%S')
    local backup_file="$BACKUP_DIR/network_config_$backup_timestamp.tar.gz"
    
    log_action "Creating network configuration backup: $backup_file"
    
    # Create temporary backup directory
    local temp_backup="/tmp/network_backup_$$"
    mkdir -p "$temp_backup"
    
    # Export current settings
    {
        echo "# Wi-Fi Service Status"
        networksetup -getnetworkserviceenabled Wi-Fi
        
        echo -e "\n# Wi-Fi Power Status"
        networksetup -getairportpower en0
        
        echo -e "\n# Current Network"
        networksetup -getairportnetwork en0
        
        echo -e "\n# Network Info"
        networksetup -getinfo Wi-Fi
        
        echo -e "\n# DNS Servers"
        networksetup -getdnsservers Wi-Fi
        
        echo -e "\n# Search Domains"
        networksetup -getsearchdomains Wi-Fi
        
        echo -e "\n# Web Proxy"
        networksetup -getwebproxy Wi-Fi
        
        echo -e "\n# Secure Web Proxy"
        networksetup -getsecurewebproxy Wi-Fi
        
        echo -e "\n# Auto Proxy"
        networksetup -getautoproxyurl Wi-Fi
        
        echo -e "\n# Proxy Bypass Domains"
        networksetup -getproxybypassdomains Wi-Fi
        
    } > "$temp_backup/current_config.txt"
    
    # Create compressed backup
    if tar -czf "$backup_file" -C "$(dirname "$temp_backup")" "$(basename "$temp_backup")" 2>/dev/null; then
        log_action "✅ Network backup created: $backup_file"
        rm -rf "$temp_backup"
        echo "$backup_file"
        return 0
    else
        log_action "❌ Network backup failed"
        rm -rf "$temp_backup"
        return 1
    fi
}

# Configure DNS servers
configure_dns() {
    local dns_profile="$1"
    local custom_dns="$2"
    
    log_action "Configuring DNS servers: $dns_profile"
    
    local dns_servers
    if [[ -n "$custom_dns" ]]; then
        dns_servers="$custom_dns"
    else
        dns_servers="${DNS_CONFIGS[$dns_profile]}"
    fi
    
    if [[ -z "$dns_servers" ]]; then
        log_action "❌ Unknown DNS profile or empty configuration: $dns_profile"
        return 1
    fi
    
    # Set DNS servers
    if networksetup -setdnsservers Wi-Fi $dns_servers; then
        log_action "✅ DNS servers configured: $dns_servers"
        
        # Verify configuration
        local current_dns
        current_dns=$(networksetup -getdnsservers Wi-Fi)
        log_action "Current DNS servers: $current_dns"
        
        return 0
    else
        log_action "❌ Failed to configure DNS servers"
        return 1
    fi
}

# Configure search domains
configure_search_domains() {
    local domains="$*"
    
    if [[ -z "$domains" ]]; then
        log_action "Clearing search domains"
        networksetup -setsearchdomains Wi-Fi "Empty"
    else
        log_action "Setting search domains: $domains"
        networksetup -setsearchdomains Wi-Fi $domains
    fi
    
    if [[ $? -eq 0 ]]; then
        log_action "✅ Search domains configured successfully"
        return 0
    else
        log_action "❌ Failed to configure search domains"
        return 1
    fi
}

# Configure web proxy
configure_web_proxy() {
    local proxy_type="$1"
    local proxy_config="$2"
    
    log_action "Configuring web proxy: $proxy_type"
    
    case "$proxy_type" in
        "none")
            # Disable all proxies
            networksetup -setwebproxystate Wi-Fi off
            networksetup -setsecurewebproxystate Wi-Fi off
            networksetup -setautoproxystate Wi-Fi off
            log_action "✅ All proxies disabled"
            ;;
        "web")
            local proxy_server proxy_port auth_required username password
            IFS=':' read -ra PROXY_PARTS <<< "$proxy_config"
            proxy_server="${PROXY_PARTS[0]}"
            proxy_port="${PROXY_PARTS[1]}"
            auth_required="${PROXY_PARTS[2]}"
            username="${PROXY_PARTS[3]:-}"
            password="${PROXY_PARTS[4]:-}"
            
            if [[ "$auth_required" == "authenticated" && -n "$username" && -n "$password" ]]; then
                networksetup -setwebproxy Wi-Fi "$proxy_server" "$proxy_port" on "$username" "$password"
            else
                networksetup -setwebproxy Wi-Fi "$proxy_server" "$proxy_port" off
            fi
            
            networksetup -setwebproxystate Wi-Fi on
            log_action "✅ Web proxy configured: $proxy_server:$proxy_port"
            ;;
        "auto")
            networksetup -setautoproxyurl Wi-Fi "$proxy_config"
            networksetup -setautoproxystate Wi-Fi on
            log_action "✅ Automatic proxy configured: $proxy_config"
            ;;
        *)
            log_action "❌ Unknown proxy type: $proxy_type"
            return 1
            ;;
    esac
    
    return 0
}

# Configure proxy bypass domains
configure_proxy_bypass() {
    local domains="$*"
    
    log_action "Configuring proxy bypass domains: $domains"
    
    if [[ -n "$domains" ]]; then
        networksetup -setproxybypassdomains Wi-Fi $domains
    else
        networksetup -setproxybypassdomains Wi-Fi "Empty"
    fi
    
    if [[ $? -eq 0 ]]; then
        log_action "✅ Proxy bypass domains configured"
        return 0
    else
        log_action "❌ Failed to configure proxy bypass domains"
        return 1
    fi
}

# Deploy network profile
deploy_network_profile() {
    local profile_name="$1"
    local custom_settings="$2"
    
    log_action "Deploying network profile: $profile_name"
    
    # Get profile configuration
    local profile_config="${NETWORK_PROFILES[$profile_name]}"
    if [[ -z "$profile_config" ]]; then
        log_action "❌ Unknown network profile: $profile_name"
        return 1
    fi
    
    # Backup current configuration
    local backup_file
    backup_file=$(backup_network_config)
    
    # Parse profile settings
    local dns_setting proxy_setting security_setting
    IFS=',' read -ra SETTINGS <<< "$profile_config"
    
    for setting in "${SETTINGS[@]}"; do
        IFS='=' read -ra SETTING_PAIR <<< "$setting"
        local key="${SETTING_PAIR[0]}"
        local value="${SETTING_PAIR[1]}"
        
        case "$key" in
            "dns")
                configure_dns "$value"
                ;;
            "proxy")
                case "$value" in
                    "auto")
                        configure_web_proxy "auto" "${PROXY_CONFIGS[corporate_auto]}"
                        ;;
                    "mandatory")
                        configure_web_proxy "web" "${PROXY_CONFIGS[corporate_web]}"
                        ;;
                    "none")
                        configure_web_proxy "none"
                        ;;
                    "bypass")
                        configure_web_proxy "none"
                        configure_proxy_bypass "*.local *.company.com localhost"
                        ;;
                esac
                ;;
            "security")
                log_action "Security setting: $value (requires manual Wi-Fi connection)"
                ;;
        esac
    done
    
    # Apply custom settings if provided
    if [[ -n "$custom_settings" ]]; then
        log_action "Applying custom settings: $custom_settings"
        # Parse and apply custom settings here
    fi
    
    # Generate deployment report
    generate_profile_report "$profile_name" "$backup_file"
    
    log_action "✅ Network profile deployed: $profile_name"
    return 0
}

# Generate profile deployment report
generate_profile_report() {
    local profile_name="$1"
    local backup_file="$2"
    local report_file="$CONFIG_DIR/profile_report_$(date '+%Y%m%d_%H%M%S').json"
    
    log_action "Generating profile deployment report: $report_file"
    
    cat > "$report_file" << EOF
{
    "deployment_metadata": {
        "timestamp": "$(date -Iseconds)",
        "profile_name": "$profile_name",
        "hostname": "$(hostname)",
        "backup_file": "$backup_file",
        "generator": "MacFleet Wi-Fi Manager"
    },
    "network_configuration": {
        "wifi_service_enabled": "$(networksetup -getnetworkserviceenabled Wi-Fi)",
        "wifi_power_status": "$(networksetup -getairportpower en0)",
        "current_network": "$(networksetup -getairportnetwork en0)",
        "dns_servers": "$(networksetup -getdnsservers Wi-Fi | tr '\n' ' ')",
        "search_domains": "$(networksetup -getsearchdomains Wi-Fi | tr '\n' ' ')",
        "web_proxy_state": "$(networksetup -getwebproxystate Wi-Fi)",
        "auto_proxy_state": "$(networksetup -getautoproxystate Wi-Fi)"
    },
    "system_info": {
        "os_version": "$(sw_vers -productVersion)",
        "build_version": "$(sw_vers -buildVersion)",
        "serial_number": "$(system_profiler SPHardwareDataType | grep 'Serial Number' | awk '{print $4}')",
        "wifi_hardware": "$(system_profiler SPAirPortDataType | grep 'Card Type' | awk -F': ' '{print $2}')"
    }
}
EOF

    log_action "✅ Profile deployment report generated: $report_file"
    echo "$report_file"
}

