3

I have an iPhone that is not managed by an organization. By using configuration profiles, I want to apply settings that cannot be set via the GUI. Those settings contain passwords and therefore I need a secure way to transfer the configuration profiles to my iPhone.

As I do not have access to other Apple devices, what possibilities do I have?

2
  • Do you want to know how to create the configuration profiles or just how to distribute it? Or both?
    – sfxedit
    Jun 26, 2021 at 23:02
  • 1
    This question is just about the secure deployment/distribution of configuration profiles. Jun 26, 2021 at 23:41

1 Answer 1

5

According to the documentation...

There are five ways to deploy configuration profiles:

As Apple Configurator is only available for macOS and both Over-the-Air Profile Delivery and MDM solutions are solutions for enterprises, you are probably left with e-mail message or a webpage.

You can of course also use any 3rd party app that offers some sort of file sharing/synchronization. But as you want to transfer sensitive information, make sure you use an app with end-to-end encryption, where you are the single owner of the encryption keys.

Via e-mail

You can easily send a configuration profile via e-mail. As soon as you click on the attachment, it will be loaded and you can install it from the Settings app.

But as you want to transfer it securely, a simple e-mail won't do it. Again, you need end-to-end encryption because the file will travel through the internet. You can achieve that by setting up S/MIME for your e-mail, for example. But I am not sure, if you can do it already as a consumer with the Apple mail app. You might need a 3rd party app for that.

Via webpage

It sounds like an overkill, but that can be done easily and securely with free open source tools and just your laptop. Steps you need:

  1. Interconnect your laptop and iPhone via WiFi (ad hoc network, no router needed, just the two devices)
  2. Setup a temporary HTTPS web server with Python to serve the configuration profile
  3. ???
  4. Profit: Access the configuration profile securely through Safari on your iPhone

This is how you can do it with a Windows laptop:

  1. Create a wireless ad hoc network. Use ipconfig afterwards to determine the IP address of your laptop for this network.

  2. Connect your iPhone to this network, as you would with any other WiFi.

  3. Create a self signed certificate that you will need for your web server. You can use OpenSSL for example. You already got that, if you have Git for Windows installed. You find it at <GIT_INSTALL_PATH>\bin or <GIT_INSTALL_PATH>\mingw64\bin. To create that certificate, just execute:

    .\openssl.exe req -new -newkey rsa:4096 -x509 -keyout localhost.pem -out localhost.pem -nodes
    
  4. Create the following folder structure to serve your configuration profile from:

    /
    └── www/
        ├── html/
        │   └── MyConfigProfile.mobileconfig
        └── localhost.pem
    
  5. Use html as your working directory and use Python 3 to start a HTTPS web server from there. Replace <IP> by the IP address you retrieved in step 1. You can also adjust the port address (2021), if you want:

    import http.server, ssl
    
    server_address = ('<IP>', 2021)
    httpd = http.server.HTTPServer(server_address, http.server.SimpleHTTPRequestHandler)
    httpd.socket = ssl.wrap_socket(httpd.socket, server_side=True, certfile='../localhost.pem', ssl_version=ssl.PROTOCOL_TLS)
    httpd.serve_forever()
    
  6. On your iPhone, open Safari and access https://<IP>:2021/MyConfigProfile.mobileconfig (replace <IP> by the IP address you retrieved in step 1). As you are using a self signed certificate, Safari cannot verify it and will complain. This is normally a security concern, but as you are the owner of both sides it is totally fine. To be 100% sure you can just compare the certificate shown on your iPhone with the one you generated on your laptop. You can then proceed to install the configuration profile.

3
  • I wonder what the point is of HTTPS here. What are you defending against? That someone else is in the same hotspot and sniffing the data? If someone is, they could just access the same address too and then Python will happily list files, allowing them to easily browse to whichever file it can serve. OTOH it's to prevent an MITM of some sort, then you definitely should be inspecting the certificate shown on the phone.
    – muru
    Jun 27, 2021 at 8:31
  • 1
    Yes, if someone can access the temporary WiFi, while you are using it, he can sure also access the sensitive file. HTTPS helps in that case, that an eavesdropper just records your wireless traffic and decrypts it later, then he won't be able to read the transfered and TLS-encrypted file. Jun 29, 2021 at 16:27
  • Anybody capable of listening in at that time should also be perfectly capable of connecting to the WiFi. Ad-hoc WiFi security has been pretty trivially crackable these days.
    – muru
    Jun 29, 2021 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .