Proxy Management on macOS
Configure and manage enterprise proxy settings across your MacFleet devices using advanced networksetup commands. This tutorial covers all proxy types including web, secure web, streaming, Gopher, and SOCKS firewall proxies with enterprise-grade management capabilities.
Understanding macOS Proxy Management
macOS provides comprehensive proxy configuration through the networksetup command-line utility, supporting:
- Web Proxy (HTTP) - Standard HTTP traffic routing
- Secure Web Proxy (HTTPS) - Encrypted HTTPS traffic with end-to-end security
- Streaming Proxy - Multimedia content optimization (deprecated in macOS 13.0+)
- Gopher Proxy - Legacy Gopher protocol support (deprecated in macOS 13.0+)
- SOCKS Firewall Proxy - Generic protocol supporting most applications
Web Proxy Configuration
Basic Web Proxy Setup
#!/bin/bash
# Configure HTTP web proxy
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="proxy.company.com"
PROXY_PORT="8080"
AUTHENTICATED="on"
USERNAME="proxyuser"
PASSWORD="proxypass"
# Set web proxy configuration
networksetup -setwebproxy "$NETWORK_SERVICE" "$PROXY_SERVER" "$PROXY_PORT" "$AUTHENTICATED" "$USERNAME" "$PASSWORD"
# Enable web proxy
networksetup -setwebproxystate "$NETWORK_SERVICE" on
echo "Web proxy configured successfully for $NETWORK_SERVICE"Advanced Web Proxy Management
#!/bin/bash
# Enterprise Web Proxy Configuration System
NETWORK_SERVICE="Wi-Fi"
CONFIG_FILE="/etc/macfleet/proxy_config.conf"
LOG_FILE="/var/log/macfleet_proxy.log"
# Logging function
log_action() {
echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}
# Load proxy configuration from file
load_proxy_config() {
if [[ -f "$CONFIG_FILE" ]]; then
source "$CONFIG_FILE"
log_action "Loaded proxy configuration from $CONFIG_FILE"
else
echo "Configuration file not found: $CONFIG_FILE"
exit 1
fi
}
# Configure web proxy with validation
configure_web_proxy() {
local server="$1"
local port="$2"
local auth="$3"
local username="$4"
local password="$5"
# Validate network service exists
if ! networksetup -listallnetworkservices | grep -q "^$NETWORK_SERVICE$"; then
log_action "ERROR: Network service '$NETWORK_SERVICE' not found"
return 1
fi
# Test proxy connectivity
if ! nc -z "$server" "$port" 2>/dev/null; then
log_action "WARNING: Cannot reach proxy server $server:$port"
fi
# Configure proxy
if networksetup -setwebproxy "$NETWORK_SERVICE" "$server" "$port" "$auth" "$username" "$password"; then
networksetup -setwebproxystate "$NETWORK_SERVICE" on
log_action "Web proxy configured: $server:$port (Auth: $auth)"
return 0
else
log_action "ERROR: Failed to configure web proxy"
return 1
fi
}
# Verify proxy configuration
verify_proxy_config() {
local proxy_info
proxy_info=$(networksetup -getwebproxy "$NETWORK_SERVICE")
echo "Current Web Proxy Configuration:"
echo "$proxy_info"
if echo "$proxy_info" | grep -q "Enabled: Yes"; then
log_action "Web proxy verification successful"
return 0
else
log_action "Web proxy verification failed"
return 1
fi
}
# Main execution
main() {
log_action "Starting web proxy configuration"
# Example configuration (replace with actual values)
configure_web_proxy "proxy.company.com" "8080" "on" "proxyuser" "proxypass"
# Verify configuration
verify_proxy_config
log_action "Web proxy configuration completed"
}
# Execute if script is run directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fiSecure Web Proxy (HTTPS)
Basic HTTPS Proxy Setup
#!/bin/bash
# Configure HTTPS secure web proxy
networksetup -setsecurewebproxy "Wi-Fi" "secure-proxy.company.com" "8443" on "secureuser" "securepass"
networksetup -setsecurewebproxystate "Wi-Fi" on
echo "Secure web proxy configured successfully"Enterprise HTTPS Proxy Management
#!/bin/bash
# Enterprise Secure Web Proxy Configuration
configure_secure_proxy() {
local network_service="$1"
local proxy_server="$2"
local proxy_port="$3"
local username="$4"
local password="$5"
echo "Configuring secure web proxy for $network_service..."
