osxadmin

OS X Lion & Mail Quotas

2011-10-20T10:24:00.006+02:00

Since OS X Lion no longer offer a GUI to change the Mail Quota size of a user, I had to find out a new way.
I know that for individual users it is possible to do this using the Directory Utility.

But that's not what I want if I have to change dozens of users.

So I figured out a way to do this using dscl:

This is how you read the current value of the Mail Quota:

MailQuota=`dscl /LDAPv3/my.server.com -readpl /Users/$theUser MailAttribute kUserDiskQuota`

And this way you may set a new value:

dscl -u diradmin -P $diradminpass /LDAPv3/my.server.com -createpl /Users/$theUser MailAttribute kUserDiskQuota $newvalueInMB

Unfortunately this value does not get updated on the mail server immediately.
In order to get the mail server to update the quotas, you have to do this:
Delete or rename /var/db/.mailusersettings.plist

Then manually recreate the file '/var/db/.mailusersettings.plist':

touch /var/db/.mailusersettings.plist
chown _postfix:mail /var/db/.mailusersettings.plist

Restarting the mail service updates the per user mail quota defined in OD.

SMS Server Tools on Mac OS X with Swisscom Unlimited USB Modem E180V

2010-01-14T12:04:00.006+01:00

We set up a server to monitor our servers, services and network devices.

Monitoring on Mac OS X

What we started off with is

- a Mac Mini with Mac OS X 10.6 Snow Leopard Client
- Lithium 5 Monitoring Software www.lithium5.com

What I wanted to do is also monitor our internet connection.
For that case we ping www.google.com.
If that service is unavailable, we expect the internet connection to have failed.

The problem now is:
If the internet connection is down, then we cannot alert via email or push notification because we have to assume that there is no connection to the internet.

The idea now is, that in this case, we alert via SMS.

The Device

So I went to our local phone provider and bought a USB HSPA/UMTS/EDGE/GPRS modem.
Thy type I chose is called 'Unlimited USB Modem E180V' which in fact is a Huawei E180V.

As we do not plan to use the Modem to surf the web, we decided to get a prepaid card along with it.
This means we can recharge it by using the credit card.

What's next?

We installed the modem an downloaded and installed the current software to go along with it from the providers web page.
It works.
But: In order for the modem to work, one has to log in and start the application of the provider, in out case:
/Applications/Unlimited Connection Manager.app

Now that is not what I wanted.
The problem is that without having started the app, the modem will not appear as a device in /dev
Which means that the device is not operable. Hmm.
But I do not want a user to have to log in and start the app on this machine.

So here's what did the trick:
I looked at the installer package that came with the modem using Suspicious Package.
It does not install anything other than the application.
So it has to be something inside the application bundle that has to be initiated to make the modem available to the system.
After poking around a bit, I found this folder:
/Applications/Unlimited Connection Manager.app/Contents/Drivers
It contains a kext ba the name of 'HuaweiDataCardDriver.kext'.

So what do I do:
We load the kext:
kextload "/Applications/Unlimited Connection Manager.app/Contents/Drivers/HuaweiDataCardDriver.kext"

And what happens:
We now see the device in /dev:


crw-rw-rw-   1 root  wheel      11,   7 Jan 13 15:17 cu.HUAWEIMobile-Diag
crw-rw-rw-   1 root  wheel      11,   9 Jan 14 12:35 cu.HUAWEIMobile-Modem
crw-rw-rw-   1 root  wheel      11,   5 Jan 13 15:17 cu.HUAWEIMobile-Pcui
crw-rw-rw-   1 root  wheel      11,   6 Jan 13 15:17 tty.HUAWEIMobile-Diag
crw-rw-rw-   1 root  wheel      11,   8 Jan 13 15:17 tty.HUAWEIMobile-Modem
crw-rw-rw-   1 root  wheel      11,   4 Jan 13 15:17 tty.HUAWEIMobile-Pcui

So basically we are now ready to send SMS.
Theoretically.

Sending SMS

When trying to find information on how to send SMS notifications via shell script, found out that there is one big problem.
While sending an SMS the device is blocked so that sending is no longer possible until the first SMS has been sent.
So one would need some kind of queue.

As it turns out, there's an app for that.
The solution is SMS Server Tools 3.

«The SMS Server Tools 3 is a SMS Gateway software which can send and receive short messages through GSM modems and mobile phones.»

And it is open source too!!!
So I downloaded it and compiled it using the apple developer tools.

Now, all we have to do is add the correct device to the config file of the smsd.

device = /dev/cu.HUAWEIMobile-Modem

And we need to start the smsd.

The Script

So we created a script that loads the extension, unmount the volumes provided by the UMTS modem and start the SMS service.

The script looks like this:


#!/bin/sh

# Script that loads the extension, unmount the volumes provided by the UMTS modem and start the SMS service
# Created by kurt hofmann © 2010

diskutil unmount /Volumes/NO\ NAME 
diskutil unmount /Volumes/Unlimited\ Connection\ Manager 

kextload /Applications/Unlimited\ Connection\ Manager.app/Contents/Drivers/HuaweiDataCardDriver.kext 

/usr/local/bin/smsd

This script is then started by a launchd job on startup.

