Rusty is a Geek

Creating VMs from an existing VDI file

2011-11-09T11:09:00.000-08:00

We recently had a request to install VirtualBox and a custom VDI for a course. Students with little technical backgrounds needed to be able to launch and create a individual instance of an Ubuntu virtual machine.

We did some experimentation on configuring the virtual machine with a shared VDI file and using VirtualBox snapshots, as well as shadow disk images, for saving changes. We decided the best course was to drop a copy of the entire VDI to the students Desktop and use VirtualBox's command line tool to configure them a VM.

We stored the VDI inside a disk image and delivered it to the /Users/Shared folder of each Mac. We then had VirtualBox installed. Using Platypus we wrapped a script that will copy the VDI, create the VM, and start it.

If the VDI already exists on the desktop, the VM is created and launched. If the VM is already created, then it's launched right away.

This provides students and faculty with a simple way to launch and use the virtual machine provided to them.

Here is the script that we use: https://github.com/rustymyers/scripts/blob/master/shell/createVBoxVM.sh

After writing this, I got a lot of comments that we should check out Vagrant. http://vagrantup.com/

Do your self a favor and always google what you want to do before writing something from scratch to do it!

Thank You Steve.

2011-10-06T05:51:00.000-07:00

My words feel lacking in empathy today. It feels futile to try to think of what to type. So I leave you with these pictures instead...

Picture of an original Macintosh with a "Thank You" note written by Rusty Myers October 6th, 2011.

Maya 2012 Semaphore Issues

2011-08-17T14:28:00.000-07:00

Recently I had the pleasure of installing Maya 2012 in a lab environment. To qualify "lab", it is a non-admin multi-user lab.

Maya 2012 seems to have a bit of an issue with cleaning itself up after running. Someone much more informed on the subject has guided me through the discovery of the issues and how to deal with them.

In a nutshell, Maya is leaving Semaphore ipc instances after quiting the program, which also persist after a user logs out! A reboot of the system will clear the semaphore, but it asking a little too much to have a user reboot after quitting Maya 2012.

So, how do I know this? After launching Maya 2012 (Or Mudbox 2012), try running this command:

$ ipcs -b
IPC status from as of Fri Aug 12 14:41:35 EDT 2011
T ID KEY MODE OWNER GROUP QBYTES
Message Queues:

T ID KEY MODE OWNER GROUP SEGSZ
Shared Memory:

T ID KEY MODE OWNER GROUP NSEMS
Semaphores:
s 327680 0xb3536107 --ra-r--r-- rzm102 psuguest 3

You can see it's being left there even after log out! To remove it, you need to pass the ID to the ipcrm command:

$ ipcrm -s 327680

That will clear the semaphore ipc and allow Maya to once again launch. I've noticed that the error in the console about "ACE_SV_Semaphore_Complex: Permission denied" still occurs, but has no effect on Maya launching.

To fix this for the labs, I'm suggesting having the logout hook clean this up using this code:

IPCSUCKS=`ipcs -b | grep -A 1 -i semaphores|tail -1|awk '{print $2}'`
sudo ipcrm -s "$IPCSUCKS"

This should clear the instance of the ipc from Semaphores. I'm not sure this is the best solution because there could be multiple ipc's from semaphore or it could be for something other than Maya. However, I'm running out of time this semester and I need to move on.

A bug report needs to be filled with Autodesk to ask them to change the permissions on the semaphore so that other non-admin users can overwrite that instance. As Frogor from ##osx-server explained: "They need to be setting it up as --ra-ra-r--".

This is a quick and dirty blog post, please forgive the assumptions, spelling mistakes, grammar mistakes, and overall vagueness.

For more information on IPC and Semaphores, check out wikipedia:

http://en.wikipedia.org/wiki/Inter-process_communication

http://en.wikipedia.org/wiki/Semaphore_(programming)

And if you are more knowledgeable about these issues, please post in the comments so we may all learn!

Source for the command examples: http://www.dbasupport.com/forums/archive/index.php/t-34262.html

Firmware Passwords on New Macs

2011-08-16T07:12:00.000-07:00

According to the KB article TS3554, new Macs have a different way of resetting the firmware password, should you forget it. More on that later.

What I want to discuss is the new tool for setting your firmware password.

No Longer is the nvram used when configuring the password. The nvram settings are outright ignored. The Firmware Password Utility shipped by Apple has been updated to accommodate this change.

I am unsure of WHERE or HOW the passwords is configured, but I do know that Apple has a new binary tool to configure it via the command line. "setregproptool" can now be used to configure your firmware password.

Finding information of this update from the MacEnterprise email list points me to the install DVD that shipped with our newest iMacs.

To locate this tool, Tomas has given you a path to it on the USB flash drive that came with Macbook Airs. Well, the DVD path is almost the same, except for a few slight changes to the media name.

Here are some directions to get the binary tool:

1) Insert your Install DVD to your Mac.

2) Open the Terminal.app from /Applications/Utilities/

3) Paste in this line:

cp /Volumes/Mac\ OS\ X\ Install\ DVD/Applications/Utilities/Firmware\ \

Password\ Utility.app/Contents/Resources/setregproptool ~/Desktop/

The setregproptool should appear on your desktop, assuming the name of the DVD is the same as I have in my command. YMMV.

Now that you have the binary tool, you can distribute it by whatever means you find the best. Scripts can be written to call it. You can now have fun.

The setregproptool has a nice little man page to help you configure your firmware password. In our case, we simply want a firmware password when choosing the "option boot" or command mode.

$ setregproptool -m "command" -p secretpassword

If a password is currently set, it will prompt you for it.

As Thomas Larkin talks about in his MacE post, the check flag (-c) was not correctly reporting that the password was set. While this may be an issue for some people it was of little concern for me, at least, for now!

Now that you can set your firmware password again, lets talk about what happens when you FORGET it!

A) Don't forget it.

B) If you do, you have to boot your Mac into the firmware password screen.

This screen provides a hash that can be sent to Apple. I assume Apple has a way to reverse this hash and respond to you with the firmware password.

All things considered, you should never see this screen. Hopefully you have a way to manage your passwords that is secured and is available to at least two people.

When that inevitable time comes that someone forgets it, your going to have to jump through some hoops.

If your an Authorized Service Center, or a Authorized Self Service Center for Apple, you can talk to the friendly TPSS support staff to have your hash reversed.

If your not, your going to need to find someone that is. That means a trip to your closest Apple Store or other Authorized Service Center.

Please avoid the hassle and don't forget your firmware password.

Good luck!

Links:

MacEnterprise Post:

http://groups.google.com/group/macenterprise/browse_thread/thread/3092c51a73d064c4?pli=1

Apple KB on resetting the FW password:

http://support.apple.com/kb/TS3554

Products Affected as of 08/2011

MacBook Air (Late 2010), MacBook Pro (17-inch, Early 2011), MacBook Pro (15-inch, Early 2011), MacBook Pro (13-inch, Early 2011), MacBook Air (Mid 2011), iMac (27-inch, Mid 2011), iMac (21.5-inch, Mid 2011), Mac mini (Mid 2011)

Adobe Encore Disc Burning

2011-06-29T11:19:00.000-07:00

I've run across an issue in our lab where the Adobe Encore CS5 app failed to burn a DVD of a project. It gives an error of: "OSStatus Error = -5000". According to Google, this is an error that occurs when the filesystem can't write to a particular location.

After running FSEventer to watch where Encore wants to write, I find it trying to log the Video TS Layout inside it's own .app bundle!

When the user has full permissions to write, Encore creates this file: /Applications/Adobe Encore CS5/Adobe Encore CS5.app/Contents/MacOS/DualLayerVideoTSLayout.log

When a user does not have write permissions, Encore complains. There are a couple options to fix this;

1) Give the world write privileges

chmod o+w DualLayerVideoTSLayout.log

2) Change the group to your standard users group

chgrp staff DualLayerVideoTSLayout.log

or my favorite...

3) Symlink the log file to tmp

ln -fhs /tmp/DualLayerVideoTSLayout.log /Applications/Adobe Encore CS5/Adobe Encore CS5.app/Contents/MacOS/DualLayerVideoTSLayout.log

So if you ever run into Adobe Encore CS5 failing to burn, check this log out!

DeployStudio freeze users home directories

2011-06-28T19:53:00.000-07:00

I've had a chance to check out the new DeployStudio "Freeze home directories content (restore at reboot)" feature of rc127. It's a check box in the Configuration Task of a workflow.

The script that runs at first boot checks for any existing backups. If none are found, it uses ditto (ditto --rsrc ) to create a copy of each home directory from /Users to /private/dss_homedirs_ref/.

If there is an existing backup of a user in /private/dss_homedirs_ref/, the script uses rsync ( rsync -av --delete ) to restore the home folder. A word of caution here; If there is an existing backup and changes have been made to the user's home directory, the rsync command will delete the files that don't exist in the backup after a reboot. This is great for a lab Mac, where you want the same home folder every time the machine reboots. Its not so great for a faculty machine, be careful and test!

By default, the Shared folder is not included in the backup and restore process.

Check out the actual script here: http://pastie.textmate.org/2141011

PSU MacAdmins Conference 2011 Videos

2011-06-27T05:29:00.001-07:00

Check out all* the videos and slides from the 2011 PSU MacAdmins Conference.

http://itunes.apple.com/us/itunes-u/penn-state-mac-admins-podcasts/id429872255

*Presentations made by Apple Employees are not available for download.

DeployStudio BackupRestore Scripts 0.7.1

2011-06-22T07:32:00.000-07:00

Visit on GitHub

- Added flag to remove user cache folder before backing up home.

- Testing new DS_INTERNAL_DRIVE variable command.

DeployStudio BackupRestore Scripts 0.7

2011-04-19T14:56:00.000-07:00

Visit on GitHub

Quick update to fix bad eliminator that killed the scripts. Thanks to Data Scavenger for reporting it.

-Updated code to use new user deliminator from '.' to '-'

https://github.com/rustymyers/BackupRestore

DeployStudio BackupRestore Scripts 0.6

2011-04-16T18:28:00.001-07:00

New Version Posted:

https://github.com/rustymyers/BackupRestore

Updates:

Lots of little error fixes from midnight coding.

Tried to unify script messages.

Older Changes:

Change name of user plists and home backups to account for names with '.' in them.

VPN Connection Failing

2011-04-15T19:34:00.000-07:00

I was having an issue with my new Macbook Pro not connecting with Cisco VPN. I had a few times this morning, but then stopped working. After a few google searches, I found this answer:

Source: http://superuser.com/questions/194961/os-x-10-6-4-system-vpn-failing-to-connect-ike-packet-transmit-failed

"This occasionally occurs for me as well, e.g. when I switch between two different Cisco VPNs. It seems to be a minor crash in racoon somewhere*. Manually restarting the process seems to do the trick for me:

$ ps -ef | grep racoon
0 5861 1 0 0:00.09 ?? 0:00.15 /usr/sbin/racoon
$ sudo kill 5861
$ ps ax | grep racoon
)>
$ sudo /usr/sbin/racoon
$ ps -ef | grep racoon
0 6786 1 0 0:00.08 ?? 0:00.15 /usr/sbin/racoon -x
(Don't know what the '-x' param does, it's not mentioned in the man page)

(*) Haven't investigated"

Now its working! Real easy fix.

New Position

2011-04-14T10:08:00.000-07:00

As I spend my morning cleaning up my new office, I think about the old duties and mates that I left behind. It was only yesterday, but I already miss my friends in the College of Education at Penn State. My duties were administering the Mac systems in the College and today I start my new job administering Mac systems for public labs at Penn State. I look forward to getting to know my new colleagues, settling into my new office, and getting to know my new job responsibilities. As I sit here looking out my window watching the students pass from one class to the next, I think of my days on campus as a student. As Mr. Layhe says: "Tempus Fugit"

Source: http://www.youtube.com/watch?v=jCaxeFu0sMk

Part Time Web Development

2011-03-30T07:25:00.001-07:00

Part-Time Web Developer

WORK UNIT: Center for Science and the Schools

LOCATION: University Park Campus, Chambers Bldg.

RESPONSIBILITIES: Design static and dynamic web pages using Dreamweaver MX, ColdFusion MX, and Microsoft Access. Assist in maintaining a Windows server, update and maintain server software, virus protection, patches, server backup functions. The position requires skills with the preceding software packages and with Microsoft server software.

This part-time position (approximately 15 hours a week) features flexible hours and a collegial work environment. The work will assist the University in developing strong and mutually beneficial collaborations between K-12 educators and Penn State scientists and engineers.

APPLICATION: provide name, email, phone number, resume, and pointers to examples of web resources that you have developed, to Janell Howe at juh6@psu.edu (Please include WEBDEVT in the email subject line)

BackupRestore Scripts 0.4.6

2011-03-22T16:52:00.000-07:00

Now with Filevault compatibility!

Backup and Restore local and mobile filevault accounts. Mobie filevault accounts require a first boot script be installed. This should not, but may interfere with other DeployStudio tasks.

Reminder, this is still a beta script. It probably won't work, but if it does, great!

Please send me feedback at rustymyers at gmail dot com!

Download the updated scripts here:

https://github.com/rustymyers/BackupRestore

BackupRestore Scripts 0.4.5

2011-03-18T06:22:00.000-07:00

Major fix that resolves issues with backing up local and network users. Also added more commenting!

Check out the new scripts!

https://github.com/rustymyers/BackupRestore

DeployStudio on Talking Mac

2011-02-18T06:59:00.001-08:00

Catch me on www.talkingmac.com Enterprise podcast, coming up February 22nd at 7pm EST, doing a quick talk about DeployStudio. Tune in for some great discussions from lots of smart folks!

BackupRestore gits it.

2011-02-09T18:55:00.001-08:00

I've added BackupRestore scripts to git. Check it out

https://github.com/rustymyers/BackupRestore

Restoring admin rights

2011-02-01T05:57:00.000-08:00

I've not had a reason to do this recently, but was curious so I decided to try. I wanted to give myself admin rights from the command line, specifically single user mode.

For those of you who don't know, single user mode is a command line only way to interact with the system as root, in most cases its possible without a password. Hold command+s when booting and see what it looks like! (if you get scared, just type "exit")

Once in single user mod (SUM), you can interact with the system by using commands. So, in this case, I want to add my user "rusty" to the admin group on the machine... This is what I did.

First, start computer in SUM - hold command+s at boot

Second, after you see the prompt (root#) type "/sbin/mount -uw /" (there are two spaces in there, its important not to loose them!)

Hit Return.

Third, I need to start the Directory Services, I do so by typing:

launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist

Hit Return.

Fourth, Now that Directory Services is started, I can make the appropriate changes use dscl.

To add my "rusty" account to the admin group, I use:

dscl . append /Groups/admin GroupMembership rusty

Fifth,

Once you are done making changes, exit SUM using the command "exit"

There are lots of other cool tricks with dscl, give it a try and post some of your favorites!

Updated BackupRestore Scripts - Beta 0.4

2011-01-28T10:55:00.001-08:00

Releasing today are updated BackupRestore scripts for DeployStudio!

http://dl.dropbox.com/u/5442688/DeployStudio/BackupRestore.Beta004.zip

The updated scripts now allow you to use the DeployStudio variables field to set the script variables. You can also set them in the script, however the variables field will overwrite any variables set in the script.

You can print the help menu using -h from the command line:

Usage: DS_BACKUP_DATA.sh [ -e "guest admin shared" ] [ -v "/Volumes/Macintosh HD" ] [ -u /Users ] [ -d "/Volumes/External Drive/" ]

BackupRestore Variables:

-e Users to Skip

Must use quotes for multiple users

Default is "guest" and "shared"

You must specify "guest" and

"shared" if your use the argument

-v Target volume

Specify full path to mount point of volume

Default is the internal volume

-u User path on target

Set to path of users on volume

Default is /Users

-d Backup destination

Specify full ath to the backup volume

Default is /tmp/DSNetworkRepository

Please send any feedback to rustymyers@gmail.com

Thanks, Enjoy!

Rusty

BackupRestore User Data with DeployStudio

2010-12-17T09:03:00.001-08:00

One of the minor annoyances I've run into during a re-imaging process is the time and trouble it takes to backup and restore user data. Our users store home folders locally on their Macs and use AD accounts to log in. I don't want to get into network homes or syncing homes. We do backup computers over the network via Tivoli storage manager, but thats another topic and we don't backup graduate student machines.

Usually, I have to spend time backing up the home folders and restoring them after imaging the Mac. This relatively easy task slows me down taking up my (precious?) time to do this. Training someone would be fairly simple, but then we'd have to hire someone who can support Macs; thats not an option right now.

The manpower I do have available to me have already been trained to use DeployStudio. The great thing about DeployStudio is; I can tell the staff person what workflow to run, I know the workflow will run the correct steps for the task, and I can give access to workflows for specific users as they grow to do more (or remove access if needed).

Since DeployStudio does not have a built in option to;

backup user data
image a machine
restore the data

...then we have to do it ourselves!

Introducing the DeployStudio BackupRestore* scripts

The concept with the scripts are easy...

Backup Script:

Creates a new folder called "Backups" DeployStudio Repository
Data is stored in a subfolder using the MAC address as the name (sans ":")
User home folder is backed up using tar
User account is backed up using plist, password hash is also backed up
Network and Mobile accounts (AD/OD) are skipped (if uid is > 1000, skip account)

Once the backup task is finished, you can run as many other tasks as you'd like. Image the hard drive, install packages, create users, etc... The last step is to restore the user data.

Restore Script:

Finds the backup folder based on the MAC address
For local accounts; Creates all the accounts & restores password hash
Restores the user home folders
Does NOT delete backups

It's important to note that the data is not removed from the backup folder. If you leave the data there, it will be restored on the machine if you run the workflow again. This could lead to unexpected results. For example, if you run the BackupRestore scripts in January you will backup "userA" and "userB". Lets say "userB" leaves in March, you delete their data on the machine, then "userC" starts using the Mac. Then, sometime in May, you run the BackupRestore scripts again The script will overwrite the backups of "userA" and "userB" and, for the first time, backup "userC". When the data is restored, you will restore all three users. This can be avoided by removing the specific users files in the Backups folder.

Example:

MAC Address: 01:02:03:04:05:06

Users: "userA" and "userB"

"userA" is a local user - GeneratedUID="ABC12345"

"userB" is a mobile account

When the Backup script creates a machine specific folder, it uses the MAC address of the machine without the ":".

//Backups/010203040506/

Then the users home folder is backed up, with tar, to the Backups folder using their username, machine MAC address, and the keyword "HOME":

userA.010203040506.HOME.tar

and

userB.010203040506.HOME.tar

The account details are backed up to a plist file with the naming convention of:

userA.010203040506.USER.plist

Then the password hash is backed up as:

userA.010203040506.ABC12345

...the mobile account is skipped because it can be recreated when the user logs back in.

That is it for backing up! When the Restore script runs it creates the user account, restores the GeneratedUID (for the local accounts), then restores the home folders on the target for EVERY record in the folder that matches the Macs MAC address.

The implementation in DeployStudio is very easy. Simply take the scripts and wrap them around your workflow:

Thats it!

I'm releasing this code for all, please share, edit, use! Please report bugs and branches back to me at rustymyers@gmail.com. I'd love to hear what your doing!

Thanks to Pete Akins and his createUser.pkg from the instaDMG project. It was heavily relied upon for the backing up and creating of users. Seriously, Thank You Pete!

Thanks to the ##osx-server channel on the freenode IRC server. Everyone was very helpful in helping me work out the "bugs".

Download the scripts!

* Updated Monday December 20, 2010

- Resolved issue with accounts not showing in System Preferences after restore.

- Added support for restoring admin rights for network users

Notes:

These scripts have been tested on 10.6 with local accounts and AD accounts. Machines are bound to AD via Directory Utility, with mobile accounts being created at login.

*Crappy generic name subject to change without notification

SysAdmin Video Series: Payload Free Package

2010-11-27T18:09:00.000-08:00

The second video focuses on creating a payload free package.

In this video I create a payload free package. This package will only install a script, it won't install anything! Its a very useful package type! This video also covers the difference between the different types of installation scripts. Download the files used in the video to follow along! NOTE: I do not have the script written well for InstaDMG. You should use the target of $3. Check this afp548.com thread for great scripts to run with InstaDMG. Watch the video

SysAdmin Video Series: First Boot Package

2010-11-04T19:54:00.000-07:00

The introductory video to the SysAdmin Video Series is here!

Following is a video on building a package that will run a script when a computer first boots. This is useful for instadmg when you can't apply scripts during the build train. Its also useful for other uses.

This video also covers some basics to Iceberg packaging and launchd plists. Download the files used in the video here.

Watch the video here.

Enjoy!

AD Binding Fails

2010-11-01T12:56:00.000-07:00

I have been having some issues lately with some random machines loosing their binding. I've just had to fix the third Mac in as many months with this issue. Unfortunately, I didn't really know what was going on until now.

I would try to bind using Directory Utility and it kept failing on step 3. I turned on DirectoryService debugging with the handy command-y:

sudo killall -USR1 DirectoryService

That produced some cool errors such as:

Active Directory: Password verify for rzm102@DOMAIN.COM failed with error -1765328230

and

Plug-in call "dsDoPlugInCustomCall()" failed with error = -14090.

Let me just say, I know my password. I didn't forget it. I type it in my machine hundreds of times a day, so it's not that!

What it was, was very interesting. I found this thread that lead me to the real issue. Apparently, the /var/db/dslocal/nodes/Default/config/Kerberos\:AD.DOMAIN.NAME file had become corrupted. When I went to cat the file, it displayed with some funky text, not the plist I was expecting.

Removing this file allows rebinding and fixes the issue. Yay!

launchd plist generator

2010-10-24T11:01:00.000-07:00

A little gem of a web app, a plist generator, from Michael Rieder.

This fancy webpage allows you to create a launchd plist! Very nice, and I suspect will be useful if I'm ever away from Lingon or my launchd notes.

Macworld 2011

2010-10-24T10:20:00.000-07:00

Macworld 2011 is only a few moths away and as excitement and anticipation builds, we must remember the simple things that need done before visiting.

Always, always, always book a hotel! There are quite a few excellent hotels in the area of Macworld, some more expensive than others. I have stayed in the W San Francisco Hotel in the past and will be again this year. It's close, has great accommodations, and a lovely swimming pool!

Also, your flights are good to book early. Personally, I prefer to return to the east coast on the red eye from SFO. It's cramped, uncomfortable, and smelly. However, I usually squeeze a couple naps in between bathroom breaks and the ballet dance of the drink carts.

Finally, and most importantly, get your Macworld ticket! The Expo runs Jan 27th to 29th; the IT and Users conference runs 26th to 29th. And here is the part of this post that I can help you with! Use my unique priority code to receive a special discount on your Expo Pass and pay only $15 (normally $25) or 15% off a conference registration package.

Register here: http://rcsreg.com/macworld/RMU9926

For more information about Macworld 2011 visit www.macworldexpo.com

Hope to see you there!

OS X Wiki

2010-10-24T10:08:00.001-07:00

It's been my wish for some time to see a wiki formed for OS X systems administration. Yay today!

Check out: http://www.osxdeployment.com/wiki/Main_Page

Don't forget to add some content!

