Use in a Classifed ISOLATED system

[chiefbobkat]

Hello,
I am new to mac administration.
Will these scripts work on a system that has NO Outside connections? The lab where these macs are going is classified and will not have a MDM to connect to.

[vaughnhart]

Air-gapped machines wouldn't be possible unless you have a local air-gapped "domain"/server that is running everything over local SSL. But there are too many caveats and unwanted possibilities. It would probably have to be Linux and a Linux air-gapped MDM. You could also generate the profiles you need install them locally. But air-gapped is air-gapped.

[robertgendler]

@chiefbobkat It’s completely possible to use the project except for 2 or 3 rule files. You’ll have to manually install the mobile config profiles by hand and approving them in the GUI.

You can set up a launchdaemon to run the compliance script generated for check and fix

the project was built with the idea to use this even without an mdm (although painful but possible).

[jamierrichardson]

https://it-training.apple.com/tutorials/apt-compliance/

Apple's Mac Security Compliance training includes instructions on how to package the shell script and a launchd to run mSCP checks and fixes without reliance on a mdm.
As the esteemed Mr. Gendler stated, it's possible to use mSCP without MDM. However, that information (and the link above) are provided for informational purposes only.

This is a situation where you should NEVER let a third party without intimate knowledge of your environment advise or influence your decisions (for or against... or what platforms to use). Remember, this is a public github - I would suggest reaching out to the vendor (Apple) to gather appropriate information for your evaluation.

[chiefbobkat]

Thank you all!
Let me redirect the question. Would it be possible to set up a baseline machine that is connected to an MDM, create all the profiles and settings needed and then image the baseline machine and apply that image to the air-gapped classified machines?

[robertgendler]

No. Absolutely not. You can not "image" a Mac. It hasn't been possible for like 8 years or so.

[robertgendler]

@chiefbobkat you can contact your Apple SE, there's quite a few for government world.

[chiefbobkat]

Thank you all for answering my questions. I have been able to close all but 12 of the STIG requirements using these tools. Thank you!