Editing the Apple Menu

¡Super-Awesome Edit!

Don't you just love it when your super long work around to disable shutting down can actually be accomplished with two simple commands? I do!


sudo defaults write /Library/Preferences/com.apple.loginwindow ShutDownDisabled -bool true
sudo defaults write /Library/Preferences/com.apple.loginwindow ShutDownDisabledWhileLoggedIn -bool true

These two commands will disable the Shut Down option at the Login Window and the pop up that is shown with a click of the power button or the control-eject shortcut. I'm unable to reproduce, but I've been told it remove the Shut Down option from the Apple menu and if a user does use the forced shut down shortcut (control-option-command-eject), the computer simply reboots.

Source:
http://hints.macworld.com/article.php?story=20091104040449752

Original Post:

One of the more exciting things about upgrading Mac Mini's in classrooms is that they can be hidden! Now that the Mini's Superdrive has been moved to an external device, the Mac can be neatly hidden away and attached to a USB hub for peripherals. Now that the Mini is hidden, we have a new concern. What if it gets turned off?

With the meat of the Mac hidden, we had concerns about users accidentally shutting it down. There would little to no way for them to reach a power button. I've seen other companies solder wires to the power switch to allow an external button, but have you seen the new Mini's guts? Our solution was to remove the Shut Down and Sleep options.

After some research, this seemed like a simple fix. To remove the Shut Down and Sleep options from the Apple Menu, all I had to do was edit a NIB file, remove an object, save and reboot. However, this simple trick also had a negative side effect. The Finder would crash, repeatedly, when I selected the Apple Menu.

Thanks to StackTrace for the initial answer:
http://apple.stackexchange.com/questions/22535/can-i-remove-the-log-out-item-from-the-apple-menu/53810#53810

Here is the file I needed to edit
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/English.lproj/StandardMenus.nib/objects.xib

After messing around a bit, I started looking closely at the objects. Each object had it's own "id". When I was looking for the Shut Down option in the Carbon.framework, I remembered seeing lists of ids in other interface files. I started to wonder if these id's were referenced else where, causing the Finder to unexpectedly quit when they couldn't be found.


Example Object:

<object class="IBCarbonMenuItem" id="238">

  <string name="title">Shut Down…</string>

  <boolean name="dynamic">TRUE</boolean>

  <boolean name="notPreviousAlternate">TRUE</boolean>

  <ostype name="command">rsdn</ostype>

</object>

I found, in the same objects.xib file, all of the id's under reference tags. After I removed all of these references, the Finder behaved and the Shut Down and Sleep options were gone!

References:

<reference idRef="236"/>
<reference idRef="285"/>
<reference idRef="238"/>

If you decide to remove the Sleep and Shut Down options, look for these id's in object and reference tags. Delete the entire object, one for the Sleep option and two for the Shut Down option, and each of the references.

id's:

Sleep - 236

Shut Down - 238, 285

As an aside, there are two Shut Down options because one is for the standard Shut Down (graceful shutdown) and the other for holding the option key and clicking Shut Down (force a shut down). 

P.S. I can't tell you how hard it was for me not to type Shit Down...

Restoring admin rights

I've not had a reason to do this recently, but was curious so I decided to try. I wanted to give myself admin rights from the command line, specifically single user mode.

For those of you who don't know, single user mode is a command line only way to interact with the system as root, in most cases its possible without a password. Hold command+s when booting and see what it looks like! (if you get scared, just type "exit")

Once in single user mod (SUM), you can interact with the system by using commands. So, in this case, I want to add my user "rusty" to the admin group on the machine... This is what I did.

First, start computer in SUM - hold command+s at boot

Second, after you see the prompt (root#) type "/sbin/mount -uw /" (there are two spaces in there, its important not to loose them!)

Hit Return.

Third, I need to start the Directory Services, I do so by typing:

launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist

Hit Return.

