mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-01 20:41:28 +02:00
ebc259e30b
This introduces a disabled-by-default allow-remote-jobs setting that controls whether the management server may run jobs (such as debug bundles) on a peer. The flag propagates end to end: through client configuration, the daemon SetConfig and Login requests, authentication, and system info, up to management, where it is stored on the peer and exposed on the peers API as remote_jobs_allowed. The client refuses any management-requested job unless the peer has opted in. Because enabling remote jobs crosses the user-to-root boundary, turning it on requires privilege, mirroring the SSH-server gate. Administrators can enforce the setting through MDM policy on both macOS and Windows, and MDM can also override the debug-bundle upload URL. The change ships policy documentation and generated profile templates, and adds configuration, conflict, and enforcement tests covering the opt-in, privilege, and MDM paths.
177 lines
7.9 KiB
XML
177 lines
7.9 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<!--
|
|
NetBird MDM configuration profile (macOS).
|
|
|
|
Wraps a `com.apple.ManagedClient.preferences` payload that pushes the
|
|
NetBird MDM policy into:
|
|
/Library/Managed Preferences/io.netbird.client.plist
|
|
|
|
Read at runtime by the netbird daemon's macOS loader
|
|
(client/mdm/policy_darwin.go — Phase 2). Key names match the canonical
|
|
lowerCamelCase form used in docs/netbird.admx and the mdm.Key*
|
|
constants in client/mdm/policy.go.
|
|
|
|
Bundle identifier: io.netbird.client
|
|
(confirm against the signed pkg before fleet roll-out)
|
|
|
|
Distribution:
|
|
- sign with `productsign --sign "Developer ID Installer: ..." ...`
|
|
before fleet roll-out (Apple-Configurator-2 won't install an
|
|
unsigned profile on Sonoma+ without user override).
|
|
- For local dev install: `sudo profiles install -path netbird-macos.mobileconfig`.
|
|
- For MDM (Jamf/Kandji/Mosyle/Intune): upload as a Custom Profile.
|
|
|
|
Editing:
|
|
- Replace UUID placeholders below with fresh UUIDs (`uuidgen` on
|
|
macOS) when forking this template for a real fleet — each
|
|
deployment should have unique UUIDs so the OS treats it as a
|
|
distinct profile.
|
|
- Tune the PayloadContent values to the policy you want to enforce.
|
|
- Remove any key you do NOT want to enforce (the daemon treats an
|
|
absent key as "no enforcement" for that field).
|
|
|
|
iOS note:
|
|
This file is macOS-specific. iOS uses managed app config via
|
|
UserDefaults[com.apple.configuration.managed] under a different
|
|
payload type (com.apple.app.configuration.managed); the wrapper
|
|
structure is the same but the inner payload dictionary differs.
|
|
See docs/netbird-ios.mobileconfig (Phase 5) when shipped.
