Skip to main content

Roll out ssg with Jamf Pro

Use a Jamf Pro policy to install ssg on your Macs and enroll them in your Fleet org. Fleet makes the script. You add it to Jamf Pro.

Third-party product

Jamf Pro is a product of another company. SigmaShake does not partner with Jamf and does not claim a certification with Jamf. These steps use only the standard Jamf Pro script and policy features.

Before you start​

  • You are an org_admin of your Fleet org.
  • You can add scripts and policies in Jamf Pro.
  • You have a small test group of Macs.

Step 1: Make an enrollment profile​

  1. Open the Fleet console. Go to Enrollment.
  2. Choose Roll out with Jamf Pro.
  3. Make an enrollment profile. Set a name and an expiry. The default expiry is 7 days. You can set a maximum number of enrollments.
  4. Copy the enrollment token. The console shows the token one time only. Keep it in a safe place.

Step 2: Download the Jamf script​

  1. In the Fleet console, choose Download Jamf script.
  2. Save the file ssg-jamf-<org-slug>.sh.

The script does not hold the token. The token comes from a Jamf script parameter. You can also get the file from the API: GET /api/v1/orgs/:org_id/enrollment-profiles/:profile_id/mdm/jamf. It needs an org_admin session. It answers 404 when the profile is not in your org. It answers 410 when the profile is expired or revoked.

Step 3: Add the script in Jamf Pro​

  1. In Jamf Pro, go to Settings > Computer management > Scripts.
  2. Add a new script. Paste the file content.
  3. On the Options tab, set the parameter labels:
    • Parameter 4: SigmaShake Fleet enrollment token
    • Parameter 5: Host label (optional)

Step 4: Make the policy​

  1. Make a new policy.
  2. Add a Scripts payload. Choose the script.
  3. Set parameter 4 to the enrollment token.
  4. Set parameter 5 to a host label, or leave it empty. A label can use letters, digits, dot, underscore and hyphen. It can be 64 characters long. With no label, the script uses the computer name.
  5. Set the triggers to Enrollment Complete and Recurring Check-in.
  6. Set the execution frequency to Once per computer.
  7. Scope the policy to your test group first.

What the script does​

  • It runs as root. Jamf runs policies as root.
  • It works on macOS only. On another system it exits with code 2.
  • It reads the token from parameter 4. The token must be 32 hexadecimal characters. Upper or lower case is accepted. If not, the script exits with code 3.
  • It installs ssg with no prompt in the folder /usr/local/sigmashake/bin. The script makes /usr/local/sigmashake and its bin folder owned by root:wheel with mode 755.
  • It refuses to continue (exit code 4) if a user other than root can write to the ssg binary or to its folder.
  • It adds a link /usr/local/bin/ssg only when /usr/local/bin is owned by root and no group or other user can write to it. If Homebrew owns that folder, the script adds no link. Run /usr/local/sigmashake/bin/ssg instead.
  • It sends the token to ssg fleet enroll on stdin. The token is not in a command argument and is not printed. If the installed ssg has no stdin option, the script uses a positional argument as a fallback.
  • It installs a LaunchDaemon in /Library/LaunchDaemons that runs /usr/local/sigmashake/bin/ssg (owner root:wheel, mode 644) and loads it with launchctl.
  • It is safe to run again. On a Mac that is already enrolled, it prints already enrolled with the org id and exits with code 0. It does not restart the daemon when nothing changed.
Exit codeMeaning
0Done, or the Mac is already enrolled
2The system is not macOS
3Parameter 4 does not hold a valid token
4The install failed, a non-root user can write to ssg or its folder, or the script does not run as root
5The enroll step failed

Step 5: Check the result​

  1. Wait for the first Mac to check in. Fleet updates the list of hosts as Macs connect.
  2. Open the Fleet console home page (the health console). Each host shows its checks. A check with no data shows unknown. Fleet shows pass only when it has evidence.
  3. If a Mac does not show up, see the Jamf policy log for the exit code. Use the table above.
  4. When the test group is good, widen the scope of the policy.

Safety notes​

  • Treat the token as a secret. Do not put it in chat, in a ticket, or in the script.
  • Set a short expiry. Revoke the profile when the rollout is done.
  • You can ask your AI agent to guide you. See Connect your AI agent to Fleet.