Double Click to minimize windows

2010-08-04T08:03:00.000-07:00

I was trolling around the ##osx-server channel on freenode today when I saw a problem someone was having. natewa, as he is know on that channel, was having trouble setting a preference to allow all new users to double click a window to minimize it. It should be able to be set in the /System/Library/User Template/English.lproj/Library/Preferences/.GlobalPreferences.plist file for all new users. For some reason, this plist file gets overwritten when a new user gets a home folder.

After looking at the User Template folder, I noticed a Non_localized.lproj folder. It seems that this folder also has a .GlobalPreferences.plist! Instead of changing the English.lproj GlobalTemplate file, I changed the Non_localized.lproj GlobalPreferences file. Bam! It worked for all new users.

My guess is that your specific language template file, such as English.lproj in my case, is being combined with the non_localized.lproj file for whatever reasons.

Here is the command I used:

sudo defaults write /System/Library/User\ Template/Non_localized/Library/Preferences/.GlobalPreferences AppleMiniaturizeOnDoubleClick -bool TRUE

That allows all new users to double click a window to minimize it. Enjoy!

Mounting Pass and Udrive in an AD environment

2010-07-30T12:15:00.001-07:00

Do I script too much?

Today I have a little script that my intern Ethan Cox and I worked on together.

Problem:

Penn State PASS and UDRIVE storage drives require a special edu.psu.kerberos file to be in place to access them. Our Active Directory requires a special edu.psu.kerberos file to be in place to log into the computer. So far, I’ve been able to either remove the machine from our AD or have people access the PASS space via the website. It’s not too bad interacting with the PASS space via the website, but it can be less appealing than the Finder.

Solution:

Create an application to temporarily switch the kerberos file with PSU’s, mount the file share, then put everything back. Seems simple enough, and it was in the end. The hardest issue to overcome was getting kinit to prompt for the password.

What you will Need:

The Platypus.app.

The Mounting Script.

The Mount the Sysman share app

The Mount the PASS share app

You can edit the finished app by Right clicking it and opening the Contents/Resources/script file.

Putting it together:

Platypus takes a script as input for creating an .app. Download the mounting script and drag it into Platypus’ “Script Path” field. For this script I change the Shell to “/bin/bash” and uncheck the “Remains running after initial execution” check box. Click the “Create” button and save your new app.

Your new app is now a double-clickable script that anyone can run.

Changing the script:

The mounting script is configurable to your needs.

There are two variables at the top of the script. The first variable sets the smb path to mount. Right now, the script only mounts SMB shares. Change the path to mount a different share.


psuserver="smb://udrive.win.psu.edu/sysman"

The second variable is the domain to get a kerberos ticket from. You can use your own domain if you need.


domain="dce.psu.edu"

Some other shares can be:


    cifs://cifs.pass.psu.edu

Edit the alternate kerberos file if it differs from PSU’s. This bit of code checks for the existence of our PSU kerberos file and creates it if it’s missing.


if [[ -e /Library/Preferences/edu.mit.Kerberos.psu ]]; then
    echo "PSU File avail"
else
    echo "[domain_realm]
    .psu.edu = dce.psu.edu
    psu.edu = dce.psu.edu

[libdefaults]
    defaultrealm = dce.psu.edu
    dnslookup_kdc = true
    forwardable = true
    noaddresses = true" > /Library/Preferences/edu.mit.Kerberos.psu
fi

Intermediate CA Bundles!

2010-07-28T11:04:00.001-07:00

Thwate changes the way certificates work.

In the past browsers and client machines would have root certificate authority files that verified the ssl certificates used. Now, with the new certificates (after June 27th, 2010), you have to install a intermediate certificate authority on the server for the new certificates to behave.

So, When I added the new cert.crt from Thwate to the Server Admin interface, it complained that it was unassigned. I found this site which explains what changed recently and how to fix it. I’m sure it works great for a *nix webserver that doesn’t use Virtual Hosts, unlike OS X server.

How do we fix this? Actually, its stupid simple after you mess with it for four hours. After you add the new cert.cer from Thwate through the Server Admin interface, open the site configuration and the security tab. Choose the new ssl certificate, save, apply, restart. Next, you will need to edit the Virtual Host for the site that has ssl enabled.

I started with this certificate but it was not working for me. Something with the three difference CAs. I ended up using this certificate bundle which worked.

From this page copy the new intermediate cert bundle and paste it into a plain text file. Save that file in /etc/certificates/ named intermediate.crt.

Open the Terminal.app and navigate to the /etc/apache2/sites folder. Open the conf file for the site with ssl enabled, look for the one with 443 in the name, with your favorite text editor. Comment out the SSLCertificateChainFile line and create a new SSLCertificateChainFile file to point to your new intermediate file. Should look like this:

SSLCertificateChainFile = "/etc/certificates/intermediate.crt"

Save the changes and restart the Web Server. I use the terminal in this case:

Stop the web server:

sudo serveradmin web stop

Start the web server:

sudo serveradmin web start

Check your site and you should be good to go! The new certificate should appear without warnings. It should also appear without warning in the Server Admin certificates tab.

Command Line Favorites #2

2010-07-26T11:33:00.001-07:00

Update to my previous post. This is a few more months of command line favs!

##System Version Checks
#
sysversionOSX=`system_profiler SPSoftwareDataType | grep "System Version:" | awk '{print $6}' | awk -F . '{print $1$2}'`
echo $sysversionOSX
#The version is displayed as the major version without periods. Thses are the possible results.
# 10.4.11 will equal 104
# 10.4.7 will equal 104
# 10.5 will equal 105
# 10.6 will equal 106
# 10.6.2 will equal 106

#This command will give you the whole OS with periods:
# system_profiler SPSoftwareDataType | grep "System Version:" | awk '{print $6}'
# Example Result: 10.6.2

#This command will show you witout the periods:
# system_profiler SPSoftwareDataType | grep "System Version:" | awk '{print $6}' | awk -F . '{print $1$2$3}'
# Example Result: 1062

#This will exit 1 if the version is 10.5 or less
# if [ "$sysversionOSX" -gt "105" ]
# then
# echo "Greater Than"
# exit 1
# fi

#This will exit 1 if the version is 10.6 or greater
if [ "$sysversionOSX" -lt "106" ]; then
echo "Less Than"
exit 1
else
echo "10.6 or higher"
fi

##Check DHCP packets
ipconfig getpacket en0

##Chech DS Cache
dscacheutil -statistics

##Watch files accessed by system
fs_usage

##List processes
ps -ef

##Show vm statistics
vm_stat

##Copy last 5 commands to textedit file
history -n -5 | open -f

##Pasteboard access
pbpaste

##Convert plist to xml1
plutil -convert xml1

##Set password policy for accounts
pwpolicy

##Spotlight info
mdls filename

##Spotlight find
mdfind variable

##List all RAID status
diskutil appleRAID list

##List bill of materials for packages
lsbom -p UGMsF pathto.bom

##Expand flat package
pkgutil --expand name.pkg destination

##List packages installed
repair_packages --list-standard-pkgs

##Repair Mail permissions
sqlite3 ~/Library/Envelope Index vacum

##Set Startup Disk
sudo systemsetup -setstartupdisk /System/Library/CoreServices

##Set fullname for user
sudo dscl . -create /Users/etcadmin RealName "etcadmin"

##Set User Picture
sudo dscl . -create /Users/etcadmin picture "/Library/User Pictures/ETC/etc.jpg"

##Set Auto login
/usr/libexec/PlistBuddy -c "Add autoLoginUser string etcadmin" $3/Library/Preferences/com.apple.loginwindow.plist

##Update auto login
/usr/libexec/PlistBuddy -c "Set autoLoginUser etcadmin" $3/Library/Preferences/com.apple.loginwindow.plist

##Remove Auto Login
/usr/libexec/PlistBuddy -c "Remove autoLoginUser string etcadmin" $3/Library/Preferences/com.apple.loginwindow.plist
OR
/usr/libexec/PlistBuddy -c "Set autoLoginUser" $3/Library/Preferences/com.apple.loginwindow.plist

##Find battery capacity information
ioreg -l | grep Capacity

##Find Battery Information
#Cycle Count
ioreg -l | grep Capacity | grep "Cycle Count"| cut -d, -f6 |sed -e s/\"//g | sed -e s/}//g
#Cycle Count Number Only
ioreg -l | grep Capacity | grep "Cycle Count"| cut -d, -f6 |sed -e s/\"Cycle\ Count\"=//g | sed -e s/}//g
#Max Capacity
ioreg -l | grep MaxCapacity | sed s/\"//g| awk '{print $3,$4,$5}'
#Max Capacity Number Only
ioreg -l | grep MaxCapacity | sed s/\"//g | awk '{print $5}'
#Current Capacity
ioreg -l | grep CurrentCapacity | sed s/\"//g| awk '{print $3,$4,$5}'
#Current Capacity Number Only
ioreg -l | grep CurrentCapacity | sed s/\"//g | awk '{print $5}'
##Design Capacity
ioreg -l | grep DesignCapacity | sed s/\"//g | awk '{print $3,$4,$5}'
#Design Capacity Number Only
ioreg -l | grep DesignCapacity | sed s/\"//g | awk '{print $5}'

##Allow local admins to auth screen saver
perl -i~backup -pe s/"account required pam_group.so no_warn group=admin,wheel fail_safe"/"account sufficient pam_group.so no_warn group=admin,wheel fail_safe"/g /etc/pam.d/screensaver

## Watch packagemaker changes to system
cd /Developer/Applications/Utilities/PackageMaker.app/Contents/MacOS
./packagemaker --watch

# Creating a snapshot package:
packagemaker --watch [normal options, except --doc and --root]

## Remove username from Cisco VPN menu
perl -i~backup -pe s/`cat /private/etc/opt/cisco-vpnclient/Profiles/ITS\ Wireless\ at\ University\ Park.pcf|grep Username`//g /private/etc/opt/cisco-vpnclient/Profiles/ITS\ Wireless\ at\ University\ Park.pcf

## Run script to update software
#!/bin/sh

#General settings to Software Updates to run in background defaults -currentHost write com.apple.SoftwareUpdate AgreedToLicenseAgrement -bool YES defaults -currentHost write com.apple.SoftwareUpdate AutomaticDownload -bool YES defaults -currentHost write com.apple.SoftwareUpdate LaunchAppInBackground -bool YES

#Set Software Update to run in background with no user interaction defaults write /System/Library/CoreServices/Software\ Update.app/Contents/Info NSUIElement -bool TRUE

#Check for new updates, what else?
/System/Library/CoreServices/Software\ Update.app/Contents/Resources/SoftwareUpdateCheck

#Re-enable Software Update to run in foreground defaults write /System/Library/CoreServices/Software\ Update.app/Contents/Info NSUIElement -bool FALSE

#Add all updates to update index under IsntallAtLogout section updatelist=(`defaults read /Library/Updates/index ProductPaths | grep -v "[{}]" | awk -F "=" '{print $1}' | grep -o "[^\" ]\+"`) defaults write /Library/Updates/index InstallAtLogout -array ${updatelist[*]}

#Tell OSX that we want to install updates at logout touch /var/db/.SoftwareUpdateAtLogout chmod og-r /var/db/.SoftwareUpdateAtLogout

#Check to see if a user is logged in or not if who | grep -q console; then
#user logged on
#Bring up an alert to reboot
osascript -e 'tell application "System Events" to display alert "A restart is required to finish updates. Please click restart to restart your computer now" buttons {"Cancel", "Restart"} as warning default button "Restart" cancel button "Cancel"
if button returned of result = "Restart" then
tell application "System Events" to restart
end if'
else

#login window
#reboot to install updates
#current errors out
osascript -e 'tell application "System Events" to tell process "SecurityAgent" to click button "Restart" of window 1'

fi

## Find UUID of computer
ioreg -rd1 -c IOPlatformExpertDevice | grep -E '(UUID)'| sed s/\"//g | sed s/\ //g | awk -F\= '{print $2}'

