CD/CSS/CSI

Apple OSX Configuration Management Design Note

Procure a third party tool that integrates with the existing SMS
infrastructure to provide configuration management of DOE owned Apple
OSX systems on the FNAL network

SMS Distribution Point Expansion

# Background

The DOE has mandated that FNAL track and centralize assets, patch
application and baseline compliance for all DOE owned computer systems.
The Computing Division Core Servers and Infrastructure Group (CSI) have
been chartered with providing these services for the lab.

The CSI group is responsible for the site SMS service used to manage
windows computers across the site. The SMS service provides a central
method for tracking assets, applying OS and software patches, and
configuring windows systems to meet baseline compliance. The SMS service
has been rolled out across the site and the implementation of the
service is well understood by systems administrators and local support
personnel across the FNAL site.

The CSI group recommends using a third party tool that integrates with
the existing SMS infrastructure to provide configuration management of
DOE owned Apple OSX systems on the FNAL network. This document outlines
the CSI group software recommendation and how it will integrate into our
existing SMS environment, implementation of the product including costs
and a timeline of expected implementation.

# Requirements

Quest Software provides a product, Vintela Management Extensions (VMX),
that integrates with an existing SMS environment to allow Windows and
non-Windows administrators to manage OSX systems:

-   System discovery - System information such as computer name and IP
    address is gathered.

-   Software distribution -- Packages are created that contain software,
    then distributed to select computers via a SMS advertisement.

-   Hardware and software inventory -- Scans are conducted every 2 days
    to ensure that hardware and software inventories are kept up to
    date.

-   Remote Tools -- VMX allows the administrator to launch Unix/Linux
    tools located on the VMX Client from a Windows machine. The VMX does
    not provide the ability to remotely control a Unix/Linux system like
    is available with a Windows system.

-   Reporting - Generating reports on systems, resources and
    applications. The reports are viewable by Internet Explorer.

-   Applying O/S and software patches - Vintela Management Extensions
    Software Distribution Wizard works much in the same way the SMS
    Distribution Software Wizard works for the windows platform.. At
    this point in time there is no equivalent MBSA scanner to detect
    which patch the non-Windows client needs.

# Design

The VMX Management Point Extension resides on the SMS Management Point.
The current SMS configuration houses the SMS Management Point on the
main SMS Server.

The VMX client must reside on every UNIX resource that is to be managed
by SMS.

There are currently 3 SMS-Admin members. These individuals have full
control of the SMS Server.

The SMS-OU-Admin is a group comprised of key individuals that represent
each division/section/experiment. The members of the SMS-OU-Admin group
will need the ability to do the following:

-   Run/create reports

-   Distribute Software/patches to their own groups via advertisements

-   Use remote control tools

The SMS OU Admins at this time will NOT have the ability to do the
following:

-   Distribute Software/patches to other groups

-   Create Packages

-   View other groups resources

-   Modify Security Rights

## Hardware

The proposed implementation will not require any new hardware. The
implementation will be installed on the existing SMS Server (Dell 2650).

## Software

Vintela Server Software - \$1463.00 (includes 5 client license,
workstation)

Vintela Client Software - \$35.00/client

# 

# Cost

  ------------------------------ -------------------- --------------------
  Hardware                       Cost                 Quantity

  Vintela Server                 1463                 1

  Vintela Client Software        10500                300
  ------------------------------ -------------------- --------------------

# Timeline

  ------------------------------ -------------------- --------------------
  Milestone                      Time                 FTE Needed

  Beta test                      2 weeks              1

  Release to lab                 2 weeks              1
  ------------------------------ -------------------- --------------------