Compare commits
No files matched your search
@@ -26,6 +26,18 @@ add-files:
|
||||
- ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
|
||||
- ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
|
||||
- ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
|
||||
# Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
|
||||
# changes are refused): real-time protection, behavior monitoring, PUA
|
||||
# blocking, cloud protection at the "high" block level, automatic updates
|
||||
# and sample submission, a daily quick scan at 12:00 and a weekly full scan
|
||||
# on Wednesday 12:30 (low priority, up to 2 h later at random). Settings
|
||||
# reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
|
||||
# Not set here: network protection (Insiders channels only) and tamper
|
||||
# protection (audit-only preview on Linux).
|
||||
- ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
|
||||
# Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
|
||||
# see the drop-in.
|
||||
- ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
|
||||
|
||||
postprocess:
|
||||
- |
|
||||
@@ -42,5 +54,7 @@ postprocess:
|
||||
[[ -f "${pp}" ]] && break
|
||||
done
|
||||
semodule -n -i "${pp}"
|
||||
# Fail the build on a typo rather than ship a config Defender can't read.
|
||||
python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
|
||||
rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
|
||||
chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst
|
||||
@@ -5,16 +5,23 @@
|
||||
# "44". Himmelblau reports VERSION_ID as the device's OS version and has no
|
||||
# setting for it. The rest of the system keeps the stock VERSION_ID, which
|
||||
# toolbox, flatpak and dnf expect to be the plain release.
|
||||
#
|
||||
# PRETTY_NAME becomes just NAME: libhimmelblau reports "PRETTY_NAME VERSION_ID"
|
||||
# as the OS version string, and Fedora's PRETTY_NAME already contains the
|
||||
# version ("Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0"). Nothing
|
||||
# else in Himmelblau reads PRETTY_NAME.
|
||||
set -euo pipefail
|
||||
|
||||
SRC=/usr/lib/os-release
|
||||
DEST=/run/himmelblau-os-release
|
||||
|
||||
version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
|
||||
name="$(. "${SRC}" && echo "${NAME:-Linux}")"
|
||||
|
||||
tmp="$(mktemp "${DEST}.XXXXXX")"
|
||||
if [[ -n "${version}" ]]; then
|
||||
sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}"
|
||||
sed -e "s/^VERSION_ID=.*/VERSION_ID=${version}/" \
|
||||
-e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${name}\"/" "${SRC}" > "${tmp}"
|
||||
else
|
||||
# No image version (not an ostree/bootc deployment): pass it through as-is.
|
||||
cat "${SRC}" > "${tmp}"
|
||||
|
||||
@@ -11,6 +11,9 @@ apply_policy = true
|
||||
# Fedora's admin group; members of sudo_groups (Entra group object IDs) are
|
||||
# added to it.
|
||||
local_sudo_group = wheel
|
||||
# Linux admins: members get wheel (sudo) at sign-in, and lose it again within
|
||||
# local_groups_reconcile_interval after leaving the group.
|
||||
sudo_groups = c3b1cfcc-7834-47eb-948b-a22204276453
|
||||
# Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
|
||||
home_attr = CN
|
||||
home_alias = SPN
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
# Install the image's enforced Defender settings each time Defender starts.
|
||||
# The image can't ship them in /etc directly: mdatp-firstboot creates
|
||||
# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
|
||||
# as local and ostree's /etc merge never adds new files under it. Copying on
|
||||
# every start also picks up changes from newer images and undoes local edits.
|
||||
[Service]
|
||||
ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"antivirusEngine": {
|
||||
"enforcementLevel": "real_time",
|
||||
"behaviorMonitoring": "enabled",
|
||||
"scanAfterDefinitionUpdate": true,
|
||||
"scanArchives": true,
|
||||
"disallowedThreatActions": ["allow", "restore"],
|
||||
"threatTypeSettingsMergePolicy": "admin_only",
|
||||
"threatTypeSettings": [
|
||||
{ "key": "potentially_unwanted_application", "value": "block" },
|
||||
{ "key": "archive_bomb", "value": "audit" }
|
||||
],
|
||||
"scheduledScan": "enabled"
|
||||
},
|
||||
"scheduledScan": {
|
||||
"dailyConfiguration": { "timeOfDay": 720 },
|
||||
"weeklyConfiguration": { "dayOfWeek": 4, "scanType": "full", "timeOfDay": 750 },
|
||||
"lowPriorityScheduledScan": true,
|
||||
"checkForDefinitionsUpdate": true,
|
||||
"randomizeScanStartTime": 2
|
||||
},
|
||||
"cloudService": {
|
||||
"enabled": true,
|
||||
"diagnosticLevel": "required",
|
||||
"automaticSampleSubmissionConsent": "safe",
|
||||
"automaticDefinitionUpdateEnabled": true,
|
||||
"cloudBlockLevel": "high"
|
||||
}
|
||||
}
|
||||
@@ -84,6 +84,34 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"SettingName": "DefenderBehaviorMonitoring",
|
||||
"Operator": "IsEquals",
|
||||
"DataType": "Boolean",
|
||||
"Operand": true,
|
||||
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
||||
"RemediationStrings": [
|
||||
{
|
||||
"Language": "en_US",
|
||||
"Title": "Behavior monitoring is off.",
|
||||
"Description": "Microsoft Defender behavior monitoring must be enabled. Update the device to the latest image or contact IT."
