TweetFollow Us on Twitter

MacEnterprise: Snow Leopard Scavenger Hunt

Volume Number: 25
Issue Number: 11
Column Tag: MacEnterprise

MacEnterprise: Snow Leopard Scavenger Hunt

Changes in OS 10.6 of interest to systems administrators

By Greg Neagle, MacEnterprise.org

Introduction

With each new release of OS X, systems administrators have a bit of a scavenger hunt: hunting for what's new, what's changed, what's fixed, what's broken, what's moved, and what's gone. I have to admit that I find the hunt kind of fun - Apple's given us a new toy, and we get to find all the surprises inside. So instead of a column on a single topic or tool, this month we will be hunting through the new OS, looking for what's new and of interest to enterprise systems administrators!

Launchd

In a recent MacEnterprise column on launchd, I covered some of the changes to launchd in Snow Leopard. The most important change of interest to systems administrators is the change in how launchd handles the Disabled key in launchd plists.

In Tiger and Leopard, if you disabled a launchd job using launchctl like this:

launchctl unload -w /path/to/launchd.plist

The job would be unloaded, and the Disabled key in the launchd plist would be set to true. In Snow Leopard, the job is still marked as disabled, but the plist is not changed. The value of the Disabled key is stored elsewhere. The launchctl man page doesn't say where it is stored, but some hunting finds it in /private/var/db/launchd.db/.

Inside this directory, there are subdirectories like these:

com.apple.launchd/
com.apple.launchd.peruser.0/
com.apple.launchd.peruser.100/
com.apple.launchd.peruser.501/

The com.apple.launchd directory holds info for LaunchDaemons, and the com.apple.launchd.peruser.* directories hold info for LaunchAgents. Each of these directories contains an overrides.plist file. This file contains the current "effective" value of the Disabled key for each launchd job:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>com.apple.backupd-attach</key>
   <dict>
      <key>Disabled</key>
      <true/>
   </dict>
   <key>com.apple.backupd-auto</key>
   <dict>
      <key>Disabled</key>
      <true/>
   </dict>
[...etc...]
</plist>

To determine the current enabled/disabled state of a given launchd job, an admin must check the value of the Disabled key in the launchd job's plist, and then also check for an override in /private/var/db/launchd.db/.

An effect of this change is it now possible for non-admins to disable LaunchAgents that run when they login, by running

launchctl unload -w /Library/LaunchAgents/some_launchd.plist

This might be a problem if you rely on LaunchAgents to run at login and perform certain tasks for the user - the user can now turn these off.

Networksetup

OS X systems administrators should be familiar with the networksetup command, which allows you to configure network-related settings from the command line. This tool is ideal for use in setup scripts, or for remote configuration via SSH. In Snow Leopard, networksetup gains a few new tricks.

AirPort options

The AirPort options in networksetup have changed. If you have AirPort configuration scripts, you may need to revise them for Snow Leopard. The -getairportnetwork, -setairportnetwork, -getairportpower, and -setairportpower options all now require a hardware port to be specified. An example:

Prior to Snow Leopard:

networksetup -setairportpower  off

Snow Leopard:

networksetup -setairportpower "AirPort" off

Does this change portend Macs with multiple AirPort interfaces? Your guess is as good as mine.

There are four new options dealing with preferred wireless networks, which could be useful in a setup script that automatically added your organization's wireless network(s) to the preferred list:

   -listpreferredwirelessnetworks hardwareport
   -addpreferredwirelessnetworkatindex hardwareport network...
   -removepreferredwirelessnetwork hardwareport network
   -removeallpreferredwirelessnetworks hardwareport

Locations

networksetup can now work with network locations. This would allow you to script the creation and setup of Home and Work locations, for example.

   -listlocations
   -getcurrentlocation
   -createlocation location [populate]
   -deletelocation location
   -switchtolocation location

802.1X

networksetup has gained the ability to work with 802.1X-secured networks. You can set the System profile, the login profile, or user profiles:

   -listalluserprofiles
   -listloginprofiles service
   -enablesystemprofile service on | off
   -enableloginprofile service profile on | off
   -enableuserprofile profile on | off
   -import8021xProfiles service path
   -export8021xProfiles service path yes | no
   -export8021xUserProfiles path yes | no
   -export8021xLoginProfiles service path yes | no
   -export8021xSystemProfile service path yes | no
   -settlsidentityonsystemprofile service path passphrase
   -settlsidentityonuserprofile profile path passphrase

These new options don't help with the actual creation of 802.1X profiles, but with the import and export options, you should be able to create them on one machine and deploy them on others.