# Validate SSL/TLS connectivity
if openssl s_client -connect "$proxy_server:$proxy_port" -verify_return_error < /dev/null 2>/dev/null; then
echo "✅ SSL connectivity verified for $proxy_server:$proxy_port"
else
echo "⚠️ WARNING: SSL connectivity issues detected"
fi
# Configure secure proxy
if networksetup -setsecurewebproxy "$network_service" "$proxy_server" "$proxy_port" on "$username" "$password"; then
networksetup -setsecurewebproxystate "$network_service" on
echo "✅ Secure web proxy configured successfully"
# Verify configuration
echo "Configuration details:"
networksetup -getsecurewebproxy "$network_service"
return 0
else
echo "❌ Failed to configure secure web proxy"
return 1
fi
}
# Certificate validation for secure proxies
validate_proxy_certificate() {
local proxy_server="$1"
local proxy_port="$2"
echo "Validating proxy certificate..."
local cert_info
cert_info=$(openssl s_client -connect "$proxy_server:$proxy_port" -servername "$proxy_server" < /dev/null 2>/dev/null | openssl x509 -text -noout)
if [[ -n "$cert_info" ]]; then
echo "Certificate validation successful"
echo "Certificate subject: $(echo "$cert_info" | grep "Subject:" | head -1)"
echo "Certificate issuer: $(echo "$cert_info" | grep "Issuer:" | head -1)"
return 0
else
echo "Certificate validation failed"
return 1
fi
}
# Usage example
configure_secure_proxy "Wi-Fi" "secure-proxy.company.com" "8443" "secureuser" "securepass"
validate_proxy_certificate "secure-proxy.company.com" "8443"SOCKS Firewall Proxy
Basic SOCKS Proxy Configuration
#!/bin/bash
# Configure SOCKS firewall proxy
networksetup -setsocksfirewallproxy "Wi-Fi" "socks-proxy.company.com" "1080" on "socksuser" "sockspass"
networksetup -setsocksfirewallproxystate "Wi-Fi" on
echo "SOCKS firewall proxy configured successfully"Advanced SOCKS Proxy Management
#!/bin/bash
# Enterprise SOCKS Proxy Configuration System
setup_socks_proxy() {
local network_service="$1"
local socks_server="$2"
local socks_port="$3"
local auth_required="$4"
local username="$5"
local password="$6"
echo "Setting up SOCKS proxy: $socks_server:$socks_port"
# Test SOCKS connectivity
if command -v nc >/dev/null 2>&1; then
if nc -z "$socks_server" "$socks_port" 2>/dev/null; then
echo "✅ SOCKS proxy connectivity verified"
else
echo "⚠️ WARNING: Cannot reach SOCKS proxy"
fi
fi
# Configure SOCKS proxy
if networksetup -setsocksfirewallproxy "$network_service" "$socks_server" "$socks_port" "$auth_required" "$username" "$password"; then
networksetup -setsocksfirewallproxystate "$network_service" on
echo "✅ SOCKS firewall proxy configured"
# Verify configuration
echo "SOCKS proxy details:"
networksetup -getsocksfirewallproxy "$network_service"
return 0
else
echo "❌ Failed to configure SOCKS proxy"
return 1
fi
}
# Test SOCKS proxy functionality
test_socks_proxy() {
local test_url="http://httpbin.org/ip"
echo "Testing SOCKS proxy functionality..."
# Test with curl through SOCKS proxy
if command -v curl >/dev/null 2>&1; then
local proxy_response
proxy_response=$(curl -s --socks5 "socks-proxy.company.com:1080" "$test_url" 2>/dev/null)
if [[ -n "$proxy_response" ]]; then
echo "✅ SOCKS proxy test successful"
echo "Response: $proxy_response"
else
echo "❌ SOCKS proxy test failed"
fi
else
echo "curl not available for testing"
fi
}
# Usage
setup_socks_proxy "Wi-Fi" "socks-proxy.company.com" "1080" "on" "socksuser" "sockspass"
test_socks_proxyLegacy Proxy Support (macOS < 13.0)
Streaming Proxy Configuration
#!/bin/bash
# Configure streaming proxy (deprecated in macOS 13.0+)
check_macos_version() {
local version
version=$(sw_vers -productVersion)
local major_version
major_version=$(echo "$version" | cut -d. -f1)
if [[ "$major_version" -ge 13 ]]; then
echo "⚠️ Streaming proxy not supported on macOS 13.0+"
return 1
fi
return 0
}
configure_streaming_proxy() {
if check_macos_version; then
networksetup -setstreamingproxy "Wi-Fi" "stream-proxy.company.com" "8080" on "streamuser" "streampass"
networksetup -setstreamingproxystate "Wi-Fi" on
echo "✅ Streaming proxy configured"
else
echo "❌ Streaming proxy not available on this macOS version"
fi
}
configure_gopher_proxy() {
if check_macos_version; then
networksetup -setgopherproxy "Wi-Fi" "gopher-proxy.company.com" "70" on "gopheruser" "gopherpass"
networksetup -setgopherproxystate "Wi-Fi" on
echo "✅ Gopher proxy configured"
else
echo "❌ Gopher proxy not available on this macOS version"
fi
}
# Execute legacy proxy setup
configure_streaming_proxy
configure_gopher_proxyEnterprise Proxy Management System
#!/bin/bash
# MacFleet Enterprise Proxy Management System
# Comprehensive proxy configuration and monitoring
# Configuration
PROXY_CONFIG_DIR="/etc/macfleet/proxy"
LOG_FILE="/var/log/macfleet_proxy.log"
BACKUP_DIR="/var/backups/macfleet/proxy"
API_ENDPOINT="https://api.macfleet.com/v1/proxy"
# Create directory structure
setup_directories() {
mkdir -p "$PROXY_CONFIG_DIR" "$BACKUP_DIR"
touch "$LOG_FILE"
}
# Logging function
log_action() {
echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}
# Get all network services
get_network_services() {
networksetup -listallnetworkservices | grep -v "^An asterisk"
}
# Backup current proxy settings
backup_proxy_settings() {
local backup_file="$BACKUP_DIR/proxy_backup_$(date +%Y%m%d_%H%M%S).json"
echo "{" > "$backup_file"
echo " \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"," >> "$backup_file"
echo " \"hostname\": \"$(hostname)\"," >> "$backup_file"
echo " \"network_services\": {" >> "$backup_file"
local first=true
while IFS= read -r service; do
if [[ "$first" == "false" ]]; then
echo "," >> "$backup_file"
fi
first=false
echo " \"$service\": {" >> "$backup_file"
echo " \"web_proxy\": $(networksetup -getwebproxy "$service" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")" >> "$backup_file"
echo " \"secure_web_proxy\": $(networksetup -getsecurewebproxy "$service" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")" >> "$backup_file"
echo " \"socks_proxy\": $(networksetup -getsocksfirewallproxy "$service" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")" >> "$backup_file"
echo " }" >> "$backup_file"
done < <(get_network_services)
echo " }" >> "$backup_file"
echo "}" >> "$backup_file"
log_action "Proxy settings backed up to: $backup_file"
}
# Configure proxy from JSON configuration
configure_from_json() {
local config_file="$1"
if [[ ! -f "$config_file" ]]; then
log_action "ERROR: Configuration file not found: $config_file"
return 1
fi
log_action "Applying proxy configuration from: $config_file"
# Parse JSON and apply settings using jq or python
if command -v jq >/dev/null 2>&1; then
# Use jq for JSON parsing
local networks
networks=$(jq -r '.networks | keys[]' "$config_file")
while IFS= read -r network; do
local web_proxy
web_proxy=$(jq -r ".networks[\"$network\"].web_proxy" "$config_file")
if [[ "$web_proxy" != "null" ]]; then
local server port auth username password
server=$(echo "$web_proxy" | jq -r '.server')
port=$(echo "$web_proxy" | jq -r '.port')
auth=$(echo "$web_proxy" | jq -r '.authentication')
username=$(echo "$web_proxy" | jq -r '.username')
password=$(echo "$web_proxy" | jq -r '.password')
networksetup -setwebproxy "$network" "$server" "$port" "$auth" "$username" "$password"
networksetup -setwebproxystate "$network" on
log_action "Web proxy configured for $network: $server:$port"
fi
done <<< "$networks"
else
log_action "ERROR: jq not available for JSON parsing"
return 1
fi
}
# Monitor proxy connectivity
monitor_proxy_connectivity() {
log_action "Starting proxy connectivity monitoring"
while IFS= read -r service; do
local web_proxy_info
web_proxy_info=$(networksetup -getwebproxy "$service")
if echo "$web_proxy_info" | grep -q "Enabled: Yes"; then
local server port
server=$(echo "$web_proxy_info" | grep "Server:" | awk '{print $2}')
port=$(echo "$web_proxy_info" | grep "Port:" | awk '{print $2}')
if nc -z "$server" "$port" 2>/dev/null; then
log_action "✅ Proxy connectivity OK: $service ($server:$port)"
else
log_action "❌ Proxy connectivity FAILED: $service ($server:$port)"
fi
fi
done < <(get_network_services)
}
# Clear all proxy settings
clear_all_proxies() {
log_action "Clearing all proxy settings"
while IFS= read -r service; do
# Disable all proxy types
networksetup -setwebproxystate "$service" off
networksetup -setsecurewebproxystate "$service" off
networksetup -setsocksfirewallproxystate "$service" off
# For older macOS versions
networksetup -setstreamingproxystate "$service" off 2>/dev/null || true
networksetup -setgopherproxystate "$service" off 2>/dev/null || true
log_action "Proxies cleared for: $service"
done < <(get_network_services)
}
# Generate proxy status report
generate_proxy_report() {
local report_file="$PROXY_CONFIG_DIR/proxy_report_$(date +%Y%m%d_%H%M%S).txt"
