802.1x User Profile for Kiosks

Quick Link: Download the Code

I was given the task of configuring 802.1x for our Portable Sig Stations. These MacBooks are used throughout the campus on wireless to allow students to agree to the terms of our network. Previously these MacBooks used an older wireless solution that was being retired in July. When the machines are set up in the morning, different consultants and student workers need to authenticate the wireless. In order to keep them working over the next few months, we had to add the new 802.1x wireless config. This was not as easy as it seemed...

User Profile 802.1x seems to be configured in four places:

~/Library/Preferences/com.apple.eap.profiles.plist
This is the system wide 802.1x config for the wireless


~/Library/Preferences/ByHost/com.apple.eapbinding.[UUID] 
This is the preferred network for the user. This was required for our setup, others may not need it.
Where the UUID could be the MAC address or UUID of the Mac.


/Library/Prefernces/SystemConfiguration/preferences.plist  
The Airport is turned on and off here.
There is also a preferred network setting here.


/Library/Prefernces/SystemConfiguration/com.apple.airport.preferences.plist
Recent networks

After watching the file changes using FSEventer, and the checking out scripts of a few other Mac Admins (Steve Yuroff and Bryan Lee), I was able to bring together the pieces I needed to get it to work.

Some other useful links:
http://www.afp548.com/article.php?story=20100421100144943
http://www.afp548.com/article.php?story=20090901010221742
http://hints.macworld.com/article.php?story=20101004114849586
http://bigmaconcampus.wordpress.com/2009/08/27/wireless-installer-the-next-generation/

Manually Configuring:

I used the instructions provided here and FSEventer to watch the files being modified:
https://www.work.psu.edu/access/dot1x/prod/mac1053.html

Now Script It!

First, manually setup and export the profile to the current directory:

networksetup -export8021xUserProfiles AirPort . yes

On a new machine:


Install the 802.1x file into "/Library/PSUshared/psu-8021x-profile.plist"
Install the script to "/Library/PSUshared/psuWirelessSetup.sh"
Install the launchd item into "/Users/kiosk/Library/LaunchAgents/edu.psu.clc.wirelesssetup.plist"
Run the visudo code in the terminal, with sudo.

UPDATE: I tried my damnedest to paste the code, Google Blogger does NOT like it. Just get the download!

While this script is designed to be for a single user, this code could be changed to be used for any user logging in, although for a standard user account a launchd item would be excessive. Also, 10.7 negates the need for this because it uses the 802.1x profile, which works much better with multiple users!

I've also included an attachment with the file, as the web isn't the best way to display scripts properly. Don't try to copy and paste the code from the browser, just download it here.

Rusty

Mounting Pass and Udrive in an AD environment

Do I script too much?

Today I have a little script that my intern Ethan Cox and I worked on together.

Problem:

Penn State PASS and UDRIVE storage drives require a special edu.psu.kerberos file to be in place to access them. Our Active Directory requires a special edu.psu.kerberos file to be in place to log into the computer. So far, I’ve been able to either remove the machine from our AD or have people access the PASS space via the website. It’s not too bad interacting with the PASS space via the website, but it can be less appealing than the Finder.

Solution:

Create an application to temporarily switch the kerberos file with PSU’s, mount the file share, then put everything back. Seems simple enough, and it was in the end. The hardest issue to overcome was getting kinit to prompt for the password.

What you will Need:

• The Platypus.app.


• The Mounting Script.

OR

• The Mount the Sysman share app


• The Mount the PASS share app

You can edit the finished app by Right clicking it and opening the Contents/Resources/script file.

Putting it together:

Platypus takes a script as input for creating an .app. Download the mounting script and drag it into Platypus’ “Script Path” field. For this script I change the Shell to “/bin/bash” and uncheck the “Remains running after initial execution” check box. Click the “Create” button and save your new app.

Your new app is now a double-clickable script that anyone can run.

Changing the script:

The mounting script is configurable to your needs.

There are two variables at the top of the script. The first variable sets the smb path to mount. Right now, the script only mounts SMB shares. Change the path to mount a different share.

psuserver="smb://udrive.win.psu.edu/sysman"

The second variable is the domain to get a kerberos ticket from. You can use your own domain if you need.

domain="dce.psu.edu"

Some other shares can be:

    cifs://cifs.pass.psu.edu

Edit the alternate kerberos file if it differs from PSU’s. This bit of code checks for the existence of our PSU kerberos file and creates it if it’s missing.

if [[ -e /Library/Preferences/edu.mit.Kerberos.psu ]]; then
    echo "PSU File avail"
else
    echo "[domain_realm]
    .psu.edu = dce.psu.edu
    psu.edu = dce.psu.edu

[libdefaults]
    defaultrealm = dce.psu.edu
    dnslookup_kdc = true
    forwardable = true
    noaddresses = true" > /Library/Preferences/edu.mit.Kerberos.psu
fi