# Monitor network connectivity
monitor_connectivity() {
    local test_hosts=("8.8.8.8" "apple.com" "github.com")
    local connectivity_report="$CONFIG_DIR/connectivity_$(date '+%Y%m%d_%H%M%S').json"
    
    log_action "Starting connectivity monitoring"
    
    cat > "$connectivity_report" << EOF
{
    "monitoring_timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "connectivity_tests": [
EOF

    local first=true
    for host in "${test_hosts[@]}"; do
        if [[ "$first" == true ]]; then
            first=false
        else
            echo "," >> "$connectivity_report"
        fi
        
        local start_time end_time duration result
        start_time=$(date +%s.%N)
        
        if ping -c 3 -W 5000 "$host" >/dev/null 2>&1; then
            result="success"
        else
            result="failed"
        fi
        
        end_time=$(date +%s.%N)
        duration=$(awk "BEGIN {printf \"%.3f\", $end_time - $start_time}")
        
        cat >> "$connectivity_report" << EOF
        {
            "host": "$host",
            "result": "$result",
            "duration_seconds": $duration,
            "timestamp": "$(date -Iseconds)"
        }
EOF
        
        log_action "Connectivity test: $host - $result ($duration seconds)"
    done
    
    cat >> "$connectivity_report" << EOF
    ],
    "network_status": {
        "current_ssid": "$(networksetup -getairportnetwork en0 | cut -d' ' -f4- || echo 'Not connected')",
        "signal_strength": "$(airport -I | grep ' RSSI:' | awk '{print $2}' || echo 'N/A')",
        "ip_address": "$(ifconfig en0 | grep 'inet ' | awk '{print $2}' || echo 'N/A')"
    }
}
EOF

    log_action "✅ Connectivity monitoring completed: $connectivity_report"
    echo "$connectivity_report"
}

# Wi-Fi security scan
security_scan() {
    local scan_report="$CONFIG_DIR/security_scan_$(date '+%Y%m%d_%H%M%S').json"
    
    log_action "Starting Wi-Fi security scan"
    
    # Scan for available networks
    local available_networks
    available_networks=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s)
    
    cat > "$scan_report" << EOF
{
    "scan_timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "security_analysis": {
        "open_networks": [],
        "wep_networks": [],
        "wpa_networks": [],
        "enterprise_networks": []
    },
    "network_details": [
EOF

    # Parse networks and categorize by security
    echo "$available_networks" | tail -n +2 | while IFS= read -r line; do
        local ssid security
        ssid=$(echo "$line" | awk '{print $1}')
        security=$(echo "$line" | awk '{for(i=7;i<=NF;i++) printf "%s ", $i; print ""}' | sed 's/[[:space:]]*$//')
        
        if [[ -n "$ssid" && "$ssid" != "SSID" ]]; then
            echo "Found network: $ssid - Security: $security" >&2
        fi
    done
    
    cat >> "$scan_report" << EOF
    ]
}
EOF

    log_action "✅ Wi-Fi security scan completed: $scan_report"
    echo "$scan_report"
}

# Reset network configuration
reset_network_config() {
    local reset_type="${1:-partial}"
    
    log_action "Resetting network configuration: $reset_type"
    
    # Backup before reset
    backup_network_config
    
    case "$reset_type" in
        "dns")
            log_action "Resetting DNS configuration"
            networksetup -setdnsservers Wi-Fi "Empty"
            networksetup -setsearchdomains Wi-Fi "Empty"
            ;;
        "proxy")
            log_action "Resetting proxy configuration"
            networksetup -setwebproxystate Wi-Fi off
            networksetup -setsecurewebproxystate Wi-Fi off
            networksetup -setautoproxystate Wi-Fi off
            networksetup -setproxybypassdomains Wi-Fi "Empty"
            ;;
        "full")
            log_action "Performing full network reset"
            # Reset all network settings
            networksetup -setdnsservers Wi-Fi "Empty"
            networksetup -setsearchdomains Wi-Fi "Empty"
            networksetup -setwebproxystate Wi-Fi off
            networksetup -setsecurewebproxystate Wi-Fi off
            networksetup -setautoproxystate Wi-Fi off
            networksetup -setproxybypassdomains Wi-Fi "Empty"
            
            # Reset Wi-Fi interface
            networksetup -setairportpower en0 off
            sleep 2
            networksetup -setairportpower en0 on
            ;;
        *)
            log_action "Resetting DNS and proxy settings"
            networksetup -setdnsservers Wi-Fi "Empty"
            networksetup -setwebproxystate Wi-Fi off
            ;;
    esac
    
    log_action "✅ Network configuration reset completed"
    return 0
}

# Main execution function
main() {
    local action="${1:-status}"
    local profile_name="$2"
    local additional_param="$3"
    
    log_action "=== MacFleet Wi-Fi Management Started ==="
    log_action "Action: $action"
    log_action "Profile: ${profile_name:-N/A}"
    
    # Setup
    setup_directories
    
    case "$action" in
        "deploy")
            if [[ -z "$profile_name" ]]; then
                echo "Available network profiles:"
                for profile in "${!NETWORK_PROFILES[@]}"; do
                    echo "  - $profile: ${NETWORK_PROFILES[$profile]}"
                done
                echo ""
                echo "Usage: $0 deploy <profile_name> [custom_settings]"
                exit 1
            fi
            deploy_network_profile "$profile_name" "$additional_param"
            ;;
        "status")
            network_diagnostics
            ;;
        "scan")
            security_scan
            ;;
        "monitor")
            monitor_connectivity
            ;;
        "dns")
            if [[ -z "$profile_name" ]]; then
                echo "Available DNS profiles: ${!DNS_CONFIGS[*]}"
                echo "Usage: $0 dns <profile_name|custom_servers>"
                exit 1
            fi
            configure_dns "$profile_name" "$additional_param"
            ;;
        "proxy")
            if [[ -z "$profile_name" ]]; then
                echo "Usage: $0 proxy <none|web|auto> [config]"
                exit 1
            fi
            configure_web_proxy "$profile_name" "$additional_param"
            ;;
        "reset")
            reset_network_config "$profile_name"
            ;;
        "backup")
            backup_network_config
            ;;
        *)
            echo "Usage: $0 {deploy|status|scan|monitor|dns|proxy|reset|backup}"
            echo "  deploy  - Deploy network profile"
            echo "  status  - Show network status and diagnostics"
            echo "  scan    - Perform Wi-Fi security scan"
            echo "  monitor - Monitor network connectivity"
            echo "  dns     - Configure DNS servers"
            echo "  proxy   - Configure proxy settings"
            echo "  reset   - Reset network configuration"
            echo "  backup  - Backup current network configuration"
            exit 1
            ;;
    esac
    
    log_action "=== Wi-Fi management completed ==="
}

# Execute main function
main "$@"

Advanced Network Configuration

Enterprise Wi-Fi Profile Management

#!/bin/bash

# Create custom network profile
create_network_profile() {
    local profile_name="$1"
    local ssid="$2"
    local security_type="$3"
    local proxy_config="$4"
    local dns_config="$5"
    
    local profile_file="$PROFILES_DIR/${profile_name}.json"
    
    cat > "$profile_file" << EOF
{
    "profile_name": "$profile_name",
    "created_date": "$(date -Iseconds)",
    "wifi_settings": {
        "ssid": "$ssid",
        "security_type": "$security_type",
        "auto_connect": true,
        "priority": 100
    },
    "proxy_settings": {
        "type": "$proxy_config",
        "auto_config_url": "",
        "manual_config": {
            "server": "",
            "port": "",
            "requires_auth": false
        },
        "bypass_domains": ["*.local", "localhost"]
    },
    "dns_settings": {
        "servers": "$dns_config",
        "search_domains": ["company.com", "local"]
    },
    "security_policies": {
        "require_certificate": false,
        "allow_untrusted": false,
        "minimum_security": "WPA2"
    }
}
EOF

    echo "Network profile created: $profile_file"
}

Automated Network Switching

#!/bin/bash

# Smart network switching based on location/SSID priority
smart_network_switching() {
    local priority_networks=("Corporate-WiFi" "Corporate-Guest" "Office-5G")
    local current_network
    current_network=$(networksetup -getairportnetwork en0 | cut -d' ' -f4-)
    
    echo "Current network: $current_network"
    echo "Scanning for priority networks..."
    
    # Get available networks
    local available_networks
    available_networks=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s | tail -n +2 | awk '{print $1}')
    
    # Check for priority networks
    for priority_ssid in "${priority_networks[@]}"; do
        if echo "$available_networks" | grep -q "$priority_ssid"; then
            if [[ "$current_network" != "$priority_ssid" ]]; then
                echo "Found higher priority network: $priority_ssid"
                echo "Would switch from: $current_network"
                # Note: Actual connection requires credentials
                return 0
            fi
        fi
    done
    
    echo "Already connected to optimal network"
}

Network Quality Monitoring

#!/bin/bash

# Monitor network quality and performance
monitor_network_quality() {
    local duration="${1:-60}"  # monitoring duration in seconds
    local interval="${2:-5}"   # check interval in seconds
    
    echo "=== Network Quality Monitoring ==="
    echo "Duration: ${duration}s, Interval: ${interval}s"
    
    local start_time end_time
    start_time=$(date +%s)
    end_time=$((start_time + duration))
    
    while [[ $(date +%s) -lt $end_time ]]; do
        local timestamp signal_strength link_quality tx_rate
        timestamp=$(date '+%H:%M:%S')
        
        # Get Wi-Fi metrics
        local airport_info
        airport_info=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I)
        
        signal_strength=$(echo "$airport_info" | grep 'RSSI:' | awk '{print $2}')
        link_quality=$(echo "$airport_info" | grep 'link auth:' | awk '{print $3}')
        tx_rate=$(echo "$airport_info" | grep 'lastTxRate:' | awk '{print $2}')
        
        # Test connectivity speed
        local ping_time
        ping_time=$(ping -c 1 8.8.8.8 2>/dev/null | grep 'time=' | awk -F'time=' '{print $2}' | awk '{print $1}')
        
        printf "%s | Signal: %sdBm | Quality: %s | Speed: %sMbps | Ping: %s\n" \
               "$timestamp" "$signal_strength" "$link_quality" "$tx_rate" "${ping_time:-timeout}"
        
        sleep "$interval"
    done
}

Security and Compliance

Network Security Audit

#!/bin/bash

# Comprehensive network security audit
network_security_audit() {
    local audit_report="$CONFIG_DIR/security_audit_$(date '+%Y%m%d_%H%M%S').json"
    
    echo "=== Network Security Audit ==="
    log_action "Starting network security audit"
    
    cat > "$audit_report" << EOF
{
    "audit_timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "security_assessment": {
        "wifi_encryption": "$(networksetup -getairportnetwork en0 | grep -o 'WPA\\|WEP\\|None' || echo 'Unknown')",
        "proxy_enabled": "$(networksetup -getwebproxystate Wi-Fi)",
        "dns_servers": "$(networksetup -getdnsservers Wi-Fi | tr '\n' ',' | sed 's/,$//')",
        "firewall_status": "$(defaults read /Library/Preferences/com.apple.alf globalstate 2>/dev/null || echo 'Unknown')"
    },
    "vulnerability_checks": [
EOF

    # Check for open networks in range
    local open_networks
    open_networks=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s | grep -E 'NONE|--' | wc -l)
    
    # Check for weak DNS
    local dns_servers
    dns_servers=$(networksetup -getdnsservers Wi-Fi)
    
    # Generate security recommendations
    local recommendations=()
    
    if [[ "$open_networks" -gt 0 ]]; then
        recommendations+=("Avoid connecting to $open_networks open networks detected")
    fi
    
    if echo "$dns_servers" | grep -q "There aren't any DNS Servers"; then
        recommendations+=("Configure secure DNS servers")
    fi
    
    cat >> "$audit_report" << EOF
    ],
    "recommendations": [
EOF

    local first=true
    for rec in "${recommendations[@]}"; do
        if [[ "$first" == true ]]; then
            first=false
        else
            echo "," >> "$audit_report"
        fi
        echo "        \"$rec\"" >> "$audit_report"
    done
    
    cat >> "$audit_report" << EOF
    ]
}
EOF

    log_action "✅ Security audit completed: $audit_report"
    echo "$audit_report"
}

Compliance Policy Enforcement

#!/bin/bash

# Enforce enterprise compliance policies
enforce_compliance_policy() {
    local policy_name="$1"
    
    log_action "Enforcing compliance policy: $policy_name"
    
    case "$policy_name" in
        "corporate")
            # Corporate policy: Secure DNS, mandatory proxy, no open networks
            configure_dns "corporate"
            configure_web_proxy "web" "${PROXY_CONFIGS[corporate_web]}"
            configure_proxy_bypass "*.company.com localhost"
            ;;
        "education")
            # Education policy: Safe DNS, content filtering proxy
            configure_dns "public"
            configure_web_proxy "auto" "http://filter.school.edu/proxy.pac"
            ;;
        "healthcare")
            # Healthcare policy: HIPAA-compliant settings
            configure_dns "secure"
            configure_web_proxy "web" "secure-proxy.hospital.org:8080:authenticated"
            ;;
        "government")
            # Government policy: Maximum security
            configure_dns "secure"
            configure_web_proxy "web" "gov-proxy.agency.gov:3128:authenticated"
            configure_proxy_bypass ""  # No bypass domains
            ;;
        *)
            log_action "❌ Unknown compliance policy: $policy_name"
            return 1
            ;;
    esac
    
    log_action "✅ Compliance policy enforced: $policy_name"
    return 0
}

Network Troubleshooting

Automated Network Repair

#!/bin/bash

# Automated network troubleshooting and repair
network_repair() {
    local repair_level="${1:-basic}"
    
    log_action "Starting network repair: $repair_level"
    
    echo "=== MacFleet Network Repair ==="
    
    # Basic connectivity test
    echo "🔍 Testing basic connectivity..."
    if ping -c 3 8.8.8.8 >/dev/null 2>&1; then
        echo "✅ Internet connectivity: OK"
    else
        echo "❌ Internet connectivity: FAILED"
        
        case "$repair_level" in
            "basic")
                echo "🔧 Attempting basic repair..."
                # Cycle Wi-Fi
                networksetup -setairportpower en0 off
                sleep 3
                networksetup -setairportpower en0 on
                sleep 5
                ;;
            "advanced")
                echo "🔧 Attempting advanced repair..."
                # Full network reset
                reset_network_config "full"
                sleep 10
                ;;
            "complete")
                echo "🔧 Attempting complete repair..."
                # Reset network preferences
                sudo rm -f /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist
                sudo rm -f /Library/Preferences/SystemConfiguration/NetworkInterfaces.plist
                echo "⚠ī¸  System restart required for complete repair"
                ;;
        esac
        
        # Retest after repair
        echo "🔄 Retesting connectivity..."
        if ping -c 3 8.8.8.8 >/dev/null 2>&1; then
            echo "✅ Repair successful"
            log_action "Network repair successful: $repair_level"
        else
            echo "❌ Repair failed - escalate to manual intervention"
            log_action "Network repair failed: $repair_level"
        fi
    fi
}

Network Performance Optimization

#!/bin/bash

# Optimize network performance settings
optimize_network_performance() {
    echo "=== Network Performance Optimization ==="
    
    # Check current MTU
    local current_mtu
    current_mtu=$(networksetup -getMTU Wi-Fi | awk '{print $NF}')
    echo "Current MTU: $current_mtu"
    
    # Optimize for different scenarios
    local optimization_type="${1:-balanced}"
    
    case "$optimization_type" in
        "throughput")
            echo "🚀 Optimizing for maximum throughput..."
            networksetup -setMTU Wi-Fi 1500
            ;;
        "latency")
            echo "⚡ Optimizing for low latency..."
            networksetup -setMTU Wi-Fi 1200
            ;;
        "balanced")
            echo "⚖ī¸  Applying balanced optimization..."
            networksetup -setMTU Wi-Fi 1400
            ;;
        *)
            echo "❌ Unknown optimization type: $optimization_type"
            return 1
            ;;
    esac
    
    # Clear DNS cache
    echo "🧹 Clearing DNS cache..."
    sudo dscacheutil -flushcache
    sudo killall -HUP mDNSResponder
    
    echo "✅ Network optimization completed"
}

Best Practices

🚀 Performance Optimization

  • Monitor network quality regularly and switch to optimal networks
  • Configure appropriate MTU sizes for your network environment
  • Use local DNS caching to improve resolution speeds
  • Optimize proxy settings for your specific use case

🔐 Security Guidelines

  • Always use encrypted networks (WPA2/WPA3) in enterprise environments
  • Configure secure DNS servers to prevent DNS poisoning
  • Implement proxy policies for content filtering and security
  • Regular security audits to identify network vulnerabilities

📋 Management Best Practices

  • Profile-based configuration for different user groups and locations
  • Centralized policy enforcement across all fleet devices
  • Regular backup of network configurations before changes
  • Automated monitoring and alerting for connectivity issues

🔍 Troubleshooting Tips

  • Use network diagnostics to identify configuration issues
  • Monitor signal strength and network quality metrics
  • Test connectivity to multiple endpoints for comprehensive validation
  • Document network changes for audit trails and troubleshooting

Important Notes

  • Network changes take effect immediately but may require reconnection
  • Proxy authentication credentials should be managed securely
  • DNS changes may require cache flushing to take effect
  • Some enterprise networks require specific certificates for authentication
  • Always backup configurations before making significant changes

Wi-Fi Control on macOS

Control and manage Wi-Fi settings across your MacFleet devices using advanced command-line tools and centralized wireless policies. This tutorial covers Wi-Fi power management, connection control, security enforcement, and enterprise-grade wireless network management with comprehensive monitoring and compliance capabilities.

Understanding macOS Wi-Fi Management

macOS provides several command-line tools for Wi-Fi management:

  • networksetup - Primary tool for network configuration and control
  • airport - Low-level wireless interface management utility
  • ifconfig - Network interface configuration tool
  • System Preferences - GUI equivalent for wireless settings

Enterprise Wi-Fi control requires careful consideration of security policies, power management, and compliance requirements.

Basic Wi-Fi Control Commands

Turn Off Wi-Fi

#!/bin/bash

# Basic Wi-Fi disable command
turn_off_wifi_basic() {
    # Get the airport interface name
    local AIRPORT=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -n "$AIRPORT" ]]; then
        networksetup -setairportpower "$AIRPORT" off
        
        if [[ $? -eq 0 ]]; then
            echo "✅ Wi-Fi turned off successfully"
            return 0
        else
            echo "❌ Failed to turn off Wi-Fi"
            return 1
        fi
    else
        echo "❌ Wi-Fi interface not found"
        return 1
    fi
}

# Example usage
turn_off_wifi_basic

Turn On Wi-Fi

#!/bin/bash

# Turn on Wi-Fi with verification
turn_on_wifi() {
    local interface_name="$1"
    
    # Auto-detect interface if not provided
    if [[ -z "$interface_name" ]]; then
        interface_name=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    fi
    
    if [[ -z "$interface_name" ]]; then
        echo "❌ Wi-Fi interface not found"
        return 1
    fi
    
    echo "Turning on Wi-Fi interface: $interface_name"
    networksetup -setairportpower "$interface_name" on
    
    # Wait for interface to come up
    sleep 3
    
    # Verify Wi-Fi is enabled
    local wifi_status
    wifi_status=$(networksetup -getairportpower "$interface_name" | grep "On")
    
    if [[ -n "$wifi_status" ]]; then
        echo "✅ Wi-Fi turned on successfully"
        return 0
    else
        echo "❌ Failed to turn on Wi-Fi"
        return 1
    fi
}

# Example usage
# turn_on_wifi "en0"

Check Wi-Fi Status

#!/bin/bash

# Check current Wi-Fi status with detailed information
check_wifi_status() {
    echo "=== Wi-Fi Status Report ==="
    echo "Generated: $(date)"
    echo "=========================="
    echo ""
    
    # Get all Wi-Fi interfaces
    local wifi_interfaces
    wifi_interfaces=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interfaces" ]]; then
        echo "❌ No Wi-Fi interfaces found"
        return 1
    fi
    
    for interface in $wifi_interfaces; do
        echo "Interface: $interface"
        echo "-----------------"
        
        # Power status
        local power_status
        power_status=$(networksetup -getairportpower "$interface")
        echo "Power Status: $power_status"
        