Lights-Out Management

Finally, networksetup gains options for configuring the Lights-Out Management interface on Intel Xserves:

   -resetBMCToDefaults
   -showBMCSettings
   -setupBMC portindex static | dhcp ipaddress subnetmask 
         routeraddress adminname adminpassword

For more details on all of the new networksetup options, type "man networksetup" at a command prompt.

Cisco VPN Support

Since we're talking about network configurations, this is a good time to note that Snow Leopard now has Cisco VPN support, accessible from the Network preferences pane. When adding a VPN interface, "Cisco IPSec" now appears as an available VPN Type.

With Cisco's client, an administrator could distribute the client software and some pre-configured profiles. Administrative configuration looks to be more difficult with Apple's built-in client. networksetup did not gain any new capabilities as far as VPN configuration, so that's no help. You can export and import configurations, and since they are XML files, you might be able to generate configurations programmatically.


Figure 1 - Cisco VPN support

Mcxrefresh

mcxrefresh is a new command-line tool to cause a client machine to re-read its MCX settings from the directory services. It must be run as root. You can specify a user id or shortname to refresh the Managed Preferences for a specific user as well as the computer settings. This might be useful when testing changes to MCX settings - you can instantly force a machine to refresh its Managed Preferences.

   mcxrefresh -n joeuser

Directory Utility

You've booted up your first Snow Leopard machine and you want to point it at your Open Directory or third-party LDAP server for directory services. In Leopard, you'd head to the /Applications/Utilities folder and look for Directory Utility. But on your Snow Leopard machine, it seems to be missing. Instead, you can open the Accounts pane in System Preferences as in Figure 2.


Figure 2 - Accounts Preference Pane

When you select Login Options, you'll see a new section for a "Network Account Server." Click Edit, and you'll see the sheet in Figure 3.


Figure 3 - Directory Services pane

From this pane, you can add directory servers, or open Directory Utility for more options. Or you can just skip all this, and go directly to the new location of Directory Utility: /System/Library/CoreServices/Directory Utility.app.

Keychain password Enhancements

A common problem in enterprise environments is keeping the login keychain password in sync with the directory services password. Many environments use a web page to allow their users to change passwords. In other environments, users may have access to multiple machines (say a Mac and a Linux box), sharing a common directory service. If they change their password on their Linux box, or use a web page to change their password, the login keychain on the Mac is not updated with the new password. When the user then logs into their Mac, the login keychain is not unlocked, and access to mail accounts, web pages, file servers and the like might be affected. Prior to Snow Leopard, many administrators used AFP548.com's Keychain Minder to handle this situation. When configured to run as a login item, Keychain Minder would check to see if the login keychain was unlocked at login, and offer to help the user reset the login keychain password if needed.

Snow Leopard builds in most of Keychain Minder's functionality. If the user password is changed, and the login keychain can't be unlocked at login, you'll see a dialog like the one in Figure 4.


Figure 4 - Update Keychain Password dialog

You can then update your keychain password, create a new keychain, or ignore the issue.

Screen Saver

Since the release of OS X 10.0, large organizations have wanted the ability to run a screen saver when the machine is at the login window. Apple's opinion always seemed to be that you should have your machines (or at least the displays) sleep when idle at the loginwindow for a long time. High schools, colleges, and other organizations instructional labs often wanted the machines to stay on with active displays so students could quickly identify available machines. When presented with a machine that was asleep, or with a darkened display, many students assumed the machine was broken. In my organization, we had a number of Macs connected to color-calibrated CRT monitors. These monitors needed to be left powered up and with an active display in order to maintain their calibration.

Whatever the reason, when an organization wanted/needed the display to remain active when the machine was at the loginwindow, they had a new challenge to deal with: screen burn-in. A machine left for hours or days at the loginwindow could burn the image of the loginwindow into the phosphors. (And although LCDs are supposedly immune to the effects of burn-in, I've seen evidence to the contrary.) So it's understandable to want the screen saver to run over the loginwindow to prevent burn-in. Some organizations also saw this as an opportunity to run a screensaver that presented news or announcements about the organization.