# Flush DNS Cache
# *10.6 and later
dscacheutil -flushcache

# 10.5.2 - 10.5.8
dscacheutil -flushcache

# 10.5.1 and earlier:
lookupd -flushcache

## List all local admins exept for root and etcadmin
sudo dscl . read /Groups/admin GroupMembership | sed 's/GroupMembership\:\ //g;s/root\ //g;s/etcadmin\ //g'

## Show All Extensions On turn on extensions in Finder and file dialogs
defaults write -g AppleShowAllExtensions -bool YES; killall Finder

## allow any user to set dvd region code
"$3"/usr/libexec/PlistBuddy -c "Set :rights:system.device.dvd.setregion.initial:class allow" "$3"/etc/authorization

## Remove "downloaded this app from internet" message
xattr -d com.apple.quarantine firefoxapp.app

## Move MacSpeech Data to local Network Users folders
for i in `ls /Users/NetworkUsers/`
do
sudo cp /Users/Shared/Library/Preferences/com.macspeech.dictate.plist /Users/NetworkUsers/$i/Library/Preferences/
done
sudo cp -R /Users/Shared/Library/Application\ Support/MacSpeech /Library/PSUadmin/guestmaster/Library/Application\ Support/
sudo cp /Users/Shared/Library/Preferences/com.macspeech.dictate.plist /Library/PSUadmin/guestmaster/Library/Preferences/

for i in `ls /Users/NetworkUsers/`
do
sudo cp -R /Users/Shared/Library/Application\ Support/MacSpeech /Users/NetworkUsers/$i/Library/Application\ Support/
sudo chmod 777 /Users/NetworkUsers/$i/Library/Application\ Support/MacSpeech
done

## Starts the Flurry screensaver over the login window when idle for 60 seconds
$defaults write "${PREFS_DIR}/com.apple.screensaver" loginWindowIdleTime -int 60
$defaults write "${PREFS_DIR}/com.apple.screensaver" loginWindowModulePath "/System/Library/Screen Savers/Flurry.saver"

## Wait for network to be ready
/usr/sbin/networksetup -detectnewhardware

## Enable Assistive Devices
sudo touch /private/var/db/.AccessibilityAPIEnabled

My Colloquy Theme

2010-06-08T19:52:00.000-07:00

I like it!!

iPad as mobile admin

2010-04-15T16:21:00.000-07:00

As I tried to type a bash command on my iPod, I dreamed to do it from a larger keyboard. After I rotated the iPod to landscape, I wished for a larger screen. Then, I got an iPad.

Remote administration is a big part of my job. Being able to be in two places at one time is not physically possible, without VNC! Be it SSH, ARD, VNC, or RDP, I longed for a device that could help. A laptop is great, but can be too big of a tool for the job, when the job is just to restart a service.

Last night I got a call about the web server being down. Thinking about http://thewebsiteisdown.com, now. Anyway, our mysql server wasn't responding, which is a bad thing. Hopping on my iPad, I opened the iSSH app and tried to ping the mysql server. No go there, the host was down. The mysql server is hosted on the VM server, so...next stop, Jump Desktop. Jump Desktop allows me to RDP into the windows servers. After adding the vm server, I tried to connect!

So I could lie to you, tell you how I restarted the vm, and the mysql server came back up, and I was a big hero (Imagine me as Clark Griswold on cover of national lampoons vacation).

It didn't happen that way. I was literally standing in my living room with kids hanging off my legs, iPad in my hand (much like the tennis racket of Clark's). However, I could not reach the VM server. I later found out it was scheduled maintenance that took the VM server offline. I expect my next remote administration job to have a better end!

So if anyone else is interested in remote administration from the iPad, here are the apps I am using:

iSSH - SSH and VNC
$9.99 - http://tinyurl.com/ipadissh
Jump Desktop - RDP
$9.99 - http://tinyurl.com/ipadjumpdesktop
Server Admin Remote - OS X server status (allows for turning services off and on)
$11.99 - http://tinyurl.com/ipadserveradminremote

I feel I should at least write a few lines about Server Admin Remote. It's very pretty, it shows the same types of things as Server Admin on my Mac does. I can turn services off and on. I can't configure them though. That's a bummer, but understandable. Does a nice job of showing graphs too.

-Rusty

TSM Backup Check

2010-04-08T12:18:00.000-07:00

Tivoli Storage Manager (TSM) is IBM's backup software that we use where I work. Its a great piece of software, but it's a bit lacking in the notifications area. To put it simply, it does not tell the user what's happening.

For obvious reasons this can lead to confusion and lost backups when errors do occur. TSM does log whats happening and we can use those logs to our benefit. Introduction the solution; TSM Backup Check.app. A simple shell script that will parse the dsmsched.log for successful backups and errors. This app is not well tested, so use with caution.

Here is the installer for the app:
http://www.personal.psu.edu/rzm102/TSM%20Backup%20Check.dmg

Here is the source for the app:
http://www.personal.psu.edu/rzm102/TSM%20Backup%20Check%20Source.zip

The TSM Backup Check package installs the "TSM Backup Check.app" and "Set TSM Backup Check Run Time.app" in to the "TSM Backup Check folder" in Applications. There is a postflight script that sets Growl to start at login.

The TSM Backup Check.app requires Growl to be installed and turned on. I used Growl 1.2 from here: http://growl.cachefly.net/Growl-1.2.dmg
The TSM Backup Check.app creates a log file in ~/Library/Logs/TSMChk.log and appends to it after each run. The script will search the dsmsched.log for your last successful backup. If it's older than 10 days, it does some error checking and reports what fails. The successful backup date is then displayed with growl.

The Set TSM Backup Check Run Time.app uses applescript to ask you for the time you want the launchd item to run the TSM Backup Check.app. The launchd item tries to launch it from the /Applications/TSM Backup Check/ folder, so if it's moved, it will break. Once you enter what time you want it to check it will enable the plist and set the time. You can enter "disable" to turn the launchd item off.

I hope that this app will help alleviate some of the confusion of the TSM systems for users. Please ask questions, tell me if something breaks, or if you want to change it to fit your environment!

Cheers,
Rusty

TSM is http://www-01.ibm.com/software/tivoli/products/storage-mgr/

10.6 Snow Leopard Screen Saver

2010-03-30T12:04:00.000-07:00

In 10.5 and before, a local admin could unlock a screen saver using their credentials. This changed in 10.6. I understand why, two admins, one computer, you really don't want your buddy to unlock your screen saver. What if you had sensitive data there?! Apple changed this so that only the user that's logged in could unlock the screen saver. All well and good, for a home computer. Here at the university, we need to be able to unlock screen savers with our local admin accounts.

Thanks to a discussion on Apple's discussion boards: http://discussions.apple.com/thread.jspa?threadID=2235793&tstart=0
I was able to find a way to change the authorization to allow local admins to unlock the screen saver. Of course I could edit the file manually, but pishaw to that! Here's the command to change the file:

Don't forget your backup!
cp /etc/pam.d/screensaver /etc/pam.d/screensaver.backup

This should all be on one line. It will make a backup of the file and change the line.:

perl -i~backup -pe s/"account required pam_group.so no_warn group=admin,wheel fail_safe"/"account sufficient pam_group.so no_warn group=admin,wheel fail_safe"/g /etc/pam.d/screensaver

You can see that all we are changing is the "required" to "sufficient". Someone much smarter than I can comment and tell us what this is actually doing, but for my purpose this gets the done stamp.

I ssh'd into a laptop I was locked out of, ran this command, and was immediately able to unlock the screen saver. This should work through ARD, SSH, Payload Free Package (provided below), etc..

Here is a payload free package that will do this. Feel free to check out what the postflight script is doing.

Enjoy Mac Ninjas

Updated blog post! Using perl script instead of shell. 20100330

Monitoring Battery Status through the Terminal

2010-03-29T05:53:00.001-07:00

We all monitor our batteries in laptops. Usually by watching a percentage symbol or fancy bar in the Menu Bar. Well, unless your on a desktop. These percentages or bar graphs give us some idea on how much time we have till we loose our digital friend. For most users, this is fine and dandy. For me, and I'm assuming some other geeks out there, it's not quite enough. I manage a few hundred laptops and finding out that someone's battery is on the fritz is never fun. If it's in warranty, no problem, just a free replacement. However, if it's "consumed" (the Apple approved term for "your battery is dead") we need to have funds allocated and parts ordered.

So how can we help manage or clients batteries more effective? Well, keep track of course! For batteries approaching a 300+ cycle count, I know to be aware that they are at the end of their life. If the Max Capacity of a battery is only 50% of its Designed Capacity, I know someone isn't happy with their battery life.

Introducing Battery Capacity Terminal Commands! Take these babies and make your own scripts, GUIs, reporting tools. Whatever you want, but please share what you can!

#Cycle Count
ioreg -l | grep Capacity | grep "Cycle Count"| cut -d, -f6 |sed -e s/\"//g | sed -e s/}//g
#Cycle Count Number Only
ioreg -l | grep Capacity | grep "Cycle Count"| cut -d, -f6 |sed -e s/\"Cycle\ Count\"=//g | sed -e s/}//g
#Max Capacity
ioreg -l | grep MaxCapacity | sed s/\"//g| awk '{print $3,$4,$5}'
#Max Capacity Number Only
ioreg -l | grep MaxCapacity | sed s/\"//g | awk '{print $5}'
#Current Capacity
ioreg -l | grep CurrentCapacity | sed s/\"//g| awk '{print $3,$4,$5}'
#Current Capacity Number Only
ioreg -l | grep CurrentCapacity | sed s/\"//g | awk '{print $5}'
##Design Capacity
ioreg -l | grep DesignCapacity | sed s/\"//g | awk '{print $3,$4,$5}'
#Design Capacity Number Only
ioreg -l | grep DesignCapacity | sed s/\"//g | awk '{print $5}'

Questions, Questions? I should buy a boat!
Rusty

BigFix on the Mac

2009-10-05T13:02:00.000-07:00

BigFix? http://bigfix.com
What's that? It's a systems management tool!
It's a big tool, with lots of stuff you can do. One of those things is deploy software or scripts to machines based on there current settings. It's called relevance.

If a machine needs the latest firefox update, we can automatically push it, based on the relevance. For example, if it's version is less than the current version, it will update.
If our admin account is missing from the machine, it can automatically add our account. Super awesome password and all. Secure and tracked using SHA1.

I've create a few tasks in BigFix so far and here are some examples of the relevance.

For the 10.6.1 update, the relevance is:
(system version = "10.6")

For Enabling remote management (Checks that Remote Management is not running and that our admin account is available):
((name of operating system = "Mac OS X") AND (not exists process whose (name of it starts with "ARDAgent")) AND (exists user "etcadmin"))

For enabling remote login (Checks overrides.plist to see if it's disabled):
(system version >= "10.6") AND (exists ((booleans of values of entries whose (key of it is "Disabled") of dictionary "com.openssh.sshd" of dictionaries of file "/private/var/db/launchd.db/com.apple.launchd/overrides.plist")) whose (it = true))

So far, it's been working pretty well. Routers slow the process down, but university IP addresses get the tasks right away. More examples to come as I work on them.

Enjoy BigFix on the Mac

Command Line Favorites #1

2009-09-11T19:01:00.000-07:00

So I've been collecting some of my favorite and most used CLI commands. I figured, now that Snow Leopard is out, why not share them!

Key:

##"Name of Command or what it does"
#"Comments from the actual command or script that it is in"

Command Line Favorites for OS X Leopard



##Change en0 to DHCP:

sudo ipconfig set en0 DHCP



##Enable ARD for etcadmin:

#etcadmin user

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users etcadmin -privs -all -restart -agent -menu

#all users

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -restart -agent -privs -all



##Change Password for admin from ARD:

 dscl . -passwd /Users/admin oldpass newpass ; kickstart - configure -privs -all -users admin



On 10.4 / 10.5:



dscl . -passwd /Users/USERNAME OLDPASS NEWPASS



##Copy text to remote location:

sudo cat /file.txt | ssh user@host 'cat - >> ~/file.txt'



##Quicklook from the Command Line:

qlmanage -p filename.jpg



#Usage: qlmanage [OPTIONS] path... -h Display this help -r Force reloading Generators list -p Show a preview of the documents -t Show thumbnails of the documents -s size Size for the thumbnail -f factor Scale factor for the thumbnail -c contentTypeUTI Force the content type used for the documents -g generator Force the generator to use



#Quick Look launch in the background:

qlmanage -p filename.jpg &



##Add highlighting to Stacks grid view:

defaults write com.apple.dock mouse-over-hilte-stack -boolean yes

killall Dock



##SSH Authorized Keys

sudo ssh-keygen -t dsa -f ~/.ssh/id_dsa -C "whatever comment"

sudo cat /private/var/root/.ssh/id_dsa.pub | ssh user@host 'cat - >> ~/.ssh/authorized_keys'

sudo cat /private/var/root/.ssh/id_dsa.pub >> /private/var/root/.ssh/authorized_keys





##Rsync Backup

sudo rsync -xrlptgoEv --progress --delete / /Volumes/Evolve



##random

systemsetup

networksetup





##Disable Time Machine "use this disk"

defaults write com.apple.TimeMachine DoNotOfferNewDisksForBackup -bool YES



##Spoof Mac Address

Retrieving your current MAC address



First, you’re going to want your current wireless MAC address so you can set it back without rebooting. Launch the Terminal and type the following command:

ifconfig en1 | grep ether

You’ll know see something like:

ether 00:12:cb:c6:24:e2

And the values after ‘ether’ makeup your current MAC address. Write this down somewhere so you don’t forget it. If you do, it’s not the end of the world, you’ll just have to reboot to reset it from a change.



Spoofing a MAC address



To spoof your MAC address, you simply set that value returned from ifconfig to another hex value in the format of aa:bb:cc:dd:ee:ff



For this example, we will set our wireless MAC address to 00:e2:e3:e4:e5:e6 by issuing the following command:

sudo ifconfig en1 ether 00:e2:e3:e4:e5:e6



The sudo command will require that you enter your root password to make the change.



Verifying the Spoofed MAC address worked



If you want to check that the spoof worked, type the same command as earlier:

ifconfig en1 | grep ether

Now you will see:

ether 00:e2:e3:e4:e5:e6

Meaning your MAC address is now the value you set it to. If you want to further verify the spoof, simply login to your wireless router and look at the ‘available devices’ (or attached devices) list, and your spoofed MAC address will be part of that list.



If you want to set your MAC address back to its real value, simply issue the above ifconfig commands with the MAC address that you retrieved in step 1. You can also reboot your Mac.



##Display full paths as Finder window titles

defaults write com.apple.finder _FXShowPosixPathInTitle -bool YES



##Add Bonjour to screen sharing application

defaults write com.apple.ScreenSharing ShowBonjourBrowser_Debug 1



##Add functionality to 10.5 Screen Sharing app

defaults write com.apple.ScreenSharing \

'NSToolbar Configuration ControlToolbar' -dict-add 'TB Item Identifiers' \

'(Scale,Control,Share,Curtain,Capture,FullScreen,GetClipboard,SendClipboard,Quality)'





##Add IP Printer



#!/bin/bash



# Tests to see if printer exists

# Requires the printer name as a parameter.  Returns 1 if the printer exists.



function printerExists()

{

 if [ $# -ne 1 ]; then

   echo "Incorrect parameters"

   return 0

 else

   lpstat -p | awk '{print $2}' | while read printer

   do

     if [ $1 = "${printer}" ]; then

       return 1

     fi

   done

 fi	

}





# Printer Name cannot Include any spaces

prName="LabPrinter"

# User friendly printer name"

prDescription="Lab Printer"

# Location

prLocation="The Lab"

# IP Address of printer

prAddress="printer.mycompany.com"

# PPD Filename... assumes it is installed on machine

prPPD="HP LaserJet 4350.gz"



#Test If Printer is already installed

printerExists $prName

prExists=$?



if [ $prExists -eq 1 ]; then

 echo "Printer already exists. Skipping: \"$prName\""

else

 # Add Printer Command

 lpadmin -p "${prName}" -D "${prDescription}" -L "${prLocation}" \

 -E -v lpd://"${prAddress}" -P "/Library/Printers/PPDs/Contents/Resources/$prPPD" \

 -o HPOption_Tray3=Tray3_500 -o HPOption_Duplexer=True -o InstalledMemory=Mem96_127 -o Duplex=DuplexNoTumble



fi



#------------------------------------------------------

#The important part is the lpadmin and lpoptions commands.  if you look at thee man pages.

#it also is a good idea to add an option to not share the printer.



#I've actually made this into a package so users can install it themselves.

#Hope that helps!

#Steve





lpadmin -p printer_name -E -v lpd://printer_and_queue_address -m printer_model_ppd_file -L "text_description_of_printer_location"

Example:

lpadmin -p "163_Chambers_Color" -E -v lpd://146.186.208.43 -P "/Library/Printers/PPDs/Contents/Resources/HP Color LaserJet 4550.gz" -L "163_Chambers_Color" -o "printer-info='163 Chambers'"



lpadmin -p B-Copier -v eqtrans://printserver/b_mfp -E -P "/Library/Printers/PPDs/Contents/Resources/HP LaserJet M5035 MFP.gz"



I have all of my printers setup using a shell script that adds them all at once. It makes setting up printers using ARD quick and easy.

• Printers are available immediately.

• For leopard machines, make sure to send the command as root or an admin. Otherwise users will need admin authentication before printing.

• Make sure to substitute the appropriate device URI (after -v)



Another quick tip is to delete all printers quickly. You can do it using the name, but I do it using a script that I grabbed somewhere.



#!/bin/bash



lpstat -p | awk '{print $2}' | while read printer

do

 echo "Deleting  Printer:" $printer

 lpadmin -x $printer

done



#Leopard Delete printer

PRINTERS_CONF="/etc/cups/printers.conf"

CUPS_PLIST="/System/Library/LaunchDaemons/org.cups.cupsd.plist"



launchctl unload "${CUPS_PLIST}"

rm ${PRINTERS_CONF}

launchctl load "${CUPS_PLIST}"



##Use your own SUS Server



#Software Update command line:

sudo defaults write com.apple.SoftwareUpdate CatalogURL "http://146.186.208.248:8088/"



#Software update program:

sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CatalogURL "http://146.186.208.248:8088/"



#To Reverse just Delete:

sudo defaults delete /Library/Preferences/com.apple.SoftwareUpdate CatalogURL





##CLI Software Update:



sudo softwareupdate -i -a



##Change Computer Name from CLI



defaults write /Library/Preferences/SystemConfiguration/preferences System 'NetworkHostNamesLocalHostName

NEWHOSTNAME

SystemComputerName

NEWHOSTNAME

ComputerNameEncoding0'



##Stop Spaces fro switching when an app is opened and have it open the app in that space

defaults write com.apple.dock workspaces-auto-swoosh -bool NO

killall Dock



##Enable ssh on machine

To enable SSH go to the terminal and type in the following:



sudo /sbin/service ssh start



That should start the SSH server on the computer. SSH should be activated even if you restart the computer until you type the following into the terminal:



sudo /sbin/service ssh stop



##KRun command to execute task at some point in time: Exmple ARD

We resolved this issue in the environments we manage by:



1. Set all Macs to turn themselves back on at 03:01AM

2. Added to /etc/crontab



50	3	*	*	*	root	/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent



##log into remote machine from cli and ARD

osascript <   tell application "System Events"

       keystroke "LOGIN_NAME"

       keystroke return

       delay 3.0 

       keystroke "PASSWORD"

       delay 3.0 

       keystroke tab

       keystroke return

       keystroke return

   end tell 

EndOfMyScript



##OR



line_01='set logInUser to "admin"';line_02='set logInPassword to "donoharm"';line_03='tell application "System Events"';line_04='tell application process "loginwindow"';line_05='key code 53';line_06='delay 1';line_07='key code 125';line_08='delay 1';line_09='key code 36 using option down';line_10='delay 1';line_11='keystroke tab';line_12='delay 1';line_13='key code 117';line_14='delay .5';line_15='keystroke tab';line_16='delay .5';line_17='key code 117';line_18='keystroke return';line_19='delay 1';line_20='keystroke tab';line_21='delay .2';line_22='repeat with aChar in characters of logInUser';line_23='keystroke aChar';line_24='delay 0.2';line_25='end repeat';line_26='keystroke tab';line_27='delay .5';line_28='repeat with aChar in characters of logInPassword';line_29='keystroke aChar';line_30='delay 0.2';line_31='end repeat';line_32='key code 98 using control down';line_33='delay 0.2';line_34='keystroke return';line_35='end tell';line_36='end tell';value=$(osascript -e "$line_01" -e "$line_02" -e "$line_03" -e "$line_04" -e "$line_05" -e "$line_06" -e "$line_07" -e "$line_08" -e "$line_09" -e "$line_10" -e "$line_11" -e "$line_12" -e "$line_13" -e "$line_14" -e "$line_15" -e "$line_16" -e "$line_17" -e "$line_18" -e "$line_19" -e "$line_20" -e "$line_21" -e "$line_22" -e "$line_23" -e "$line_24" -e "$line_25" -e "$line_26" -e "$line_27" -e "$line_28" -e "$line_29" -e "$line_30" -e "$line_31" -e "$line_32" -e "$line_33" -e "$line_34" -e "$line_35" -e "$line_36") # 53=escape,125=down,117=delete



##Mount shares with apple script:

tell application Finder

activate

mount volume "afp://ownerofsharepoint:password@serverIPhere/volumename/sharename here"

end tell



##Migrate ARD to new machine



# Copy database to remote machine:

sudo scp -Epr /var/db/RemoteManagement root@machinename:/var/db



# Copy /Library prefs

sudo scp -Ep /Library/Preferences/com.apple.RemoteDesktop.plist

root@machinename:/Library/Preferences



# Copy home dir prefs

sudo scp -E 

/Users/username/Library/Preferences/com.apple.RemoteDesktop.plist

username@machinename:~/Library/Preferences



# Copy home dir Application Support Remote Desktop dir

sudo scp -Er /Users/username/Library/Application Support/Remote Desktop

username@machinename:'~/LIbrary/Application

Support'



##Bind or unbind to leopard server

dsconfigldap -v -r oldserver.somewhere.lan

dscl /Search -delete / CSPSearchPath /LDAPv3/oldserver.somewhere.lan

dsconfigldap -v -a newserver.somewhere.lan

dscl /Search -create / SearchPolicy CSPSearchPath

dscl /Search -append / CSPSearchPath /LDAPv3/newserver.somewhere.lan



#Set up mac Mail sript

#!/bin/sh

#

#

# Create_Email_Account v1 

#

#-------------------------------------------------------------------------

#

#          Created: Feb 2007

#         Modified: 18-06-07

#

#           Author: D Savage

#                   Humanities and Social Science Support

#                   Information Services

#                   University of Edinburgh

#

#-------------------------------------------------------------------------

#   Description:

#

#		Script to setup thunderbird and mail for new staff, runs once

#		by using the users loginwindow.plist, then deletes the file

# 		mac must be bound to AD!

#

#-------------------------------------------------------------------------

#	Disclaimer:

#

#		We accept no responsibility for, nor do we warrant the merchantibility or 

#		fitness of this script. Any use or modification is at your own risk, though 

#		we would request notification of any modification required.

#

#-------------------------------------------------------------------------



#

#Set environ

#

#get user shortname

user=`who | grep console| awk '{print $1}'`





#fetch data from AD

Get_AD_Data ()

