MacOS - FortiClient Installer .SH Installs and Configures all in one script

[barlowaaronrva]

1. Make sure to read through this and edit the configs and everything else, I did not go to deep on documenting so you will need to read through this carefully. 

1. Add the config profile to intune

2. add this as a script after adjusting in intune and run as system for macs

3. have some tea

notes: you can put the dmg anywhere not just blob

#!/bin/bash

weburl="use azure blob storage" # Replace with your own URL path

FortiClient_Installerversion="7230822" #Enter your FortiClient installer version using version and build number. e.g FortiClient 7.2.2 would be value "7220776"

# Please modify below values based on the new FCT installer feature set created on the EMS, and please don't modify other part of the script.

av="0"	# Enter 0 when Malware feature is disabled in the FortiClient installer
af="0"	# Enter 0 when Application Firewall  feature is disabled in the FortiClient installer
sb="0"	# Enter 0 when Advanced Persistent Threat (APT) components feature is disabled in the FortiClient installer
sra="0"	# Enter 0 when Secure Access Architecture Components feature is disabled in the FortiClient installer
sso="1"	# Enter 0 when Single Sign-On Mobility Agent feature is disabled in the FortiClient installer
vs="0"	# Enter 0 when vulnerability Scan feature is disabled in the FortiClient installer
wf="0"	# Enter 0 when Web Filtering feature is disabled in the FortiClient installer

# FortiClient 6.4 does not have ZTNA feature, and FCT 7.0 or higher version will always install ZTNA  feature because of the mantis 0825169.

# ztna="1" # You should keep this value as "1" until the mantis 0825169 get fixed.

# Please set uninstall value to 1 for FortiClient un-installatiion only. By default, the uninstall value is '0' for deployment.
uninstall="0"

# For 7.2.3, FCT uses ftgdagent process for webfiltering by default.
# Enabling the new webfilter with https mode will install a new certificate in the system keychain access, which requires admin's permission to trust the certificate.
# set httpsmode to "0" to disable https mode inspection (default action), set httpsmode to "1" to enable.
httpsmode="0"

tempdir="/tmp/Installer"
MOUNT_POINT="$tempdir/mount"

appname="FortiClient" # The name of our App deployment script (also used for Octory monitor)

logandmetadir="/Library/Logs/MDM/$appname"
log="$logandmetadir/$appname.log"

function startLog() {
    ## Check if the log directory has been created
    if [ ! -d "$logandmetadir" ]; then
        ## Creating Metadirectory
        echo "$(date) | Creating [$logandmetadir] to store metadata"
        mkdir -p "$logandmetadir"
    fi
}

## Install DMG Function
function installDMG () {
    cd "$tempdir"
    mkdir -p $MOUNT_POINT
    echo "made directory $MOUNT_POINT"
    echo $PWD

    hdiutil attach installer.dmg -mountpoint $MOUNT_POINT -noverify -nobrowse -noautoopen
    sudo /usr/sbin/installer -pkg $MOUNT_POINT/Install.mpkg -target /
    if [[ $httpsmode == 0 ]]; then
        DisableHTTPSMode
    else
        echo "Https Mode is enabled."
    fi
    echo "New FCT Has been installed successfully"
    hdiutil detach $MOUNT_POINT
    echo "Unmount FCT mount point"
}

function downloadApp () {
    rm -rf $tempdir
    mkdir -p $tempdir
    cd "$tempdir"
    echo "Tries to Download FortiClient deployment Package from MIS EMS server"
    curl -k --connect-timeout 30 --retry 5 --retry-delay 60 -L -J -O "$weburl"
    if [ $? -eq 0 ]; then

        # We have downloaded a file, we need to know what the file is called and what type of file it is
        tempSearchPath="$tempdir/"
        for f in $tempSearchPath*; do
            tempfile=$f
            echo "tempfile 0 $tempfile"
        done

        mv "$tempfile" "$tempdir/installer.dmg"
        tempfile="$tempdir/installer.dmg"

    else
        echo "$(date) | Failure to download [$weburl] to [$tempfile]"
        exit 1
    fi

    sudo /Applications/FortiClientUninstaller.app/Contents/Library/LaunchServices/com.fortinet.forticlient.uninstall_helper upgrade-uninstall
    echo "FCT Mac has been uninstalled"
}

function UninstallFCT () {
    sudo /Applications/FortiClientUninstaller.app/Contents/Library/LaunchServices/com.fortinet.forticlient.uninstall_helper upgrade-uninstall
    echo "FCT Mac has been uninstalled"
}
function DisableHTTPSMode () {
    sudo rm /Library/Application\ Support/Fortinet/FortiClient/data/enable_wf_https_mode
    echo "https mode disabled"
}

if [ $EUID -ne 0 ] || [ "$(id -u)" != "0" ]; then
    echo "Please run as root"
    exit 1
fi

startLog
echo ""
echo "##################################################################"
echo "# $(date) | Logging Deployment of FortiCLient Mac"
echo "##################################################################"
echo ""
echo $4

if [[ $uninstall == 1 ]]; then
    UninstallFCT
    exit 0
elif [[ $uninstall == 0 ]]; then