Unfortunately, Apple did not support running the screen saver at the login window. Various workarounds were developed. An application called Screen Preserver could be used to display slideshows over the loginwindow. In 10.3 and 10.4, enterprising administrators developed scripts that allowed Apple's screen saver to run over the login window. But Leopard brought that practice to an end, as the built-in screen saver no longer would run over the loginwindow.

So it was with some surprise when testing Snow Leopard this summer that I noticed the screen saver kick in while I was logged out. This new behavior persisted into the final release. There's no user interface to control which screen saver runs, or how long to wait until activation. I haven't yet figured out any other way to control these options, but I'm sure someone will before long. Still, this is a welcome change, and only took eight years for Apple to implement!

Exchange integration

We can't finish our scavenger hunt without mentioning a new feature of great interest to many enterprise systems administrators (and regular users!) - support for Microsoft Exchange. If your organization is running Exchange Server 2007 (and alas, my organization isn't yet...), you can configure Mail, iCal, and Address Book to talk to your organization's Exchange server. While this doesn't give you the full range of functionality you can get from Entourage 2008 Web Services Edition (let alone Outlook on Windows), it may be sufficient for some user's needs.

The Exchange integration in Snow Leopard is based on Exchange Web Services, a new protocol first available in Exchange Server 2007 SP1. Older Exchange servers support only MAPI (a protocol extremely difficult to replicate outside of Windows - even Entourage, a Microsoft product, doesn't use it), or the limited OWA (Outlook Web Access) protocol, which is on its way out. For this reason, the Exchange integration in Snow Leopard doesn't work with older Exchange servers.

Since this is a new feature, and Exchange support is notoriously difficult to implement (otherwise, why would Entourage still have issues?), it may work well in your environment, or not at all. Early reactions on the MacEnterprise mailing list are mixed: some organizations are reporting great success; others are having difficulties. If your organization is running Exchange 2007, try it yourself and see.

Figure 5 shows the dialog in Mail.app for adding an Exchange 2007 account. Note the options to also setup Address Book and iCal. If you don't configure them here, each of these applications also has an interface for configuring Exchange 2007 accounts.


Figure 5 - Mail setup for Exchange 2007

Conclusion

That concludes our scavenger hunt. If there's a theme to the changes in Snow Leopard, it's "refinement". Lots of little things have been subtly refined, providing a better user experience, or making things work the way they should have earlier. We have by no means covered all the changes in OS X 10.6 - there are many more. Have fun on your hunt!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

DaisyDisk 4.8 - $9.99
DaisyDisk allows you to visualize your disk usage and free up disk space by quickly finding and deleting big unused files. The program scans your disk and displays its content as a sector diagram... Read more
VMware Fusion 11.5.0 - Run Windows apps...
VMware Fusion and Fusion Pro - virtualization software for running Windows, Linux, and other systems on a Mac without rebooting. The latest version includes full support for Windows 10, macOS Mojave... Read more
Apple Configurator 2.10 - Configure and...
Apple Configurator makes it easy to deploy iPad, iPhone, iPod touch, and Apple TV devices in your school or business. Use Apple Configurator to quickly configure large numbers of devices connected to... Read more
Spotify 1.1.15.448. - Stream music, crea...
Spotify is a streaming music service that gives you on-demand access to millions of songs. Whether you like driving rock, silky R&B, or grandiose classical music, Spotify's massive catalogue puts... Read more
MenuMeters 1.9.8 - CPU, memory, disk, an...
MenuMeters is a set of CPU, memory, disk, and network monitoring tools for Mac OS X. Although there are numerous other programs which do the same thing, none had quite the feature set I was looking... Read more
Blocks 3.5.2 - RapidWeaver plug-in; divi...
Blocks is a plugin for RapidWeaver. It allows you to place blocks of text, graphics, and even raw HTML onto your page wherever you like. Drag blocks around, resize them, and even overlap content. All... Read more
Live Home 3D Pro 3.7 - $49.99
Live Home 3D Pro is powerful yet intuitive home design software that lets you build the house of your dreams right on your Mac, iPhone or iPad. It has every feature of Live Home 3D, plus some... Read more
Ableton Live 10.1.1 - Record music using...
Ableton Live lets you create and record music on your Mac. Use digital instruments, pre-recorded sounds, and sampled loops to arrange, produce, and perform your music like never before. Ableton Live... Read more
BetterTouchTool 3.202 - Customize multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom)... Read more
Fission 2.4.6 - Streamlined audio editor...
Fission can crop and trim audio, paste in or join files, or just rapidly split one long file into many. It's streamlined for fast editing. Plus, it works without the quality loss caused by other... Read more

