Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: MicroMDM – Open Source MDM Server for Apple Devices

micromdm.io

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#21

Post by kiallmacinnes »

urda wrote: post #2

I'm curious do any HN readers manage their personal devices through MDM with their own profiles, and what benefits are you seeing from that?

Do I do it for my personal devices? No. Do I see any benefits? Nope! But ... when have I let that stop me from running something wildly inappropriate for a single user "enterprise"!

I don't own anything apple, so I'm unlikely to ever run this MDM, but, if a good Android one came to my attention.. maybe? I'm geeky enough to enjoy doing it, even if it comes with no real benefits to me.

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#22

Post by ghostly_s »

robinwassen wrote: post #17
ghostly_s wrote: post #15

Earlier quoted context omitted.

Setting up Mobile Device Management itself is not particularly onerous, it's definitely best practice to create a new Apple ID for that purpose, however. A technical individual can already do this easily enough with the freely-available Meraki MDM. The Device Enrollment Program I believe is more complicated and inaccessible to individuals (haven't dealt with this personally), and is quickly becoming a prerequisite fo…

Meraki MDM is not free anymore AFAIK. But if you signed up while they offered the 100 free devices plan it's still valid.

Hm, guess I missed that...and their offering has a long way to go before I'd consider it worth paying for. An alternative then might be Jamf, they recently started offering a free tier with a handful of devices for their hosted 'Jamf Now' MDM (or at least it's free via their promotions on sites like Daring Fireball).

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#23

Post by kiallmacinnes »

hsk0823 wrote: post #9
zalmoxes wrote: post #3

Earlier quoted context omitted.

The server is only meant for enterprise deployments. It would be pretty hard to do this on a personal level because you need to apply for an enterprise account with Apple, and request a very specific push certificate option.

Anyone can get a push certificate, it's not just businesses, https://identity.apple.com/pushcert/

While that is true, anyone can get a push notification cert, this is a different cert..

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#24

Post by walterbell »

zalmoxes wrote: post #10

Hi, I'm the author(along with several other developers). MicroMDM is used in some enterprise environments and was recently mentioned in a number of security presentations regarding Apple's MDM and Device Enrollment Program services. https://duo.com/labs/research/mdm-me-maybe https://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Dee...

Do you know if a small business can use DEP features?

Could per-app VPNs be used without DEP? If so, could they be used with MicroMDM, native iOS IPSEC client and an open-source VPN server, or is a 3rd-party VPN client like Cisco required for per-app VPN?

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#25

Post by andrewaylett »

urda wrote: post #2

I'm curious do any HN readers manage their personal devices through MDM with their own profiles, and what benefits are you seeing from that?

I'm administrator for GSuite for the school I'm a trustee of, so my personal (Android) device is enrolled by virtue of me wanting to know how it works and also wanting my school email on that device.

I'm not sure it would be worthwhile setting up for personal use -- the policies it lets you set aren't doing anything other than ensuring you're following best practices (like setting a screen lock) so you don't gain anything over just doing that, and the direct management tools aren't any finer-grained than you can get from Google's Find My Device.

I'm not sure you're able to set up a linked "for work" profile without MDM; that might be a benefit if you want compartmentalisation.

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#26

Post by zalmoxes »

walterbell wrote: post #24
zalmoxes wrote: post #10

Hi, I'm the author(along with several other developers). MicroMDM is used in some enterprise environments and was recently mentioned in a number of security presentations regarding Apple's MDM and Device Enrollment Program services. https://duo.com/labs/research/mdm-me-maybe https://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Dee...

Do you know if a small business can use DEP features? Could per-app VPNs be used without DEP? If so, could they be used with MicroMDM, native iOS IPSEC client and an open-source VPN server, or is a 3rd-party VPN client like Cisco required for per-app VPN?

Anyone can use DEP, just need a DUNS number to enroll into the program, and then to purchase devices from apple direct, or from an approved reseller. Unfortunately you cannot retroactively add devices that were already purchased.

DEP is not required for the VPN profile configs, that can be applied with just MDM (or even manually). The VPN payloads are documented here https://developer.apple.com/enterprise/documentation/Configu...

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#27

Post by walterbell »

zalmoxes wrote: post #26
walterbell wrote: post #24

Earlier quoted context omitted.

Do you know if a small business can use DEP features? Could per-app VPNs be used without DEP? If so, could they be used with MicroMDM, native iOS IPSEC client and an open-source VPN server, or is a 3rd-party VPN client like Cisco required for per-app VPN?

Anyone can use DEP, just need a DUNS number to enroll into the program, and then to purchase devices from apple direct, or from an approved reseller. Unfortunately you cannot retroactively add devices that were already purchased. DEP is not required for the VPN profile configs, that can be applied with just MDM (or even manually). The VPN payloads are documented here https://developer.apple.com/enterprise/documentati…

Are those the same profiles generated by Apple Configurator 2? I was able to get per-site Safari VPNs added by manually editing XML in the profile, but no success with per-application VPNs.

Commercial MDM providers only whitelist a handful of VPN client apps for per-app VPN profiles. Why are those needed when there is already a native iOS VPN client for IPSEC?

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#28

Post by walterbell »

zalmoxes wrote: post #26
walterbell wrote: post #24

Earlier quoted context omitted.

Do you know if a small business can use DEP features? Could per-app VPNs be used without DEP? If so, could they be used with MicroMDM, native iOS IPSEC client and an open-source VPN server, or is a 3rd-party VPN client like Cisco required for per-app VPN?

Anyone can use DEP, just need a DUNS number to enroll into the program, and then to purchase devices from apple direct, or from an approved reseller. Unfortunately you cannot retroactively add devices that were already purchased. DEP is not required for the VPN profile configs, that can be applied with just MDM (or even manually). The VPN payloads are documented here https://developer.apple.com/enterprise/documentati…

> purchase devices from apple direct, or from an approved reseller. Unfortunately you cannot retroactively add devices that were already purchased.

So you need to provide a DEP-authorized account number to the salesperson in an Apple store? Is this possible when buying online from apple.com?

Any idea why Apple does not provide a service to test whether a device serial number is DEP-managed? It would deter attempts to resell DEP-managed devices.

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#29

Post by zalmoxes »

walterbell wrote: post #27
zalmoxes wrote: post #26

Earlier quoted context omitted.

Anyone can use DEP, just need a DUNS number to enroll into the program, and then to purchase devices from apple direct, or from an approved reseller. Unfortunately you cannot retroactively add devices that were already purchased. DEP is not required for the VPN profile configs, that can be applied with just MDM (or even manually). The VPN payloads are documented here https://developer.apple.com/enterprise/documentati…

Are those the same profiles generated by Apple Configurator 2? I was able to get per-site Safari VPNs added by manually editing XML in the profile, but no success with per-application VPNs. Commercial MDM providers only whitelist a handful of VPN client apps for per-app VPN profiles. Why are those needed when there is already a native iOS VPN client for IPSEC?

they should be the same, yes. You can compare the .mobileconfig file with the spec from the PDF.

That's all commercial vendors do, push these XML files to your device.

Re: Show HN: MicroMDM – Open Source MDM Server for Apple Devices

#30

Post by walterbell »

urda wrote: post #2

I'm curious do any HN readers manage their personal devices through MDM with their own profiles, and what benefits are you seeing from that?

Apple Configurator 2 can be used locally to set some policies which are only available on "supervised" devices, e.g. prevent USB pairing with unknown computers.
Post reply on HN