franton / jss-in-a-box

The Casper Suite setup script

JSS-In-A-Box

The (almost) complete Jamf Pro JSS setup script

http://www.richard-purves.com/?p=136

IMPORTANT NOTE

This project was officially retired on September 3rd 2018

There is no more support and is kept here for historical reasons.

See https://www.richard-purves.com/2018/09/03/wither-jss-in-a-box/

--

Before we start, i'm planning to refactor the code and modularise a lot more functions as it's getting untidy in here. That'll be next big release, just not sure when.

Introduction

This is the (almost) complete setup script for JAMF Software's JSS server. It will perform the following tasks :-

1. Install and configure all the software packages required to run the JSS
2. Harden the server via software firewall and optional HTTPS certificates
3. Show all currently running JSS on the server
4. Create a new JSS and Database
5. Delete an existing JSS and Database
6. Dump a selected (or ALL) JSS database to a file
7. Upload a database file back into MySQL
8. Upgrade a single JSS install on the server
9. Upgrade ALL JSS installs on the server
10. (optional) Refresh Tomcat SSL certificate from LetsEncrypt (The LetsEncrypt certificates are automatically renewed via a cron job. The same code can be invoked manually with this option)
11. Will now optimally configure Tomcat and MySQL (locally only) for number of instances, available ram etc etc. (this one was HARD to do)

The only things it doesn't do are:

1. Set up anything to do with load balancing. That can be done inside the JSS itself.
2. Any remote server configuration with the sole exception of modifying remote databases.
3. Clustered server setup.

Oh, and NO SNEAKY using this on your CJA course! I've tipped off the JAMF instructors I know of!

Getting started

This assumes you have an either an Ubuntu 16.04 LTS or a RedHat 7.x server installed with openssh. This also assumes the server is properly configured to see the internet and has a properly set up DNS hostname.

Please do NOT use Ubuntu's minimal iso install. This will miss out lots of key software and this script will fail. Use the "server" download instead.

1. Download the proper script depending on which Linux distribution you are using.
2. Edit the jss-in-a-box.sh script variables in line with your own security policies

• Server admin username
• Use LetsEncrypt (if this is set to FALSE, then the JSS will be set up without HTTPS)
• SSL Domain name for the server
• SSL E-mail address to register with the LetsEncrypt CA
• SSL Keypass password
• MySQL root password
• MySQL server address
• JSS database username
• JSS database password

3. Edit the jss-in-a-box.sh script firewall settings.
4. scp the ROOT.war file supplied by JAMF to the server
5. scp the jss-in-a-box.sh script over to the server
6. Run the script with sudo. e.g. sudo ./jss-in-a-box.sh
7. Follow the options! (They are all disabled until no.1 is run successfully).

You should, depending on server and internet speed have a fully functioning JSS running inside of an hour. Probably less.

(Optional) Run the script with sudo ./jss-in-a-box.sh -h to get a help prompt.

The instructional video below provides more details of operation. NOTE: This is of an earlier version but the info is still valid.

Instructional Video

Software Installed

• JSS
• Curl (missing from Ubuntu)
• Git (used purely for installing LetsEncrypt)
• Unzip
• Uncomplicated Firewall (Ubuntu) / FirewallD (Redhat)
• OpenSSL
• OpenVMTools
• Oracle Java 8
• Java Cryptography Extensions
• Apache Tomcat 8.0x
• MySQL Server 5.7
• (optional) LetsEncrypt

jss-in-a-box's Issues

New Installation Ubuntu not working

Hello,

as requested here is the issue I am having:

On a fresh install of Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-81-generic x86_64)

after downloading and running the latest version of the script, it installs all files without error but I am unable to browse the address https://:8443

Looking in the catalina.out logs I can see:

22-Jun-2017 18:51:22.733 SEVERE [main] org.apache.tomcat.util.digester.Digester.fatalError Parse Fatal Error at line 95 column 5: Element type "Connector" must be followed by either attribute specifications, ">" or "/>".
org.xml.sax.SAXParseException; systemId: file:/opt/tomcat8/conf/server.xml; lineNumber: 95; columnNumber: 5; Element type "Connector" must be followed by either attribute specifications, ">" or "/>".

Adding /> to the end of the https section of the server.xml allows it to load.