        # Connection status
        if echo "$power_status" | grep -q "On"; then
            # Get current network
            local current_network
            current_network=$(networksetup -getairportnetwork "$interface" | cut -d' ' -f4-)
            echo "Current Network: $current_network"
            
            # Get IP address if connected
            local ip_address
            ip_address=$(ifconfig "$interface" | grep "inet " | awk '{print $2}')
            if [[ -n "$ip_address" ]]; then
                echo "IP Address: $ip_address"
            else
                echo "IP Address: Not assigned"
            fi
            
            # Signal strength (if available)
            if command -v airport >/dev/null 2>&1; then
                local signal_info
                signal_info=$(airport -I | grep "agrCtlRSSI" | awk '{print $2}')
                if [[ -n "$signal_info" ]]; then
                    echo "Signal Strength: $signal_info dBm"
                fi
            fi
        else
            echo "Wi-Fi is disabled"
        fi
        
        echo ""
    done
}

# Execute status check
check_wifi_status

Advanced Wi-Fi Management

Wi-Fi Interface Discovery

#!/bin/bash

# Discover and analyze Wi-Fi interfaces
discover_wifi_interfaces() {
    echo "=== Wi-Fi Interface Discovery ==="
    echo ""
    
    # List all network hardware
    echo "1. ALL NETWORK HARDWARE:"
    echo "------------------------"
    networksetup -listallhardwareports
    echo ""
    
    # Focus on Wi-Fi interfaces
    echo "2. WI-FI INTERFACES DETECTED:"
    echo "----------------------------"
    local wifi_count=0
    
    while IFS= read -r line; do
        if echo "$line" | grep -q "Wi-Fi"; then
            echo "Hardware Port: $line"
            # Get the next line which contains device name
            read -r device_line
            echo "Device: $device_line"
            
            # Extract device name
            local device_name
            device_name=$(echo "$device_line" | awk '{print $2}')
            
            # Get MAC address
            local mac_address
            mac_address=$(ifconfig "$device_name" 2>/dev/null | grep "ether" | awk '{print $2}')
            if [[ -n "$mac_address" ]]; then
                echo "MAC Address: $mac_address"
            fi
            
            # Get current status
            local power_status
            power_status=$(networksetup -getairportpower "$device_name" 2>/dev/null)
            echo "Power Status: $power_status"
            
            echo ""
            ((wifi_count++))
        fi
    done < <(networksetup -listallhardwareports)
    
    echo "Total Wi-Fi interfaces found: $wifi_count"
    
    if [[ $wifi_count -eq 0 ]]; then
        echo "⚠ī¸  No Wi-Fi interfaces detected"
        return 1
    fi
    
    return 0
}

# Execute interface discovery
discover_wifi_interfaces

Network Scanning and Analysis

#!/bin/bash

# Scan for available Wi-Fi networks
scan_wifi_networks() {
    local interface_name="$1"
    local scan_type="${2:-basic}"  # basic, detailed, security
    
    # Auto-detect interface if not provided
    if [[ -z "$interface_name" ]]; then
        interface_name=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    fi
    
    if [[ -z "$interface_name" ]]; then
        echo "❌ Wi-Fi interface not found"
        return 1
    fi
    
    echo "=== Wi-Fi Network Scan ==="
    echo "Interface: $interface_name"
    echo "Scan Type: $scan_type"
    echo "========================="
    echo ""
    
    # Ensure Wi-Fi is on for scanning
    local power_status
    power_status=$(networksetup -getairportpower "$interface_name")
    
    if echo "$power_status" | grep -q "Off"; then
        echo "Enabling Wi-Fi for scanning..."
        networksetup -setairportpower "$interface_name" on
        sleep 3
    fi
    
    case "$scan_type" in
        "basic")
            # Basic network list
            echo "Available Networks:"
            echo "-------------------"
            if command -v airport >/dev/null 2>&1; then
                airport -s
            else
                echo "airport command not available, using networksetup scan"
                # Note: networksetup doesn't have direct scan command, using airport utility
            fi
            ;;
        "detailed")
            # Detailed network information
            echo "Detailed Network Analysis:"
            echo "-------------------------"
            if command -v airport >/dev/null 2>&1; then
                airport -s | while IFS= read -r line; do
                    if [[ -n "$line" && ! "$line" =~ ^[[:space:]]*$ ]]; then
                        echo "Network: $line"
                        # Extract SSID and signal strength
                        local ssid signal
                        ssid=$(echo "$line" | awk '{print $1}')
                        signal=$(echo "$line" | awk '{print $3}')
                        
                        if [[ -n "$signal" ]]; then
                            if [[ "$signal" -gt -50 ]]; then
                                echo "  Signal Quality: Excellent ($signal dBm)"
                            elif [[ "$signal" -gt -70 ]]; then
                                echo "  Signal Quality: Good ($signal dBm)"
                            elif [[ "$signal" -gt -80 ]]; then
                                echo "  Signal Quality: Fair ($signal dBm)"
                            else
                                echo "  Signal Quality: Poor ($signal dBm)"
                            fi
                        fi
                        echo ""
                    fi
                done
            fi
            ;;
        "security")
            # Security analysis of networks
            echo "Security Analysis:"
            echo "-----------------"
            if command -v airport >/dev/null 2>&1; then
                airport -s | grep -E "(WPA|WEP|NONE)" | while IFS= read -r line; do
                    local ssid security
                    ssid=$(echo "$line" | awk '{print $1}')
                    security=$(echo "$line" | grep -o -E "(WPA2|WPA3|WPA|WEP|NONE)")
                    
                    case "$security" in
                        "WPA3")
                            echo "✅ $ssid: Secure (WPA3)"
                            ;;
                        "WPA2")
                            echo "✅ $ssid: Secure (WPA2)"
                            ;;
                        "WPA")
                            echo "⚠ī¸  $ssid: Moderately Secure (WPA)"
                            ;;
                        "WEP")
                            echo "❌ $ssid: Insecure (WEP - Deprecated)"
                            ;;
                        "NONE"|*)
                            echo "❌ $ssid: Open Network (No Security)"
                            ;;
                    esac
                done
            fi
            ;;
    esac
}

# Example usage
# scan_wifi_networks "en0" "detailed"

Enterprise Wi-Fi Control System

#!/bin/bash

# MacFleet Enterprise Wi-Fi Control System
# Comprehensive wireless management, security enforcement, and compliance monitoring

# Configuration
LOG_FILE="/var/log/macfleet_wifi_control.log"
CONFIG_FILE="/etc/macfleet/wifi_config.conf"
BACKUP_DIR="/var/backups/macfleet/wifi"
POLICY_DIR="/etc/macfleet/wifi_policies"

# Create directory structure
setup_directories() {
    mkdir -p "$(dirname "$LOG_FILE")" "$BACKUP_DIR" "$POLICY_DIR" "$(dirname "$CONFIG_FILE")"
    touch "$LOG_FILE"
    
    # Set appropriate permissions
    chmod 755 "$BACKUP_DIR" "$POLICY_DIR"
}

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Enterprise Wi-Fi policy enforcement
enforce_wifi_policy() {
    local policy_name="$1"
    local policy_file="$POLICY_DIR/${policy_name}.policy"
    
    if [[ ! -f "$policy_file" ]]; then
        log_action "ERROR: Wi-Fi policy not found: $policy_name"
        return 1
    fi
    
    log_action "Enforcing Wi-Fi policy: $policy_name"
    
    # Load policy configuration
    source "$policy_file"
    
    # Get Wi-Fi interface
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    # Apply policy settings
    case "${WIFI_POLICY_ACTION:-disable}" in
        "disable")
            networksetup -setairportpower "$wifi_interface" off
            log_action "Wi-Fi disabled per policy: $policy_name"
            ;;
        "enable")
            networksetup -setairportpower "$wifi_interface" on
            log_action "Wi-Fi enabled per policy: $policy_name"
            ;;
        "scheduled")
            apply_scheduled_wifi_policy "$wifi_interface" "$policy_name"
            ;;
        "conditional")
            apply_conditional_wifi_policy "$wifi_interface" "$policy_name"
            ;;
        *)
            log_action "ERROR: Unknown policy action: ${WIFI_POLICY_ACTION}"
            return 1
            ;;
    esac
    
    return 0
}

# Scheduled Wi-Fi control
apply_scheduled_wifi_policy() {
    local interface="$1"
    local policy_name="$2"
    local current_hour=$(date +%H)
    local current_day=$(date +%u)  # 1=Monday, 7=Sunday
    
    log_action "Applying scheduled Wi-Fi policy: $policy_name"
    
    # Load schedule from policy
    local enable_hours="${WIFI_ENABLE_HOURS:-09-17}"
    local enable_days="${WIFI_ENABLE_DAYS:-1-5}"
    
    # Parse time range
    local start_hour end_hour
    start_hour=$(echo "$enable_hours" | cut -d'-' -f1)
    end_hour=$(echo "$enable_hours" | cut -d'-' -f2)
    
    # Parse day range
    local start_day end_day
    start_day=$(echo "$enable_days" | cut -d'-' -f1)
    end_day=$(echo "$enable_days" | cut -d'-' -f2)
    
    # Check if current time is within allowed window
    local time_allowed=false
    local day_allowed=false
    
    if [[ "$current_hour" -ge "$start_hour" && "$current_hour" -lt "$end_hour" ]]; then
        time_allowed=true
    fi
    
    if [[ "$current_day" -ge "$start_day" && "$current_day" -le "$end_day" ]]; then
        day_allowed=true
    fi
    
    if [[ "$time_allowed" == "true" && "$day_allowed" == "true" ]]; then
        networksetup -setairportpower "$interface" on
        log_action "Wi-Fi enabled - within scheduled hours"
    else
        networksetup -setairportpower "$interface" off
        log_action "Wi-Fi disabled - outside scheduled hours"
    fi
}

# Conditional Wi-Fi control
apply_conditional_wifi_policy() {
    local interface="$1"
    local policy_name="$2"
    
    log_action "Applying conditional Wi-Fi policy: $policy_name"
    