SMS can now be sent using this command from the command line:
sendsms thenumber 'the message'
thenumber is an international phone number without the leading zeros.

Receiving SMS

Now that sending SMS works I wanted to know what it needs to receive SMS.
Then when I send an SMS it might be that someone replies to that message, so it might be useful to receive them.
SMS Server Tools 3 provides a solution for that.

There is an eventhandler that gets called whenever it receives or sent a message or when it was not able to send a message.
So I created a script that sends me an incoming SMS as an email.

The script is here /usr/local/bin/sms2email

It looks like this:


#!/bin/sh
# This is an example how to use an eventhandler with smsd.
# $1 is the type of the event wich can be SENT, RECEIVED, FAILED or REPORT.
# $2 is the filename of the sms.
# $3 is the message id. Only used for SENT messages with status report.

#The next line changes the file attributes so that everybody can read
#received SM
#if [ "$1" = "RECEIVED" ]; then
#  chmod a+r $2
#fi

email_receiver="email@provider.com"


#This sends all received SM to an eMail receiver:
if [ "$1" = "RECEIVED" ]; then
  /usr/bin/mail -s "Incoming SMS" $email_receiver <$2
fi

Now all we have to do is to is put a reference to the script into the smsd.conf file.

When trying this, I found that there was a problem trying to read the SMS from the device.
So I had to add an additional init string to put the modem in the right mode.

The smsd.conf file

So this is what my config file looks now:


# Example smsd.conf. Read the manual for a description

devices = GSM1
logfile = /var/log/smsd.log
loglevel = 6
smart_logging = yes
eventhandler = /usr/local/bin/sms2email

[GSM1]
init = AT+CPMS="MT","MT","MT"
check_memory_method = 2
device = /dev/cu.HUAWEIMobile-Modem
incoming = yes
#pin = 1111

Conclusion

Now this works perfectly for my needs.
I now have a server that can send SMS per cli and it can even receive SMS and forward them as email.
Cool.

If you have any questions just let me know.

Troubleshooting: MCX in Leopard

2009-08-20T14:03:00.001+02:00

Troubleshooting: MCX
•  Launch Terminal
•  Run the mcxquery command
– mcxquery –user
– mcxquery –group
– mcxquery –computer

Troubleshooting: MCX
•  Login as the user.
•  Launch System Profiler from /
Applications/Utilities
•  On the left, under Software, select
Managed Preferences.
•  On the right the details of the
preferences being applied to the
Computer.

Troubleshooting: MCX
•  sudo dscl . –delete /Computers
•  sudo rm –rf /Library/Managed\
Preferences

Hint found here:
Keep Control of Your School’s Leopard by Amanda Kunes.

createmobileaccount

2009-06-03T08:57:00.001+02:00

creste a mobile account:

/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount

usage: createmobileaccount -n username [-h homepath] [-P | [-p password]] [-e] [-q] [[-x] | [-X]] [[-s] | [-S]] [-u syncURL] [-v]
-n username : user record name
-h homepath : user home path; Default is "/Users/"
-p password : user password
-P : prompt for password. A password is required for FileVault home
-e encrypt : encrypt new home with FileVault
-q quota : max size in bytes of FileVault home
-x : create as external account on non-boot volumes. Default
-X : create as mobile account account non-boot volumes.
-s : set home sync on if home created.
-S : set home sync off if home created. Default.
-u syncURL : server target of home synchronization
-v : verbose output

Examples:
createmobileaccount -n jsmith
createmobileaccount -v -P -x -n jsmith
createmobileaccount -vsdn jsmith -h /Volumes/HD3/jhome
createmobileaccount -i

Notes:
- createmobileaccount must run as root.
- If you do not specify a password, the account's cached password will be created during the account's first log in.

Linkto a product on the Apple Store

2008-11-24T08:29:00.002+01:00

Have you ever tried to send a link to someone showing them a product on the apple store?

Here's how to do it:

1. Get the product number
The way to do so is to add the product to the cart and then go to the cart. It shows you the product numbers.

2. The rest is easy:

Create a links llike this one:
http://store.apple.com/ch-de/product/MB129

or this one:
http://store.apple.com/us/product/MB128

That's it.

Display only

2008-11-11T10:56:00.003+01:00

We wanted to use a Mac Mini as a display only.

That means: jaut a display, no keyboard, no mouse.

Just display a web page.

No problem? Try it. The Mac Mini wants a mouse. It tells you so. Every time you boot it.
Every time the mac starts up, a dialogue appears telling you that you're an idiot because you did not connect a mouse.

OS X in that case tries to set up a mouse using using bluetooth.

So, one way to eliminate this dialogue would obviously to remove the app.
It's this one:

/System/Library/CoreServices/Bluetooth Setup Assistant.app

But that's not a very elegant way to do this.
Besides there is always the risk of an update putting the app back in place thus the dialog appearing again.

After having looked at the app I found a reference to 'com.apple.bluetoothsetupassistant'. I googled a bit I and found a solution on this page:

Managing Bluetooth, or pesky Apple Preferences « Managing OS X

There it says:

# turn off the Bluetooth KB/mouse dialog that comes up if no KB/mouse is found
`/usr/bin/defaults write /var/root/Library/Preferences/blued BluetoothAutoSeekHIDDevices -int 0`;

# restart the Bluetooth daemon
`/usr/bin/killall -HUP blued`;

Or you might open the Bluetooth Preference Pane and uncheck “Open Bluetooth Setup Assistant at startup when no input device is present”

That will do it as well, just in case ;-)

Folder Redirection & Microsoft Office 2008

2008-11-06T13:17:00.003+01:00

When using the Folder Redirection of Mac OS X Server 10.5, I was having really big problems with Word from Microsoft Office 2004.
It would not save!!!
Sometimes even documents were overwritten!!
Very nasty

It seems though there is a solution to this:

I found the hint here: http://jochsner.dyndns.org/scripts/NHR.html

It sais that:

«
There appears to be an issue with Office redirection if there is a folder missing at the root of your network mount on the server. The user will be able to successfully save a new document once, and after that, they will get error messages that they don't have permission to save the file to the destination. The answer to this was found on http://macosxhints.com:

http://www.macosxhints.com/article.php?story=20051122213207398

The fault occurs unless a folder called .TemporaryItems has been created at the root level of any mounted volume containing the saved file; so if the user's home directory is contained in an AFP share called Homes, then there has to be a directory called .TemporaryItems in the Homes folder on the server. If the home directory is on another local volume called UserData, there has to be a directory called .TemporaryItems at the root of that volume.

Since .TemporaryItems is a dot file, it will not be visible in the Finder. When the application is able to create this .TemporaryItems directory, it is world writable and sticky. For improved security, as long as all users are in a common group like "staff," then the folder can be restricted to writing by the group instead.
$ cd /path/to/volume/or/sharepoint
$ sudo mkdir .TemporaryItems
$ chgrp staff .TemporaryItems
$ chmod 1770 .TemporaryItems
»

Where's that sound!

2008-09-04T15:30:00.002+02:00

I tried a few times ti find out where the sound i located that is played when the installer has successfully installed an application.

Today I finally found it.

The sound name is 'burn complete.aif'.

You can find it here: /System/Library/Components/CoreAudio.component/Contents/Resources/SystemSounds/system/burn complete.aif

I did not find this by myself.
I got the tip from here http://forums.macrumors.com/showthread.php?t=524273

SirAdmin

2008-03-20T08:32:00.003+01:00

SirAdmin is a ver cool GUI tool to manage IMAP mailboxes.

It has one problem though.
In order to get it to work, you have to enable clear password authentication on the mail server.

Using Server Admin go to

Mail>Settings>Advanced>Security

Here you have to enable 'Clear' in the IMAP column, otherwise SirAdmin will not be able to authenticate

Tip found here.

Leopard Auto User Setup using Workgroup Manager in Advanced Server Setup

2008-02-29T08:55:00.001+01:00

There seems to be an easier way of doing this:
In the manual User_Management_v10.5.mnl.pdf you can find a section 'Using the Preference Editor to Manage Core Services' on page 236.
Using this information it is quite easy to assign preferences in the workgroup manager.
The cool thing about this is that you may use '%@' as a variable for the login name.
This way options such as the account name for login into the mail server may be used.

If I were given the option to post a few picture I could illustrate this.
Feel free to contact me for more information...

Sharing...

2008-01-23T09:09:00.000+01:00

Have you ever tried to set up a share point using the command line?

Why would you do this?

Well, I thought that there must be a way to copy share points after a clean install.

So, how do we find out what is being shared:

Enter this command:
sharing -l

This gives you something like this:

name: Software
path: /Volumes/Backup/Software
afp: {
name: Software
shared: 1
guest access: 0
inherit perms: 1
}
ftp: {
name: Software
shared: 0
guest access: 0
}
smb: {
name: Software
shared: 0
guest access: 0
inherit perms: 0
oplocks: 0
strict locking: 0
directory mask: 493
create mask: 420
}

In order to set up this share point again after a clean install one would have to enter this command:
sharing -a /Volumes/Backup/Software -g 000 -i 10 -s 100

chmod ACL removal

2008-01-18T16:21:00.001+01:00

The command to recursively remove all ACLs from the files in the working directory and its subdirectories is:

sudo echo | sudo chmod -R -E ./*

How to rebuild the LaunchServices database

2008-01-10T09:33:00.000+01:00

If your "Open With" menu shows applications that are no longer installed, or shows some of them as duplicates, you can use the following Terminal command to rebuild your LaunchServices database:

/System/Library/Frameworks/ApplicationServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -kill -r -domain local -domain system -domain user

Enable Mail Bundles in Mac OS X 10.5 Leopard

2007-11-19T12:41:00.000+01:00

Normally Bundles no longer work after installing Leopard.
I miss Mail.appetizer. To get these working again in Leopard follow these steps:

