802.1x User Profile for Kiosks

Quick Link: Download the Code

I was given the task of configuring 802.1x for our Portable Sig Stations. These MacBooks are used throughout the campus on wireless to allow students to agree to the terms of our network. Previously these MacBooks used an older wireless solution that was being retired in July. When the machines are set up in the morning, different consultants and student workers need to authenticate the wireless. In order to keep them working over the next few months, we had to add the new 802.1x wireless config. This was not as easy as it seemed...

User Profile 802.1x seems to be configured in four places:

~/Library/Preferences/com.apple.eap.profiles.plist
This is the system wide 802.1x config for the wireless


~/Library/Preferences/ByHost/com.apple.eapbinding.[UUID] 
This is the preferred network for the user. This was required for our setup, others may not need it.
Where the UUID could be the MAC address or UUID of the Mac.


/Library/Prefernces/SystemConfiguration/preferences.plist  
The Airport is turned on and off here.
There is also a preferred network setting here.


/Library/Prefernces/SystemConfiguration/com.apple.airport.preferences.plist
Recent networks

After watching the file changes using FSEventer, and the checking out scripts of a few other Mac Admins (Steve Yuroff and Bryan Lee), I was able to bring together the pieces I needed to get it to work.

Some other useful links:
http://www.afp548.com/article.php?story=20100421100144943
http://www.afp548.com/article.php?story=20090901010221742
http://hints.macworld.com/article.php?story=20101004114849586
http://bigmaconcampus.wordpress.com/2009/08/27/wireless-installer-the-next-generation/

Manually Configuring:

I used the instructions provided here and FSEventer to watch the files being modified:
https://www.work.psu.edu/access/dot1x/prod/mac1053.html

Now Script It!

First, manually setup and export the profile to the current directory:

networksetup -export8021xUserProfiles AirPort . yes

On a new machine:


Install the 802.1x file into "/Library/PSUshared/psu-8021x-profile.plist"
Install the script to "/Library/PSUshared/psuWirelessSetup.sh"
Install the launchd item into "/Users/kiosk/Library/LaunchAgents/edu.psu.clc.wirelesssetup.plist"
Run the visudo code in the terminal, with sudo.

UPDATE: I tried my damnedest to paste the code, Google Blogger does NOT like it. Just get the download!

While this script is designed to be for a single user, this code could be changed to be used for any user logging in, although for a standard user account a launchd item would be excessive. Also, 10.7 negates the need for this because it uses the 802.1x profile, which works much better with multiple users!

I've also included an attachment with the file, as the web isn't the best way to display scripts properly. Don't try to copy and paste the code from the browser, just download it here.

Rusty

Creating VMs from an existing VDI file

We recently had a request to install VirtualBox and a custom VDI for a course. Students with little technical backgrounds needed to be able to launch and create a individual instance of an Ubuntu virtual machine.

We did some experimentation on configuring the virtual machine with a shared VDI file and using VirtualBox snapshots, as well as shadow disk images, for saving changes. We decided the best course was to drop a copy of the entire VDI to the students Desktop and use VirtualBox's command line tool to configure them a VM.

We stored the VDI inside a disk image and delivered it to the /Users/Shared folder of each Mac. We then had VirtualBox installed. Using Platypus we wrapped a script that will copy the VDI, create the VM, and start it.

If the VDI already exists on the desktop, the VM is created and launched. If the VM is already created, then it's launched right away.

This provides students and faculty with a simple way to launch and use the virtual machine provided to them.

Here is the script that we use: https://github.com/rustymyers/scripts/blob/master/shell/createVBoxVM.sh

After writing this, I got a lot of comments that we should check out Vagrant. http://vagrantup.com/

Do your self a favor and always google what you want to do before writing something from scratch to do it!

AD Binding Fails

I have been having some issues lately with some random machines loosing their binding. I've just had to fix the third Mac in as many months with this issue. Unfortunately, I didn't really know what was going on until now.

I would try to bind using Directory Utility and it kept failing on step 3. I turned on DirectoryService debugging with the handy command-y:

sudo killall -USR1 DirectoryService

That produced some cool errors such as:

Active Directory: Password verify for rzm102@DOMAIN.COM failed with error -1765328230

and

Plug-in call "dsDoPlugInCustomCall()" failed with error = -14090.

Let me just say, I know my password. I didn't forget it. I type it in my machine hundreds of times a day, so it's not that!

What it was, was very interesting. I found this thread that lead me to the real issue. Apparently, the /var/db/dslocal/nodes/Default/config/Kerberos\:AD.DOMAIN.NAME file had become corrupted. When I went to cat the file, it displayed with some funky text, not the plist I was expecting.

Removing this file allows rebinding and fixes the issue. Yay!

launchd plist generator

A little gem of a web app, a plist generator, from Michael Rieder.

This fancy webpage allows you to create a launchd plist! Very nice, and I suspect will be useful if I'm ever away from Lingon or my launchd notes.

OS X Wiki

It's been my wish for some time to see a wiki formed for OS X systems administration. Yay today!