    # Check battery level
    local battery_level
    battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
    
    # Check power source
    local power_source
    power_source=$(pmset -g ps | head -1 | grep -o "'.*'" | tr -d "'")
    
    # Check ethernet connection
    local ethernet_connected=false
    local ethernet_interfaces
    ethernet_interfaces=$(networksetup -listallhardwareports | grep -A 1 Ethernet | grep Device | awk '{print $2}')
    
    for eth_interface in $ethernet_interfaces; do
        local eth_status
        eth_status=$(ifconfig "$eth_interface" 2>/dev/null | grep "status: active")
        if [[ -n "$eth_status" ]]; then
            ethernet_connected=true
            break
        fi
    done
    
    # Apply conditional logic
    local should_enable_wifi=true
    
    # Disable Wi-Fi if ethernet is connected and policy requires it
    if [[ "$ethernet_connected" == "true" && "${DISABLE_WIFI_WITH_ETHERNET:-false}" == "true" ]]; then
        should_enable_wifi=false
        log_action "Wi-Fi disabled - Ethernet connection detected"
    fi
    
    # Disable Wi-Fi if battery is low and policy requires it
    if [[ -n "$battery_level" && "$battery_level" -lt "${MIN_BATTERY_FOR_WIFI:-20}" ]]; then
        should_enable_wifi=false
        log_action "Wi-Fi disabled - Low battery level: $battery_level%"
    fi
    
    # Enable/disable Wi-Fi based on conditions
    if [[ "$should_enable_wifi" == "true" ]]; then
        networksetup -setairportpower "$interface" on
        log_action "Wi-Fi enabled - Conditions met"
    else
        networksetup -setairportpower "$interface" off
        log_action "Wi-Fi disabled - Conditions not met"
    fi
}

# Security compliance check
check_wifi_security_compliance() {
    log_action "Performing Wi-Fi security compliance check"
    
    local compliance_issues=()
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found for compliance check"
        return 1
    fi
    
    # Check if Wi-Fi is enabled when it should be disabled
    local power_status
    power_status=$(networksetup -getairportpower "$wifi_interface")
    
    if echo "$power_status" | grep -q "On"; then
        # Wi-Fi is enabled, check current network security
        local current_network
        current_network=$(networksetup -getairportnetwork "$wifi_interface" | cut -d' ' -f4-)
        
        if [[ "$current_network" != "You are not associated with an AirPort network." ]]; then
            log_action "Connected to network: $current_network"
            
            # Check if network is in approved list
            local approved_networks_file="$POLICY_DIR/approved_networks.list"
            if [[ -f "$approved_networks_file" ]]; then
                if ! grep -q "^$current_network$" "$approved_networks_file"; then
                    compliance_issues+=("Connected to non-approved network: $current_network")
                fi
            fi
            
            # Check for open networks
            if command -v airport >/dev/null 2>&1; then
                local network_security
                network_security=$(airport -I | grep "Security")
                if echo "$network_security" | grep -q "none"; then
                    compliance_issues+=("Connected to open/unsecured network")
                fi
            fi
        fi
    fi
    
    # Check for saved insecure networks
    local network_profiles
    network_profiles=$(networksetup -listpreferredwirelessnetworks "$wifi_interface" 2>/dev/null | tail -n +2)
    
    while IFS= read -r network; do
        if [[ -n "$network" ]]; then
            # Clean network name
            network=$(echo "$network" | sed 's/^[[:space:]]*//')
            
            # Check against blacklist
            local blacklist_file="$POLICY_DIR/blacklisted_networks.list"
            if [[ -f "$blacklist_file" ]]; then
                if grep -q "^$network$" "$blacklist_file"; then
                    compliance_issues+=("Blacklisted network in saved profiles: $network")
                fi
            fi
        fi
    done <<< "$network_profiles"
    
    # Generate compliance report
    if [[ ${#compliance_issues[@]} -eq 0 ]]; then
        log_action "✅ Wi-Fi security compliance check passed"
        return 0
    else
        log_action "❌ Wi-Fi security compliance violations found:"
        for issue in "${compliance_issues[@]}"; do
            log_action "  - $issue"
        done
        return 1
    fi
}

# Network profile management
manage_wifi_profiles() {
    local action="$1"
    local network_name="$2"
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    case "$action" in
        "list")
            log_action "Listing saved Wi-Fi profiles"
            echo "=== Saved Wi-Fi Profiles ==="
            networksetup -listpreferredwirelessnetworks "$wifi_interface"
            ;;
        "remove")
            if [[ -z "$network_name" ]]; then
                log_action "ERROR: Network name required for removal"
                return 1
            fi
            
            log_action "Removing Wi-Fi profile: $network_name"
            networksetup -removepreferredwirelessnetwork "$wifi_interface" "$network_name"
            
            if [[ $? -eq 0 ]]; then
                log_action "✅ Wi-Fi profile removed: $network_name"
            else
                log_action "❌ Failed to remove Wi-Fi profile: $network_name"
                return 1
            fi
            ;;
        "removeall")
            log_action "Removing all saved Wi-Fi profiles"
            
            # Get list of networks and remove each one
            local networks
            networks=$(networksetup -listpreferredwirelessnetworks "$wifi_interface" 2>/dev/null | tail -n +2)
            
            while IFS= read -r network; do
                if [[ -n "$network" ]]; then
                    network=$(echo "$network" | sed 's/^[[:space:]]*//')
                    networksetup -removepreferredwirelessnetwork "$wifi_interface" "$network"
                    log_action "Removed profile: $network"
                fi
            done <<< "$networks"
            
            log_action "✅ All Wi-Fi profiles removed"
            ;;
        *)
            log_action "ERROR: Invalid action for profile management: $action"
            return 1
            ;;
    esac
}

# Power management optimization
optimize_wifi_power() {
    local optimization_level="${1:-balanced}"  # aggressive, balanced, conservative
    
    log_action "Applying Wi-Fi power optimization: $optimization_level"
    
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    case "$optimization_level" in
        "aggressive")
            # Maximum power savings
            log_action "Applying aggressive power optimization"
            
            # Disable Wi-Fi when ethernet is connected
            local ethernet_connected=false
            local ethernet_interfaces
            ethernet_interfaces=$(networksetup -listallhardwareports | grep -A 1 Ethernet | grep Device | awk '{print $2}')
            
            for eth_interface in $ethernet_interfaces; do
                local eth_status
                eth_status=$(ifconfig "$eth_interface" 2>/dev/null | grep "status: active")
                if [[ -n "$eth_status" ]]; then
                    ethernet_connected=true
                    break
                fi
            done
            
            if [[ "$ethernet_connected" == "true" ]]; then
                networksetup -setairportpower "$wifi_interface" off
                log_action "Wi-Fi disabled - Ethernet connection detected"
            fi
            ;;
        "balanced")
            # Moderate power savings
            log_action "Applying balanced power optimization"
            
            # Check battery level and disable if very low
            local battery_level
            battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
            
            if [[ -n "$battery_level" && "$battery_level" -lt 10 ]]; then
                networksetup -setairportpower "$wifi_interface" off
                log_action "Wi-Fi disabled - Critical battery level: $battery_level%"
            fi
            ;;
        "conservative")
            # Minimal power optimization
            log_action "Applying conservative power optimization"
            
            # Only disable in extreme circumstances
            local battery_level
            battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
            
            if [[ -n "$battery_level" && "$battery_level" -lt 5 ]]; then
                networksetup -setairportpower "$wifi_interface" off
                log_action "Wi-Fi disabled - Emergency battery level: $battery_level%"
            fi
            ;;
        *)
            log_action "ERROR: Invalid optimization level: $optimization_level"
            return 1
            ;;
    esac
    
    return 0
}

# Generate Wi-Fi management report
generate_wifi_report() {
    local report_file="$BACKUP_DIR/wifi_management_report_$(date +%Y%m%d_%H%M%S).json"
    
    log_action "Generating Wi-Fi management report: $report_file"
    
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    {
        echo "{"
        echo "  \"report_type\": \"wifi_management\","
        echo "  \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\","
        echo "  \"hostname\": \"$(hostname)\","
        echo "  \"system_info\": {"
        echo "    \"macos_version\": \"$(sw_vers -productVersion)\","
        echo "    \"user\": \"$(whoami)\""
        echo "  },"
        
        if [[ -n "$wifi_interface" ]]; then
            local power_status current_network ip_address
            power_status=$(networksetup -getairportpower "$wifi_interface" | grep -o "On\|Off")
            current_network=$(networksetup -getairportnetwork "$wifi_interface" | cut -d' ' -f4-)
            ip_address=$(ifconfig "$wifi_interface" | grep "inet " | awk '{print $2}')
            
            echo "  \"wifi_status\": {"
            echo "    \"interface\": \"$wifi_interface\","
            echo "    \"power_status\": \"$power_status\","
            echo "    \"current_network\": \"$current_network\","
            echo "    \"ip_address\": \"${ip_address:-null}\""
            echo "  },"
        else
            echo "  \"wifi_status\": {"
            echo "    \"interface\": null,"
            echo "    \"power_status\": \"unavailable\","
            echo "    \"current_network\": null,"
            echo "    \"ip_address\": null"
            echo "  },"
        fi
        
        # Battery and power information
        local battery_level power_source
        battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
        power_source=$(pmset -g ps | head -1 | grep -o "'.*'" | tr -d "'")
        
        echo "  \"power_info\": {"
        echo "    \"battery_level\": ${battery_level:-null},"
        echo "    \"power_source\": \"${power_source:-unknown}\""
        echo "  },"
        
