Manage Octory Helper

Whether it is to execute a termination script with root privileges, or to execute Octory PRO actions, you might have to use the privileged Helper available on the website. This tip will show you how to intall the Helper as an admin and not through the authorization pane with Octory, as well as how to remove it.

The app will try to install the Helper with an admin authorization panel if it has to execute an action with root rights (like ExecuteCommand) although the Helper is not installed and ready to run. But - and it is an important “but” - it will require a user with admin rights to install the Helper. Thus, when you deploy the app, the user will be asked to enter the admin credentials to install the Helper. This is the reason why the Helper is provided separately so that you can install it when deploying Octory with your root privileges.

Install the Helper

Once you downloaded the zip file and unarchived it, you will find 4 files:

You might have to remove the quarantine set by the system on the script in order to execute it after deployed. To know if the file is quarantined, you can run
xattr HelperInstall/installHelper.sh
You should see a flag com.apple.quarantine is the file is quarantined. To remove it, run
xattr -d com.apple.quarantine HelperInstall/installHelper.sh

This script has to be executed with root rights, and will exit if not. It will check if the Helper and the daemon are installed and if the daemon is loaded. If one of those conditions is not met, the script will try to perform the required step like installing the Helper or loading the daemon.

Starting from Octory 2.0.6, the Helper has received a minor security update to check the app's connection.
It's possible that you encounter a problem with the Helper when executing actions or running the termination script in specific use cases like prestage enrolments. When such problems arise, the logs print a "Couldn't get 'secCode' message.
To prevent the problem, it's possible to install the weak helper which will not check the connection. When doing so, it's your responsibility to remove the Helper once the onboarding is over. To use the weak helper, add the --weak flag when calling the install script.

./installHelper.sh --weak

Check the installation

To make sure the Helper is properly installed, you can run

sudo launchctl list | grep com.amaris.octory.helper
If everything has been installed correctly, the command should output something like
-	0	com.amaris.octory.helper

Remove the Helper

If you use Octory for onboarding only, it's better to remove it from the system once the Mac is ready. Doing so, it's necessary to remove the Helper to avoid this tool to be forgotten and remain on the system with the unavoidable risk to be misused by an attack.To do so, 3 steps have to be performed:
  1. Unload the daemon
  2. Remove the daemon
  3. Remove the Helper
You can either execute the script removeHelper.sh from the HelperInstall folder or execute the following commands.
launchctl unload /Library/LaunchDaemons/com.amaris.octory.helper.plist
rm /Library/LaunchDaemons/com.amaris.octory.helper.plist
rm /Library/PrivilegedHelperTools/com.amaris.octory.helper

Go further