{

role=$1

dscl localhost -read "/Active Directory/All Domains/Users/${user}" | grep "^${role}:" | awk '{print $2}'

}



empType=`Get_AD_Data employeeType` 

firstN=`Get_AD_Data FirstName`

lastN=`Get_AD_Data LastName` 



fullN=`echo $firstN $lastN`

#Only students don't use staff mail so

email=`echo ${user}@staffmail.ed.ac.uk`

mailServer="staff.mail.server"

AccountName="Staff M ail Service"

SMTPName="Staff.smtp.server"



#if a student then use sms

if [ "$empType" == "Student" ];

	then

	email=`echo ${user}@sms.ed.ac.uk`

	mailServer="student.mail.server"

	AccountName="Student Mail Service"

	SMTPName="student.smtp.serverk"

fi



#

#End environ

#

thunConf=`find /Users/$user/Library/Thunderbird/Profiles/ -name 'staff.mail.server*' -o -print`

mailConf=`ls /Users/${user}/Library/Mail | grep "staffmail"`

if ! [ -z $mailConf ] && ! [ -z $thunConf ]

	then

	exit 0;

fi





ls /Users/${user}/Library/Thunderbird/Profiles/ | grep -v '^[.*]' > /tmp/thun.txt





#

#Mail.app config done here

#



osascript <tell application "Mail"

	set theAccountName to "$AccountName"

	set theMailServer to "$mailServer"

	set theUsername to "$user"

	set theFullName to "$fullN"

	set theEmailAddresses to "$email"

	set theSMTPName to "$SMTPName"

	try

		set theAccount to make new imap account with properties {name:theAccountName, user name:theUsername, server name:theMailServer, full name:theFullName, email addresses:theEmailAddresses, uses ssl:true}

		

	end try

	

	set theSMTPServer to make new smtp server with properties {server name:theSMTPName}

	set smtp server of theAccount to theSMTPServer

end tell

EOF



killall "Mail"







#

#Thunderbird config starts here

#

#server2









end='");'



cat /tmp/thun.txt | ( while read profileName; 

     do

prefFile="/Users/${user}/Library/Thunderbird/Profiles/${profileName}/prefs.js"



cat <> $prefFile

user_pref("mail.account.account2.identities", "id1");

user_pref("mail.account.account2.server", "server2");

user_pref("mail.accountmanager.accounts", "account1,account2");

user_pref("mail.accountmanager.defaultaccount", "account2}");

user_pref("mail.identity.id1.doBcc", false);

user_pref("mail.identity.id1.doBccList", "");

user_pref("mail.identity.id1.draft_folder", "mailbox://nobody@Local%20Folders/Drafts");

user_pref("mail.identity.id1.drafts_folder_picker_mode", "0");

user_pref("mail.identity.id1.escapedVCard", "");

user_pref("mail.identity.id1.fcc_folder", "mailbox://nobody@Local%20Folders/Sent");

user_pref("mail.identity.id1.fcc_folder_picker_mode", "0");

user_pref("mail.identity.id1.fullName", "${fullN}");

user_pref("mail.identity.id1.organization", "");

user_pref("mail.identity.id1.reply_to", "");

user_pref("mail.identity.id1.smtpServer", "smtp1");

user_pref("mail.identity.id1.stationery_folder", "mailbox://nobody@Local%20Folders/Templates");

user_pref("mail.identity.id1.tmpl_folder_picker_mode", "0");

user_pref("mail.identity.id1.useremail", "${email}");

user_pref("mail.identity.id1.valid", true);

user_pref("mail.root.imap-rel", "[ProfD]ImapMail");

user_pref("mail.root.none-rel", "[ProfD]Mail");

user_pref("mail.server.server1.directory-rel", "[ProfD]Mail/Local Folders");

user_pref("mail.server.server1.hostname", "Local Folders");

user_pref("mail.server.server1.name", "Local Folders");

user_pref("mail.server.server1.type", "none");

user_pref("mail.server.server1.userName", "nobody");

user_pref("mail.server.server2.capability", 17593141);

user_pref("mail.server.server2.download_on_biff", true);

user_pref("mail.server.server2.hostname", "${mailServer}");

user_pref("mail.server.server2.isSecure", true);

user_pref("mail.server.server2.login_at_startup", true);

user_pref("mail.server.server2.max_cached_connections", 5);

user_pref("mail.server.server2.name", "${AccountName}");

user_pref("mail.server.server2.namespace.personal", "\"\"");

user_pref("mail.server.server2.namespace.public", "\"Shared Folders/\"");

user_pref("mail.server.server2.socketType", 3);

user_pref("mail.server.server2.timeout", 29);

user_pref("mail.server.server2.type", "imap");

user_pref("mail.server.server2.userName", "${user}");

user_pref("mail.smtp.defaultserver", "smtp1");

user_pref("mail.smtpserver.smtp1.auth_method", 1);

user_pref("mail.smtpserver.smtp1.hostname", "${SMTPName}");

user_pref("mail.smtpserver.smtp1.port", 25);

user_pref("mail.smtpserver.smtp1.try_ssl", 0);

user_pref("mail.smtpserver.smtp1.username", "${user}");

user_pref("mail.smtpservers", "smtp1");

EOF



done)



rm -dfr /Users/${user}/Library/Preferences/loginwindow.plist



exit 0;



#Fix ard issue

osascript -e 'tell app "ARDAgent" to do shell script "chmod 0555 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent"';



## Script for phoning home

#Set the computername

systemsetup -setcomputername $(/bin/hostname)



#Phone home

SUBJECT="New Host Added: "

TO="ard@mydomian.com"



/usr/bin/mail -s "$SUBJECT $(/bin/hostname)" "$TO" <

A new host was imaged today at `date`. Add $(/bin/hostname) to your ARD configuration. It's profile is:



$(system_profiler | head -n 17)

EOF



##Implement Filevault on all machines



Copy /Library/Keychains: FileVaultMaster.cer, and FileVaultMaster.keychain 



#MCX settings for password hint or:

/Library/Keychains: FileVaultMaster.cer, and FileVaultMaster.keychain 



#add blank password hint

sudo defaults write /Library/Preferences/com.apple.loginwindow MasterPasswordHint "" 





##Postflight script to set time zone and start NTP (Leopard) 



#!/bin/sh



#Set variables

systemSetupLocation="/usr/sbin/systemsetup"

timeZone="Europe/Dublin"

networkTimeServer="time.euro.apple.com"



#Set time zone, set time server, start NTP

$systemSetupLocation -settimezone $timeZone

$systemSetupLocation -setnetworktimeserver $networkTimeServer iburst

$systemSetupLocation -setusingnetworktime on



##Set computer to netboot through ARD

sudo bless --netboot --server bsdp://server.apple.edu



##Set dns for primary interface

mainInt=$(networksetup -listnetworkserviceorder | \

awk '/\(1\)/ {$1="";sub("^ ","",$0);print}')

networksetup -setdnsservers "$mainInt" 10.0.0.1 10.0.0.2



##Backup OD to archive

echo "dirserv:backupArchiveParams:archivePassword = mypassword" > /var/root/command.txt

echo "dirserv:backupArchiveParams:archivePath = /path/to/backup/odarchive" >> /var/root/command.txt

echo "dirserv:command = backupArchive" >> /var/root/command.txt

serveradmin command < /var/root/command.txt

rm /var/root/command.txt



##Hide users with UID under 500

defaults write /Library/Preferences/com.apple.loginwindow Hide500users 1



##Bind computers to OD and add to computergroups



I've started using this script to add a computer record to my ODM as part of my 1stRun OD binding script.  It also adds that machine to a ComputerList and a ComputerGroup.  I don't know the details (guessing ComputerLists are for 10.4 and earlier, ComputerGroups for 10.5 and later) but I have to add the computer to both the ComputerList and the ComputerGroup for it to show up in WGM.  (Actually, I didn't try just adding to the ComputerGroup, but when you add a machine to a Computer Group in WGM, it gets added to both the ComputerGroup and the ComputerList in LDAP.)  Here's my script:



	thisComputerName="$(systemsetup -getcomputername | cut -c 16-)"

	thisLocalSubnetName="$(systemsetup -getlocalsubnetname | cut -c 20-)"

	thisHWAddress="$(ifconfig en0 | awk ' /ether/ { print $2 }')"

	

	# Create a computer record using the LocalSubnetName as the record id

	dscl -u diradmin -P "diradminpass" /LDAPv3/odm.mydomain.net/ -create /Computers/$thisLocalSubnetName macAddress $thisHWAddress

	# note you get a GUID here for free, don't have to set with uuidgen



	# Add the RealName attribute

	dscl -u diradmin -P "diradminpass" /LDAPv3/odm.mydomain.net/ -append /Computers/$thisLocalSubnetName RealName "$thisComputerName"



	# Add to the facultylaptops ComputerList

	dscl -u diradmin -P "diradminpass" /LDAPv3/odm.mydomain.net/ -merge "/ComputerLists/facultylaptops" apple-computers "$thisLocalSubnetName"



	# Add to the facultylaptops ComputerGroup

	thisGUID="$(dscl /LDAPv3/odm.mydomain.net/ -read /Computers/$thisLocalSubnetName GeneratedUID | awk '{ print $2 }')"

	dscl -u diradmin -P "diradminpass" /LDAPv3/odm.mydomain.net/ -merge "/ComputerGroups/facultylaptops" apple-group-memberguid "$thisGUID"

	dscl -u diradmin -P "diradminpass" /LDAPv3/odm.mydomain.net/ -merge "/ComputerGroups/facultylaptops" memberUid "$thisLocalSubnetName"

	

## Remove leopard video and music

However the video is a QuickTime file, located here :

Assistant.app/Contents/Resources/TransitionSection.bundle/Contents/Resources/intro.mov>

The music is there :

Assistant.app/Contents/Resources/TransitionSection.bundle/Contents/Resources/intro-sound.mp3>



##To reset the local KDC

 #  1. Using Keychain Access, locate the com.apple.kerberos.kdc certificate and key pair in the System keychain.  Delete all three entries.

