Articles in this section

Deploying EditShare Connect Across an Organization at Scale

Follow

EditShare Connect (ESC) is the application your team members use to access EFS storage on their Windows, Mac, and Linux workstations.

While ESC can be used to access your storage via Samba (SMB), we strongly recommend using the native EFS mount protocol for best results, as this gives you access to Swift Read capabilities for reading/writing media across multiple EFS storage nodes servers, and it also provides you with automatic load balancing and fault tolerance so that workloads are distributed across all EFS servers, and services remain highly available. 

We recognize that deploying ESC and updates across an entire organization is an important task that is often the responsibility of the IT department. As such we've provided some helpful information to make it easier to accomplish this task. 

Windows

The Windows version of EditShare Connect is provided as an industry-standard MSI installer that, among other things, includes both the EditShare Connect.exe GUI, and the EditShare File System.exe command line program that provides access to the EFS file system driver. In most cases, your users only need to run EditShare Connect; only unusual specialized scenarios require direct use of the command line tool.

The MSI installer supports silent-mode installations, which allows the software to be rolled out in an Active Directory domain or other centralized workstation management tool.

The MSI installer supports two optional modes that can be used:

  1. /silent
    Does a fully automatic install, but also pops up a progress window. This option may not be suitable in some centrally managed environments where updates are scheduled to be run during off-hours when there may be no one logged in.
  2. /verysilent
    Does a fully automatic install, with no graphical feedback. This option may be more suitable for the fully-automated & centrally managed scenarios noted above.

For more details, see the EditShare Storage Administrator’s Guide.

macOS

The macOS version of EditShare Connect is provided using Apple’s PKG package installer format, and is bundled with three sub-components:

  1. EditShare Connect, the graphical application people use to access EditShare storage services.
  2. EFSFUSE, the low-level software used to provide direct access to EFS storage services using the software’s own native protocol.
  3. ACL Permissions UI, an optional Finder extension used with ACL media spaces. 

In nearly all cases, each Mac editing workstation needs EditShare Connect and EFSFUSE; the ACL Finder extension is only necessary when EditShare’s ACL media spaces are being used.

The EFSFUSE software uses an Apple-approved kernel extension (KEXT) for providing high-performance access to EFS storage services. In Apple’s ongoing efforts to tighten macOS security, they are encouraging developers to switch from kernel extensions to a new technology called system extensions. However, it is not currently feasible to implement a general-purpose filesystem driver using Apple’s system extension APIs, so Apple continues to fully support kernel extensions for applications that still require them, as EFSFUSE does.

Apple has, however, made the process of installing kernel extensions more complex than it was in the past. Administrators that need to batch-install EditShare Connect and EFSFUSE on many Mac clients can use Mobile Device Management (MDM) to streamline this process. The below process in summary runs the EditShare installer twice. First to install at the login screen and the second just to force the Kext to load in System Extensions once that automatic login user is logged in.

 

Additionally with further Apple security updates in versions of Ventura and above we have found that you will also want to make sure the EditShare Connect App is added to the following locations within the System Settings of the MacOS.

  • System Settings > Privacy & Security > Accessibility
  • System Settings > Privacy & Security > Full Disk Access
  • System Settings > Privacy & Security > Local Network (this only exists in Sequoia)

Jamf MDM settings for installing EFSFUSE on macOS workstations

One popular MDM provider for managing Mac networks is Jamf, which requires the following settings to allow installation of the EFSFUSE software:

Approved Kernel Extensions

  • [x] Allow users to approve kernel extensions
  • [x] Allow standard users to approve legacy kernel extensions (macOS 11 or later)

Approved Team IDs and Kernel Extensions

Approved Team ID

  • Display Name: EditShare Connect
  • Team ID: URJUZJ3GCG

Approved Kernel Extensions

(Optional) Approve the following bundle IDs only

  • DISPLAY NAME: EditShare Connect
  • KERNEL EXTENSION BUNDLE ID: com.editshare.EFS.filesystems.efsfuse

If you are using an MDM provider other than Jamf, you may need to adapt these settings, but you’ll probably need to assert something similar to these settings in your preferred MDM framework.

Below are the stages and steps to not only get the EditShare Fuse KEXT installed, but also enabled through Jamf.

 Deployment Stage one:
   * Enroll new or recently erased mac on to Jamf via Apple School Manager.
   * Set mac to automatically login with an admin account which was created through prestage enrollment and enable the bootstrap token. This will give the ability to escrow bootstrap the server and approve the whitelisting of the kext through a config profile.
   * Deploy all Software including the EditShare software, this is done at the login window with no user currently logged in.
   * Create a launch Agent and daemon to start up on login and will do the following.
   1. Create a splash screen to block user interaction.
   2. Call the launch Demon to run the following Jamf policies:
   3. Disable auto login (switch back to our Jamf Connect login window)
   4. Delete the Launch Agent/Daemon
   5. Restart the Device through MDM Restart with Kernel Cache Rebuild with a 5 minute delay
   6. Reinstall EditShare, As EditShare had previously installed all this achieves is for the kext to load in System Settings and device will restart within 5 minutes killing the installer as it doesn’t move passed the normal “Approve the Kext pane.” popup.
   * Restart


   Deployment Stage two:
   * Device logs with the admin account automatically and runs the launch agent and daemon following the steps 1 -6   Once the device restarts it returns to our login screen where a standard user (non-admin privileges) can login, sign into EditShare without receiving any prompts and can mount via EFS and SMB.   

You can also create a launch agent (in Jamf) to write a file to bake the IP address into the login screen of EditShare Connect so our students don’t have to type that in every time.

 

Additional parameters for EditShare Connect in an Organization:

There are a number of preferences which can be preconfigured to ease deployment at scale such as prefilling the EditShare Connect connection dialog. Two such values are setting the server's IP address and enabling the ADSSO checkbox. Many other settings can be set and are available in the Windows Registry key HKEY_CURRENT_USER\Software\EditShare\EditShare Connect\ and the MacOS plist file /Users/$USER/Library/Preferences/com.editshare.EditShare Connect.plist

 

Pre configuring the server dialog in EditShare Connect

 

On MacOS

Open a terminal and type the following commands:

 

Setting the server IP address

$ defaults write "/Users/$USER/Library/Preferences/com.editshare.EditShare Connect.plist" server.address -string 192.168.1.3

 

Enabling the Active Directory Single Sign on (ADSSO)

$ defaults write "/Users/$USER/Library/Preferences/com.editshare.EditShare Connect.plist" local.adsso 1

 

 

On Microsoft Windows


Create registry files (.reg), or alter existing entries:

Setting the server IP address

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\EditShare\EditShare Connect\servers\1]
"address"="192.168.1.3"

 

Enabling the Active Directory Single Sign on (ADSSO)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\EditShare\EditShare Connect\servers\1]
"adsso"="true"

 

 

Mobile Device Management (MDM)

Should you wish to deploy EditShare Connect via Mobile Device Management (MDM) using a tool such as JAMF or Kandji, you may need the following details to provide exceptions for the EFS FUSE filesystem which will allow the Kernel Extension (kext) to be deployed.

 

Name: EditShare Connect
Team ID: URJUZJ3GCG
KERNEL EXTENSION BUNDLE ID: com.editshare.EFS.filesystems.efsfuse

Related articles

Comments

0 comments

Please sign in to leave a comment.