Quit Mail

Enter these commands in Terminal:

defaults write com.apple.mail EnableBundles -bool YES
defaults write com.apple.mail BundleCompatibilityVersion -int 3

Start Mail

Turn off Translucent Menu Bar in Leopard

2007-11-16T08:21:00.000+01:00

sudo defaults write /System/Library/LaunchDaemons/com.apple.WindowServer 'EnvironmentVariables' -dict 'CI_NO_BACKGROUND_IMAGE' 1

Changing the root password on MySQL

2007-11-08T12:45:00.000+01:00

Many distributions of Linux have an option to install MySQL. In this case, or even if you compile MySQL, the default password is blank. MySQL can also run on Windows boxen. When you install MySQL, make sure that you set the root password. You can do this:


root@u-1:/home/u-1# mysql -u root mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor.  Commands end with ; or g.
Your MySQL connection id is 1 to server version: 3.23.47
Type 'help;' or 'h' for help. Type 'c' to clear the buffer.
mysql> SET PASSWORD FOR root@localhost=PASSWORD('rubberchicken');
Query OK, 0 rows affected (0.06 sec)
mysql>

In this example, we set the root password to rubberchicken. Note from the above that the password wasn't set. If we try this again, we need to use the -p option to enter the password:


root@u-1:/home/u-1# mysql -u root mysql
ERROR 1045: Access denied for user: 'root@localhost' (Using password: NO)
root@u-1:/home/u-1# mysql -u root -p mysql
Enter password: 
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor.  Commands end with ; or g.
Your MySQL connection id is 3 to server version: 3.23.47
Type 'help;' or 'h' for help. Type 'c' to clear the buffer.
mysql>

To reset a root password that you forgot (using paths on our system):


[root@host root]#killall mysqld
[root@host root]#/usr/libexec/mysqld -Sg --user=root &

You may have better luck with:


mysqld --skip-grant-tables --user=root

Go back into MySQL with the client:


[root@host root]# mysql
Welcome to the MySQL monitor.  Commands end with ; or g.
Your MySQL connection id is 1 to server version: 3.23.41
Type 'help;' or 'h' for help. Type 'c' to clear the buffer.
mysql> USE mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> UPDATE user
-> SET password=password("newpassword")
-> WHERE user="root";
Query OK, 2 rows affected (0.04 sec)
Rows matched: 2  Changed: 2  Warnings: 0
mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)
mysql> exit;
[root@host root]#killall mysqld

Start MySQL the normal way for your system, and all is good. For Red Hat this is:


/etc/init.d/mysqld start

Group Members

2007-10-29T09:13:00.000+01:00

Have you ever tried to get a list of group members in a text file.

Well you can do it this way:

dscl /LDAPv3/ldap.company.com -read /Groups/ThisGroup Member > ThisGroupsMembers.txt

Join Kerberos

2007-10-17T10:17:00.000+02:00

I was having some troubles getting a server to join kerberos.

After some time I found out that the problem was related to a correct dns entry.

So there are two ways to fix this:

a) correct dns
b) if that is not possible due to some reason as in my case you may try this:

Use a text editor to open the /etc/hosts file, then add the following entry to the end of the file:

IP address FQDN

... where IP address is the IP address of the KDC, and FQDN is the fully qualified domain name that you specified on your DNS server.

For example: 123.456.78.910 www.example.com

In Terminal (/Applications/Utilities), execute the following command:
sudo scutil --set HostName
... where FQDN is the fully qualified domain name of this server that was configured on your DNS server.

After that I had no problems to join kerberos using:

sso_util remove -k -a diradminuser -p diradminpassword
rm /etc/krb5.keytab
# rm /Library/Preferences/edu.mit.Kerberos
# rm -R /Library/Preferences/DirectoryService/
rm -R /var/db/krb5kdc/*

/usr/sbin/sso_util configure -r LDAP.HOPRO.EDU -a diradminuser -p diradminpassword -f /LDAPv3/ipaddrofladserver -v 1 all

Hint found here:
Mac OS X Server 10.4: Kerberos authentication services may not successfully start

Passwords not working?

2007-10-10T13:27:00.000+02:00

Are you running a Mac OS X server and having troubles with your passwords?

The symptoms you see are:

- A user can't log in to some systems
- The /Library/Logs/PasswordService/ApplePasswordServer.Server.log on the relevant password server contains this message:

Dec 5 2005 14:28:26 AUTH2: {0x4322345c67952fc40000016800000685, user1} DIGEST-MD5 authentication failed, SASL error -13 (password incorrect).