 #  2. Using Terminal, execute this command to remove the local KDC:

      sudo rm -fr /var/db/krb5kdc

 #  3. Using Terminal, execute this command to re-generate the local KDC root certificate and key pair:

      sudo /usr/libexec/configureLocalKDC



##Set sleep/wake



pmset [displaysleep or disksleep] [number in minutes]



##OSA Dialog box restart

#Tell user to restart

osascript -e 'tell app "System Events" to display dialog "Please Restart your Computer." buttons "OK" default button 1 with title "Restart Please" with icon stop'



##Rename the boot drive



#You can use the following script to rename the boot drive:



diskutil $(df / | awk '{print $1}') newname



#or



tell application "Finder" to set name of startup disk to "MyDiskName"



#or



diskutil rename / newname



##Fix spotlight



mdimport -d1 /



##Set mac startup time



pmset repeat poweron MTWRF 07:40:00



##Stop Software updates automaticly



softwareupdate --schedule off



##Get the hardware model of the machine



sysctl -n hw.model



##Reset MCX managment

#10.4

/System/Library/CoreServices/mcxd.app/Contents/MacOS/mcxd -f

#10.5

sudo dscl . -delete /Computers

sudo rm -rf /Library/Managed\ Preferences



##Curl file suggestions



curl should be (?) curl -O

installer is installer -pkg  -target /



#!/bin/bash



##Script to test for the availability of internet and download something





#Set loop variable.

viperecho=FALSE

number=0



if [ "$(id -u)" != "0" ]; then

   echo "This script must be run as root" 1>&2

   exit 1

else

while [ $viperecho = 'FALSE' ];do

	# If block to test internet availability

	if ping -nc 3  | grep '100%' >/dev/null 2>&1 ; 

	then 

		/bin/echo $(date) "failed to connect to server" >> 

		/bin/echo $(date) "Attempt= $number" >> 

		number=$((number + 1))

		/bin/echo $(date) "sleep for 5 seconds" >> 

		/bin/sleep 5

		/bin/echo $(date) "looping again" >> 

		# change the numer to higher count if needed

		while (($number == 10));do

				/bin/echo $(date) "Service not availible, exiting" >> 

				exit 0

		done	

	else

		/bin/echo $(date) "Downloading file" >> 

		/usr/bin/curl  -o /tmp/.pkg --stderr 

		/bin/echo $(date) "Done downloading" >>  

		/usr/sbin/installer -pkg /tmp/.pkg -target / >>  

		/bin/rm /tmp/redirect.pkg

		/bin/echo $(date) "Exiting Redirect Download" >> 

		viperecho=TRUE

	fi

fi

exit 0

done



#!/bin/sh

## Script for getting the network service name which holds the default route

# dre@mac.com, 2/14/05  (with some help from mikeash)



# First we get the generated unique ID of the network service that is currently

# set as the default route. Because scutil doesn't have command line switches

# for quering specific keys, we use echo to send commands to scutil's STDIN,

# as a way of simulating the commands we would type interactively to achieve

# the same result (tr is used to convert ||| into carriage return)



SERVICE_GUID=`echo "open|||get State:/Network/Global/IPv4|||d.show" | \

tr '|||' '\n' | scutil | grep "PrimaryService" | awk '{print $3}'`



# next we use SERVICE_GUID to perform another query to scutil, this time to get

# the human-readable name associated with the given network service. This name

# could contain spaces and the like, so we switch awk's field seperator to ": "

# to nab everything after the colon.



SERVICE_NAME=`echo "open|||get Setup:/Network/Service/$SERVICE_GUID|||d.show" |\

tr '|||' '\n' | scutil | grep "UserDefinedName" | awk -F': ' '{print $2}'`



echo $SERVICE_NAME



##Enable dashboard development mode

defaults write com.apple.dashboard devmode YES



##Netboot Across subnets script

#!/bin/sh

# Name: Robert Henderson

# Date: 2-25-2005

# Description:

# Allows the user to make a choice on which netboot volume they want to boot from.

# Thanks to Mike Bomich for the original code created by NBA.



### Global Variables ###

server=

sharepoint="NetBootSP0″



# Determine Arch value and point to proper netboot image

archtech=`arch`

if [ "`arch`" == "ppc" ] ; then

setName="PPCNetboot.nbi"

else

setName="IntelNetboot.nbi"

fi



imageName="NetInstall-Restore.dmg"

protocol="nfs"

simple="false"

nextboot=""



if [ $simple == true ]; then

if [ "`arch`" == "ppc" ]; then

/usr/sbin/nvram boot-device="enet:${server}" boot-args="" boot-file=""

else

/usr/sbin/bless –netboot –server "bsdp://${server}" $nextboot

fi

else

if [ "`arch`" == "ppc" ]; then

/usr/sbin/nvram boot-args="rp=${protocol}:${server}:/private/tftpboot/NetBoot/${sharepoint}:${setName}/${imageName}" boot-file="enet:${server},NetBoot\\${sharepoint}\\${setName}\\mach.macosx" boot-device="enet:${server},NetBoot\\${sharepoint}\\${setName}\\booter"

else

/usr/sbin/bless –netboot –booter "tftp://${server}/NetBoot/${sharepoint}/${setName}/i386/booter" –kernel "tftp://${server}/NetBoot/${sharepoint}/${setName}/i386/mach.macosx" –options "rp=${protocol}:${server}:/private/tftpboot/NetBoot/${sharepoint}:${setName}/${imageName}" $nextboot

fi

fi

reboot



##Netboot Commands

PPC:

/usr/sbin/nvram boot-args="rp=nfs:146.186.208.248:/private/tftpboot/NetBoot/NetBootSP0:nb_nrset09_4007.nbi/NetInstall-Restore.dmg" boot-file="enet:146.186.208.248,NetBoot\\NetBootSP0\\nb_nrset09_4007.nbi\\mach.macosx" boot-device="enet:146.186.208.248,NetBoot\\NetBootSP0\\nb_nrset09_4007.nbi\\booter"



Intel:

/usr/sbin/bless –netboot –booter "tftp://146.186.208.248/NetBoot/NetBootSP0/nb_nrset09_4007.nbi/i386/booter" –kernel "tftp://146.186.208.248/NetBoot/NetBootSP0/nb_nrset09_4007.nbi/i386/mach.macosx" –options "rp=nfs:146.186.208.248:/private/tftpboot/NetBoot/NetBootSP0:nb_nrset09_4007.nbi/NetInstall-Restore.dmg" $nextboot



#!/bin/sh

# Name: Robert Henderson

# Date: 2-25-2005

# Description:

# Allows the user to make a choice on which netboot volume they want to boot from.

# Thanks to Mike Bomich for the original code created by NBA.



### Global Variables ###

server=146.186.208.248

sharepoint="NetBootSP0"



# Determine Arch value and point to proper netboot image

archtech=`arch`

if [ "`arch`" == "ppc" ] ; then

setName="nb_nrset09_4007.nbi"

else

setName="nb_nrset09_4007.nbi"

fi



imageName="NetInstall-Restore.dmg"

protocol="nfs"

simple="false"

nextboot=""



if [ $simple == true ]; then

if [ "`arch`" == "ppc" ]; then

/usr/sbin/nvram boot-device="enet:${server}" boot-args="" boot-file=""

else

/usr/sbin/bless –netboot –server "bsdp://${server}" $nextboot

fi

else

if [ "`arch`" == "ppc" ]; then

/usr/sbin/nvram boot-args="rp=${protocol}:${server}:/private/tftpboot/NetBoot/${sharepoint}:${setName}/${imageName}" boot-file="enet:${server},NetBoot\\${sharepoint}\\${setName}\\mach.macosx" boot-device="enet:${server},NetBoot\\${sharepoint}\\${setName}\\booter"

else

/usr/sbin/bless –netboot –booter "tftp://${server}/NetBoot/${sharepoint}/${setName}/i386/booter" –kernel "tftp://${server}/NetBoot/${sharepoint}/${setName}/i386/mach.macosx" –options "rp=${protocol}:${server}:/private/tftpboot/NetBoot/${sharepoint}:${setName}/${imageName}" $nextboot

fi

fi

reboot



##Add a item to the dock.app


dockadd () {
        defaults write com.apple.dock persistent-apps -array-add "<dict><key>tile-data</key><dict><key>file-data</key><dict><key>_CFURLString</key><string>$1</string><key>_CFURLStringType</key><integer>0</integer></dict></dict></dict>";
        osascript -e "tell application \"Dock\" to quit"
}




##If you set the password on a machine, then read it out:



sudo nvram security-password

security-password	%cd%c9%ce%ca%c6%cb



#You can then set it on other machines with:



sudo nvram security-mode=command

sudo nvram security-password=%cd%c9%ce%ca%c6%c



#clear the password



sudo nvram security-mode=none

sudo nvram -d security-password



##Repair disk permissions

diskutil repairPermissions /



##Delete MCX Cache

dscl . -delete /Config/mcx_cache



##Remove Smartboard auto launch

defaults delete /Library/Preferences/loginwindow AutoLaunchedApplicationDictionary



##Get computer serial number

system_profiler SPHardwareDataType | awk -F ': ' '/Serial Number/ {print $2}'



##Load and start a launchd deamon

#I saw that someone responded with the:



launchctl load

#or

launchctl load /Library/LaunchDaemons/com.yourbusiness.appname



#...command.  That loads the LaunchDaemon if it wasn't loaded already.  If you want to start a job, use:



launchctl start [job label]



##Make System Preferences Secure

/usr/local/sbin/PlistBuddy -c "set :rights:system.preferences:shared false" /etc/authorization



##Determine OS version

defaults read "$1"/System/Library/CoreServices/SystemVersion ProductVersion | awk -F. '{print $2}'

#OR

defaults read "$1"/System/Library/CoreServices/SystemVersion ProductVersion



##Manipulate text file

perl -i~ -pe 's/abc/def/g' filename 



##Backup sql database

mysqldump -ugallery -p -h kb.educ.psu.edu --opt gallery2 > gallery2.sql



##Cat computernames from txt file

cat Desktop/SAV/SAV\ Clients | awk '{print $3}' | grep rack |sort

cat Desktop/SAV/SAV\ Clients | awk '{print $3}' | grep kell |sort

cat Desktop/SAV/SAV\ Clients | awk '{print $3}' | grep cdr |sort

cat Desktop/SAV/SAV\ Clients | awk '{print $3}' | grep ch |sort



##Say + Volume

sudo osascript -e "set Volume 10" | say "hello World"



##Enabled disabled moible home user

#To reset a disabled mobile home user, you can use the command like this on the remote machine:

pwpolicy -a adminusername -u username -n /Local/Default -enableuser



##Airport command

#help

bash /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -h



##Mysql Login Error

This may help or not! but this is what i did to create a user (root) password needs to changed to your password.



mysqladmin -u root password "password"

mysql -u root -p



Enter password: mypassword

Welcome to the MySQL monitor. Commands end with ; or \g.

Your MySQL connection id is 4 to server version: 5.0.27-standard



Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

mysql> use mysql;

mysql> delete from user where Host like "%";

mysql> grant all privileges on *.* to root@localhost identified by 'password' with grant option;

mysql> flush privileges;

mysql> exit;



##Check Password expire on Windows for AD user

net user "userID" /domain



##Determine Password expiration

ldapsearch -LLL -Q -s base -H ldap://146.186.208.239 -b DC=educ,DC=psu,DC=edu maxPwdAge | /usr/bin/awk -F- '/maxPwdAge/ {print $2/10000000}'



##MCX Manifests

find /Applications -name *.manifest -print



##remove (hide) the machine from the network browser. It will still be visible va ARD:

defaults write /Library/Preferences/com.apple.RemoteManagement VNCNoRegister -bool yes



##Set VNC Password

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -clientopts -setvnclegacy -vnclegacy yes -setvncpw -vncpw "test"



##Turn Airport on and off

networksetup -setairportpower off

networksetup -setairportpower on



##Disable Launchd item

sudo defaults write /Library/LaunchDaemons/com.apple. Disabled true



##Set or unset dns servers

#remove

networksetup -setdnsservers Ethernet "Empty"

networksetup -setdnsservers Airport "Empty"

#Set

sudo networksetup -setdnsservers Ethernet 12.12.12.12

sudo networksetup -setdnsservers Airport 12.12.12.12



##Disable Firewall

#Disable

sudo ipfw disable firewall

#Enable

sudo ipfw enable firewall



##Find hardware model

sysctl -n hw.model



##Disable ipv6

networksetup -setv6off Ethernet



##Enable Directory Service Logging at startup

touch /Library/Preferences/DirectoryService/.DSLogAPIAtStart



##Manually turn loggin on/off

sudo killall -USR1 DirectoryService



##Restart DirectorySercice

sudo killall DirectoryService



##Fresh Start with Directory Service

#!/bin/bash



rm -R /Library/Preferences/DirectoryService

rm -R /var/db/authserver

rm /Library/Preferences/edu.mit.Kerberos

rm /etc/krb5.keytab



#restart DS

sudo killall DirectoryService



##Mount discs before login

#I've never done this, but you might find it a problem, as external drives aren't normally mounted until after login.  You can get around this with a plist file:

sudo defaults write /Library/Preferences/SystemConfiguration/autodiskmount AutomountDisksWithoutUserLogin -bool true



##Find user if of current user

user=`who | grep console| awk '{print $1}'`

/usr/bin/id -P | awk -F: '{ print $1 }'



##ldadmin user for printing issue

dseditgroup -o edit -p -a admin -t group _lpadmin



##The following command would find all files modified within 24 hours: 

sudo find / -mtime -1 



##Some restore from the command line with TSM :



dsmc res "/was/*" /tmp/was/ -virtualnodename=aixsrv -ina -pick -fromdate=MM/DD/YY



#Where :

# 

# "/was/*" is the files/directories to be restored

# 

# /tmp/was/ is the destination (if omitted, the files will be restored to their original location)

# 

# -virtualnodename=aixsrv is used when we want to restore files belonging to another node

# 

# -pick is used to display an interactive menu with the list of the files before performing the restore 

# 

# -ina is to list the files that were no longer on the node at the time of the last backup (used with -pick)

# 

# -fromdate is used to specify a date from which you want to search for backups (in the same family, -todate, -pitdate, -fromtime ...)



