Tiny Deathstars of Foulness

When I was speaking at MacADUK, I asked Tom Bridge about starting a podcast. He’s got a great voice, and I thought he’d be a great co-host. Before we were able to get to that when we got home, Adam Codega, independently of the conversation I’d had with Tom, dropped a note on Twitter to see who else might be interested in doing a Podcast. A few people responded that they’d be interested in also jumping in on a new Podcast. Over the next few weeks, decisions were made that the podcast would be hosted as a part of, the format, the hosting location, and lots of other really cool stuff. And some of us got together and recorded the first episode. And then, last night, we recorded the second episode just in time to get that into editorial before Episode 1 is released. And soooooo, episode 1 is out! It includes Tom Bridge, Emil Kausalik, Adam Codega, and myself. We also have an interview with some of the organizers from the Penn State Mac Admins conference, which I wasn’t able to sit in on, but find just fantastic. And Tom did some of the editing. Aaron Lippincott (@dials-Mavis) did a lot of work on the mastering and deserves lots of credit there (he made everyone sound way betterer). And John Kitzmiller did a lot of work on the domain and website and DNS type of stuff, as well as helping with hosting of the podcast assets as well. And Adam’s done a lot of work on the back end linking things together, so a great team effort. The next episode also features Pepijn Bruienne and Marcus Ransom (who I lovingly decided we should call the He-Man of the Mac Universe) and covers the latest iOS 9.3 release, as well as some information about the Classroom app. So stay tuned for that, but click below to give the episode a listen, or find on iTunes once it appears (and I’ll post a link to that once we can). Overall, I’m really stoked to get this thing going, and that the group has built a great system for future episodes, that should be sustainable for many, many episodes. I’m also really stoked to be able to get to work with this specific group – I’m a big fan of everyone, and I look forward to many episodes to come! So follow on Twitter at @MacAdmPodcast and feel free to let us know if you’ve done something awesome and we should mention it or interview you! Screen Shot 2016-03-28 at 10.39.29 AM

March 28th, 2016

Posted In: iPhone, Mac OS X, Mac OS X Server, Mac Security, Mass Deployment, Network Infrastructure, personal

Tags: , , , , , ,

Who still says “like a boss?” I guess I did. Get over it. But don’t get over spam. Especially annoying are the ones we know we accidentally signed up for. Because it’s our own darn fault. But luckily, there’s a lot more tools for dealing with bulk mail (solicited or unsolicited) these days. Most modern email clients have the ability to deal with spam. Exchange/Office 365 has clutter and junk. You can build rules on sites. You can use spam assassin on your servers. But, there’s also a nice little app called Once you sign up you’ll have 3 ways of dealing with each message: request removal from a list, mark as rolled up into a single daily digest, or mark as good email. Download it here. The app works a lot like something like Tinder. You swipe right to like something, left to not like something. Facebook should implement this into your timeline! Screen Shot 2015-12-01 at 2.34.08 PM If you decide to mark emails as digests, you’ll get an email once a day that looks like this: Screen Shot 2015-12-01 at 2.20.58 PM This works great for organizations that actually properly remove you from lists (which is surprisingly most). Using this swiping type of workflow, you can knock through 100 or more emails in 10-15 minutes. For organizations that don’t respect unfollow or stop sending me your crap emails, there’s also always just marking them as spam. The only problem with this is that you likely have a phone, a computer, a home computer, and maybe a tablet. No one wants to mark the same email as spam four times and then potentially have emails disappearing and not being able to figure out which computer they were marked as junk on. There are lots and lots of options for this type of thing. But given the ease of use an quick evisceration I can do on my mailbox, I rather like Give it a shot. You might hate it. I don’t.

December 3rd, 2015

Posted In: Apps, cloud, Network Infrastructure

Tags: , , , , ,

There’s a quick and easy IT Business Edge slideshow at that I helped with about 5 Mobile Apps You Really Need for SMB Success. Screen Shot 2015-08-10 at 2.55.35 PM Hope you enjoy!

