3

I'd like to configure an always-on VPN on my iPhone and as always Apple's absurdity gets in the way. Specifically, they require to put the device in supervised mode, which requires Apple Configurator running on a Mac. I don't have any and I do not plan to buy one in the near future.

I've searched around and it seems like some MDM services allow provisioning of the devices from Windows, which means the supervision process of Apple Configurator has been reverse-engineered.

Now, I'd like to know if there's other Windows or Linux software that allow switching devices into supervised mode, or at the very least some documentation about the process so I can write my own code to do it.

  • You can do it from an iPhone app. itunes.apple.com/us/app/ipcu/id513585146?mt=8 – bret7600 Apr 24 '16 at 22:35
  • 1
    In the meantime a workaround is to set up a Mac VM. Create a new VM, use these commands to enable emulation of the SMC, then acquire a Snow Leopard ISO (make sure the hashes match the official one so you don't install a compromised version) and install it in that VM. From there upgrade it to the latest OS and you can finally use Apple configurator. – André Borie Aug 1 '16 at 15:07
1

Since you mentioned GroundControl in your link, I would like to make it clear that GroundControl is not an MDM. It is kind of an alternative for Apple configurator. You can supervise many devices at once and also it can be done from a Windows device but physical connection is required.

Another way to supervise device is by Apple Device Enrollment Program (DEP). Any device which is purchased directly from Apple or from an authorised re-seller can be supervised through DEP. DEP is the only available option for wireless supervision. DEP requires enrollment in an MDM solution. The MDM will assist in additional device management operations.

To know more please check out Device Enrollment Program and iOS supervised mode.

  • Is there any documentation or insight that explains HOW GroundControl is able to do this via Windows? I would imagine that Apple keeps this as a closely guarded secret, so I'm very curious how GroundControl accomplishes this without Apple's help. – Shadowman Jan 25 '18 at 16:55
0

In regards to directly answering your specific question, it is not possible to put an Apple device in Supervised mode without using Apple Configurator.app or having your device pre-configured with the DEP (for example from a company).

You can confirm this in this rather well-worded post, directly from Apple.

You've got some obvious work-arounds, using OSX in a VM or a friend's Mac, etc. In a comment above, someone recommended this app, which I cannot verify or authenticate.

Mobile phones are by nature, not secure at all. Even with very advanced, tailored solutions, for example, VMWare's air-watch, one cannot even verify they are secure. I would highly recommend readers to study the research by Karsten Noel, and others. In a positive sense, many of the features that make so-called smart phones, convenient, require them to continuously phone-home, whether this is through a 3rd party network like a VPN, or not.

If your main concern is to get a complete VPN solution, that is always-on, and routes 100% of your cellular and Wi-fi traffic, without a doubt, through a VPN-tunnel, I would suggest that is not possible at all through an iPhone, with normal hardware; because it's hard to tell without using Wireshark/tcpdump or other tools on all the networks, to see what is happening when the phone comes off and on, or wakes up from sleep, etc., although there are several iOS apps, for example OpenVPN Connect.

  • 1
    I do not mind trusting Apple. I don't need the VPN for bulletproof security, it's simply to get a static IP address and IPv6 on the phone without having the stupid carrier in between (who happily censors sites, lies in their DNS responses and completely wrecks any unencrypted HTTP traffic). – André Borie Aug 8 '16 at 16:42
  • You should be able to use any provider that uses openvpn, and then an "app" like openvpn connect, which is correctly interfaced with the vpn switch in iOS. It will stay "always on" at least in a loose sense of the word, as long as the settings are set how you want it. Like I said those, it probably does allow a few things here and there when the phone first comes on or sleeps, that's what I was referring to, either way. I'll reword my response so that it doesn't sound in this case unnecessarily critical, but sounds like it fits your ISP, that's disgusting! – forgotstackxpassword Aug 8 '16 at 19:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .