Tiny Deathstars of Foulness

The macOS Server5.2 Guide is basically complete. There are a number of services in the server, each explored here: Good luck out there! screen-shot-2016-10-01-at-11-52-52-pm

October 20th, 2016

Posted In: Mac OS X Server

Tags: , , , , ,

You might be happy to note that other than the ability to interpret new payloads, the profiles command mostly stays the same in Sierra. You can still export profiles from Apple Configurator or Profile Manager (or some of the 3rd party MDM tools). You can then install profiles by just opening them and installing. Once profiles are installed on a Mac, mdmclient, a binary located in /usr/libexec will process changes such as wiping a system that has been FileVaulted (note you need to FileVault if you want to wipe an OS X Lion client computer). /System/Library/LaunchDaemons and /System/Library/LaunchAgents has a mdmclient daemon and agent respectively that start it up automatically. This, along with all of the operators remains static from 10.10 and on. To script profile deployment, administrators can add and remove configuration profiles using the new /usr/bin/profiles command. To see all profiles, aggregated, use the profiles command with just the -P option:

/usr/bin/profiles -P

As with managed preferences (and piggy backing on managed preferences for that matter), configuration profiles can be assigned to users or computers. To see just user profiles, use the -L option:

/usr/bin/profiles -L

You can remove all profiles using -D:

/usr/bin/profiles -D

The -I option installs profiles and the -R removes profiles. Use -p to indicate the profile is from a server or -F to indicate it’s source is a file. To remove a profile:

/usr/bin/profiles -R -F /tmp/HawkeyesTrickshot.mobileconfig

To remove one from a server:

/usr/bin/profiles -R -p com.WestCoastAvengers.HawkeyesTrickshot

The following installs HawkeyesTrickshot.mobileconfig from /tmp:

/usr/bin/profiles -I -F /tmp/HawkeyesTrickshot.mobileconfig

If created in Profile Manager:

/usr/bin/profiles -I -p com.WestCoastAvengers.HawkeyesTrickshot

You can configure profiles to install at the next boot, rather than immediately. Use the -s to define a startup profile and take note that if it fails, the profile will attempt to install at each subsequent reboot until installed. To use the command, simply add a -s then the -F for the profile and the -f to automatically confirm, as follows (and I like to throw in a -v usually for good measure):

profiles -s -F /Profiles/SuperAwesome.mobileconfig -f -v

And that’s it. Nice and easy and you now have profiles that only activate when a computer is started up. As of OS X Yosemite, the dscl command got extensions for dealing with profiles as well. These include the available MCX Profile Extensions: -profileimport -profiledelete -profilelist [optArgs] -profileexport -profilehelp

To list all profiles from an Open Directory object, use 
-profilelist. To run, follow the dscl command with -u to specify a user, -P to specify the password for the user, then the IP address of the OD server (or name of the AD object), then the profilelist verb, then the relative path. Assuming a username of diradmin for the directory, a password of moonknight and then cedge user:

dscl -u diradmin -P moonknight profilelist /LDAPv3/

To delete that information for the given user, swap the profilelist extension with profiledelete:

dscl -u diradmin -P apple profilelist /LDAPv3/

If you would rather export all information to a directory called ProfileExports on the root of the drive:

