Deployment and management in an enterprise environment

If you look after many Macs, you don’t want to set up Little Snitch on each of them by hand. Little Snitch helps you in three ways:

You can deploy it to many Macs at once with Jamf, Hexnode, or a similar MDM solution.
You can manage its rules and settings from a central location.
You can restrict what users without administrator rights can change.

Mass deployment

Mass deployment works only for the first installation, so that nobody can use this mechanism to change an existing installation of Little Snitch. That’s why it has three requirements:

The Network Extension of Little Snitch isn’t activated yet. To check, run systemextensionsctl list.
The folder /Library/Application Support/Objective Development/Little Snitch doesn’t exist yet.
The file /var/root/LittleSnitchMassDeploymentConfiguration.json exists and contains a valid configuration. This file controls the mass deployment.

Test the procedure on a few Macs before you deploy Little Snitch on a large scale. To try the installation again, remove Little Snitch completely first:

In the Little Snitch app, choose Help > Uninstall Little Snitch….
Select the checkbox Also permanently delete rules, settings and network statistics of all users.
Click Uninstall.

Or do it by hand:

In Finder, move the Little Snitch app to the Trash. Finder should also remove the Network Extension of Little Snitch, but because of bugs in macOS, it sometimes doesn’t, even though it reports that it did.
If the Network Extension is still there, remove it in System Settings:
1. Open General > Login Items & Extensions > Extensions > Network Extensions.
2. Click the Info button to the right of Little Snitch.
3. In the window that opens, click the ellipsis button .
4. Choose Delete Extension.
In Terminal, run sudo rm -rf '/Library/Application Support/Objective Development/Little Snitch'.

Prepare the initial configuration

A mass deployment starts from an initial configuration. The easiest way to prepare it is to set up Little Snitch on one Mac and export the result:

Install Little Snitch manually on one Mac.
Configure Little Snitch for your needs.
In the Little Snitch app, choose File > Create Backup…. Little Snitch exports the configuration to a file with the extension .lsbackup, in JSON format.
Open the file in a text editor and check it (see below).
Add these two entries to the top-level object:
- massDeploymentLicenseKey: The license key. If you need a license size that our online shop doesn’t offer, contact our support.
- massDeploymentLicenseOwner: The name of the license owner, for example the name of your organization.
Save the file as LittleSnitchMassDeploymentConfiguration.json.

Here’s a minimal configuration file that works:

{
  "massDeploymentLicenseKey" : "36123456789-715P8-0123456789",
  "massDeploymentLicenseOwner" : "ACME, Inc.",
  "globalDefaults" : {
    "activeSilentMode" : 0,
    "allowCommandLineAccess" : 1
  },
  "groups" : {
    "aaaaac" : {
      "isActive" : true,
      "type" : "builtinMacOSServices"
    },
    "aaaaad" : {
      "isActive" : true,
      "type" : "builtinICloudServices"
    }
  },
  "rules" : [ ],
  "users" : [ ]
}

Some settings and rules apply to a single user, and Little Snitch identifies users by their numeric Unix user ID (UID), which can differ from Mac to Mac. So avoid rules for single users. Better still, don’t put individual rules into the configuration at all. Instead, put your common rules into a remote rule group on a web server that you control, and add your blocklists from the same server as custom blocklists. That way, you can update rules and blocklists later, on all Macs at once. For the file format of remote rule groups, see The .lsrules file format. You can also create such a file by selecting rules in the Little Snitch app and choosing File > Export Selected Rules….

When you check the initial configuration, you can remove the statistics properties. Always look at the JSON key "users". In most cases, delete all users and keep an empty array, so that every user gets the default settings. If you want to restrict rule editing, profile editing, settings editing, or similar for some users, the configuration needs entries for these users, with the restrictions in their "defaults" object. Since Little Snitch identifies users by their UID, the simplest way to cover all accounts is to copy the configuration of one user to the first UIDs, for example 501 to 510.

Turn on Terminal access to Little Snitch, so that shell scripts can apply configuration changes later. Do this on the Mac where you prepare the configuration, before you create the backup: choose Little Snitch > Settings… > Security and turn on Allow access via Terminal. If you already created the backup, edit the JSON configuration instead: set the key "allowCommandLineAccess" in the "globalDefaults" object.

Minimize the interaction with the user at the first start

When users install Little Snitch themselves, macOS shows them several dialogs to allow the Network Extension. If they miss a step, the installation fails, and Little Snitch isn’t active.

To spare your users these dialogs, approve the Network Extension in advance with a .mobileconfig profile. You can download this example:

LittleSnitch.mobileconfig

Adapt the texts that users see, and the identifiers, as needed.

Install this profile with your MDM solution. macOS accepts the approval of a system extension only from an MDM solution, not from a profile that a user installs manually.

To make macOS show the profile as verified, sign it:

security cms -S -N "My Certificate Name" -i /path/to/LittleSnitch.mobileconfig -o /path/to/LittleSnitch-signed.mobileconfig

With this profile, macOS no longer asks the user. Little Snitch itself still asks the user to accept the license agreement and to confirm the installation, though. To skip that too, set the following user defaults, for the user who runs the app, not for the root user:

defaults write at.obdev.littlesnitch AcceptLicenseAgreementAutomatically YES
defaults write at.obdev.littlesnitch PerformInstallationAutomatically YES

Or start Little Snitch with these defaults from the command line:

/Applications/Little\ Snitch.app/Contents/MacOS/Little\ Snitch -AcceptLicenseAgreementAutomatically YES -PerformInstallationAutomatically YES

At the first start, Little Snitch shows its welcome window. If you manage Little Snitch entirely from a central location, you can turn it off. Run this command for the user, not as root:

defaults write at.obdev.littlesnitch LastShownWelcomeWindowVersion 3

Install the files

When the Macs meet all requirements, copy Little Snitch.app to the /Applications folder of each Mac. Before you start the app, make sure that LittleSnitchMassDeploymentConfiguration.json is in /var/root.