        # Network profiles
        echo "  \"saved_profiles\": ["
        if [[ -n "$wifi_interface" ]]; then
            local first_profile=true
            networksetup -listpreferredwirelessnetworks "$wifi_interface" 2>/dev/null | tail -n +2 | while IFS= read -r network; do
                if [[ -n "$network" ]]; then
                    network=$(echo "$network" | sed 's/^[[:space:]]*//')
                    if [[ "$first_profile" == "false" ]]; then
                        echo ","
                    fi
                    first_profile=false
                    echo -n "    \"$network\""
                fi
            done
        fi
        echo ""
        echo "  ]"
        echo "}"
    } > "$report_file"
    
    log_action "Wi-Fi management report generated: $report_file"
    echo "$report_file"
}

# Main management function
main() {
    local action="${1:-status}"
    local parameter1="$2"
    local parameter2="$3"
    
    setup_directories
    log_action "MacFleet Wi-Fi Control started with action: $action"
    
    case "$action" in
        "disable"|"off")
            turn_off_wifi_basic
            ;;
        "enable"|"on")
            turn_on_wifi "$parameter1"
            ;;
        "status")
            check_wifi_status
            ;;
        "scan")
            scan_wifi_networks "$parameter1" "$parameter2"
            ;;
        "discover")
            discover_wifi_interfaces
            ;;
        "policy")
            enforce_wifi_policy "$parameter1"
            ;;
        "compliance")
            check_wifi_security_compliance
            ;;
        "profiles")
            manage_wifi_profiles "$parameter1" "$parameter2"
            ;;
        "optimize")
            optimize_wifi_power "$parameter1"
            ;;
        "report")
            generate_wifi_report
            ;;
        *)
            check_wifi_status
            ;;
    esac
    
    log_action "MacFleet Wi-Fi Control completed with action: $action"
}

# Execute main function with all arguments
main "$@"

Wi-Fi Policy Templates

Corporate Wi-Fi Policy Configuration

# /etc/macfleet/wifi_policies/corporate_standard.policy
# MacFleet Corporate Wi-Fi Policy

# Policy action: disable, enable, scheduled, conditional
WIFI_POLICY_ACTION="conditional"

# Scheduled settings (for scheduled action)
WIFI_ENABLE_HOURS="08-18"    # 8 AM to 6 PM
WIFI_ENABLE_DAYS="1-5"       # Monday to Friday

# Conditional settings
DISABLE_WIFI_WITH_ETHERNET="true"
MIN_BATTERY_FOR_WIFI="15"

# Security settings
REQUIRE_WPA2_MINIMUM="true"
BLOCK_OPEN_NETWORKS="true"
AUTO_CONNECT_CORPORATE_ONLY="true"

# Power management
POWER_OPTIMIZATION_LEVEL="balanced"
AUTO_DISABLE_IDLE="true"
IDLE_TIMEOUT_MINUTES="30"

Security-Focused Wi-Fi Policy

# /etc/macfleet/wifi_policies/high_security.policy
# MacFleet High Security Wi-Fi Policy

WIFI_POLICY_ACTION="conditional"

# Security requirements
REQUIRE_WPA3_MINIMUM="true"
BLOCK_OPEN_NETWORKS="true"
BLOCK_WEP_NETWORKS="true"
APPROVED_NETWORKS_ONLY="true"

# Conditional disabling
DISABLE_WIFI_WITH_ETHERNET="true"
DISABLE_WIFI_IN_SECURE_AREAS="true"
MIN_BATTERY_FOR_WIFI="25"

# Monitoring
ENABLE_CONNECTION_LOGGING="true"
ALERT_ON_UNAPPROVED_NETWORKS="true"
SCAN_INTERVAL_MINUTES="5"

Power Conservation Policy

# /etc/macfleet/wifi_policies/power_saver.policy
# MacFleet Power Conservation Wi-Fi Policy

WIFI_POLICY_ACTION="conditional"

# Aggressive power saving
DISABLE_WIFI_WITH_ETHERNET="true"
MIN_BATTERY_FOR_WIFI="30"
POWER_OPTIMIZATION_LEVEL="aggressive"

# Scheduled disabling for night hours
WIFI_ENABLE_HOURS="07-22"    # 7 AM to 10 PM
WIFI_ENABLE_DAYS="1-7"       # All days

# Auto-disable features
AUTO_DISABLE_IDLE="true"
IDLE_TIMEOUT_MINUTES="15"
DISABLE_BACKGROUND_SCANNING="true"

Security and Compliance Functions

Network Whitelist Management

#!/bin/bash

# Manage approved Wi-Fi networks
manage_network_whitelist() {
    local action="$1"
    local network_name="$2"
    local whitelist_file="$POLICY_DIR/approved_networks.list"
    
    case "$action" in
        "add")
            if [[ -z "$network_name" ]]; then
                echo "ERROR: Network name required"
                return 1
            fi
            
            # Add network to whitelist
            if ! grep -q "^$network_name$" "$whitelist_file" 2>/dev/null; then
                echo "$network_name" >> "$whitelist_file"
                log_action "Added network to whitelist: $network_name"
            else
                log_action "Network already in whitelist: $network_name"
            fi
            ;;
        "remove")
            if [[ -z "$network_name" ]]; then
                echo "ERROR: Network name required"
                return 1
            fi
            
            # Remove network from whitelist
            if [[ -f "$whitelist_file" ]]; then
                grep -v "^$network_name$" "$whitelist_file" > "${whitelist_file}.tmp"
                mv "${whitelist_file}.tmp" "$whitelist_file"
                log_action "Removed network from whitelist: $network_name"
            fi
            ;;
        "list")
            echo "=== Approved Networks Whitelist ==="
            if [[ -f "$whitelist_file" ]]; then
                cat "$whitelist_file"
            else
                echo "No approved networks configured"
            fi
            ;;
        "enforce")
            enforce_network_whitelist
            ;;
        *)
            echo "ERROR: Invalid whitelist action: $action"
            return 1
            ;;
    esac
}

# Enforce network whitelist
enforce_network_whitelist() {
    local wifi_interface
    wifi_interface=$(networksetup -listallhardwareports | grep -A 1 Wi-Fi | grep Device | awk '{print $2}')
    
    if [[ -z "$wifi_interface" ]]; then
        log_action "ERROR: No Wi-Fi interface found"
        return 1
    fi
    
    # Get current network
    local current_network
    current_network=$(networksetup -getairportnetwork "$wifi_interface" | cut -d' ' -f4-)
    
    if [[ "$current_network" == "You are not associated with an AirPort network." ]]; then
        log_action "No active Wi-Fi connection"
        return 0
    fi
    
    # Check if current network is approved
    local whitelist_file="$POLICY_DIR/approved_networks.list"
    if [[ -f "$whitelist_file" ]]; then
        if grep -q "^$current_network$" "$whitelist_file"; then
            log_action "✅ Connected to approved network: $current_network"
            return 0
        else
            log_action "❌ Connected to non-approved network: $current_network"
            
            # Disconnect from non-approved network
            networksetup -setairportpower "$wifi_interface" off
            sleep 2
            networksetup -setairportpower "$wifi_interface" on
            
            log_action "Disconnected from non-approved network"
            return 1
        fi
    else
        log_action "⚠ī¸  No whitelist configured - allowing all networks"
        return 0
    fi
}

# Example usage
# manage_network_whitelist "add" "CorporateWiFi"
# manage_network_whitelist "list"
# manage_network_whitelist "enforce"

Wi-Fi Audit and Monitoring

#!/bin/bash

# Comprehensive Wi-Fi audit
audit_wifi_configuration() {
    local audit_file="$BACKUP_DIR/wifi_audit_$(date +%Y%m%d_%H%M%S).txt"
    
    log_action "Performing comprehensive Wi-Fi audit: $audit_file"
    
    {
        echo "MacFleet Wi-Fi Configuration Audit"
        echo "=================================="
        echo "Generated: $(date)"
        echo "Hostname: $(hostname)"
        echo "Auditor: $(whoami)"
        echo ""
        
        # Wi-Fi interface information
        echo "WI-FI INTERFACE ANALYSIS:"
        echo "------------------------"
        discover_wifi_interfaces
        echo ""
        
        # Current connection status
        echo "CONNECTION STATUS:"
        echo "-----------------"
        check_wifi_status
        echo ""
        
        # Security compliance
        echo "SECURITY COMPLIANCE:"
        echo "-------------------"
        if check_wifi_security_compliance; then
            echo "✅ Security compliance check passed"
        else
            echo "❌ Security compliance violations detected"
        fi
        echo ""
        
        # Saved network profiles
        echo "SAVED NETWORK PROFILES:"
        echo "----------------------"
        manage_wifi_profiles "list"
        echo ""
        
        # Policy enforcement status
        echo "POLICY ENFORCEMENT:"
        echo "------------------"
        local policy_files
        policy_files=$(ls "$POLICY_DIR"/*.policy 2>/dev/null)
        
        if [[ -n "$policy_files" ]]; then
            for policy_file in $policy_files; do
                local policy_name
                policy_name=$(basename "$policy_file" .policy)
                echo "Policy: $policy_name"
                echo "  File: $policy_file"
                echo "  Status: $(if [[ -f "$policy_file" ]]; then echo "Active"; else echo "Inactive"; fi)"
            done
        else
            echo "No policies configured"
        fi
        echo ""
        
        # Power management status
        echo "POWER MANAGEMENT:"
        echo "----------------"
        local battery_level power_source
        battery_level=$(pmset -g batt | grep -o '[0-9]*%' | tr -d '%')
        power_source=$(pmset -g ps | head -1 | grep -o "'.*'" | tr -d "'")
        
        echo "Battery Level: ${battery_level:-Unknown}%"
        echo "Power Source: ${power_source:-Unknown}"
        echo ""
        
        # Recommendations
        echo "SECURITY RECOMMENDATIONS:"
        echo "------------------------"
        echo "â€ĸ Implement approved network whitelist"
        echo "â€ĸ Enable automatic disconnection from open networks"
        echo "â€ĸ Configure scheduled Wi-Fi disable during off-hours"
        echo "â€ĸ Implement battery-based power management"
        echo "â€ĸ Regular audit of saved network profiles"
        echo "â€ĸ Monitor for connections to unapproved networks"
        