dscl -u diradmin -P moonknight profileexport . all -o /ProfileExports

In Yosemite we got a few new options (these are all still in 10.11 with no new operators), such as -H which shows whether a profile was installed, -z to define a removal password and -o to output a file path for removal information. Also, as in Yosemite it seems as though if a configuration profile was pushed to you from MDM, you can’t remove it (fyi, I love having the word fail as a standalone in verbose output):
bash-3.2# profiles -P _computerlevel[1] attribute: profileIdentifier: 772BED54-5EDF-4987-94B9-654456CF0B9A _computerlevel[2] attribute: profileIdentifier: 00000000-0000-0000-A000-4A414D460003 _computerlevel[3] attribute: profileIdentifier: C11672D9-9AE2-4F09-B789-70D5678CB397 charlesedge[4] attribute: profileIdentifier: com.krypted.office365.a5f0e328-ea86-11e3-a26c-6476bab5f328 charlesedge[5] attribute: profileIdentifier: _computerlevel[6] attribute: profileIdentifier: EE08ABE9-5CB8-48E3-8E02-E46AD0A03783 _computerlevel[7] attribute: profileIdentifier: F3C87B6E-185C-4F28-9BA7-6E02EACA37B1 _computerlevel[8] attribute: profileIdentifier: 24DA416D-093A-4E2E-9E6A-FEAD74B8B0F0 There are 8 configuration profiles installed bash-3.2# profiles -r 772BED54-5EDF-4987-94B9-654456CF0B9A bash-3.2# profiles -P _computerlevel[1] attribute: profileIdentifier: F3C87B6E-185C-4F28-9BA7-6E02EACA37B1 _computerlevel[2] attribute: profileIdentifier: EE08ABE9-5CB8-48E3-8E02-E46AD0A03783 _computerlevel[3] attribute: profileIdentifier: 24DA416D-093A-4E2E-9E6A-FEAD74B8B0F0 _computerlevel[4] attribute: profileIdentifier: 00000000-0000-0000-A000-4A414D460003 _computerlevel[5] attribute: profileIdentifier: 772BED54-5EDF-4987-94B9-654456CF0B9A _computerlevel[6] attribute: profileIdentifier: C11672D9-9AE2-4F09-B789-70D5678CB397 charlesedge[7] attribute: profileIdentifier: charlesedge[8] attribute: profileIdentifier: com.krypted.office365.a5f0e328-ea86-11e3-a26c-6476bab5f328 There are 8 configuration profiles installed bash-3.2# profiles -rv 772BED54-5EDF-4987-94B9-654456CF0B9A profiles: verbose mode ON profiles: returned error: -204 fail

October 3rd, 2016

Posted In: Uncategorized

Tags: , , , , , ,

The Ring is a great little device. I love it when I see an alert on my Apple Watch, tap a button on my phone, and then see the UPS deliverer walking away from my front door. When you’re home though, it’s nice to have a door chime. The first thing you do when you’re setting up one of these is to join a wireless network called Chime-****something****. This is pretty common in the home automation world. Devices ship running as a WAP so you can wirelessly control and set them up. IMG_8431 Once the device joins the wireless network, open the Ring app and then verify that you’re joined to the right wireless network. If you need to leave the app and join the right network, do so. IMG_8432 Provided that you’re joined to the Chime network, the Chime will then scan for Wi-Fi networks. IMG_8433 Once the networks have been listed, choose the one yours will live on (or use the Add Hidden Network option if you have a suppressed SSID). IMG_8434 When prompted, provide a password for the network. IMG_8435 The chime then completes setup and should be audible when the button on the Ring is pressed. IMG_8436

July 6th, 2016

Posted In: Home Automation

Tags: , , , ,

The Apple Watch is just another wearable with a limited feature set. In much the same way that the iPhone is just another phone. But they’re not. They have apps. And the apps are what make these devices so powerful. Installing apps on an Apple Watch is pretty straight forward. But before we do, it’s worth mentioning that there are two types. the first is a glance. This is just another view for an app that is on your iPhone that the Apple Watch talks to. The second is an actual app. These have more functionality and more options. There are also built-in apps that can be shown or hidden. Apps are managed from the phone. To install either type of app, simply open the Apple Watch app on your phone. From there, you will see any apps that have either an app or a glance available on a device. IMG_3508 Tap on an entry and you’ll see whatever is available for that app. New apps aren’t displayed on your Apple Watch. Use the slider to control whether it is displayed or not. IMG_3509 Some apps have more options. If so, tap on the app and enable those options if needed. When you enable these apps, you’ll see the icon start loading on the watch, in much the same way that an icon starts to load on a phone when you purchase the app from the App Store. IMG_3510 Also, some apps, when you download an update to the app, will even prompt you to install a glance for the app on your phone. IMG_3511   The apps show up on right side of the default apps on the watch. IMG_3647 Here’s the Nike app. This app only works properly when you open the app on the phone. It sits at a loading screen and only opens when the app on the phone opens. When it shows up, you can then do whatever the app is built to do. In this case, start and stop runs. IMG_3648 That’s it. Straight forward. Just be patient. Takes awhile for Apple Watches to communicate with phones and to move data back and forth between them.