##Check schedule for tsm

dsmc query schedule



##my favorite date

date "+%Y%m%d"



##Convert disk image to compressed-readonly

hdiutil convert "image.dmg" -format UDZO -o "Output.dmg"



##Get info on the disk image

hdiutil imageinfo "image.dmg"

Script to find active internet interface and display IP address

2009-01-11T11:05:00.001-08:00

Need I say more?

I used it with Platypus to create a application that I can push out to all the computers I manage. I'm also using with InstaDMG to create new system images.


#!/bin/bash

################################################################################
#Display IP Address and Hostname of Computer
#Written to be used with Platypus - http://www.sveinbjorn.org/platypus
#Written by Rusty Myers - rustymyers@gmail.com
################################################################################


################################################################################
#Variables
################################################################################

computername=`scutil --get ComputerName`

en0test=`ifconfig en0 | grep -q 'inet ' && echo en0`

en1test=`ifconfig en1 | grep -q 'inet ' && echo en1`

################################################################################
#Functions
################################################################################

function testinterface {
    if [ "$en0test" == "en0" ]
    then
    activeinterface=en0
    elif [ "$en1test" == "en1" ]
    then
    activeinterface=en1
    else
    activeinterface=None
    fi
}

function displayip {
    if [ "$activeinterface" == "None" ]
    then
    ipaddress="None"
    else
    ipaddress=`ipconfig getifaddr $activeinterface`
    fi
}

function displaydialog {
    echoserial=`/usr/bin/osascript << EOT
    tell app "System Events"
    Activate
    display dialog "Your IP address is $ipaddress. Your computer name is $computername" buttons "OK" default button 1 with title "IP Address and Computer Name"
    end tell
    EOT`
    
    echo $echoserial
}


################################################################################
#Run the Functions
################################################################################

testinterface

displayip

displaydialog

Stop Smartboard from starting at login

2009-01-09T05:35:00.001-08:00

It's a bit of a pain that SMART buries the startup commands in the /Library/Preferences/loginwindow.plist file. But, thanks to the defaults command, this doesn't have to be hard to fix. Open the Terminal.app and type:

defaults delete /Library/Preferences/loginwindow AutoLaunchedApplicationDictionary

You could also type these commands into the Terminal.app to create a file that is runable with double clicks:

echo defaults delete /Library/Preferences/loginwindow AutoLaunchedApplicationDictionary>>~/Desktop/"remove smart startup item.command"|chmod 775 ~/Desktop/"remove smart startup item.command"

You can then rename the file and distribute it to users.

Binding Macs to OD and AD, Security Requirments

2009-01-05T08:44:00.001-08:00

While scripting binding to my AD and OD servers, I wanted to increase security of the accounts that are used. Each of the directory servers does this a little differently.

Bind to OD

For security purposes, it's not a great idea to script binding with the administrator account. This is what is commonly done with restrictions on the disk image and scripts. This is how I have done it up to this point too. Being overly paranoid and wanting to leave a respectable legacy, I looked into binding with an account that's less than super-admin.

After testing it out, I can use a simple access account (without administrator privileges) to bind machines to OD. This solves my issues with using a privileged account. I am also changing the passwords monthly.

Bind to AD

Again, binding to AD has the same issues with using a Domain Administrators account. To solve this, I used this article to create an account that is only allowed to bind/unbind machines.

http://support.microsoft.com/kb/251335

Also, this is a nice GUI to binding on first boot:
http://forums.bombich.com/viewtopic.php?p=46346

Rusty
Thanks to Jody for the AD side!

Quantum of Solace and Wii WFC

2009-01-02T11:37:00.001-08:00

I rented Quantum of Solace for the wii over break and have been trying to play online. It took me a bit to figure out what was wrong. After checking the Network Test from Nintendo support, I found out what my problem was.

My router, Linksys BEFSR41 V3, Had Dynamic Routing turned off. Usually because if I don't know what it does, I turn it off and see what happens. So I probably turned of Transmitting and Recveiveing of RIP a long time ago. I read what it does;
"The Dynamic Routing feature can be used to
automatically adjust to physical changes in the network's layout. The
Router uses the dynamic RIP protocol. It determines the route that the
network packets take based on the fewest number of hops between the
source and the destination. The RIP protocol regularly broadcasts
routing information to other routers on the network.", and turned it back on.

After that, it worked like a charm! The menu is located under Setup->Advanced routing on the routers config website. If you find yourself in the same position, give that a try.

Network Test:
http://www.nintendo.com/consumer/systems/wii/en_na/NetworkTest.jsp

Mini nuclear plants to power 20,000 homes

2008-11-09T07:15:00.001-08:00

This is freaking awesome! I'd love to have Tyrone buy one of these puppies to power our homes!

http://www.guardian.co.uk/environment/2008/nov/09/miniature-nuclear-reactors-los-alamos

The 50 Skills Every Geek Should Have

2008-11-07T17:15:00.001-08:00

From Gizmodo, check, check, it out!

Top 50 Skills! How Many Do You Fit Into?

Me, 36. But thats if you swap out DOS for UNIX on #40.

Enjoy!

http://gizmodo.com/5078829/the-50-skills-every-geek-should-have

OS X Mail Account Bundles fail

2008-06-27T19:06:00.001-07:00

I have been trying to use Mac Mail Account bundles at PSU to auto-configure Mac Mail on 10.5.3. I found that there is an issue following the documentation at the moment.

The documentation:
http://developer.apple.com/documentation/MacOSXServer/Conceptual/XServer_ProgrammingGuide/Articles/MailAccountBundles.html#//apple_re/doc/uid/TP40002464

States that I can locate my MailAccount.plist under a folder following the reverse-ordered ICANN domain name, in this case: "edu.psu.mailaccounts". There are multiple locations where this directory can be stored,

~/Library/Mail/AccountTypes
/Library/Mail/AccountTypes
/Network/Library/Mail/AccountTypes

I tried the first two and they didn't work.

I eventually had some interns just add the <dict> with my settings to the com.apple.mailaccounts MailAccounts.plsit file. It worked after that. Here is the plist that I used. I just copied the <dict> sections:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Multiple</key>
<array>
<dict>
<key>Accounts</key>
<array>
<dict>
<key>AccountID</key>
<string>5D795DD4-55CB-11D8-A81E-000A957054BE</string>
<key>AccountName</key>
<string>PSU</string>
<key>AuthenticationScheme</key>
<array/>
<key>DeliveryAccounts</key>
<array>
<string>2C6B8A3E-EF11-41BA-BCA4-0DE050C51D5C</string>
</array>
<key>EmailAddressDomain</key>
<string>@psu.edu</string>
<key>PortNumber</key>
<integer>995</integer>
<key>Protocol</key>
<string>POP</string>
<key>SSLEnabled</key>
<true/>
<key>SSLEnabledIsEditable</key>
<false/>
<key>ServerName</key>
<array>
<string>email.psu.edu</string>
</array>
<key>UserNameMatchesEmailAddress</key>
<true/>
</dict>
<dict>
<key>AccountID</key>
<string>2C6B8A3E-EF11-41BA-BCA4-0DE050C51D5C</string>
<key>AccountName</key>
<string>PSU SMTP</string>
<key>AuthenticationScheme</key>
<array>
<string></string>
</array>
<key>PortNumber</key>
<integer>25</integer>
<key>Protocol</key>
<string>SMTP</string>
<key>SSLEnabled</key>
<true/>
<key>ServerName</key>
<string>authsmtp.psu.edu</string>
</dict>
</array>
<key>Identifier</key>
<string>edu.psu</string>
<key>Version</key>
<integer>1</integer>
</dict>
</array>
</dict>
</plist>

Credit goes to Rob Kelly and Dave Williams (Interns) for figuring out that it works in the com.mac.mailaccounts MailAccounts.plist.

Mac Mail fails to check pop when too many messages are open.

2008-05-29T06:01:00.001-07:00

I don't really know what happened. My guess is that it has something to do with the .plist file com.apple.mail.plist. I have verified this on 10.5.2 and 10.5.3. If you use mac mail and have at least three accounts to 5 accounts of any variety, try it out. Open about 15 message windows and then check mail. See if you can get your pop or other server to fail on checking your password. Guess what the fix is, that's right! Use Flags and not open messages to mark what emails you need to respond to. Then, create a smart folder that shows only flagged messages and you too can leave your inbox empty!

The new way to manage OS X images: InstaDMG

2008-04-17T16:10:00.001-07:00

InstaDMG public beta is released. This script will help OS X administrators create images for deployment. Put an image of the installer disc in one folder, updates in another, and any additional packages (such as apps) in another. This script will build your image in a few hours, or schedule it to run nightly. Great integration with other tools too

read more | digg story

Time Machine, Thank You...

2007-12-18T15:25:00.001-08:00

So I was messing with setting up Calendar syncing with an online service, whom will remain nameless. I noticed that my online service had duplicated all of my calendar entries. "Shitty", I thought to myself, "but I can deal". So I decided to delete all the online calendars and re-sync it with my still good iCal. Oh, fine and dandy, until it auto-synced and wiped out all my calendars in iCal! What application integration! "Motherfuckers", I mumbled under my breath. I threw my pen and started to get pissed. Maybe the undo button will work. Well, that brought back one of my calendars, but no data. "Fuck, Fuck, Fuck" I yelled. A co-worker who is quite smart about troubleshooting asked what was wrong. I explained about this crappy sync and how I lost my calendars and how I wanted to kill someone. She asked, "Do you have any backups?". "Fuck Yeah, I do" I yelled. "Thank you Time Machine!" I restored my calendars from one hour ago! One hour! That's great, how many events could be missing from one hour? Well, luckily I'm not that important of a guy and I only lost one event. So, whoo hoo Time Machine, YMTND.

A side note, I had been using www.icalx.com to publish and subscribe to mine and my wifes calendars and it has worked great. Don't try to fix something that is not broken.

Fun Stuff for geeks

2007-12-08T19:00:00.001-08:00

Meetup groups on Google Map, who has more supporters?

Meet-UpGroupsCompared.gif (GIF Image, 501x358 pixels)

Fun Stuff for geeks

2007-12-06T09:25:00.001-08:00

I would have included thinkgeek.com
10 Geeky Websites: Where Real Geeks Gather

Flock Alternative

2007-12-01T10:37:00.001-08:00

I'm not a fan of a lot of things Flock does, but what I am a fan of is the easy ability to blog. Well, stupid me, of course Firefox has a add-on to do this:

ScribeFire :: Firefox Add-ons

Surprise, no more Flock, back to the good old Firefox.

Blogged with ScribeFire

Make A secret container with a lighter

2007-11-28T18:57:00.003-08:00

Check out this video and make your own:

How To Make A "Secret Container" Out Of A LIGHTER - video powered by Metacafe

Blogged with Flock

BASH Scripting Guide

2007-11-27T09:39:00.001-08:00

All of the people that have never tried a unix machine, need to. And after you do that, try some BASH Scripting!
http://www.bit-tech.net/bits/2007/11/26/bashing_through_scripts/1

Blogged with Flock