Linux Profiles

Profiles are the primary means to manage devices. Configure profiles so that your Linux devices remain secure and configured to your preferred settings.

Think of profiles as the settings and rules that, when combined with compliance policies, help you enforce corporate rules and procedures. Profiles contain the settings, configurations, and restrictions that you want to enforce on devices.

A profile consists of the general profile settings and a specific payload. Profiles work best when they contain only a single payload.

Wi-Fi Profile for Linux

Configuring a Wi-Fi profile lets devices connect to corporate networks, even if they are hidden, encrypted or password protected.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the General Settings for the profile as appropriate.

3. Select the Wi-Fi payload.

4. Configure Wi-Fi settings, including:

   Setting	Description
   Service Set Identifier	Provide the name of the network.
   Hidden Network	Indicate if the Wi-Fi network is hidden.
   Set as Active Network	Indicate if the device connects to the network with no end-user interaction.
   Security Type	Specify the access protocol used and certificate are requirements. Required fields depend on the selected security type. If None or WPA/WPA 2 are selected, then the Password field displays. If WPA/WPA 2 Enterprise is selected, then the Protocols and Authentication fields display. Protocols - Use Two Factor Authentication SFA Type Authentication - Identity Anonymous Identity Username Password Identity Certificate Root Certificate
   Password	To connect to the network, provide the required credentials for the device. The password field displays when WPA/WPA 2 is selected from the Security Type field.
   Proxy Type	To configure the Wi-Fi proxy settings, enable Proxy Type.
   Proxy Server	Enter the hostname or the IP address for the proxy server.
   Proxy Server Port	Enter the port for the proxy server.
   Exclusion List	To exclude from the proxy, enter the hostnames. Hostnames entered here are not routed through the proxy. Use the * as a wildcard for the domain. For example: *.omnissa.com or *omnissa.com.

5. Select Save and Publish.

Credential Profile for Linux

To protect corporate assets and for greater security, implement digital certificates. To implement digital certificates you must define a certificate authority, then configure a Credentials payload alongside your Wi-Fi payload. Each payload has settings for associating the certificate authority defined in the Credentials payload.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.
2. Configure the profile's General settings as appropriate.
3. Select the Credentials profile.
4. Select Configure.
5. To select either Upload or Defined Certificate Authority for the Credential Source, use the drop-down menu. The remaining profile options are source-dependent. If you select Upload, then you must enter a Credential Name and upload a new certificate. If you select Defined Certificate Authority, then you must choose a predefined Certificate Authority and a template.
6. Select Save and Publish.

Note:

The tools, certutil (for cer files) and pk12util (for pfx files) are used to install certificates to each user’s browser database/profile. By default, these certificates are accessible to all users in Firefox or Chromium-based browsers. During the certificate profile installation, Intelligent Hub first applies the certificate to the default certificate location. Then, the browser sqlite database updates with the same certificate.

All pfx/cer files are included and are a part of the browser. During installation all user certificate databases are included in the installed profile because each user has their own certificate database in the browser, and the Intelligent Hub is not associated with the local user.

Also, during uninstall of a certificate profile (or certificate revocation), the installed certificate is removed from the default certificate locations and from the browser certificate database.

Custom Configuration Profile

The Custom Configuration payload can be used to configure your Linux devices with features that the Workspace ONE UEM console does not currently support through its native payloads. This payload currently uses open source Puppet for this configuration, so nothing other than the free Puppet agent installed on the device to support this functionality.

When a custom configuration profile is assigned to a Linux device, Workspace ONE UEM passes the manifest to the Puppet running on the device. Currently, when a device is enterprise wiped or unenrolled, these configuration changes are not removed from the device unless a removal manifest is defined in the profile.

For more information on Puppet, including sample manifests, see: http://forge.puppet.com.

To validate the syntax of your puppet code, see: https://validate.puppet.com.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the General settings for the profile as appropriate.

3. Select the Custom Configuration profile.

4. Select Configure.

5. Configure the payload including:

   Setting	Description
   Name	Populate a name that distinguishes this payload from others.
   Enforce Manifest	If selected, then reapply the manifest at the data transmit interval configured in Settings > Device & Users > Linux > Intelligent Hub Settings. If deselected, then the manifest executes once when the profile initially pushes to the device.
   Check for Dependency	If the puppet manifest has a required dependency, then it can be included here. For example, "puppetlabs/stdlib".
   Install Manifest	Copy and paste the content of your Puppet Manifest here. This manifest implements on the device assigned in the general tab.
   Remove Manifest	This manifest executes on the device when this profile is unassigned from a device. If this manifest is left blank, when a custom configuration profile is removed from a device, the action dictated by the Install Manifest remains on the device.

6. Select Save and Publish.

Custom Configuration Examples

Puppet Manifest Examples

Learn and explore Puppet if you are interested in creating custom configuration profiles. To get started, the following are examples of Puppet code that can be used on standard Ubuntu. They do not work on other distributions of Linux.

Install Chrome Browser on Ubuntu:

• Dependency: None
• Installation Manifest:

file { 'google-chrome-stable_current_amd64.deb': source => 'https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb', path => '/tmp/google-chrome-stable_current_amd64.deb', ensure => present, } exec { 'install-chrome': command => '/usr/bin/dpkg -i /tmp/google-chrome-stable_current_amd64.deb', logoutput => true, }

• Removal Manifest:

package { 'google-chrome-stable': ensure => 'absent', }

Deactivating SSH Server on Ubuntu:

• Dependency: puppetlabs-stdlib

• Installation Manifest:

service { 'ssh': name => 'sshd', ensure => false, enable => false,}

Removal Manifest:

service { 'ssh': name => 'sshd', ensure => true, enable => true,}