Technology Services, Munki Changelog

Munki

Upcoming Events

Past Events

The Endpoint Services team will be applying an emergency patch tomorrow morning, from 7:00 AM to 9:00 AM on the Multi-Tenant Munki server. The service will be unavailable intermittently during the event. This should resolve any issues with Munki introduced by the recent macOS 11.3 upgrade. Any Macs that had previously been upgraded to macOS 11.3 should begin reconnecting afterwards. No further action is required by IT Pros.

• Transition Multi-Tenant Munki client authentication from using SSL client authentication to basic authentication
  • Resolves issues with Munki client authentication introduced by the macOS 11.3 update
• Improve the Munki service’s resiliency during periods of high demand

On Wednesday, February 15, from 7:00 AM to 9:00 AM, the Endpoint Services (EPS) team will be making modifications to the Multi-Tenant Munki service. During this time, portal access and WebDAV access may be interrupted. No further action is required by IT Pros.

• Update the MTM Shibboleth metadata configuration

On Wednesday, October 7, from 7:00 AM to 9:00 AM, the Endpoint Services (EPS) team will be making modifications to the Multi-Tenant Munki service. During this time, portal access and WebDAV access may be interrupted. No further action is required by IT Pros.

• Fix bug where computers with an ‘ungenerated’ status did not respect their time window
• Fix sorting of software on the MTM software list
• Add HTML lang attribute to portal for improved accessibility
• Backend PHP upgrade
• Add separate download links for Munki v4 and Munki v5 to MTM downloads page

Endpoint Services is currently testing Munki version 5 (v5) and will be rolling it out to endpoints using the Multi-Tenant Munki service. Munki v5 introduces some significant changes to how Munki handles updates:

• On macOS 10.14+, Munki v5 won't attempt installation of Apple Updates that require a restart (e.g. point releases, security updates, BridgeOSupdates)
  • For these updates, Munki v5 directs users to System Preferences - Software Update
• Munki v5 offers additional update encouragement, including number of days an update has been pending
• More aggressive update notification behavior begins after 14 days (a default setting), making it more difficult for users to ignore or defer pending updates
  • EPS will offer optional configurations for 7, 21, and 30 days before aggressive update notification behavior begins
  • EPS will also offer an optional configuration to completely disable aggressive update notification behavior
• Currently there's no Apple-supported method for automated, touch-free updates
  • EPS is testing a workaround for non-T2, non-encrypted hardware
• EPS will release Munki v5 using a different name key than v4, allowing stakeholders to make the transition at their own pace

On Thursday, January 23, from 7:00 AM to 9:00 AM, the Endpoint Services (EPS) team will be making modifications to the Multi-Tenant Munki service. During this time, portal access and WebDAV access may be interrupted. No further action is required by IT Pros.

• The work will fix a bug that affects the re-onboarding of machines that do not have MunkiReport installed.

MunkiReport

Past Events

On Tuesday, April 20th, from 7:00 AM to 9:00 AM, the Endpoint Services team will be upgrading the MunkiReport server to version 5.6.5. No further action is required by IT Pros.

• New Browser Extensions module
  • Only works for Google Chrome, Microsoft Edge, and Mozilla Firefox browsers

• Fix for 32-bit apps widgets
• Fix for Bluetooth module logic for devices with Bluetooth enabled but no connected devices
• Fix for Devtools module logic for devices that do not have Xcode installed
• Fix for Disk Report module for disk encryption status of FileVaulted APFS volumes
• Fix for Software Update module not collecting MRT update data on newer versions of macOS
• Fix for USB module for broken widgets and issues with devices without vendor IDs

• Updated Apple support URL used for machine model lookups to use HTTPS
• Add text renderer to Applications module to prevent cross-site scripting (XSS) attacks.
• Update Shibboleth to v3.2.1

• Improvements to Power module for better support of Big Sur and M1 machines
• Changes to CrowdStrike module so that only non-empty records are displayed in the listing
• General cleanup of Find My Mac module and added 'Date Enabled' field
• General cleanup of iBridge module and addition of new fields (iBridge version, iBridge hardware model, Machine region, iBridge OS version, iBridge board ID, Machine model)
• General cleanup of Printer module
• General cleanup of USB module

On Tuesday, March 2nd, from 7:00 AM to 9:00 AM, the Endpoint Services team will be upgrading the MunkiReport server to version 5.6.4. No further action is required by IT Pros.