    # Verifying FortiClient has been already Installed or not.
    if open -Ra "FortiClient" ; then

    # Checking FortiClient Version
    FortiClient_version="$(grep -A1 'version=' /Library/Application\ Support/Fortinet/FortiClient/conf/fctinfo | sed 's/.*=//' | tr -d '.')"
    echo "Current FortiClient Version = ${FortiClient_version}"

        # Comparing FortiClient version
        if [[ "$FortiClient_version" == *"$FortiClient_Installerversion"* ]]; then

            #Checking FCT is only-VPN or Full version
            if [ -f "/Library/Application Support/Fortinet/FortiClient/bin/epctrl" ]; then

                # Extracting feature values from config.plist file
                ep_av="$(grep -A1 '<key>AntiVirus</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"
                ep_af="$(grep -A1 '<key>ApplicationFirewall</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"
                ep_sb="$(grep -A1 '<key>Sandboxing</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"
                ep_sra="$(grep -A1 '<key>SecureRemoteAccess</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"
                ep_sso="$(grep -A1 '<key>SingleSignOn</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"
                ep_vs="$(grep -A1 '<key>VulnerabilityScan</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"
                ep_wf="$(grep -A1 '<key>WebFiltering</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"

                # You maybe uncomment this once the mantis 0825169 get fixed.
                # ep_ztna="$(grep -A1 '<key>ZeroTrustNetworkAccess</key>' /Library/Application\ Support/Fortinet/FortiClient/conf/custom.plist)"
                # ep_ztna="<key>ZeroTrustNetworkAccess</key><integer>1</integer>"  # Remove this hardcoded ep_ztna once the mantis 0825169 get fixed.

                if [[ -n "$ep_av" ]]; then
                e_av=1
                else
                e_av=0
                fi
                if [[ -n "$ep_af" ]]; then
                e_af=1
                else
                e_af=0
                fi
                if [[ -n "$ep_sb" ]]; then
                e_sb=1
                else
                e_sb=0
                fi
                if [[ -n "$ep_sra" ]]; then
                e_sra=1
                else
                e_sra=0
                fi
                if [[ -n "$ep_sso" ]]; then
                e_sso=1
                else
                e_sso=0
                fi
                if [[ -n "$ep_vs" ]]; then
                e_vs=1
                else
                e_vs=0
                fi
                if [[ -n "$ep_wf" ]]; then
                e_wf=1
                else
                e_wf=0
                fi
                #if [[ -n "$ep_ztna" ]]; then
                #  e_ztna=1
                #else
                #  e_ztna=0
                #fi



            # Comparing Feature set
                if [[ $av == $e_av && $af == $e_af && $sb == $e_sb && $sra == $e_sra && $sso == $e_sso && $vs == $e_vs && $wf == $e_wf ]]; then
                    echo "Same FortiClient has already been installed on the endpoint"
                else
                echo "Currently installed FortiClient features are shown below:"
                echo "##########################################################"
                if [[ -n $ep_av ]]; then
                    echo "Malware feature"
                fi
                if [[ -n $ep_af ]]; then
                    echo "Application Firewall"
                fi
                if [[ -n $ep_sb ]]; then
                    echo "Advanced Persistent Threat (APT) components"
                fi
                if [[ -n $ep_sra ]]; then
                    echo "Secure Access Architecture Components"
                fi
                if [[ -n $ep_sso ]]; then
                    echo "Single Sign-On Mobility Agent"
                fi
                if [[ -n $ep_vs ]]; then
                    echo "Vulnerability Scan"
                fi
                if [[ -n $ep_wf ]]; then
                    echo "Web Filtering"
                fi
                # if [[ -n $ep_ztna ]]; then
                #    echo "Zero Trust Network Access"
                # fi
                echo "##########################################################"
                echo "FortiClient with different feature set would be installed on the endpoint."
                echo "Removing old FortiClient and installing new FortiClient."
                downloadApp
                installDMG
                fi
            else
                echo "FortiClient only-VPN version has been installed on the endpoint. Upgrading FortiClient only-VPN version to Full Version"
                downloadApp
                installDMG
            fi
        else
            echo "FortiClient with different version has been installed on the endpoint. Removing old FortiClient and installing new FortiClient"
            downloadApp
            installDMG
        fi
    else
        echo "No FortiClient is installed on the endpoint. Installing FortiClient now"
        downloadApp
        installDMG
    fi
else
    echo "uninstall value can only be 0 or 1!"
fi