Fourth, Now that Directory Services is started, I can make the appropriate changes use dscl.

To add my "rusty" account to the admin group, I use:

dscl . append /Groups/admin GroupMembership rusty

Fifth,

Once you are done making changes, exit SUM using the command "exit"

There are lots of other cool tricks with dscl, give it a try and post some of your favorites!

AD Binding Fails

I have been having some issues lately with some random machines loosing their binding. I've just had to fix the third Mac in as many months with this issue. Unfortunately, I didn't really know what was going on until now.

I would try to bind using Directory Utility and it kept failing on step 3. I turned on DirectoryService debugging with the handy command-y:

sudo killall -USR1 DirectoryService

That produced some cool errors such as:

Active Directory: Password verify for rzm102@DOMAIN.COM failed with error -1765328230

and

Plug-in call "dsDoPlugInCustomCall()" failed with error = -14090.

Let me just say, I know my password. I didn't forget it. I type it in my machine hundreds of times a day, so it's not that!

What it was, was very interesting. I found this thread that lead me to the real issue. Apparently, the /var/db/dslocal/nodes/Default/config/Kerberos\:AD.DOMAIN.NAME file had become corrupted. When I went to cat the file, it displayed with some funky text, not the plist I was expecting.

Removing this file allows rebinding and fixes the issue. Yay!

launchd plist generator

A little gem of a web app, a plist generator, from Michael Rieder.

This fancy webpage allows you to create a launchd plist! Very nice, and I suspect will be useful if I'm ever away from Lingon or my launchd notes.

Double Click to minimize windows

I was trolling around the ##osx-server channel on freenode today when I saw a problem someone was having. natewa, as he is know on that channel, was having trouble setting a preference to allow all new users to double click a window to minimize it. It should be able to be set in the /System/Library/User Template/English.lproj/Library/Preferences/.GlobalPreferences.plist file for all new users. For some reason, this plist file gets overwritten when a new user gets a home folder.

After looking at the User Template folder, I noticed a Non_localized.lproj folder. It seems that this folder also has a .GlobalPreferences.plist! Instead of changing the English.lproj GlobalTemplate file, I changed the Non_localized.lproj GlobalPreferences file. Bam! It worked for all new users.

My guess is that your specific language template file, such as English.lproj in my case, is being combined with the non_localized.lproj file for whatever reasons.

Here is the command I used:

sudo defaults write /System/Library/User\ Template/Non_localized/Library/Preferences/.GlobalPreferences AppleMiniaturizeOnDoubleClick -bool TRUE


That allows all new users to double click a window to minimize it. Enjoy!

Mounting Pass and Udrive in an AD environment

Do I script too much?

Today I have a little script that my intern Ethan Cox and I worked on together.

Problem:

Penn State PASS and UDRIVE storage drives require a special edu.psu.kerberos file to be in place to access them. Our Active Directory requires a special edu.psu.kerberos file to be in place to log into the computer. So far, I’ve been able to either remove the machine from our AD or have people access the PASS space via the website. It’s not too bad interacting with the PASS space via the website, but it can be less appealing than the Finder.

Solution:

Create an application to temporarily switch the kerberos file with PSU’s, mount the file share, then put everything back. Seems simple enough, and it was in the end. The hardest issue to overcome was getting kinit to prompt for the password.

What you will Need:

• The Platypus.app.


• The Mounting Script.

OR

• The Mount the Sysman share app


• The Mount the PASS share app

You can edit the finished app by Right clicking it and opening the Contents/Resources/script file.

Putting it together:

Platypus takes a script as input for creating an .app. Download the mounting script and drag it into Platypus’ “Script Path” field. For this script I change the Shell to “/bin/bash” and uncheck the “Remains running after initial execution” check box. Click the “Create” button and save your new app.

Your new app is now a double-clickable script that anyone can run.

Changing the script:

The mounting script is configurable to your needs.