Then have a look at this document:

Mac OS X Server: Authentication issues with DIGEST-MD5, "SASL error -13"

diskutil resizeVolume

2007-08-07T14:34:00.000+02:00

To create a partition for Windows on a iMac with a 150GB disk I used the following commands:

First we need to look at the current disk partitioning:
diskutil list
which returns something like

/dev/disk0
#: type name size identifier
0: GUID_partition_scheme *149.1 GB disk0
1: EFI 200.0 MB disk0s1
2: Apple_HFS MyMac 148.7 GB disk0s2

Then I used the command
diskutil resizeVolume disk0s2 112G MS-DOS Windows 36G

This resizes the Mac partition to 112 GB and creates a second partition in ms-dos format named 'Windows' with a sie of 36 GB

More infos here:
http://www.macgeekery.com/tips/cli/nondestructively_resizing_volumes

A reboot is then required. But wait:
Be sure to set the startup disk first, otherwise your mac will not start up!!!
bless --mount "/Volumes/Macintosh HD" --setBoot

In order to use the newly created volume with netboot, I had to erase the volume.
Otherwise the volume was not visible in NetRestore.
The command to do this is:

diskutil eraseVolume MS-DOS ".Windows XP" /dev/disk0s3

Printer Stuff

2007-06-28T08:53:00.000+02:00

I tried to change the default printer remotely.

Lets see what we got:
/System/Library/StartupItems/PrintingServices/PrintingServices restart
to start and stop the printing.

we have /etc/cups/printers.conf where all the information is stored.

we have 'lpadmin -d printer_name' so set the default printer.

but how do I change the default printer without restarting the mac so that it shows in Remote Desktop?

Sending email attachments through the terminal

2007-05-23T14:23:00.000+02:00

uuencode FILENAME FILENAME | mail -s SUBJECT RECIPIENT

Hint found here:

http://cbutera.wordpress.com/tag/apple/

kerberos troubles

2007-05-21T15:45:00.000+02:00

Are you having troubles getting kerberos to work on Mac OS X Server?

Well here's a hint:

Open Workgroup Manager on the designated Kerberos server and delete everything you may find in the path:

/Config/KerberosKDC

You may have to enable 'Show "All Records" tab and inspector' in the preferences if WGM in order to do so.

I found that the server I work with hat rubbish in there which prevented it from working.

Sharing files on OS X with ACL

2007-04-26T15:27:00.000+02:00

A problem with the /Users/Shared folder in OS X is that it is only shared read-only. You can add write access to all items in the shared folder, but when a new user adds files, it will be read only by the others. With Tiger and ACL you can now setup a both read and write shared folder, which inherits write access to all files automaticly. Here is how;

First you need to enable ACL on your root file system:

sudo /usr/sbin/fsaclctl -p / -e

Then enable inheritable write access to the Shared folder:

sudo chmod -R +a
"admin allow delete,chown,list,search,add_file,add_subdirectory,delete_child,file_inherit,directory_inherit" /Users/Shared

"Well Known" TCP and UDP Ports Used By Apple Software Products

2007-04-16T13:18:00.000+02:00

"Well Known" TCP and UDP Ports Used By Apple Software Products

Managed Client: How to prevent profanity from appearing in Dictionary

2007-04-16T13:12:00.000+02:00

This is an interesting subject.
I guess this could be helpful to manage other preferences from the workgroup manager as well:
http://docs.info.apple.com/article.html?artnum=305348

Actually this tip should help manage any preferences that use the plist format.
Now this is really interesting.

I wonder if I can turn off the software update function of iTunes...

Screensaver over LoginWindow

2007-04-10T11:02:00.000+02:00

Unfortunately Apple does not supply a method of using a screensaver while the mac is in the login window.

This may however be accomplished using this hint:
Screensaver over Loginwindow

Screensaver Configuration

2007-04-10T10:59:00.000+02:00

Some details on how to configure the behaviour of the default screensaver on Mac OS X:

The settings for the default saver are to be found here:
System/Library/Frameworks/ScreenSaver.framework/Versions/A/Resources/Engine Defaults.plist

More information on this subject here:
Screensaver configuration

Enable auto login via command line [update]

2007-04-03T15:25:00.000+02:00

I have been wondering on how to do this for a long time.

Here's the clue:
On Mac OS X Server side there is this tool:
/System/Library/ServerSetup/serversetup

Amongst a lot of other features, it offers these functions:

serversetup -setAutoLoginUser Name UID Password
Set the autostart user using the name and password supplied.

serversetup -getAutoLoginUser
Returns the current AutoLoginUser.

serversetup -clearAutoLoginUser UID
Disables AutoLogin feature.

Now what if I copied this tool to a Mac client?
Guess what...

It works. Well sort of. Sometimes.
It works if the script is executed while logged in locally on the machine.
But that's not what I want.

But I found another hint here:

http://www.applescript.net/viewtopic.php?id=17957

What you can do is copy the file/private/etc/kcpassword generated on one machine to all the macs you want to log in automatically. It contains an encrypted password. Unfortunately there is no documented way of generating this file on a client. Hmm.

Then all you have to do is change the login preferences by issuing the following commands:

/usr/bin/defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser yourusername
/usr/bin/defaults write /Library/Preferences/com.apple.loginwindow autoLoginUID yourUIDnumber

[update]
There is a cooler way to do this.
I found a utility whose name is 'kcpasswd'.
kcpasswd is a command line application that changes a user's KeyChain password.
That's not exaclty that I was looking for, but it comes real close.
So I sent an email to the author of 'kcpasswd' if there were any chance that he could support generating the /etc/kcpassword file.

After a while I received an email from Phill Tejada telling me that he had this new tool called 'loginoptions' which does just that.
Way cool and thanks a lot Phill.

Oh yes, the links, I almost forgot:
FruitBatSoftware
loginoptions

logKext

2007-03-30T08:32:00.000+02:00

LogKext is a freeware keylogger for Mac OS X.

If you know what this is for, then you can get it here:
http://fsbsoftware.com/data/LogKextReadme2.html

Otherwise just forget it.

Monitor FileSystem Usage

2007-03-28T11:30:00.000+02:00

Have you ever been wondering who is eating your fileserver's performance?

Unfortunately Apple offers no tools to monitor this.

You may however get some indications by entering the command:

fs_usage -w AppleFileServer | grep Volumes

More on this subject:
TIGER SERVER: High CPU Usage on AppleFileServer process

Top 15 Terminal Commands for Hidden Mac OS X Settings

2007-03-27T09:17:00.000+02:00

Found here:

http://www.macosxtips.co.uk/index_files/terminal-commands-for-hidden-mac-os-x-settings.html

Re-index your ladp

2007-03-23T14:15:00.001+01:00

Sometimes it looks like your ldap db is corrupted.
In that case you can try to re-index your ladp

1. Stop slapd with

sudo launchctl unload /System/Library/LaunchDaemons/org.openldap.slapd.xml

2. Wait a minute to give slapd time to stop. You can see it in the OD status pane of Server Admin

3. Re-index your ladp db with

sudo slapindex -v -d 1

(I like the debug output just to see what it is doing.)

4. Start slapd back up with

sudo launchctl load /System/Library/LaunchDaemons/org.openldap.slapd.xml

See if that helps.

Backup using rsnapshot

2007-03-23T13:20:00.000+01:00

I've been using rsnapshot to back up some of our servers.

rsnapshot can be installed via Darwinports (or manually; it's only two files:, a Perl script and a config file) and works beautifully on OS X.

Even though there might be an issue when using ACLs I prefer having a copy of the data instead of losing all....

It creates hard links instead of copies of files that have not changed. This way incremental backups can be made where each copy in itself is self containing, meaning that it is a full copy that can be copied back in case of an emergency.

Really cool.

There's a good page on this subject to be found here:
rsnapshot on OS X howto

Reset Xsan Serial Numbers

2007-03-23T09:33:00.000+01:00

If by any chance you are setting up a Xsan and are getting these errors:

"Error while writing settings (Duplicate registration)"

Then this apparently has nothing to do with the serial number.
It could be correct. But the problem is that Xsan has a database in which it stores the associations from hostnames an serial numbers. And this database can somehow seem to get mixed up if you install the same Xsan several times...

The thing to do is then to get rid of the database by entering the command:

rm /etc/systemserialnumbers/xsan

on Metadata controllers as well as on all the clients.
Then reboot all of them and start anew.

This is how I got it working again.

The hint I followed was found here:
http://www.xsanity.com/forum/viewtopic.php?p=348

sso_util -- Kerberos -- Open Directory Single Sign On

2007-03-19T13:56:00.000+01:00

So this is the tool to manage the kerberos stuff!

I accidentally found it when browsing around for information on how to remove a replica from an open directory system.

That by the way is done by entering the command:

slapconfig -removereplica 192.168.1.1

But here's the info on sso_util:
Manual Page For sso_util(8)

So here's how to stop the kerberos server:

sso_util remove -k -a diradminuser -p diradminpassword

Eject key doesn’t work in 10.4.9

2007-03-15T14:29:00.000+01:00

I wish that I could configure time it takes for the Eject key to react.

I personally did never press this key accidentally and I wish that I could set it back to normal behaviour.
Especially since I also use this key to restart or shut down my mac....

Let's see if can figure out how to change this...

smile ;-)

2007-03-15T13:52:00.000+01:00

I use the following script within Apple Remote Desktop (ARD) to take a picture of the people sitting in front of their macs and send it to me via email:

b=`users | cut -d " " -f 1`
u=`/usr/bin/ldapsearch -x -h myldapserver.com -b "cn=users, dc=mydomain, dc=com" "uid=$b"| grep cn: |cut -d":" -f 2`
c=`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/systemsetup -getcomputername | cut -d":" -f 2 | cut -d " " -f 2`
/usr/local/sbin/wacaw --jpeg smile
echo "This is $u ($b) on $c" | /usr/local/bin/mutt -a "/usr/local/sbin/smile.jpeg" -s "$b@$c" "me@mymaildomain.com"
rm /usr/local/sbin/smile.jpeg

It send me a photo of the person sitting in front of the mac together with their name so that I know who it is.

This script uses:
wacaw to capture a picture from the iSight.
The Mutt E-Mail Client
Unlike mail this email client allows me to send an attachment.
Mutt was compiled using the method described in my last post.

It also uses 'ldapsearch' to get the real name of the person.