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"SettingName": "DefenderCloudProtection",
|
||||
"Operator": "IsEquals",
|
||||
"DataType": "Boolean",
|
||||
"Operand": true,
|
||||
"MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
|
||||
"RemediationStrings": [
|
||||
{
|
||||
"Language": "en_US",
|
||||
"Title": "Cloud-delivered protection is off.",
|
||||
"Description": "Microsoft Defender cloud-delivered protection must be enabled. Update the device to the latest image or contact IT."
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"SettingName": "DefenderDefinitionsUpToDate",
|
||||
"Operator": "IsEquals",
|
||||
|
||||
@@ -2,20 +2,26 @@
|
||||
# Intune custom compliance discovery script for Linux: is Microsoft Defender
|
||||
# for Endpoint (mdatp) installed, onboarded, licensed and protecting?
|
||||
#
|
||||
# Upload in Intune > Devices > Compliance > Scripts (Linux), and pair it with
|
||||
# defender-compliance.json in a Linux compliance policy (Custom compliance).
|
||||
# Himmelblau runs it as root inside himmelblaud-tasks.service and sends the
|
||||
# JSON on stdout to Intune, which evaluates it against the rules. Every setting
|
||||
# is always emitted, so a missing or stopped Defender reads as non-compliant
|
||||
# instead of as a script error.
|
||||
# Upload in Intune > Endpoint security > Device compliance > Scripts (Linux),
|
||||
# and pair it with defender-compliance.json in a Linux compliance policy
|
||||
# (Custom compliance). Himmelblau runs it as root inside
|
||||
# himmelblaud-tasks.service and sends the JSON on stdout to Intune, which
|
||||
# evaluates it against the rules. Every setting is always emitted, so a missing
|
||||
# or stopped Defender reads as non-compliant instead of as a script error.
|
||||
|
||||
MDATP=/usr/bin/mdatp
|
||||
|
||||
# Print one `mdatp health` field without quotes or a trailing " [managed]".
|
||||
# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
|
||||
# Defender won't answer `mdatp health` started from inside himmelblaud-tasks
|
||||
# (it can't read that process while checking the caller), so ask through
|
||||
# systemd, which runs mdatp as its own child. Elsewhere, ask mdatp directly.
|
||||
health="$(systemd-run --quiet --wait --pipe --collect "${MDATP}" health 2>/dev/null)"
|
||||
grep -q '^healthy' <<< "${health}" || health="$("${MDATP}" health 2>/dev/null)"
|
||||
|
||||
# Print one field of the `mdatp health` output ("name : value") without
|
||||
# quotes or a trailing " [managed]".
|
||||
field() {
|
||||
"${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
|
||||
| sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
|
||||
grep -m1 "^$1 *:" <<< "${health}" \
|
||||
| sed -e 's/^[^:]*: *//' -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
|
||||
}
|
||||
|
||||
bool() {
|
||||
@@ -28,6 +34,8 @@ healthy=false
|
||||
licensed=false
|
||||
onboarded=false
|
||||
rtp=false
|
||||
behavior_monitoring=false
|
||||
cloud_protection=false
|
||||
definitions_ok=false
|
||||
definitions_age=-1
|
||||
version=""
|
||||
@@ -40,6 +48,8 @@ if [[ -x "${MDATP}" ]]; then
|
||||
healthy="$(bool "$(field healthy)")"
|
||||
licensed="$(bool "$(field licensed)")"
|
||||
rtp="$(bool "$(field real_time_protection_enabled)")"
|
||||
[[ "$(field behavior_monitoring)" == enabled ]] && behavior_monitoring=true
|
||||
cloud_protection="$(bool "$(field cloud_enabled)")"
|
||||
[[ -n "$(field org_id)" ]] && onboarded=true
|
||||
[[ "$(field definitions_status)" == up_to_date ]] && definitions_ok=true
|
||||
age="$(field definitions_updated_minutes_ago)"
|
||||
@@ -57,6 +67,8 @@ cat <<EOF
|
||||
"DefenderLicensed": ${licensed},
|
||||
"DefenderOnboarded": ${onboarded},
|
||||
"DefenderRealTimeProtection": ${rtp},
|
||||
"DefenderBehaviorMonitoring": ${behavior_monitoring},
|
||||
"DefenderCloudProtection": ${cloud_protection},
|
||||
"DefenderDefinitionsUpToDate": ${definitions_ok},
|
||||
"DefenderDefinitionsAgeDays": ${definitions_age},
|
||||
"DefenderVersion": "${version}"
