My own settings are below, but if the goal was to only allow explicitly approved apps inbound you would -setallowsigned off This is one of those things that's still better managed via script.
Given that the configuration options are extremely poor, how do you manage the firewall to have some control over what is allowed through without pushing that responsibility to the user? Definitely not a good solution considering the other settings this configures. Being able to easily block this with a policy is nice, but then we have cases where someone wants to use AirPlay which needs incoming connections to work.Īllowing 1 application through the firewall does not appear to be an option so the alternative is to not apply the Security and Privacy policy to their machine. In our environment, we do not allow incoming connections nor server services to be running on user workstations. Also the fact that if you have a policy applied to the machine with the Firewall payload its locked to whether that policy says the Firewall is enabled or not.
The configuration options are very basic either Block Everything or Control incoming connections for specific apps which looks like you'd then need to populate the list with any application that could possibly receive incoming connection which seems like an impossible task. Struggling quite a bit with the Firewall features in JAMF and I'm wondering how others are working with or around it.
0 kommentar(er)