At the first start, Little Snitch installs the Network Extension, turns on the network filter, and loads the initial configuration, just as if you restored a backup. It then deletes LittleSnitchMassDeploymentConfiguration.json, because the file contains confidential information. It deletes the file even if an error occurs.

Upgrade Little Snitch

To upgrade Macs from Little Snitch 6 or from an earlier version of Little Snitch 7, follow these steps:

If you upgrade from Little Snitch 6, upgrade to version 6.5 or later first. Earlier versions don’t accept Little Snitch 7 license keys.

If you need a new license key, set it:

sudo littlesnitch set-license <new-license-key>

If you upgrade from Little Snitch 6, turn off the welcome window of Little Snitch 7. Run this command for each user account on the Mac, as that user, not as root:
```
defaults write at.obdev.littlesnitch LastShownWelcomeWindowVersion 3
```
If you upgrade from a version of Little Snitch 6 earlier than 6.5.1, quit the Little Snitch app if it’s running, for example with sudo killall "Little Snitch". Later versions don’t need this step.
Replace the app in /Applications:
1. Copy the new version to /Applications under a temporary name, for example Little Snitch new.app.
2. Move the old Little Snitch.app to the Trash.
3. Rename the new version to Little Snitch.app.
This way, /Applications never contains an incomplete copy of the app.

Little Snitch then upgrades its system extensions and its daemon by itself, as soon as a user is logged in. If no user is logged in, it does this when the first user logs in, because only the Little Snitch app is allowed to upgrade the system extensions.

Centralized configuration

After the installation, you’ll want to keep rules and settings up to date on all Macs. Little Snitch offers two ways to do that centrally:

Remote rule groups and blocklists
The littlesnitch command line utility

Change settings

The littlesnitch command line utility can change every setting, and your deployment software can usually run commands on all Macs. The commands for settings work only with Allow access via Terminal turned on in Settings > Security.

To list all global settings and their values:

sudo littlesnitch list-preferences --global-only

To list the user-specific settings and their values:

sudo littlesnitch --user <uid or name> list-preferences --user-only

In a user session, the tool takes the user from the environment variable SUDO_USER, so you can leave out --user <uid or name>.

To read the details of a setting:

sudo littlesnitch read-preference <key>

<key> is the name of the setting, as list-preferences shows it. It can also point to an element of a dictionary or an array, see below. A key always identifies either a global setting or a user-specific setting, never both.

To change a setting:

sudo littlesnitch --user <uid or name> write-preference <key> <new value>

For a global setting, or when the tool can take the user from the environment, you can leave out --user.

How you write a value depends on the type of the setting:

Boolean: yes, true, 1, no, false or 0.
Unsigned integer: A decimal number, for example 42.
Signed integer: A decimal integer with an optional - prefix. Some settings accept only a range of values.
Floating point: All usual forms of floating point numbers, for example 3.5 or -5e6.
Date: ISO 8601 format, for example 2024-05-21T14:22:03+0000.
String: The string as it is. If necessary, put it in quotes or escape it for the shell.
Data blob: Base64-encoded, for example YmxvYg==.

Arrays and Dictionaries: The tool can’t write them directly, but it can write their elements with a key path:

sudo littlesnitch write-preference key-to-array.0 value-written-to-index-0

sudo littlesnitch write-preference key-to-dictionary.subkey value-written-to-subkey

Import a complete configuration

To start over, or to change many things at once, import a complete configuration. This works just like the initial installation:

sudo littlesnitch restore-model --preserve-terminal-access configuration.lsbackup

As with the initial installation, be careful with user-specific settings. To map the user IDs, use the option --map-users, see restore-model. You don’t need to add a license key or license owner: Little Snitch keeps them from the original installation.

The option --preserve-terminal-access makes sure that you keep command line access after the import, even if the imported configuration doesn’t contain the setting "allowCommandLineAccess".

Update rules

The command line utility can’t change rules directly, because the syntax would be too complex. Instead, you have two options:

Use a remote rule group (recommended). Include a remote rule group with an HTTPS URL on your own server in your initial configuration, and Little Snitch keeps these rules up to date automatically. Add a blocklist from your own server too. You could write a blocklist as a set of rules instead, but Little Snitch processes real blocklists more efficiently.
Edit the configuration. If you need to update local rules, export the current configuration in JSON format with littlesnitch export-model, change it with your own scripts, and import it again with littlesnitch restore-model.

Restrict permissions

Some organizations let their users decide how to use Little Snitch. Others restrict what users can do, so that nobody can bypass a basic level of protection. The following settings in Little Snitch > Settings… > Security decide what a user can do. Include them in your initial configuration.

When a setting is off and a user tries a restricted operation, Little Snitch asks for the name and password of an administrator, so an administrator can still do it on the user’s Mac.

Allow Rule Editing

With this setting off, users can’t add, change, or delete rules, blocklists, rule groups, or profiles without an administrator password. When no rule matches a connection in Alert Mode, they can still create temporary rules in the connection alert.

Allow Profile Switching

Even with rule editing off, users can still switch between profiles. To prevent that, turn off this setting. It matters only if your configuration contains profiles.

Allow Settings Editing

With this setting off, users can’t change settings without an administrator password. Turn it off, or users could simply turn off the other restrictions.

Allow Global Rule Editing

This setting matters only on Macs with more than one user account. It controls the rules for Anyone, which affect all users of the Mac. Rules for system processes are global too, but users can create them even with this setting off, because they need them to manage the connections of their own apps.