Another problem is that MySQL will install then if you check again, it will report that it's not installed and attempt to reinstall.

running the check after it installs shows the following:

$ dpkg -l | grep mysql
ii mysql-apt-config 0.8.3-1 all Auto configuration for MySQL APT Repo.
ii mysql-client 5.7.18-1ubuntu16.04 amd64 MySQL Client meta package depending on latest version
ii mysql-common 5.7.18-1ubuntu16.04 amd64 MySQL Common
ii mysql-community-client 5.7.18-1ubuntu16.04 amd64 MySQL Client
ii mysql-community-server 5.7.18-1ubuntu16.04 amd64 MySQL Server
ii mysql-server 5.7.18-1ubuntu16.04 amd64 MySQL Server meta package depending on latest version

Thanks!

maxPostSize?

Am I correct in line 1124's maxPostSize is overridden on line 1124?

JSS-In-A-Box/jss-in-a-box.sh

Line 1122 in a67ed6d

sed -i '86i\ \t\tprotocol="HTTP/1.1" connectionTimeout="20000" maxPostSize="8388608"' $server

JSS-In-A-Box/jss-in-a-box.sh

Line 1124 in a67ed6d

sed -i '88i\ \t\tmaxPostSize="-1" maxThreads="150" minSpareThreads="25"' $server

Won't start..

I love the product you've created. It was really easy to install and I'm excited how much time it will save me to bring up JSS environments in a flash. I am having trouble however starting up the web page. Since this instance wasn't set up the same way as the jar file from JAMF I'm not sure what to look for. Tomcat appears to be running as well as MySQL and nothing gave me an error when you're installer ran. Can you help me out?

JSS not running after running the Script

Hi,
i did a fresh Ubuntu 16.04 installation and run the script. It was running nicely.
Fort the Option 1) to install
then Option 3) to setup ROOT Instance

Unfortunately if i try to access the URL, there is nothing answering. So i assume something went wrong. Before i start searching for hours - is there any log or something i could provide to identify the issue?

Does not correctly detect CentOS 7

Current code for detecting CentOS 7 does not work.

Actual output:

cat /etc/redhat-release
CentOS Linux release 7.3.1611 (Core)

Line reading:
cat /etc/redhat-release | awk '{ print $7 }' | cut -c 1
changed to:
cat /etc/redhat-release | awk '{ print $4 }' | cut -c 1

pulls correct version.

Curling Tomcat Version adding White space Ubuntu 16.04.3

OS: Ubuntu 16.04.3 (inline upgrade from 14.10)

Line 671 version=$( curl -s http://tomcat.apache.org/download-80.cgi | grep "<h3 id="8.0" | head -n1 | awk '{gsub("<[^>]*>", "")}1')

Version: 8.0.47

Downloading and installing latest Tomcat 8
--2017-10-04 11:56:40-- http://www.apache.org/dist/tomcat/tomcat-8/v%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%208.0.47/bin/apache-tomcat-%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%208.0.47.tar.gz
Resolving www.apache.org (www.apache.org)... 88.198.26.2, 140.211.11.105, 62.210.60.236, ...
Connecting to www.apache.org (www.apache.org)|88.198.26.2|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2017-10-04 11:56:40 ERROR 404: Not Found.

tar (child): /opt/apache-tomcat- 8.0.47.tar.gz: Cannot open: No such file or directory
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable: exiting now
mv: cannot stat ‘/opt/apache-tomcat- 8.0.47’: No such file or directory
rm: cannot remove ‘/opt/apache-tomcat- 8.0.47.tar.gz’: No such file or directory

adding | awk ‘{print $NF’} ) to the end of line 671 as a temporary fix

Tomcat 8 keeps crashing..

I don't think that Tomcat is actually running. How can I troubleshoot this with regard to your installation?

Connection Timeout with fresh ubuntu 14.04 install

Installed the script with on a fresh 14.04 install with Letsencrypt enabled. Letsencrypt reported success updating certs etc.
Everything with the script was successful.
After script is finished, browser connections to https://mydomain.com:8443 always get connection timeouts.
UFW logs report UFW Blocks from connections from my address. If I disable UFW, browser connections report an immediate Unable to Connect message.
Not sure where to proceed from here. TIA for any input.

LetsEncrypt Challenge

Not so much a Issue, but a note/question: in order to get LetsEncrypt to run through without error, i had to forward 443 to the Server as well.

Can this be avoided?

Does this portforward need to remain in place for the Cert-Update to happen?