|
|
-->
|
|
<plist version="1.0">
|
|
<dict>
|
|
<!-- Outer profile envelope -->
|
|
<key>PayloadType</key>
|
|
<string>Configuration</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>PayloadIdentifier</key>
|
|
<string>io.netbird.client.mdm</string>
|
|
<key>PayloadUUID</key>
|
|
<string>11111111-1111-1111-1111-111111111111</string>
|
|
<key>PayloadDisplayName</key>
|
|
<string>NetBird MDM Policy</string>
|
|
<key>PayloadDescription</key>
|
|
<string>Enforces NetBird client configuration. Values written here override any local user / CLI / on-disk setting and are re-applied at every daemon boot and on every 1-minute MDM reload tick.</string>
|
|
<key>PayloadOrganization</key>
|
|
<string>NetBird</string>
|
|
<key>PayloadScope</key>
|
|
<string>System</string>
|
|
<key>PayloadRemovalDisallowed</key>
|
|
<false/>
|
|
|
|
<key>PayloadContent</key>
|
|
<array>
|
|
<dict>
|
|
<!-- Managed preferences payload: writes /Library/Managed Preferences/io.netbird.client.plist -->
|
|
<key>PayloadType</key>
|
|
<string>com.apple.ManagedClient.preferences</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>PayloadIdentifier</key>
|
|
<string>io.netbird.client.mdm.preferences</string>
|
|
<key>PayloadUUID</key>
|
|
<string>22222222-2222-2222-2222-222222222222</string>
|
|
<key>PayloadDisplayName</key>
|
|
<string>NetBird Managed Preferences</string>
|
|
<key>PayloadEnabled</key>
|
|
<true/>
|
|
|
|
<key>PayloadContent</key>
|
|
<dict>
|
|
<key>io.netbird.client</key>
|
|
<dict>
|
|
<key>Forced</key>
|
|
<array>
|
|
<dict>
|
|
<key>mcx_preference_settings</key>
|
|
<dict>
|
|
|
|
<!-- ===== Identity / auth (strings) ===== -->
|
|
<key>managementURL</key>
|
|
<string>https://api.netbird.io:443</string>
|
|
|
|
<!-- Pre-shared key: secret. Remove the entry entirely
|
|
when not used; do NOT leave an empty string. -->
|
|
<!--
|
|
<key>preSharedKey</key>
|
|
<string>REPLACE_ME</string>
|
|
-->
|
|
|
|
<!-- ===== Engine / runtime behavior (bool) =====
|
|
Remove any key to leave the field unmanaged. -->
|
|
<!--
|
|
<key>disableAutoConnect</key>
|
|
<false/>
|
|
<key>disableAutostart</key>
|
|
<false/>
|
|
<key>disableClientRoutes</key>
|
|
<false/>
|
|
<key>disableServerRoutes</key>
|
|
<false/>
|
|
<key>blockInbound</key>
|
|
<false/>
|
|
-->
|
|
<key>allowServerSSH</key>
|
|
<true/>
|
|
<!--
|
|
<key>rosenpassEnabled</key>
|
|
<true/>
|
|
<key>rosenpassPermissive</key>
|
|
<false/>
|
|
-->
|
|
|
|
<!-- ===== Remote jobs (debug bundles) =====
|
|
allowRemoteJobs : opt into management-requested
|
|
remote jobs. Off by default.
|
|
debugBundleUploadURL : override the debug-bundle upload
|
|
service (https URL with a host);
|
|
precedence over the management value. -->
|
|
<!--
|
|
<key>allowRemoteJobs</key>
|
|
<true/>
|
|
<key>debugBundleUploadURL</key>
|
|
<string>https://upload.example.com</string>
|
|
-->
|
|
|
|
<!-- ===== WireGuard UDP port (int) =====
|
|
Range 1-65535. Omit to keep the default. -->
|
|
<!--
|
|
<key>wireguardPort</key>
|
|
<integer>51820</integer>
|
|
-->
|
|
|
|
<!-- ===== Split tunnel (Android-only at the daemon level)
|
|
Pushed harmlessly on macOS for fleets with mixed
|
|
desktop+mobile devices; the macOS daemon ignores it. -->
|
|
<!--
|
|
<key>splitTunnelMode</key>
|
|
<string>allow</string>
|
|
<key>splitTunnelApps</key>
|
|
<string>com.acme.app1,com.acme.app2</string>
|
|
-->
|
|
|
|
<!-- ===== UI / kill switches (bool) ===== -->
|
|
<!--
|
|
<key>disableUpdateSettings</key>
|
|
<true/>
|
|
<key>disableProfiles</key>
|
|
<true/>
|
|
<key>disableNetworks</key>
|
|
<true/>
|
|
<key>disableAdvancedView</key>
|
|
<true/>
|
|
<key>disableMetricsCollection</key>
|
|
<false/>
|
|
-->
|
|
|
|
</dict>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
</dict>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
</plist>
|