    } > "$audit_file"
    
    log_action "Wi-Fi audit completed: $audit_file"
    echo "$audit_file"
}

audit_wifi_configuration

Important Technical Notes

NetworkSetup Command Reference

  • networksetup -setairportpower <device> on|off: Enable/disable Wi-Fi
  • networksetup -getairportpower <device>: Check Wi-Fi power status
  • networksetup -getairportnetwork <device>: Get current Wi-Fi network
  • networksetup -listpreferredwirelessnetworks <device>: List saved networks
  • networksetup -removepreferredwirelessnetwork <device> <network>: Remove saved network

Security Considerations

  1. Admin Privileges: Many network commands require admin access
  2. Network Isolation: Ensure proper network segmentation
  3. Profile Management: Regularly audit and clean saved network profiles
  4. Open Network Protection: Block connections to unsecured networks
  5. Compliance Monitoring: Implement continuous security compliance checking

Power Management Best Practices

  1. Battery Optimization: Disable Wi-Fi when battery is critically low
  2. Ethernet Priority: Prefer wired connections when available
  3. Scheduled Control: Implement time-based Wi-Fi policies
  4. Idle Management: Disable Wi-Fi during extended idle periods
  5. Resource Monitoring: Track power consumption patterns

Enterprise Use Cases

  1. Security-First Environments: Strict network whitelisting and compliance
  2. Power-Conscious Deployments: Battery optimization for mobile workers
  3. Scheduled Operations: Time-based Wi-Fi control for different work shifts
  4. Compliance Requirements: Audit trails and security monitoring
  5. Fleet Standardization: Consistent Wi-Fi policies across all devices

Remember to test all scripts on individual devices before deploying across your MacFleet environment, and ensure compliance with corporate security policies when implementing enterprise Wi-Fi control systems.

Website Access Control on macOS

Control website access across your MacFleet devices using advanced hosts file management, DNS filtering, and enterprise policy controls. This tutorial provides comprehensive tools for implementing organizational web access policies.

Understanding Website Access Control Methods

macOS offers multiple approaches for controlling website access:

  • Hosts File Management - Local DNS override for specific domains
  • DNS Configuration - Network-level filtering via custom DNS servers
  • System Proxy Settings - Route traffic through filtering proxies
  • Firewall Rules - Block specific IP addresses and port ranges

Basic Website Blocking

Block Single Website

#!/bin/bash

# Block access to a specific website
WEBSITE="www.facebook.com"

# Add entry to hosts file
echo "127.0.0.1 $WEBSITE" >> /etc/hosts
echo "127.0.0.1 facebook.com" >> /etc/hosts

echo "Blocked access to $WEBSITE"

Block Multiple Websites

#!/bin/bash

# Block multiple websites at once
BLOCKED_SITES=(
    "www.facebook.com"
    "facebook.com" 
    "m.facebook.com"
    "www.twitter.com"
    "twitter.com"
    "www.instagram.com"
    "instagram.com"
)

for site in "${BLOCKED_SITES[@]}"; do
    echo "127.0.0.1 $site" >> /etc/hosts
    echo "Blocked: $site"
done

echo "Website blocking completed"

Basic Website Unblocking

Unblock Single Website

#!/bin/bash

# Remove website from hosts file
WEBSITE="www.facebook.com"

/usr/bin/sed -i "" "/127.0.0.1 $WEBSITE/d" /etc/hosts
/usr/bin/sed -i "" "/127.0.0.1 facebook.com/d" /etc/hosts

echo "Unblocked access to $WEBSITE"

Unblock All Websites

#!/bin/bash

# Remove all blocking entries from hosts file
/usr/bin/sed -i "" '/^127.0.0.1.*[^localhost]/d' /etc/hosts

echo "All website blocks removed"

Enterprise Website Access Control System

#!/bin/bash

# MacFleet Enterprise Website Access Control
# Comprehensive web filtering and policy management system

# Configuration
MACFLEET_DIR="/etc/macfleet"
POLICIES_DIR="$MACFLEET_DIR/web_policies"
REPORTS_DIR="$MACFLEET_DIR/reports"
COMPLIANCE_DIR="$MACFLEET_DIR/compliance"
AUDIT_DIR="$MACFLEET_DIR/audit"
LOG_FILE="/var/log/macfleet_web_access.log"
BACKUP_DIR="$MACFLEET_DIR/backups"

# Create directory structure
create_directories() {
    local dirs=("$MACFLEET_DIR" "$POLICIES_DIR" "$REPORTS_DIR" "$COMPLIANCE_DIR" "$AUDIT_DIR" "$BACKUP_DIR")
    for dir in "${dirs[@]}"; do
        [[ ! -d "$dir" ]] && mkdir -p "$dir"
    done
}

# Logging function
log_action() {
    local message="$1"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] $message" | tee -a "$LOG_FILE"
}

# Backup hosts file
backup_hosts() {
    local backup_file="$BACKUP_DIR/hosts_backup_$(date +%Y%m%d_%H%M%S)"
    cp /etc/hosts "$backup_file"
    log_action "Hosts file backed up to: $backup_file"
}

# Website Categories for Enterprise Filtering
declare -A WEBSITE_CATEGORIES=(
    ["social_media"]="facebook.com,twitter.com,instagram.com,linkedin.com,snapchat.com,tiktok.com,pinterest.com"
    ["entertainment"]="youtube.com,netflix.com,hulu.com,twitch.tv,spotify.com,reddit.com"
    ["gaming"]="steam.com,epic.com,roblox.com,minecraft.net,ea.com,ubisoft.com"
    ["shopping"]="amazon.com,ebay.com,etsy.com,shopify.com,aliexpress.com"
    ["news"]="cnn.com,bbc.com,reuters.com,bloomberg.com,wsj.com"
    ["adult_content"]="example.com"
    ["malicious"]="malware.com,phishing-site.com,trojan-host.com"
)

# Security Policies
declare -A SECURITY_POLICIES=(
    ["high_security"]="social_media,entertainment,gaming,shopping,adult_content,malicious"
    ["moderate_security"]="adult_content,malicious,gaming"
    ["minimal_security"]="adult_content,malicious"
    ["development_team"]="malicious"
    ["executive_access"]="malicious"
)

# Block websites by category
block_category() {
    local category="$1"
    local policy="$2"
    
    if [[ -z "${WEBSITE_CATEGORIES[$category]}" ]]; then
        log_action "ERROR: Unknown category: $category"
        return 1
    fi
    
    log_action "Blocking category: $category (Policy: $policy)"
    
    # Split comma-separated domains
    IFS=',' read -ra domains <<< "${WEBSITE_CATEGORIES[$category]}"
    
    for domain in "${domains[@]}"; do
        # Add multiple variations
        echo "127.0.0.1 $domain" >> /etc/hosts
        echo "127.0.0.1 www.$domain" >> /etc/hosts
        echo "127.0.0.1 m.$domain" >> /etc/hosts
        echo "127.0.0.1 mobile.$domain" >> /etc/hosts
        
        log_action "Blocked domain: $domain"
    done
    
    # Save policy metadata
    echo "category=$category,policy=$policy,timestamp=$(date),user=$(whoami)" >> "$POLICIES_DIR/applied_blocks.log"
}

# Apply security policy
apply_security_policy() {
    local policy="$1"
    
    if [[ -z "${SECURITY_POLICIES[$policy]}" ]]; then
        log_action "ERROR: Unknown security policy: $policy"
        return 1
    fi
    
    log_action "Applying security policy: $policy"
    backup_hosts
    
    # Clear existing blocks
    /usr/bin/sed -i "" '/^127.0.0.1.*[^localhost]/d' /etc/hosts
    
    # Apply categories for this policy
    IFS=',' read -ra categories <<< "${SECURITY_POLICIES[$policy]}"
    
    for category in "${categories[@]}"; do
        block_category "$category" "$policy"
    done
    
    # Flush DNS cache
    dscacheutil -flushcache
    killall -HUP mDNSResponder
    
    log_action "Security policy '$policy' applied successfully"
    
    # Generate compliance report
    generate_compliance_report "$policy"
}

# Advanced DNS-based filtering
configure_dns_filtering() {
    local filter_level="$1"
    
    log_action "Configuring DNS filtering: $filter_level"
    
    case "$filter_level" in
        "enterprise")
            # Use enterprise DNS servers with filtering
            networksetup -setdnsservers "Wi-Fi" 208.67.222.222 208.67.220.220
            networksetup -setdnsservers "Ethernet" 208.67.222.222 208.67.220.220
            ;;
        "family_safe")
            # Use family-safe DNS
            networksetup -setdnsservers "Wi-Fi" 208.67.222.123 208.67.220.123
            networksetup -setdnsservers "Ethernet" 208.67.222.123 208.67.220.123
            ;;
        "secure")
            # Use security-focused DNS
            networksetup -setdnsservers "Wi-Fi" 1.1.1.2 1.0.0.2
            networksetup -setdnsservers "Ethernet" 1.1.1.2 1.0.0.2
            ;;
        "default")
            # Reset to automatic DNS
            networksetup -setdnsservers "Wi-Fi" "Empty"
            networksetup -setdnsservers "Ethernet" "Empty"
            ;;
    esac
    
    log_action "DNS filtering configured: $filter_level"
}

# Whitelist management for essential business sites
manage_whitelist() {
    local action="$1"
    local domain="$2"
    local whitelist_file="$POLICIES_DIR/business_whitelist.txt"
    
    case "$action" in
        "add")
            if ! grep -q "^$domain$" "$whitelist_file" 2>/dev/null; then
                echo "$domain" >> "$whitelist_file"
                # Remove from hosts file if blocked
                /usr/bin/sed -i "" "/127.0.0.1.*$domain/d" /etc/hosts
                log_action "Added to whitelist: $domain"
            else
                log_action "Domain already whitelisted: $domain"
            fi
            ;;
        "remove")
            if [[ -f "$whitelist_file" ]]; then
                /usr/bin/sed -i "" "/^$domain$/d" "$whitelist_file"
                log_action "Removed from whitelist: $domain"
            fi
            ;;
        "list")
            if [[ -f "$whitelist_file" ]]; then
                echo "Business Whitelist:"
                cat "$whitelist_file"
            else
                echo "No whitelist found"
            fi
            ;;
    esac
}