cat <<EOF > /Library/Application\ Support/Fortinet/FortiClient/conf/vpn.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>AutoConnectOnInstall</key>
	<integer>0</integer>
	<key>AutoStartVPN</key>
	<string></string>
	<key>AutoStartVPNOnlyOffNet</key>
	<integer>0</integer>
	<key>DNSServiceResettingInterval</key>
	<integer>0</integer>
	<key>DisableConnectDisconnect</key>
	<integer>0</integer>
	<key>DisallowPersonalVPN</key>
	<integer>0</integer>
	<key>EnableIPSec</key>
	<integer>1</integer>
	<key>EnableSSL</key>
	<integer>0</integer>
	<key>InheritLocalDNS</key>
	<integer>0</integer>
	<key>IpsecShouldBlockIpv6</key>
	<integer>1</integer>
	<key>MinimizeOnConnect</key>
	<integer>0</integer>
	<key>PreferDtlsTunnel</key>
	<integer>1</integer>
	<key>Profiles</key>
	<dict>
		<key>Your FortiClient Name</key>
		<dict>
			<key>AllowAutoConnect</key>
			<integer>0</integer>
			<key>AllowKeepRunning</key>
			<integer>0</integer>
			<key>AllowSavePassword</key>
			<integer>0</integer>
			<key>AllowedTags</key>
			<string></string>
			<key>AuthInfo</key>
			<string></string>
			<key>CertCNMatchType</key>
			<string></string>
			<key>CertCNPattern</key>
			<string></string>
			<key>CertIssuerMatchType</key>
			<string></string>
			<key>CertIssuerPattern</key>
			<string></string>
			<key>Comment</key>
			<string></string>
			<key>DisclaimerMessage</key>
			<string>$null</string>
			<key>EmsAllowAutoConnect</key>
			<integer>0</integer>
			<key>EmsAllowKeepRunning</key>
			<integer>0</integer>
			<key>EmsAllowSavePassword</key>
			<integer>0</integer>
			<key>EnableCustomPort</key>
			<integer>1</integer>
			<key>GotSettingsFromFGT</key>
			<integer>1</integer>
			<key>HostcheckFailWarning</key>
			<string></string>
			<key>KeepRunning</key>
			<integer>0</integer>
			<key>KeepRunningMaxRetry</key>
			<integer>0</integer>
			<key>Name</key>
			<string>Your FortiClient Name</string>
			<key>OnConnectScript</key>
			<string>$null</string>
			<key>OnDisconnectScript</key>
			<string>$null</string>
			<key>ProhibitedTags</key>
			<string></string>
			<key>PromptForAuthentication</key>
			<integer>0</integer>
			<key>PromptForCertificate</key>
			<integer>0</integer>
			<key>ProxyAddress</key>
			<string></string>
			<key>ProxyPassword</key>
			<string></string>
			<key>ProxyPort</key>
			<integer>0</integer>
			<key>ProxyUser</key>
			<string></string>
			<key>ReadOnly</key>
			<integer>0</integer>
			<key>RedundantSortMethod</key>
			<integer>0</integer>
			<key>SSOEnabled</key>
			<integer>1</integer>
			<key>SamlFQDNConsistency</key>
			<integer>0</integer>
			<key>SavePassword</key>
			<integer>0</integer>
			<key>SaveUsername</key>
			<integer>0</integer>
			<key>Server</key>
			<string>fortivpn.yoursite.com</string>
			<key>ServerPort</key>
			<integer>10443</integer>
			<key>ShowPasscode</key>
			<integer>0</integer>
			<key>SslVpnType</key>
			<string></string>
			<key>TrafficControl</key>
			<dict>
				<key>Apps</key>
				<array/>
				<key>Enabled</key>
				<false/>
				<key>FQDNs</key>
				<array/>
				<key>Mode</key>
				<integer>2</integer>
			</dict>
			<key>UseExternalBrowser</key>
			<integer>1</integer>
			<key>VpnMode</key>
			<integer>1</integer>
			<key>VpnType</key>
			<integer>0</integer>
			<key>WarnInvalidServerCertificate</key>
			<integer>1</integer>
		</dict>
	</dict>
	<key>SecureRemoteAccess</key>
	<integer>0</integer>
	<key>SslShouldBlockIpv6</key>
	<integer>1</integer>
	<key>SuppressVpnNotification</key>
	<integer>0</integer>
	<key>VpnCurrentConnect</key>
	<string></string>
	<key>WarnInvalidServerCertificate</key>
	<integer>1</integer>
</dict>
</plist>

EOF

# Ensure proper permissions for the file
chmod 644 /Library/Application\ Support/Fortinet/FortiClient/conf/vpn.plist

echo "vpn.plist created successfully!"

[ryan_www]

This looks handy, thanks for posting it!  Why is HTTPS mode being disabled?  Is this to work around the certificate trust issues with the web filter? (EDIT: I just tested this and while it does work around that issue, it also pretty much just disables the web filtering all together)

function DisableHTTPSMode () {
    sudo rm /Library/Application\ Support/Fortinet/FortiClient/data/enable_wf_https_mode
    echo "https mode disabled"

[barlowaaronrva]

we JUST use this as a VPN and have it optimized for performance however this was really just a proof of concept, have a great day!!