Simple, Safe, Secure Ransomware Protection

Deployment with Munki

White Papers

Retrospect Backup 16 includes improved support for deployment toolsets. With Munki for macOS, you can deploy macOS clients throughout your infrastructure.

Let’s walk through the process step-by-step. It assumes you have administrative access but you haven’t installed Server.app.

Munki Versions

There are several versions of Munki:

  • Munki 1.x and earlier support Mac OS X 10.5–10.9.x.

  • Munki 2.x supports Mac OS X 10.6 – 10.11.x

  • Munki 2.3.1 or higher is recommended for use with OS X 10.11 and macOS 10.12.

  • Munki 3.x supports OS X 10.8 and higher.

The following was verified with Munki 3.5 on a macOS High Sierra (10.13.6) system.

Configure Munki Web Server

Munki is an web service that you host on a local web server. You use a web server to host the Munki repo on a Mac, Windows, or Linux system.

  1. Follow these instructions for setup. We tested with an Apache web server

  2. Set up the Munki repo on the same system as well. configure an apache webserver as well as a munki repo on the same system.

If you need any help, please check the Munki FAQ first. Additional steps are needed for the Retrospect client when using Firefox.

Configure Retrospect Client

The best way to deploy the Retrospect Client is with a public key. To do this with Munki, we first need to construct a single package that it can deploy: a DMG.

  1. Open "Disk Utility".

  2. Select "File > New Image" and create a new image.

  3. Add the Retrospect Client installer package file along with a folder named "public_key" with the "pubkey.dat" file inside it and save the DMG file.

Adding to Munki

Our next step is to add the client DMG to Munki for deployment. Munki needs to know what the package is.

We import the DMG with /usr/local/munki/munkiimport /path_to_dmg_file. Then we fill out the resulting prompt as follows (for 15.6.1 in this case):

Item name: Retrospect Client Installer
Display name: Retrospect Client
Description: Client for Retrospect
Version: 15.6.1.105
Category: Backup
Developer: Retrospect, Inc.
Unattended install: False
Unattended uninstall: False
Catalogs: retrospect
Import this item? [y/n] y
Upload item to subdirectory path []: apps/retrospect
Copying Retrospect Client 15_6.dmg to repo...
Copied Retrospect Client 15_6.dmg to pkgs/apps/retrospect/Retrospect Client 15_6-15.6.1.105.dmg.
Edit pkginfo before upload? [y/n]: y
Pkginfo editing complete? [y/n]: y
Saved pkginfo to pkgsinfo/apps/retrospect/Retrospect Client Installer-15.6.1.105.
Rebuild catalogs? [y/n] y

We need to add one more piece for successful remote deployment. Selecting "Edit pkginfo before upload? [y/n]: y" will open a XML file. After <key>receipts</key> <array> </array>, you need to add the following for the install script to properly load the client after installation.

   - <key>postinstall_script</key>
   - <string>#!/bin/sh
   - launchctl load -w "/Library/LaunchDaemons/com.retrospect.retroclient.plist"
   - exit 0
   - </string>

With the pkginfo file saved, you can manually check in Munki’s Managed Software Center. The auto-update service will also let you know automatically when an update is available. After it is installed, the client is ready to be added.

Additional Information

  • Receipts: The Retrospect Client uninstaller script does not remove receipts for the client. If the system has had a client installed and Munki is trying to determine if the same client version needs to be installed, it will think it is already installed. Receipts are under /private/var/db/receipts, and all .bom and .plist client files need to be deleted.

  • Upload Error: Uploading the custom created .dmg file using munkiimport will report an error during the process. "ERROR: hdiutil error nx_kernel_mount:1359:". This is cosmetic and does not affect the process.

  • Site Uninstall: To use Munki to uninstall the client, customers can add the Retrospect Client to the site manifest file. They would move the client from managed installs to managed uninstalls. This would be for a wide removal of the client. For specific machines, it’s easier to have customers use the uninstaller script.

  • Mass Updates: Customers can use Munki to keep the client up to date without having to make changes in Retrospect, following the same process above.

  • RCU: Customers can also use the .rcu file to update the client using Retrospect Backup. Munki will not try and push out the older version.

  • Debugging: A handy way to see why the client is not being offered to the munki client machine is to run "sudo /usr/local/munki/managedsoftwareupdate -v" from the client machine. This will help customers troubleshoot the issue.

Last Update: March 5, 2019