# Emergency access mode
emergency_access() {
    local action="$1"
    local emergency_file="$POLICIES_DIR/emergency_mode.flag"
    
    case "$action" in
        "enable")
            # Backup current hosts and clear all blocks
            backup_hosts
            cp /etc/hosts "$BACKUP_DIR/hosts_before_emergency"
            /usr/bin/sed -i "" '/^127.0.0.1.*[^localhost]/d' /etc/hosts
            touch "$emergency_file"
            echo "emergency_enabled=$(date)" > "$emergency_file"
            log_action "EMERGENCY ACCESS ENABLED - All website blocks removed"
            ;;
        "disable")
            if [[ -f "$emergency_file" ]]; then
                rm "$emergency_file"
                # Restore previous configuration if available
                if [[ -f "$BACKUP_DIR/hosts_before_emergency" ]]; then
                    cp "$BACKUP_DIR/hosts_before_emergency" /etc/hosts
                    log_action "Emergency access disabled - Previous configuration restored"
                else
                    log_action "Emergency access disabled - Manual reconfiguration required"
                fi
            else
                log_action "Emergency access is not currently enabled"
            fi
            ;;
        "status")
            if [[ -f "$emergency_file" ]]; then
                echo "Emergency access: ENABLED"
                cat "$emergency_file"
            else
                echo "Emergency access: DISABLED"
            fi
            ;;
    esac
}

# Generate comprehensive compliance report
generate_compliance_report() {
    local policy="$1"
    local report_file="$REPORTS_DIR/web_access_compliance_$(date +%Y%m%d_%H%M%S).json"
    
    local blocked_domains=$(grep -c "^127.0.0.1" /etc/hosts 2>/dev/null || echo "0")
    local whitelist_count=0
    [[ -f "$POLICIES_DIR/business_whitelist.txt" ]] && whitelist_count=$(wc -l < "$POLICIES_DIR/business_whitelist.txt")
    
    cat > "$report_file" << EOF
{
  "report_metadata": {
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "hostname": "$(hostname)",
    "policy_applied": "$policy",
    "report_version": "1.0"
  },
  "web_access_control": {
    "blocked_domains_count": $blocked_domains,
    "whitelisted_domains_count": $whitelist_count,
    "dns_filtering_active": $(networksetup -getdnsservers Wi-Fi | grep -q "208.67" && echo "true" || echo "false"),
    "emergency_mode": $([ -f "$POLICIES_DIR/emergency_mode.flag" ] && echo "true" || echo "false")
  },
  "security_policy": {
    "name": "$policy",
    "categories_blocked": "$(echo "${SECURITY_POLICIES[$policy]}" | tr ',' ' ')",
    "compliance_frameworks": ["SOX", "HIPAA", "NIST", "ISO27001"]
  },
  "system_status": {
    "hosts_file_size": $(wc -l < /etc/hosts),
    "last_dns_flush": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "backup_available": $([ -d "$BACKUP_DIR" ] && [ "$(ls -1 "$BACKUP_DIR"/hosts_backup_* 2>/dev/null | wc -l)" -gt 0 ] && echo "true" || echo "false")
  }
}
EOF
    
    log_action "Compliance report generated: $report_file"
    echo "Report saved to: $report_file"
}

# Health check and validation
perform_health_check() {
    echo "=== MacFleet Web Access Control Health Check ==="
    
    # Check hosts file integrity
    if [[ -f "/etc/hosts" ]]; then
        echo "✓ Hosts file exists"
        local hosts_size=$(wc -l < /etc/hosts)
        echo "  - Lines: $hosts_size"
    else
        echo "✗ Hosts file missing"
    fi
    
    # Check blocked domains
    local blocked_count=$(grep -c "^127.0.0.1" /etc/hosts 2>/dev/null || echo "0")
    echo "✓ Blocked domains: $blocked_count"
    
    # Check DNS configuration
    local dns_servers=$(networksetup -getdnsservers Wi-Fi)
    echo "✓ DNS servers: $dns_servers"
    
    # Check whitelist
    if [[ -f "$POLICIES_DIR/business_whitelist.txt" ]]; then
        local whitelist_count=$(wc -l < "$POLICIES_DIR/business_whitelist.txt")
        echo "✓ Whitelisted domains: $whitelist_count"
    else
        echo "○ No whitelist configured"
    fi
    
    # Check emergency mode
    if [[ -f "$POLICIES_DIR/emergency_mode.flag" ]]; then
        echo "⚠ī¸  Emergency mode: ACTIVE"
    else
        echo "✓ Emergency mode: INACTIVE"
    fi
    
    # Check recent activity
    if [[ -f "$LOG_FILE" ]]; then
        local recent_entries=$(tail -5 "$LOG_FILE" | wc -l)
        echo "✓ Recent log entries: $recent_entries"
    fi
}

# Fleet deployment function
deploy_to_fleet() {
    local policy="$1"
    local fleet_file="$2"
    
    if [[ ! -f "$fleet_file" ]]; then
        log_action "ERROR: Fleet file not found: $fleet_file"
        return 1
    fi
    
    log_action "Starting fleet deployment of policy: $policy"
    
    while IFS= read -r host; do
        [[ -z "$host" || "$host" =~ ^#.*$ ]] && continue
        
        echo "Deploying to: $host"
        
        # Copy this script to remote host and execute
        ssh "$host" "bash -s" << EOF
#!/bin/bash
# Remote deployment of web access policy: $policy

# Create directories
mkdir -p /etc/macfleet/{web_policies,reports,compliance,audit,backups}

# Apply the policy (simplified for remote execution)
$(declare -p WEBSITE_CATEGORIES)
$(declare -p SECURITY_POLICIES)
$(type apply_security_policy | sed '1d')

apply_security_policy "$policy"
EOF
        
        if [[ $? -eq 0 ]]; then
            log_action "Successfully deployed to: $host"
        else
            log_action "Failed to deploy to: $host"
        fi
        
    done < "$fleet_file"
    
    log_action "Fleet deployment completed"
}

# Main execution function
main() {
    create_directories
    
    case "${1:-}" in
        "apply_policy")
            apply_security_policy "$2"
            ;;
        "block_category")
            backup_hosts
            block_category "$2" "manual"
            ;;
        "configure_dns")
            configure_dns_filtering "$2"
            ;;
        "whitelist")
            manage_whitelist "$2" "$3"
            ;;
        "emergency")
            emergency_access "$2"
            ;;
        "health_check")
            perform_health_check
            ;;
        "report")
            generate_compliance_report "${2:-manual}"
            ;;
        "deploy")
            deploy_to_fleet "$2" "$3"
            ;;
        "help"|*)
            echo "MacFleet Website Access Control System"
            echo ""
            echo "Usage: $0 <command> [options]"
            echo ""
            echo "Commands:"
            echo "  apply_policy <policy>     - Apply security policy (high_security|moderate_security|minimal_security|development_team|executive_access)"
            echo "  block_category <category> - Block website category (social_media|entertainment|gaming|shopping|news|adult_content|malicious)"
            echo "  configure_dns <level>     - Configure DNS filtering (enterprise|family_safe|secure|default)"
            echo "  whitelist <action> <domain> - Manage whitelist (add|remove|list)"
            echo "  emergency <action>        - Emergency access control (enable|disable|status)"
            echo "  health_check             - Perform system health check"
            echo "  report [policy]          - Generate compliance report"
            echo "  deploy <policy> <fleet_file> - Deploy policy to fleet"
            echo ""
            echo "Examples:"
            echo "  $0 apply_policy high_security"
            echo "  $0 whitelist add salesforce.com"
            echo "  $0 emergency enable"
            echo "  $0 health_check"
            ;;
    esac
}

# Execute main function
main "$@"

Business Hours and User-Friendly Controls

Time-Based Access Control

#!/bin/bash

# Apply different policies based on business hours
apply_time_based_policy() {
    local current_hour=$(date +%H)
    local day_of_week=$(date +%u)
    
    # Business hours: Monday-Friday 9 AM - 6 PM
    if [[ $day_of_week -le 5 ]] && [[ $current_hour -ge 9 ]] && [[ $current_hour -lt 18 ]]; then
        echo "Business hours detected - applying strict policy"
        apply_security_policy "high_security"
    else
        echo "Outside business hours - applying relaxed policy"
        apply_security_policy "moderate_security"
    fi
}

User Notification System

#!/bin/bash

# Notify user of website access changes
notify_user() {
    local message="$1"
    local title="MacFleet Web Access"
    
    # Use osascript for user notification
    osascript -e "display notification \"$message\" with title \"$title\" sound name \"Glass\""
    
    # Also log to system
    log_action "User notification: $message"
}

# Example usage
notify_user "Website access policy updated to High Security mode"

Important Security Considerations

  • Hosts file permissions should be restricted to prevent unauthorized modifications
  • DNS filtering provides network-level protection beyond local hosts file
  • Emergency access procedures should be documented and tested
  • Regular backups of hosts file and configuration are essential
  • Audit logging helps track policy changes and compliance

Compliance and Reporting

The enterprise system generates comprehensive reports for:

  • SOX Compliance - Financial services web access controls
  • HIPAA Requirements - Healthcare data protection policies
  • NIST Framework - Cybersecurity standards alignment
  • ISO 27001 - Information security management

Testing and Validation

Before deploying to production:

  1. Test individual commands on isolated systems
  2. Verify DNS resolution after applying policies
  3. Confirm business applications remain accessible
  4. Test emergency procedures and restoration
  5. Validate compliance reporting accuracy

This comprehensive system transforms basic website blocking into an enterprise-grade access control platform with advanced policy management, compliance reporting, and fleet deployment capabilities.