August 10th, 2015

Posted In: Bushel, iPhone, Mac OS X, Mac OS X Server, Mac Security, Mass Deployment, Network Infrastructure

Tags: , , , ,

Mac admins spend a lot of time building images. In System Image Utility this can mean baking an image that just looks for a path of a NetRestore source and restores an operating system. Constantly making these is a pretty duplicative task. The goal of this article is to take a generic NetRestore NetBoot image and augment it in such a way that you don’t need to create new NetBoot images unless there’s a new build train. Instead, all you need to do is edit a file that changes the path (uri) of your image so that it can be restored. Using this, you can just stop the NetInstall service in OS X Server, edit a file, start the service back up and boot clients into the NetBoot environment. Screen Shot 2015-07-09 at 5.21.31 PM When you make a NetBoot Set, you’ll select a source. This can be a local volume or a network volume. Once your NetBoot nbi is created, you’ll see a NetInstall.dmg. If you open that dmg, you’ll see a directory called Packages. If you open that, you’ll see an InstallPreferences.plist. Let’s cat that real quick: cat /Volumes/NetInstall/Packages/InstallPreferences.plist The output would be as follows: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ""> <plist version="1.0"> <dict> <key>restoreList</key> <array> <dict> <key>installRecoveryPartition</key> <true/> <key>restoreSourcesAllowManual</key> <true/> <key>restoreSourcesArray</key> <array> <dict> <key>descriptionKey</key> <string>Unicast Image</string> <key>sourceKey</key> <string>asr://</string> </dict> </array> <key>restoreSourcesBrowseMulticast</key> <false/> <key>restoreSourcesBrowseOthers</key> <true/> <key>retainOriginalVolumeName</key> <true/> <key>sourcePath</key> <string>/System/Installation/Packages/System.dmg</string> </dict> </array> </dict> </plist> Here, let’s look at a few specific keys that we can edit:
  • descriptionKey: A simple, human readable description of the image that will be installed
  • sourceKey: The URI to the image that asr will connect to in order to install the image sourcePath: This is the path to the dmg file within the nbi. This is usually best left untouched unless you’ve switched something around within the nbi (which I’ve only seen done a couple of times).
  • restoreSourcesBrowseMulticast: Set to true to allow for multicast imaging. Obviously, DeployStudio or asr would be used to make this work and you’d need to provide a multicast address.
  • installRecoveryPartition: Set this to false if you don’t want to install a recovery partition. You probably should be creating one.
  • restoreSourcesAllowManual: Allows for manual entry of an image source.
  • restoreSourcesBrowseOthers: Allows for browsing over Bonjour for an image source.
  • restoreSourcesArray: Not present if you chose a local path.
You can also edit the NBImageInfo.plist file to set some of the other items you might otherwise edit in System Image Utility. Here, you’ll need to covert the plist to xml to edit it: plutil -convert xml1 /Volumes/NetBootSP/NetInstall\ OS\ X\ Yosemite.nbi/NBImageInfo.plist In here, you’ll see a plist similar to the following: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" ""> <plist version="1.0"> <dict> <key>Architectures</key> <array> <string>i386</string> </array> <key>BackwardCompatible</key> <false/> <key>BootFile</key> <string>booter</string> <key>Description</key> <string></string> <key>DisabledSystemIdentifiers</key> <array> <string>iMac10,1</string> <string>iMac11,1</string> <string>iMac11,2</string> <string>iMac11,3</string> <string>iMac12,1</string> <string>iMac12,2</string> <string>iMac13,1</string> <string>iMac13,2</string> <string>iMac13,3</string> <string>iMac14,1</string> <string>iMac14,2</string> <string>iMac14,3</string> <string>iMac14,4</string> <string>iMac15,1</string> <string>iMac7,1</string> <string>iMac8,1</string> <string>iMac9,1</string> <string>Mac-50619A408DB004DA</string> <string>Mac-F305150B0C7DEEEF</string> <string>MacBook5,1</string> <string>MacBook5,2</string> <string>MacBook6,1</string> <string>MacBook7,1</string> <string>MacBook8,1</string> <string>MacBookAir2,1</string> <string>MacBookAir3,1</string> <string>MacBookAir3,2</string> <string>MacBookAir4,1</string> <string>MacBookAir4,2</string> <string>MacBookAir5,1</string> <string>MacBookAir5,2</string> <string>MacBookAir6,1</string> <string>MacBookAir6,2</string> <string>MacBookAir7,1</string> <string>MacBookAir7,2</string> <string>MacBookPro10,1</string> <string>MacBookPro10,2</string> <string>MacBookPro11,1</string> <string>MacBookPro11,2</string> <string>MacBookPro11,3</string> <string>MacBookPro12,1</string> <string>MacBookPro3,1</string> <string>MacBookPro4,1</string> <string>MacBookPro5,1</string> <string>MacBookPro5,2</string> <string>MacBookPro5,3</string> <string>MacBookPro5,4</string> <string>MacBookPro5,5</string> <string>MacBookPro6,1</string> <string>MacBookPro6,2</string> <string>MacBookPro7,1</string> <string>MacBookPro8,1</string> <string>MacBookPro8,2</string> <string>MacBookPro8,3</string> <string>MacBookPro9,1</string> <string>MacBookPro9,2</string> <string>Macmini3,1</string> <string>Macmini4,1</string> <string>Macmini5,1</string> <string>Macmini5,2</string> <string>Macmini5,3</string> <string>Macmini6,1</string> <string>Macmini6,2</string> <string>Macmini7,1</string> <string>MacPro3,1</string> <string>MacPro4,1</string> <string>MacPro5,1</string> <string>MacPro6,1</string> <string>Xserve3,1</string> </array> <key>EnabledSystemIdentifiers</key> <array/> <key>Index</key> <integer>2459</integer> <key>IsDefault</key> <false/> <key>IsEnabled</key> <true/> <key>IsInstall</key> <true/> <key>Kind</key> <integer>1</integer> <key>Language</key> <string>Default</string> <key>Name</key> <string>test</string> <key>RootPath</key> <string>NetInstall.dmg</string> <key>SupportsDiskless</key> <false/> <key>Type</key> <string>HTTP</string> <key>imageType</key> <string>netrestore</string> <key>osVersion</key> <string>10.10</string> </dict> </plist> The important keys to look at here are:
  • SupportsDiskless: Switch this on and off if you want NetBoot to run for diskless systems (e.g. if you’re a 3 letter government agency).
  • Index: Typically use unique index IDs.
  • IsDefault: Makes that image the default image.
  • RootPath: The path to that NetInstall.dmg file from earlier.
  • ImageType: netrestore versus netinstall.
  • DisabledSystemIdentifiers: Disables certain models of Macs, which you’d edit by adding and removing items from that array.
So you can edit these files, and once you do so, you won’t need to be baking NetBoot sets all the time. Just when there’s a new build train of OS X and you can’t boot those new machines to NetBoot. Enjoy.

July 9th, 2015

Posted In: Mac OS X, Mac OS X Server, Mass Deployment, Network Infrastructure

Tags: , , , , , , , ,

sFlow is an industry standard that allows network equipment with the appropriate agents to send data to sFlow collectors, which then analyze network traffic. You can install sFlow on routers, switches, and even put agents on servers to monitor traffic. Brocade (along with most other switch manufacturers) supports sFlow. Before you do anything log into the switch and check the current flow configuration: show sFlow To configure, log into the switch and use the the int command to access an interface. From within the interface, use the following command: sflow forwarding Then exit the interface using the very difficult to remember exit command: exit Repeat the enablement of forwarding for any other necessary interfaces. Next, we’ll configure a few globals that would be true across all interfaces. The first is the destination address, done using the destination verb followed by the IP and then the port (I’m using the default 6343 port for sFlow): sflow destination 6343 Set the sample rate: sflow sample 512 Set the polling interval: sflow polling-interval 30 Finally, enable sFlow: sflow enable

January 2nd, 2015

Posted In: Mac OS X, Mac OS X Server, Mac Security, Network Infrastructure, Xsan

Tags: , , , , , , , , ,

I was recently building some preflight scripts and was looking to record some information about a machine live, before proceeding with a script. I found the cheapest way to determine information about architectures and chipsets when scripting preflight scripts for OS X to be the arch and machine commands respectively. For example, to verify the architecture is i386, use the arch command with no options: /usr/bin/arch Which simply outputs “i386”: i386 To check the machine type, simply use the machine command: /usr/bin/machine Which outputs as follows: x86_64h

December 14th, 2014

Posted In: Mac OS X, Mac OS X Server, Mac Security, Mass Deployment, Network Infrastructure

Tags: , , , , , , ,

The other day, my daughter said “it’s opposite day” when it was time to do a little homework, trying to get out of it! Which reminded me of a funny little command line tool called rev. Rev reads a file and reverses all the lines. So let’s touch a file called rev ~/Desktop/revtest and then populate it with the following lines: 123 321 123 Now run rev followed by the file name: rev ~/Desktop/revtest Now cat it: cat !$ Now rev it again: rev !$ You go go forward and back at will for fun, much more fun than homework… Enjoy!

December 12th, 2014

Posted In: Mac OS X, Mac OS X Server, Mac Security, Mass Deployment, Network Infrastructure, Programming, Ubuntu, Unix

Tags: , , , , , , ,

OS X has a command called rvictl, which can be used to proxy network communications from iOS devices through a computer over what’s known as a Remote Virtual Interface, or RVI. To setup an rvi, you’ll need the udid of a device and the device will need to be plugged into a Mac and have the device paired to the Mac. This may seem like a lot but if you’ve followed along with a couple of the other articles I’ve done recently this should be pretty simple. First we’ll pair: idevicepair pair Then tap Trust on the device itself. Then we’ll grab that udid with idevice_id: idevice_id -l Next, we’ll setup a rvi with rvictl and the -s option (here I’m just going to grab the udid since I only have one device plugged into my computer): rvictl -s `idevice_id -l` Then we can list the connections using rvictl with the -l option: rvictl -l Next, we’ll run a tcpdump using this newly constructed rvi0: tcpdump -n -i rvi0 Next, we’ll get a lot of logs. Let’s fire up the Nike FuelBand app and refresh our status. Watching the resultant traffic, we’ll see a line like this: 22:42:29.485691 IP > Flags [S], seq 3936380112, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 706439445 ecr 0,sackOK,eol], length 0 There’s an IP in there, We can look this up and see that the servers are sitting on Amazon Web Services and verify it’s Nike. Watching the traffic with tcpdump we can then obtain GET, POST and other information sent and received. Using wireshark we could get even more detailed data. Overall though, this article is meant to focus on the iOS side of this and not on debugging and refining the approach to using tcpdump/wireshark. rvictl is a great tool in the iOS development cycle and for security researchers that are looking into how many of the apps on iOS devices exchange data. Enjoy.

November 19th, 2014

Posted In: iPhone, Mac Security, Network Infrastructure

Tags: , , , , , , , , ,

Xcode and other tools can be used to view logs on iOS devices. One of those other tools is libimobiledevice. I usually install libimobiledevice using homebrew, as there are a few dependencies that can be a little annoying. To install homebrew if you haven’t already, run the following command: ruby -e "$(curl -fsSL" Once run, follow the prompts to complete the installation. Once homebrew is installed, run the following brew command to download the required components and then libimobiledevice: brew install -v --devel --fresh automake autoconf libtool wget libimobiledevice Then run ideviceinstaller: brew install -v --HEAD --fresh --build-from-source ideviceinstaller Once these are installed, you can plug in a paired device, unlock it and use the following command to view the logs on the screen: idevicesyslog This is akin to running a tail against the device. Again, the device must be paired. You can use the command line (e.g. if you’re running this on Linux) to view the logs, but if you’re not paired you’ll need to use idevicepair to pair your device, followed by the pair verb (which is very different from the pear verb): idevicepair pair You can also unpair using the unpair verb: idevicepair unpair
When pairing and unpairing, you should see the appropriate entries in /var/db/lockdown. The final option I’m going to cover in this article is the date (very useful when scripting unit tests using this suite. To obtain this, use the idevicedate command, no operators or verbs required: idevicedate

November 14th, 2014

Posted In: iPhone, Mac OS X, Mac OS X Server, MobileMe, Network Infrastructure

Tags: , , , , , , , ,

The Directory Utility application has moved to /System/Library/CoreServices/Applications. Once open, you can use it to bind to directory services, change search policies and even dink around with NIS if you still rock the flannel with your ripped up jeans. But, the thing that I tend to do in Directory Utility the most is look at user and group attributes. To do so, open Directory Utility and click on the Directory Editor tab. In the bar directly below, you’ll see Viewing and In Node. The Viewing option is what type of object you’re going to look at. The In Node option shows the directory domain you’re viewing. Below, we show the local users in /Local/Default. Screen Shot 2014-10-30 at 9.02.04 AM Click on a user and you will see all of the attributes that exist for that user. Not all users are created equal when it comes to attributes, so if you’re looking for a specific attribute then you can go through different users to see what they have. Screen Shot 2014-10-30 at 9.12.18 AM Change the In Node option to /LDAPV3/ (or the name of your directory service such as your Active Directory) to see all the attributes available there. You can then note the names and use them in scripts, etc. Screen Shot 2014-10-30 at 9.04.11 AM You can also access this information via dscl, but I’ve covered that enough times in the past to be bored with myself for even making the reference. Enjoy.

November 6th, 2014

Posted In: Mac OS X, Mac OS X Server, Mac Security, Network Infrastructure

Tags: , , , ,

« Previous PageNext Page »