|
||||
|
||||
@@ -56,7 +56,7 @@ if [[ ! -x "${MDATP}" ]]; then
|
||||
fi
|
||||
|
||||
# The image finishes the Defender install on first boot (mdatp-firstboot).
|
||||
if [[ ! -f /var/lib/mdatp-firstboot.done ]]; then
|
||||
if [[ -x /usr/libexec/mdatp-firstboot && ! -f /var/lib/mdatp-firstboot.done ]]; then
|
||||
log "Defender first-boot setup has not completed; starting it."
|
||||
systemctl start mdatp-firstboot.service
|
||||
fi
|
||||
@@ -71,8 +71,16 @@ if ! wait_for_daemon; then
|
||||
fi
|
||||
|
||||
if [[ -z "$(field org_id)" ]]; then
|
||||
if [[ "${ONBOARDING_JSON}" == REPLACE_WITH_MDATP_ONBOARD_JSON ]]; then
|
||||
# Prefix match, so the placeholder appears only once in this file and a
|
||||
# find-and-replace of it can't hit this line.
|
||||
if [[ "${ONBOARDING_JSON}" == REPLACE_WITH_* ]]; then
|
||||
log "Defender is not onboarded and this script has no onboarding JSON."
|
||||
elif ! printf '%s\n' "${ONBOARDING_JSON}" \
|
||||
| python3 -c 'import json, sys; assert "onboardingInfo" in json.load(sys.stdin)' 2>/dev/null; then
|
||||
# A paste that lost the first "{" or last "}" line would otherwise leave
|
||||
# Defender with an unreadable onboarding file ("No license found").
|
||||
log "The onboarding JSON in this script is not valid; paste mdatp_onboard.json again, including its first '{' and last '}' lines."
|
||||
exit 1
|
||||
else
|
||||
log "Defender is not onboarded; writing ${ONBOARD_FILE}."
|
||||
install -d -m 0755 "$(dirname "${ONBOARD_FILE}")"
|
||||
@@ -85,18 +93,30 @@ if [[ -z "$(field org_id)" ]]; then
|
||||
fi
|
||||
fi
|
||||
|
||||
# Settings Defender's own policy manages show " [managed]" and can't be
|
||||
# changed locally; this only fixes a locally disabled real-time protection.
|
||||
# Settings a managed config (mdatp_managed.json) sets show " [managed]" and
|
||||
# can't be changed locally; these fix devices without one, where behavior
|
||||
# monitoring is off by default. Behavior monitoring needs real-time
|
||||
# protection, so that goes first.
|
||||
if [[ "$(field real_time_protection_enabled)" != true ]]; then
|
||||
log "Real-time protection is off; enabling it."
|
||||
"${MDATP}" config real-time-protection --value enabled
|
||||
fi
|
||||
|
||||
if [[ "$(field behavior_monitoring)" != enabled ]]; then
|
||||
log "Behavior monitoring is off; enabling it."
|
||||
"${MDATP}" config behavior-monitoring --value enabled
|
||||
fi
|
||||
|
||||
if [[ "$(field cloud_enabled)" != true ]]; then
|
||||
log "Cloud-delivered protection is off; enabling it."
|
||||
"${MDATP}" config cloud --value enabled
|
||||
fi
|
||||
|
||||
if [[ "$(field definitions_status)" != up_to_date ]]; then
|
||||
log "Definitions are not up to date; updating them."
|
||||
"${MDATP}" definitions update
|
||||
fi
|
||||
|
||||
healthy="$(field healthy)"
|
||||
log "healthy=${healthy} licensed=$(field licensed) org_id=$(field org_id) rtp=$(field real_time_protection_enabled) definitions=$(field definitions_status)"
|
||||
log "healthy=${healthy} licensed=$(field licensed) org_id=$(field org_id) rtp=$(field real_time_protection_enabled) behavior_monitoring=$(field behavior_monitoring) cloud=$(field cloud_enabled) definitions=$(field definitions_status)"
|
||||
[[ "${healthy}" == true ]]
|
||||
Reference in new issue
Block a user