Configuring build for universal binaries from open source

2007-03-13T16:38:00.000+01:00

Configuring for universal binaries
The first approach is to simply have configure build a universal binary, by passing in the appropriate CFLAGS and LDFLAGS environment variables. This is done simply by running

env CFLAGS="-O -g -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch i386 -arch ppc" \
LDFLAGS="-arch i386 -arch ppc" ./configure --prefix=${HOME}/Hello --disable-dependency-tracking

This is documented here:
Technical Note TN2137
Building Universal Binaries from "configure"-based Open Source Projects

After entering the commands 'make' and 'make install' you can then find the binaries in a folder called 'Hello' in your home directory. This is very useful if you don't want to install the binaries directly in your system but would rather have them isolated.
The advantage being that you can now easily use 'PackageMaker' to create a installer package ;-).

Apple Remote Desktop - Send Unix Commands

2007-03-13T13:59:00.000+01:00

An interesting list of commands can found here:

http://homepage.mac.com/applesd/page2/page1/page0/index.html
or here:
http://macenterprise.org/content/view/114/140

Secure OS X

2007-03-13T08:47:00.000+01:00

There's an interesting article on how to secure Mac OS X to be found here:
Howto: A more secure OS X before Leopard
An even more secure OS X before Leopard

Adding additional security measures is always a subject when working as a system administrator.

PDF Guides:
NSA’s Guide to Panther Hardening
Corsaire’s Guide on Securing OS X Tiger
Apple’s Document on Securing Tiger

syslogd

2007-03-08T09:15:00.000+01:00

There is an interesting article on how to set up a syslog server in mac os x on afp548:

http://www.afp548.com/article.php?story=20050816135035340

slapconfig

2007-03-05T12:59:00.000+01:00

slapconfig is a utility for configuring slapd, slurpd, and the Directory
Services search policy. It must be run by root.

-addreplica
Adds a replica to the slapd configuration file.

-createreplica
Create a new replica from an existing LDAP master.

-removereplica -
Removes a replica from the slapd configuration file.

more infos can be found in the man pages of slapconfig.

After having set up a new server, I imported the ldap data from the old server.
After checking the setup I had the problem that I had to remove the old replicas.
Even though I removed them in the server settings they still showed up in the file /Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist of the clients.
So i used slapconfig on the server to remove them.

cut

2007-03-05T10:58:00.001+01:00

echo "steve:jobs"| cut -f 1 -d ":"
returns 'steve' because cut is set to return field 1 using delimiter ":"
cool!

ldapsearch

2007-03-05T10:54:00.000+01:00

ldapsearch
Sometimes it may be useful to get the name of a mac with a specific mac address from your directory server:

/usr/bin/ldapsearch -x -h 192.168.1.10 -b "cn=computers, dc=myserver, dc=com" "macAddress=00:0a:95:f1:01:04"

We use this in a script that installs our Mac OS X clients.
This has the advantage that mac clients whose name are defined in our open directory are automatically renamed as they are installed thus always have the correct name without any additional manual renaming.

Unfortunately ldapsearch truncates it's output to 80 characters per line which can be very annoying.
To prevent this one may add one line of Perl:

perl -p -0040 -e 's/\n //'

-p: Loop for each line and print
-0040: Set input delimiter to 040 i.e. space
-e: Command follows - strip newline/spac

get mac address

2007-03-05T10:53:00.000+01:00

To get the mac address use the following command:

hwAddress=`ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'`

dscl

2007-03-05T10:52:00.000+01:00

Directory Service command line utility

List users:
dscl /LDAPv3/ldapserver.myserver.com -list /Users

Read a users properties:
dscl /LDAPv3/ldapserver.myserver.com -read /Users/ms

MCX Cache

2007-03-05T10:51:00.004+01:00

Update MCX Cache
sudo /System/Library/CoreServices/mcxd.app/Contents/Resources/MCXCacher -U UserNameHere

/System/Library/CoreServices/mcxd.app/Contents/Resources/MCXCacher

MCXCacher -U usershortname [-h homepath]
Creates (or overwrites an existing) mobile account on the current
machine for user "usershortname" with optional home path "homepath"

MCXCacher
Performs the pre-login checks and refreshes cache if required.

MCXCacher -u usershortname
Performs the post login checks and refreshes caches -- does
everything that "MCXCacher" does plus caches the current user's
mcx_settings

MCXCacher -f
Flushes the cache (Mobile accounts not removed; but system is unmanaged)

MCXCacher -d
Dirties the cache so that it will be refreshes at the next login
("MCXCacher" call by mcxd)
-----------------------

MCXCacher -f will put the machine into an unmanaged state until the
next time it reconnects to the management server, so it's a rather
drastic thing to do. From memory, if you run this command, Mobile
Users won't be able to login at the loginwindow unless the machine
can connect to the management server at that time.

MCXCacher -d does the right thing in the vast majority of cases, and
as John DeTroye just pointed out to me, runs at login/logout and
restart.