May 14th, 2015

Posted In: Apple Watch

Tags: , , , , ,

You waited. And you tapped your fingers on the desk. And you sat and waited some more, for the UPS person. You stared at your mailbox. And then, after all of that, UPS showed up. And you signed. And then you had that box in your hands. The cardboard box, when opened, gave way to a sweet white box. You opened it by pulling the little tag off, and then you pulled the watch out of the box. You tried on the two bands. And you picked the one that fit you the best. So now what? Turn on the watch by hitting the button on the side and watch that beautiful Apple logo light up the screen. But now you need to pair the watch with your phone for it to be useable. So what to do? Well, first of all, make sure your phone is updated to the latest and greatest version of iOS. From there, open the Apple Watch app on the iPhone. IMG_3471 The app will prompt you to start pairing a watch with the phone. You can only pair one watch with an iPhone. Tap the Start Pairing button. When prompted, line up the screen on the watch with the image and the outline. IMG_3472 Wait for the watch to complete pairing and then tap the Set Up Apple Watch button. IMG_3473 You’ll then be prompted for which wrist to put the watch on. I used my dominant wrist, so right. IMG_3474 You’ll then be prompted to accept the Terms and Conditions (aka license agreement) from Apple. Tap Agree. IMG_3475 Tap Agree again. IMG_3476 Next, when prompted for the Apple ID to use, if you’d like to use an Apple ID with the watch, provide the password for that Apple ID using the Enter Password button, or use the Skip This Step option to skip the Apple ID. IMG_3477 At the Location Services screen, tap OK. This is really just informational to let you know that Location Services will be used. It’s kinda’ necessary to use the watch properly. IMG_3478 At the Siri screen, again, you’re informed that Siri will be used. Tap OK. IMG_3479 At the Diagnostics screen, same thing. You’re informed that diagnostics will be supplied to Apple. Tap OK. IMG_3480 At the Apple Watch Passcode screen, choose whether you’d like to use a passcode on the watch. I’m not a fan of using a passcode on the watch; however, you will have to use one if you want to use Apple Pay on the watch. Tap Create a Passcode to set one up now and then provide the passcode you’d like to use. IMG_3481 The Apple Watch will sync apps and show glances from apps that are on the phone. Tap Install All to go ahead and install any Apple Watch apps on the device. You can always turn them off later. Or you can tap Choose Later to go ahead and complete setup and wait until later to set up the watch and finish apps setup later. I’d recommend using Install All and then turn off the ones you don’t want later. IMG_3482 Then the watch will start syncing with your devices. At the Apple Watch Is Syncing screen, wait. Don’t do anything else or get the watch too far from the phone or you’ll have to start over from scratch. IMG_3483 The watch looks like this while it’s syncing. IMG_3484 Once the watch is finished syncing, use the My Watch app to sync apps, show glances, setup Apple Pay and configure which built-in apps are shown on the device. IMG_3508 The next and most important aspect of your new Apple Watch is to use it and love it. Go for a run, sync some apps, enjoy the hell out of your new watch. It’s great. Now, get to it!

May 9th, 2015

Posted In: Apple Watch

Tags: , , , , , , , , , , , , , ,

(Allister Banks Guest Post:) As part of my presentations at LOPSA-East(the pdf slides of this one is here) earlier this year, I wanted to demonstrate how quickly you can get a proof-of-concept of Munki running on a recent Mac OS without Server. I had always used Greg Neagle’s awesome intro articles for MacTech(especially part 2,) which were  created back in 10.6 days(simpler times, amirite?) This video takes you through the setup of a Munki repo, and goes on to demonstrate not only basic Munki interaction and functionality, but if you setup MunkiWebAdmin and the reporting scripts on your clients in addition, it does a quick tour of that interface. Setting Up a Munki Repository on 10.7+, Quick MunkiWebAdmin Demo from Allister Banks on Vimeo. Pardon the length, lack of sound and meme’s sprinkled throughout, but I hope it’s of use to someone!