• macOS 11 Big Sur support
• Apple Silicon M1 support
• Application architecture (Universal, Intel) column added to the applications listing

On August 12, 2020, the Endpoint Services team will be upgrading the MunkiReport service to version 5.6.3. All existing endpoint data will remain intact. IT Pros will need to clear their browser cache or use private browsing to avoid issues with deleting machines.

• Patches a number of security vulnerabilities
  • XSS Filter Bypass On Comments
  • CSRF Bypass On Endpoints With No Body Parameters
  • munki_facts XSS
  • Reflected XSS In Managedinstalls Module
  • SQL Injection In Datatables Order By In Post Body
  • SQL Injection In Reportdata Ip In 'req' GET Parameter
  • SQL Injection in softwareupdate module
• Improvement in disk report module so that only the root partition is used when calculating FileVault status
• “Auth Restart Supported” column added to the FileVault Listing
• Removal of external IP in network module
  • Fixes issue with data ingestion failure causing partial client imports
• Log file size added to MunkiReport module
• Fix for passing Munki runtype variable in preflight scripts (used by MunkiTimeWindow)
• Miscellaneous backend fixes and enhancements

On July 7, 2020, the Endpoint Services team will be upgrading the MunkiReport service to version 5.6.2. All existing endpoint data will remain intact. No further action is required by IT Pros.

• Adds macOS 11.0 (Big Sur beta) as latest highest supported OS
• Miscellaneous backend fixes and enhancements

On June 11, 2020, the Endpoint Services team will be upgrading the MunkiReport service to version 5.5.1. No further action is required by IT Pros. The client upgrade installer will be promoted to production catalogs during the regular Wednesday release cycle.

• New Firewall module
• Apple Remote Desktop module rewrite with additional data added to Apple Remote Desktop module (ARD users, VNC enabled, Allow All Local Users, etc.)
• Additional data added to MunkiReport module (MR file upload size, MR warnings, start/end time, etc.)
• Localadmin module deprecated and replaced with the new Users module
  • Some existing data for users/local administrators on devices will be erased! Data should repopulate upon next client check-in following the installation of the latest MunkiReport package.
• Highest Supported OS module renamed to Supported OS
  • Module now shows the operating system that a machine shipped with
• Archiver user role added
• Miscellaneous bug fixes

On May 28, 2020, from 7:00 AM to 9:00 AM, the Endpoint Services team will be upgrading the MunkiReport service to version 5.4.1. No further action is required by IT Pros. The client upgrade installer will be promoted to production catalogs during the regular Wednesday release cycle.

• New archiving feature
  • Archiving machines will not remove them from Endpoint Services billing! Be sure to delete inactive machines to avoid inaccurate charges.
  • Similar to deleting machines, only users with the MunkiReport admin role can archive machines.
  • Archived machines that check-in again should automatically change their status from ‘Archived’ to ‘In Use’.
  • New archive filters have been added.
• Bluetooth module rewrite with enhanced features
  • Existing Bluetooth device data will be erased! Bluetooth data should repopulate upon next client check-in.
• Miscellaneous bug fixes

On Tuesday, May 5th, from 7:00 AM to 9:00 AM, the Endpoint Services (EPS) team will be upgrading the MunkiReport server to version 5.3.5. All existing endpoint data will remain intact. No further action is required by IT Pros. The client upgrade installer will be promoted to production catalogs during the regular Wednesday release cycle.

• Zoom has been added to the App Versions report
• Cross Site Request Forgery (CSRF) vulnerability patches
• Fix for PHP and Apache version information leakage
• Miscellaneous bug fixes