The flags that allow you to specify where a mobile user home
directory is created are really useful though. I'm using it with a
login hook that means that my users get their home directory set to
another partition when they first login as a Mobile User.

stat

2007-03-05T10:51:00.003+01:00

Display User and Group of a folder:
stat -f "%u:%g" backup/

Display Permissions of a folder:
stat -f "%p" backup/

find installed files

2007-03-05T10:51:00.001+01:00

any opaque installer that asks for a password, you might want to take the pause that refreshes and square yourself to capture what was done. a technique...

quit apps that may be changing files. we want as few files mod'd as possible.

before running the installer, in the shell:

% touch ~/newer

then, run your installer. when it has completed, in the shell...

% sudo /usr/bin/find / -xdev -newer ~/newer

this will spit up all files changed since the above touch.

you might want to capture it by redirecting to a file...

% sudo /usr/bin/find / -xdev -newer ~/newer >~/install.foo.touched.log

note that there may be some files in there that were modified, but not by the installer.

Hide 'Other Users...' in Login Window

2007-03-05T10:50:00.001+01:00

sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWOTHERUSERS_MANAGED false

To hide local admin users:
sudo defaults write /Library/Preferences/com.apple.loginwindow HideAdminUsers true

Make a client pretend it is a server

2007-03-05T10:47:00.000+01:00

Some tools only work on the server version of Mac OS X.

In order to make these tools work on a client you can make the system think it is a server by issuing the following command:

sudo touch /System/Library/CoreServices/ServerVersion.plist

You may then use these server tools.
Afterwards you will have to change things back:

sudo rm /System/Library/CoreServices/ServerVersion.plist

Make sure to not leave out the last line, else your computer will think its Mac OS X Server!

filenames with spaces...

2007-03-05T10:44:00.000+01:00

This is a quickie. On the Mac you regularly handle files with spaces in the Finder without issue, and even on the command line when you put quotes around it or let tab-completion escape it properly. However, if you try to do things in a shell script, like a for loop, on filenames that involve a space you're going to hit a wall. For splits items on a space, regardless of it they're quoted (if they're stored in a variable). However, the read command does not. Observe.

find ~ -name '* *' | while read FILE
do
echo $FILE rocks.
done

And that's that. Run the command and pipe to the while stanza and it works like a charm.

Software Update Server

2007-03-05T10:39:00.000+01:00

I know that a client can be forced to use a local Software Update Server by managing the preferences on the directory server.

You can do this through the command line too. That app is just editing the software update .plist file. For a global change of software update server for all users, type this.

sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CatalogURL "http://you-server:8088/"

Remember to add that "/" after the port number. And the part with the address, you do actually put that in quotes when entering in the terminal.

In our environment it is also necessary to add the software update server to the list of servers that will not pass throug our web proxy server because the software update won't work with a proxy between client and server...

create non-admin user

2007-03-05T10:35:00.000+01:00

The user created in the last post creates an admin user.

In order to remove admin rights all that has to be done is to take that user out of the admin group.

on the local machine this can be done using the following command:

niutil -destroyval . /groups/admin users username

Create a new user via command line

2007-03-05T10:33:00.000+01:00

To create a user:
$ sudo /System/Library/ServerSetup/serversetup -createUser fullname
shortname password
The name, short name, and password must be typed in the order shown. If the full
name includes spaces, type it in quotes.
The command displays a 1 if the full name or short name is already in use.

To create a user with a specific UID:
$ sudo /System/Library/ServerSetup/serversetup -createUserWithID
fullname shortname password userid
The name, short name, password, and UID must be typed in the order shown. If the full
name includes spaces, type it in quotes.
The command displays a 1 if the full name, short name, or UID is already in use or if the
UID you specified is less than 100.

To create a user with a specific UID and home directory:
$ sudo /System/Library/ServerSetup/serversetup -createUserWithIDIP
fullname shortname password userid homedirpath
The name, short name, password, and UID must be typed in the order shown. If the full
name includes spaces, type it in quotes.

Backup a file....

2007-03-05T10:32:00.001+01:00

sudo cp /etc/sudoers /etc/sudoers.`date +%Y%m%d_%H%M%S`
This will create a file name like this /etc/sudoers.20051025_115428 which has not only the date of when you backed up this file, but also the time - useful if you're doing many revisions on one file in a day!

No Startup Sound

2007-03-05T10:22:00.001+01:00

sudo nvram SystemAudioVolume=" "

Seems to use ASCII character values from 32 upwards to represent the different volumes - the default is "{" which is quite loud..

to restore default behaviour :

sudo nvram -d SystemAudioVolume

tip found at:
http://forum.onmac.net/archive/index.php/t-507.html

The MacBook I tried this on however does not seem to do as it should.
After a reboot the value of SystemAudioVolume seems to get set back to 'w'...

Oh well, I'll just keep on using 'StartupSound.prefPane' found here:
http://www5e.biglobe.ne.jp/~arcana/StartupSound/index.en.html

Getting started...

2007-03-05T10:05:00.000+01:00

I have been using the internet for years to find solutions to my problems.
Now I think the time has come for me to publish my knowledge as well so that others with similar problems might profit from my experience.

So instead of writing down my stuff for my own records I will now write them down here so that others might profit from them as well...