November 4th, 2013

Posted In: Mac OS X

Tags: , , , , , , , , , ,

With the DHCP service no longer in the Server apps provided by Apple (for the most part), it’s important to look at alternative solutions to host the service. The DHCP Service in Windows Server is a Role that a Windows Server can fill that dynamically assigns IP addresses to client computers requesting addresses. The DHCP Role is easily added using the Server Manager application, available in the Administrative Tools menu of the Start Menu. Once opened, click on the Add Roles button. At the Select Server Roles screen, locate DHCP Server and then check the box for it, which will allow you to click on the Next button. At the DHCP Server screen, click on Next. At the Select Network Connection Bindings screen, check the box for each network interface that will be available to DHCP to host DHCP scopes (a scope being a range of addresses that the server will host. Click on Next. At the Specify IPv4 DNS Server Settings screen, enter the name of the search domain to be assigned in the “Parent domain” field. Then provide the ip address for the first DNS server that is provided to clients in the “Preferred DNS server IPv4 address” field. Click on Next once the appropriate DNS information has been provided. If you are using “WINS servers click on WINS is required for applications on this network” and then click on the Next button. At the “Add or Edit DHCP Scopes” screen, click on the Add… button to provide the first DHCP scope for the environment. At the Add Scope screen, enter the following information:
  • Scope name: A friendly name for the DHCP scope (e.g. Marketing Subnet)
  • Starting IP address: The first IP address in the scope of addresses provided
  • Ending IP address: The last IP address in the scope of addresses provided (note that you cannot overlap pools and that
  • Subnet type: Select a type of scope being created (note that this changes the lease times)
  • Activate this scope: Check this box to make the scope available immediately
  • Subnet mask: The subnet mask used by clients of the scope
  • Default gateway: The router for the scope being created
Once you’re satisfied with your settings, click OK. Next, select whether DHCP will be provided for IPv6 and click on Next. If IPv6 is supported, enter the address of an IPv6 based DNS service. Click Next. Next, integrate DHCP with Active Directory (to disable, use the “Skip authorization of this DHCP server in AD DS”) by either allowing the service to use the credentials of the currently logged in user or using the Specify button to provide a different user account. Click Next. At the Summary screen, verify the settings are as intended and then click on Next.The role is then installed and if you selected to do so the service is started as well. There are a lot of steps here, but if you’re new to Windows Server, don’t let that intimidate you. It’s a wizard and normally takes me a little less than 5 minutes, about what we grew to expect from OS X Server.

September 11th, 2012

Posted In: Windows Server

Tags: , , , , , , , ,

OS X Server has long had a VPN service that can be run. The server is capable of running the two most commonly used VPN protocols: PPTP and L2TP. The L2TP protocol is always in use, but the server can run both concurrently. You should use L2TP when at all possible. Sure, “All the great themes have been used up and turned into theme parks.” But security is a theme that it never hurts to keep in the forefront of your mind. If you were thinking of exposing the other services in Mountain Lion Server to the Internet without having users connect to a VPN service then you should think again, because the VPN service is simple to setup and even simpler to manage. Setting Up The VPN Service In Mountain Lion To setup the VPN service, open the Server app and click on VPN in the Server app sidebar. The VPN Settings  screen has two options available in the “Configure VPN for” field, which has two options:
  • L2TP: Enables only the L2TP protocol
  • L2TP and PPTP: Enables both the L2TP protocol and the PPTP protocol
The VPN Host Name field is used by administrators leveraging profiles. The setting used becomes the address for the VPN service in the Everyone profile. L2TP requires a shared secret or an SSL certificate. In this example, we’ll configure a shared secret by providing a password in the Shared Secret field. Additionally, there are three fields, each with an Edit button that allows for configuration:
  • Client Addresses: The dynamic pool of addresses provided when clients connect to the VPN 
  • DNS Settings: The name servers used once a VPN client has connected to the server. As well as the Search Domains configuration.
  • Routes: Select which interface (VPN or default interface of the client system) that a client connects to each IP address and subnet mask over.
  • Save Configuration Profile: Use this button to export configuration profiles to a file, which can then be distributed to client systems (OS X using the profiles command, iOS using Apple Configurator or both using Profile Manager).
Once configured, open incoming ports on the router/firewall. PPTP runs over port 1723. L2TP is a bit more complicated (with keys bigger than a baby’s arm), running over 1701, but also the IP-ESP protocol (IP Protocol 50). Both are configured automatically when using Apple AirPorts as gateway devices. Officially, the ports to forward are listed at Using The Command Line I know, I’ve described ways to manage these services from the command line before. But, “tonight we have number twelve of one hundred things to do with your body when you’re all alone.” The serveradmin command can be used to manage the service as well as the Server app. The serveradmin command can start the service, using the default settings, with no further configuration being required: sudo serveradmin start vpn And to stop the service: sudo serveradmin stop vpn And to list the available options: sudo serveradmin settings vpn To disable L2TP, set to no: sudo serveradmin settings = no To configure how long a client can be idle prior to being disconnected: sudo serveradmin settings = 10 By default, each protocol has a maximum of 128 sessions, configureable using sudo serveradmin settings = 200 To see the state of the service, the pid, the time the service was configured, the path to the log files, the number of clients and other information, use the fullstatus option: sudo serveradmin fullstatus vpn Which returns output similar to the following: vpn:servicePortsAreRestricted = "NO" vpn:readWriteSettingsVersion = 1 = "MSCHAP2" = 0 = yes = "MPPEKeySize128" = "2012-07-31 02:05:38 +0000" = "PPP" = "PPTP" = "DSAuth" = 97849 = "MSCHAP2" = 0 = yes = "2012-07-31 02:05:39 +0000" = "PPP" = "L2TP" = "DSAuth" = 97852 vpn:servicePortsRestrictionInfo = _empty_array vpn:health = _empty_dictionary vpn:logPaths:vpnLog = "/var/log/ppp/vpnd.log" vpn:configured = yes vpn:state = "RUNNING" vpn:setStateVersion = 1 Security folk will be stoked to see that the shared secret is shown in the clear using: = "a dirty thought in a nice clean mind" Configuring Users For VPN Access Each account that accesses the VPN server needs a valid account to do so. To configure existing users to use the service, click on Users in the Server app sidebar. At the list of users, click on a user and then click on the cog wheel icon, selecting Edit Access to Services. At the Service Access screen will be a list of services that could be hosted on the server; verify the checkbox for VPN is highlighted for the user. Setting Up Client Computers As you can see, configuring the VPN service in Mountain Lion Server is a simple and straight-forward process – much easier than eating your cereal with a fork and doing your homework in the dark.. Configuring clients is as simple as importing the profile generated by the service. However, you can also configure clients manually. To do so in OS X, open the Network System Preference pane. From here, click on the plus sign (“+”) to add a new network service. At the prompt, select VPN in the Interface field and then either PPTP or L2TP over IPSec in the VPN Type. Then provide a name for the connection in the Service Name field and click on Create. At the list of network interfaces in the Network System Preference pane, provide the hostname or address of the server in the Server Address field and the username that will be connecting to the VPN service in the Account Name field. If using L2TP, click on Authentication Settings. At the prompt, provide the password entered into the Shared Secret field earlier in this article in the Machine Authentication Shared Secret field and the user’s password in the User Authentication Password field. When you’re done, click OK and then provided you’re outside the network and routeable to the server, click on Connect to test the connection. Conclusion Setting Up the VPN service in OS X Mountain Lion Server is as simple as clicking the ON button. But much more information about using a VPN can be required. The natd binary is still built into Mountain Lion at /usr/sbin/natd and can be managed in a number of ways. But it’s likely that the days of using an OS X Server as a gateway device are over, if they ever started. Sure “feeling screwed up at a screwed up time in a screwed up place does not necessarily make you screwed up” but using an OS X Server for NAT when it isn’t even supported any more probably does. So rather than try to use the server as both, use a 3rd party firewall like most everyone else and then use the server as a VPN appliance. Hopefully it can do much more than just that to help justify the cost. And if you’re using an Apple AirPort as a router (hopefully in a very small environment) then the whole process of setting this thing up should be super-simple.

July 31st, 2012

Posted In: Mac OS X, Mac OS X Server, Mac Security, Mass Deployment, Network Infrastructure

Tags: , , , , , , , , , , , , , ,

Gatekeeper is the new feature of OS X that controls what types of apps can be opened. To configure Gatekeeper, open the Security & Privacy System Preference pane. Click on the General tab and unlock to make changes. Here, you’ll see “Allow applications downloaded from:” along with the following 3 options:
  • Mac App Store: Only apps downloaded from the App Store can be opened.
  • “Mac App Store and identified developers”: Only apps downloaded from the App Store and those signed can be opened.
  • Anywhere: Any app can be opened.

Configuring Gatekeeper in Mountain Lion

Configuring Gatekeeper is as easy as selecting one of these options. Now, under the hood, the state of Gatekeeper is kept in /var/db/SystemPolicy-prefs.plist. There’s only one option there, though: enabled. So you could try and run defaults to disable Gatekeeper: defaults write /var/db/SystemPolicy-prefs enabled no. However, doing so is not really going to provide all the options available in the GUI. To configure the options, Apple has provided spctl, a command line tool used to manage Gatekeeper. In it’s simplest form, Gatekeeper can be enabled using the –master-enable and –master-disable options, which are pretty straight forward. Use –master-enable to enable Gatekeeper: spctl --master-enable And then use –master-disable to disable Gatekeeper: spctl --master-disable Whether Gatekeeper (assessments) is enabled or disabled can be returned using the –status option: spctl --status The -a option is used to assess an application to see if it will open or not: spctl -a /Applications/ If an application passes and has a rule available then you’ll get no response. If there’s no rule for the application, you’ll get a response that: /Applications/ unknown error 99999=1869f You add rules about apps using the –add option. Each app gets a label, defined with the –label option. For example, to add GitHub: spctl --add --label "GitHub" /Applications/ To then enable access to GitHub: spctl --enable --label "GitHub" Or disable: spctl --disable --label "GitHub" As with most things, there’s actually a rub. spctl doesn’t always work. I’ve had more than a few issues with getting the labels to apply just right. Sometimes the -a will report back that an app is rejected and it will still open. I think this is first gen technology and that prior to relying on it that it would be a really good idea to test very thoroughly before deploying.

July 25th, 2012

Posted In: Mac OS X, Mac Security, Mass Deployment

Tags: , , , , , , , , , ,

Google recently decided that it was time to force some other company to buy cloudy dispositioned upstarts, Dropbox and Google also decided that Office365 represented Microsoft being a little too brazen in their attempts to counteract the inroads that Google has made into Microsoft territory. Therefor, Google thumped their chest and gave away 5GB of storage in Google Drive. Google then released a tool that synchronizes data stored on a Google Drive to Macs and Windows systems. Installing Google Drive is pretty easy. Just browse to Google Docs and Google will tell you that there’s this weird new Google Drive thing you should check out. Here, click on Download Google Drive for Mac (or Windows if you use Windows). Then agree to give your first born to Google (but don’t worry, they’d never collect on that debt ’cause they’re sworn to do no evil). Once downloaded, run the installer. You can link directly to your documents now using The only real question the installer asks is whether you’d like to automatically sync your Google Drive to the computer. I said yes, but if you’ve got a smallish drive you might decide not to. Once the Google Drive application has been downloaded and installed, open it (by default it’s set to open at startup). You’ll then see a icon in the menu bar that looks a little like a recycling symbol. Here, click on Open Google Drive folder. The folder with your Google Docs then shows up on your desktop. Copy an item in there and it syncs up to Google. It can then easily be shared through the Google Apps web portal and accessed from other systems. While there are still a number of features that and Dropbox will give you due to the fact that they’re a bit more mature, I’d expect Google Drive to catch up fast. And given that I already have tons of documents in Google Docs, it is nice to have them saved down to my local system. I’m now faced with an interesting new challenge: where to draw the line in my workflow between Google Drive, Dropbox and Not a bad problem to have, really! Given the frustrations of having things strewn all over the place I’ll want to minimize some of the haphazardness I’ve practiced with regards to why I put things in different places in the past. In some cases I need to be able to email to folders, have expiring links or to have extended attributes sync between services, so there are some aspects that are likely to be case-by-case… Overall though, I’m very happy with the version 1 release of Google Drive. I mean, who complains about free stuff!?!?!

May 11th, 2012

Posted In: cloud, Mac OS X

Tags: , , , , , , , ,

Next Page »