Brandon LiandClaude Opus 5
389c714caf
Setup asked for a token that is the same on every machine - a token is reusable and enrols any number of browsers - so it is a default in both scripts now and step 7 is a plain yes/no. It is a modest secret: it lets someone enrol their own browser into the org and nothing more, and rotating it is a console click and a one-line change. Both scripts also install Chrome if it is absent, from Google's enterprise MSI and the official .deb, since enrolling a browser that is not there writes a token nothing reads. Chromium is refused rather than substituted: no cloud management, so it could never be enrolled - and on ARM, where Chrome is not published at all, the Linux script says so instead of installing something that cannot do the job. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
76 lines
3.4 KiB
Bash
Executable File
76 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Enrol this machine's Chrome in Chrome Enterprise Core.
|
|
#
|
|
# The Linux counterpart to enroll-chrome-management.ps1. Chrome reads the token
|
|
# from a file under /etc at startup, so this needs root, and it applies to every
|
|
# user on the machine.
|
|
#
|
|
# sudo scripts/enroll-chrome-management.sh # the built-in token
|
|
# sudo scripts/enroll-chrome-management.sh <token> # a different one
|
|
# sudo scripts/enroll-chrome-management.sh --remove
|
|
#
|
|
# Chrome only — Chromium builds have no cloud-management support, so a Chromium
|
|
# install cannot be enrolled and stays subject to the off-store restriction.
|
|
set -euo pipefail
|
|
|
|
# Defaulted so setup is hands-off. A token is reusable and enrols any number of
|
|
# browsers, which is what makes a baked-in default work. It is a modest secret:
|
|
# anyone holding it can enrol *their* browser into the org — our policies and a
|
|
# row in the console — and nothing more. Rotate it in Devices > Chrome > Managed
|
|
# browsers and change it here.
|
|
DEFAULT_TOKEN=ce4fa6cd-e940-45f6-9086-85075d6cff34
|
|
|
|
DIR=/etc/opt/chrome/policies/enrollment
|
|
TOKEN_FILE="$DIR/CloudManagementEnrollmentToken"
|
|
|
|
info() { printf ' %s\n' "$1"; }
|
|
fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || fail "run this with sudo — the token lives under /etc"
|
|
|
|
if [ "$1" = "--remove" ]; then
|
|
rm -f "$TOKEN_FILE" "$DIR/CloudManagementEnrollmentOptions"
|
|
info "removed $TOKEN_FILE"
|
|
info "Restart Chrome. This stops it asking for policy, but does not undo the"
|
|
info "enrolment on Google's side — delete the browser from Devices > Chrome >"
|
|
info "Managed browsers too."
|
|
exit 0
|
|
fi
|
|
|
|
TOKEN="${1:-$DEFAULT_TOKEN}"
|
|
|
|
# Enrolling a browser that is not installed would write a token nothing reads.
|
|
# Chromium is not a substitute: it has no cloud-management support, so it can
|
|
# never be enrolled, and Google publishes Chrome for x86_64 only — on a Pi there
|
|
# is no version of this that works, and saying so beats installing something
|
|
# that cannot do the job.
|
|
if ! command -v google-chrome >/dev/null 2>&1 && [ ! -x /opt/google/chrome/chrome ]; then
|
|
ARCH=$(uname -m)
|
|
[ "$ARCH" = "x86_64" ] || fail "Google Chrome is not published for $ARCH. Chromium cannot be enrolled — this machine cannot run the extension."
|
|
command -v apt-get >/dev/null || fail "Chrome is missing and this is not an apt system — install Google Chrome, then re-run"
|
|
|
|
info "Google Chrome is not installed — fetching it from Google (about 120 MB)"
|
|
DEB=$(mktemp --suffix=.deb)
|
|
curl -fsSL -o "$DEB" https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb \
|
|
|| fail "could not download Chrome"
|
|
# apt rather than dpkg: it pulls the dependencies a bare dpkg -i would leave
|
|
# half-configured.
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y "$DEB" >/dev/null || fail "Chrome install failed"
|
|
rm -f "$DEB"
|
|
info "Chrome installed"
|
|
fi
|
|
|
|
mkdir -p "$DIR"
|
|
# The file must contain the token and nothing else: no quotes, no newline noise,
|
|
# no filename extension. Chrome reads it verbatim.
|
|
printf '%s' "$TOKEN" > "$TOKEN_FILE"
|
|
chmod 644 "$TOKEN_FILE"
|
|
info "wrote $TOKEN_FILE"
|
|
|
|
echo
|
|
info "Next:"
|
|
info " 1. Restart Chrome completely."
|
|
info " 2. chrome://policy should name the Admin console as a policy source, and"
|
|
info " chrome://management should say the browser is managed."
|
|
info " 3. Then: sudo scripts/install-extension-policy.sh"
|