There are two variables at the top of the script. The first variable sets the smb path to mount. Right now, the script only mounts SMB shares. Change the path to mount a different share.

psuserver="smb://udrive.win.psu.edu/sysman"

The second variable is the domain to get a kerberos ticket from. You can use your own domain if you need.

domain="dce.psu.edu"

Some other shares can be:

    cifs://cifs.pass.psu.edu

Edit the alternate kerberos file if it differs from PSU’s. This bit of code checks for the existence of our PSU kerberos file and creates it if it’s missing.

if [[ -e /Library/Preferences/edu.mit.Kerberos.psu ]]; then
    echo "PSU File avail"
else
    echo "[domain_realm]
    .psu.edu = dce.psu.edu
    psu.edu = dce.psu.edu

[libdefaults]
    defaultrealm = dce.psu.edu
    dnslookup_kdc = true
    forwardable = true
    noaddresses = true" > /Library/Preferences/edu.mit.Kerberos.psu
fi

Intermediate CA Bundles!

Thwate changes the way certificates work.

In the past browsers and client machines would have root certificate authority files that verified the ssl certificates used. Now, with the new certificates (after June 27th, 2010), you have to install a intermediate certificate authority on the server for the new certificates to behave.

So, When I added the new cert.crt from Thwate to the Server Admin interface, it complained that it was unassigned. I found this site which explains what changed recently and how to fix it. I’m sure it works great for a *nix webserver that doesn’t use Virtual Hosts, unlike OS X server.

How do we fix this? Actually, its stupid simple after you mess with it for four hours. After you add the new cert.cer from Thwate through the Server Admin interface, open the site configuration and the security tab. Choose the new ssl certificate, save, apply, restart. Next, you will need to edit the Virtual Host for the site that has ssl enabled.

I started with this certificate but it was not working for me. Something with the three difference CAs. I ended up using this certificate bundle which worked.

From this page copy the new intermediate cert bundle and paste it into a plain text file. Save that file in /etc/certificates/ named intermediate.crt.

Open the Terminal.app and navigate to the /etc/apache2/sites folder. Open the conf file for the site with ssl enabled, look for the one with 443 in the name, with your favorite text editor. Comment out the SSLCertificateChainFile line and create a new SSLCertificateChainFile file to point to your new intermediate file. Should look like this:

SSLCertificateChainFile = "/etc/certificates/intermediate.crt"

Save the changes and restart the Web Server. I use the terminal in this case:

Stop the web server:

sudo serveradmin web stop

Start the web server:

sudo serveradmin web start

Check your site and you should be good to go! The new certificate should appear without warnings. It should also appear without warning in the Server Admin certificates tab.

BigFix on the Mac

BigFix? http://bigfix.com
What's that? It's a systems management tool!
It's a big tool, with lots of stuff you can do. One of those things is deploy software or scripts to machines based on there current settings. It's called relevance.

If a machine needs the latest firefox update, we can automatically push it, based on the relevance. For example, if it's version is less than the current version, it will update.
If our admin account is missing from the machine, it can automatically add our account. Super awesome password and all. Secure and tracked using SHA1.

I've create a few tasks in BigFix so far and here are some examples of the relevance.

For the 10.6.1 update, the relevance is:
(system version = "10.6")

For Enabling remote management (Checks that Remote Management is not running and that our admin account is available):
((name of operating system = "Mac OS X") AND (not exists process whose (name of it starts with "ARDAgent")) AND (exists user "etcadmin"))

For enabling remote login (Checks overrides.plist to see if it's disabled):
(system version >= "10.6") AND (exists ((booleans of values of entries whose (key of it is "Disabled") of dictionary "com.openssh.sshd" of dictionaries of file "/private/var/db/launchd.db/com.apple.launchd/overrides.plist")) whose (it = true))

So far, it's been working pretty well. Routers slow the process down, but university IP addresses get the tasks right away. More examples to come as I work on them.

Enjoy BigFix on the Mac