{
echo "MacFleet Proxy Status Report"
echo "Generated: $(date)"
echo "Hostname: $(hostname)"
echo "=================================="
echo ""
while IFS= read -r service; do
echo "Network Service: $service"
echo "--------------------------------"
echo "Web Proxy:"
networksetup -getwebproxy "$service" | sed 's/^/ /'
echo ""
echo "Secure Web Proxy:"
networksetup -getsecurewebproxy "$service" | sed 's/^/ /'
echo ""
echo "SOCKS Firewall Proxy:"
networksetup -getsocksfirewallproxy "$service" | sed 's/^/ /'
echo ""
echo "=================================="
echo ""
done < <(get_network_services)
} > "$report_file"
echo "Proxy report generated: $report_file"
log_action "Proxy status report generated: $report_file"
}
# Main function
main() {
local action="${1:-status}"
setup_directories
log_action "MacFleet Proxy Management started with action: $action"
case "$action" in
"backup")
backup_proxy_settings
;;
"configure")
configure_from_json "$2"
;;
"monitor")
monitor_proxy_connectivity
;;
"clear")
backup_proxy_settings
clear_all_proxies
;;
"report")
generate_proxy_report
;;
"status"|*)
generate_proxy_report
monitor_proxy_connectivity
;;
esac
log_action "MacFleet Proxy Management completed"
}
# Execute main function with all arguments
main "$@"Proxy Configuration Templates
Corporate Web Proxy Template
# /etc/macfleet/proxy/corporate_web.conf
PROXY_TYPE="web"
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="proxy.company.com"
PROXY_PORT="8080"
AUTHENTICATION="on"
USERNAME="employee_username"
PASSWORD="employee_password"
AUTO_CONFIG_URL=""
BYPASS_LIST="*.company.com,localhost,127.0.0.1"Secure Enterprise Template
# /etc/macfleet/proxy/secure_enterprise.conf
PROXY_TYPE="secure_web"
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="secure-proxy.company.com"
PROXY_PORT="8443"
AUTHENTICATION="on"
USERNAME="secure_user"
PASSWORD="secure_password"
SSL_VERIFICATION="enabled"
CERTIFICATE_PINNING="enabled"SOCKS Proxy Template
# /etc/macfleet/proxy/socks_proxy.conf
PROXY_TYPE="socks"
NETWORK_SERVICE="Wi-Fi"
PROXY_SERVER="socks.company.com"
PROXY_PORT="1080"
AUTHENTICATION="on"
USERNAME="socks_user"
PASSWORD="socks_password"
SOCKS_VERSION="5"Security Considerations
Proxy Authentication Security
#!/bin/bash
# Secure proxy credential management
encrypt_credentials() {
local username="$1"
local password="$2"
local keychain="MacFleet-Proxy"
# Store credentials in keychain
security add-generic-password -a "$username" -s "proxy-credentials" -w "$password" -T "" "$keychain" 2>/dev/null
if [[ $? -eq 0 ]]; then
echo "✅ Credentials stored securely in keychain"
else
echo "❌ Failed to store credentials in keychain"
fi
}
# Retrieve credentials from keychain
decrypt_credentials() {
local username="$1"
local keychain="MacFleet-Proxy"
local password
password=$(security find-generic-password -a "$username" -s "proxy-credentials" -w "$keychain" 2>/dev/null)
if [[ -n "$password" ]]; then
echo "$password"
else
echo "ERROR: Could not retrieve password for $username"
return 1
fi
}Important Configuration Notes
Network Service Names
- Service names are case-sensitive
- Use quotes for names with spaces:
"Wi-Fi" - Common services:
"Wi-Fi","Ethernet","USB 10/100/1000 LAN"
Proxy Authentication
- Set
authenticatedto"on"to enable authentication - Set
authenticatedto"off"to disable authentication - Credentials will be prompted if authentication is enabled but not provided
macOS Version Compatibility
- Streaming Proxy: Deprecated in macOS 13.0+
- Gopher Proxy: Deprecated in macOS 13.0+
- Web/Secure Web/SOCKS: Available on all supported macOS versions
Error Handling
- Existing proxy configurations will show errors when reconfigured
- Use
networksetup -setproxystateto disable before reconfiguring - Test connectivity before applying to fleet devices
Best Practices
- Always backup current settings before changes
- Test connectivity after proxy configuration
- Use secure storage for proxy credentials
- Monitor proxy health continuously
- Validate certificates for HTTPS proxies
- Document configurations for compliance
- Implement logging for audit trails
- Test on individual devices before fleet deployment
Remember to validate all scripts on test devices before deploying across your MacFleet environment, and ensure proxy servers are accessible and properly configured for your network infrastructure.