Check out: http://www.osxdeployment.com/wiki/Main_Page

Don't forget to add some content!

Double Click to minimize windows

I was trolling around the ##osx-server channel on freenode today when I saw a problem someone was having. natewa, as he is know on that channel, was having trouble setting a preference to allow all new users to double click a window to minimize it. It should be able to be set in the /System/Library/User Template/English.lproj/Library/Preferences/.GlobalPreferences.plist file for all new users. For some reason, this plist file gets overwritten when a new user gets a home folder.

After looking at the User Template folder, I noticed a Non_localized.lproj folder. It seems that this folder also has a .GlobalPreferences.plist! Instead of changing the English.lproj GlobalTemplate file, I changed the Non_localized.lproj GlobalPreferences file. Bam! It worked for all new users.

My guess is that your specific language template file, such as English.lproj in my case, is being combined with the non_localized.lproj file for whatever reasons.

Here is the command I used:

sudo defaults write /System/Library/User\ Template/Non_localized/Library/Preferences/.GlobalPreferences AppleMiniaturizeOnDoubleClick -bool TRUE


That allows all new users to double click a window to minimize it. Enjoy!

Mounting Pass and Udrive in an AD environment

Do I script too much?

Today I have a little script that my intern Ethan Cox and I worked on together.

Problem:

Penn State PASS and UDRIVE storage drives require a special edu.psu.kerberos file to be in place to access them. Our Active Directory requires a special edu.psu.kerberos file to be in place to log into the computer. So far, I’ve been able to either remove the machine from our AD or have people access the PASS space via the website. It’s not too bad interacting with the PASS space via the website, but it can be less appealing than the Finder.

Solution:

Create an application to temporarily switch the kerberos file with PSU’s, mount the file share, then put everything back. Seems simple enough, and it was in the end. The hardest issue to overcome was getting kinit to prompt for the password.

What you will Need:

• The Platypus.app.


• The Mounting Script.

OR

• The Mount the Sysman share app


• The Mount the PASS share app

You can edit the finished app by Right clicking it and opening the Contents/Resources/script file.

Putting it together:

Platypus takes a script as input for creating an .app. Download the mounting script and drag it into Platypus’ “Script Path” field. For this script I change the Shell to “/bin/bash” and uncheck the “Remains running after initial execution” check box. Click the “Create” button and save your new app.

Your new app is now a double-clickable script that anyone can run.

Changing the script:

The mounting script is configurable to your needs.

There are two variables at the top of the script. The first variable sets the smb path to mount. Right now, the script only mounts SMB shares. Change the path to mount a different share.

psuserver="smb://udrive.win.psu.edu/sysman"

The second variable is the domain to get a kerberos ticket from. You can use your own domain if you need.

domain="dce.psu.edu"

Some other shares can be:

    cifs://cifs.pass.psu.edu

Edit the alternate kerberos file if it differs from PSU’s. This bit of code checks for the existence of our PSU kerberos file and creates it if it’s missing.

if [[ -e /Library/Preferences/edu.mit.Kerberos.psu ]]; then
    echo "PSU File avail"
else
    echo "[domain_realm]
    .psu.edu = dce.psu.edu
    psu.edu = dce.psu.edu

[libdefaults]
    defaultrealm = dce.psu.edu
    dnslookup_kdc = true
    forwardable = true
    noaddresses = true" > /Library/Preferences/edu.mit.Kerberos.psu
fi

Intermediate CA Bundles!

Thwate changes the way certificates work.

In the past browsers and client machines would have root certificate authority files that verified the ssl certificates used. Now, with the new certificates (after June 27th, 2010), you have to install a intermediate certificate authority on the server for the new certificates to behave.

So, When I added the new cert.crt from Thwate to the Server Admin interface, it complained that it was unassigned. I found this site which explains what changed recently and how to fix it. I’m sure it works great for a *nix webserver that doesn’t use Virtual Hosts, unlike OS X server.

How do we fix this? Actually, its stupid simple after you mess with it for four hours. After you add the new cert.cer from Thwate through the Server Admin interface, open the site configuration and the security tab. Choose the new ssl certificate, save, apply, restart. Next, you will need to edit the Virtual Host for the site that has ssl enabled.

I started with this certificate but it was not working for me. Something with the three difference CAs. I ended up using this certificate bundle which worked.

From this page copy the new intermediate cert bundle and paste it into a plain text file. Save that file in /etc/certificates/ named intermediate.crt.

Open the Terminal.app and navigate to the /etc/apache2/sites folder. Open the conf file for the site with ssl enabled, look for the one with 443 in the name, with your favorite text editor. Comment out the SSLCertificateChainFile line and create a new SSLCertificateChainFile file to point to your new intermediate file. Should look like this:

SSLCertificateChainFile = "/etc/certificates/intermediate.crt"

Save the changes and restart the Web Server. I use the terminal in this case:

Stop the web server:

sudo serveradmin web stop

Start the web server:

sudo serveradmin web start

Check your site and you should be good to go! The new certificate should appear without warnings. It should also appear without warning in the Server Admin certificates tab.