Latest Forum Discussions

See All

Marvel Strike Force is adding Agent Coul...
Marvel Strike Force, the popular squad-based RPG, is set to receive a bunch of new content over the next few weeks. [Read more] | Read more »
Lots of premium games are going free (so...
You may have seen over the past couple weeks a that a bunch of premium games have suddenly become free. This isn’t a mistake, nor is it some last hurrah before Apple Arcade hits, and it’s important to know that these games aren’t actually becoming... | Read more »
Yoozoo Games launches Saint Seiya Awaken...
If you’re into your anime, you’ve probably seen or heard of Saint Seiya. Based on a shonen manga by Masami Kurumada, the series was massively popular in the 1980s – especially in its native Japan. Since then, it’s grown into a franchise of all... | Read more »
Five Nights at Freddy's AR: Special...
Five Nights at Freddy's AR: Special Delivery is a terrifying new nightmare from developer Illumix. Last week, FNAF fans were sent into a frenzy by a short teaser for what we now know to be Special Delivery. Those in the comments were quick to... | Read more »
Rush Rally 3's new live events are...
Last week, Rush Rally 3 got updated with live events, and it’s one of the best things to happen to racing games on mobile. Prior to this update, the game already had multiplayer, but live events are more convenient in the sense that it’s somewhat... | Read more »
Why your free-to-play racer sucks
It’s been this way for a while now, but playing Hot Wheels Infinite Loop really highlights a big issue with free-to-play mobile racing games: They suck. It doesn’t matter if you’re trying going for realism, cart racing, or arcade nonsense, they’re... | Read more »
Steam Link Spotlight - The Banner Saga 3
Steam Link Spotlight is a new feature where we take a look at PC games that play exceptionally well using the Steam Link app. Our last entry talked about Terry Cavanaugh’s incredible Dicey Dungeons. Read about how it’s a great mobile experience... | Read more »
Combo Quest (Games)
Combo Quest 1.0 Device: iOS Universal Category: Games Price: $.99, Version: 1.0 (iTunes) Description: Combo Quest is an epic, time tap role-playing adventure. In this unique masterpiece, you are a knight on a heroic quest to retrieve... | Read more »
Hero Emblems (Games)
Hero Emblems 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: ** 25% OFF for a limited time to celebrate the release ** ** Note for iPhone 6 user: If it doesn't run fullscreen on your device... | Read more »
Puzzle Blitz (Games)
Puzzle Blitz 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: Puzzle Blitz is a frantic puzzle solving race against the clock! Solve as many puzzles as you can, before time runs out! You have... | Read more »

Price Scanner via MacPrices.net

Get one of Apple’s new 2019 iPhone 11 models...
Boost Mobile is offering the new 2019 Apple iPhone 11, iPhone 11 Pro, and 11 Pro Max for $100 off MSRP. Their discount reduces the cost of an iPhone 11 to $599 for the 64GB models, $899 for the 64GB... Read more
13″ 1.4GHz Silver MacBook Pros on sale for $1...
B&H Photo has new 2019 13″ 1.4GHz 4-Core Touch Bar Silver MacBook Pros on sale for $100 off Apple’s MSRP. Overnight shipping is free to many addresses in the US. These are the same MacBook Pros... Read more
4-core and 6-core 2018 Mac minis available at...
Apple has Certified Refurbished 2018 Mac minis available on their online store for $120-$170 off the cost of new models. Each mini comes with a new outer case plus a standard Apple one-year warranty... Read more
$250 prepaid Visa card with any Apple iPhone,...
Xfinity Mobile will include a free $250 prepaid Visa card with the purchase of any new iPhone, new line activation, and transfer of phone number to Xfinity Mobile. Offer is valid through October 27,... Read more
Sprint is offering the 64GB Apple iPhone 11 P...
Sprint has the new 64GB iPhone 11 Pro available for $12.50 per month for new customers with an eligible trade-in in of iPhone 7 or newer. That’s down from their standard monthly lease of $41.67. The... Read more
Final week: Apple’s 2019 Back to School Promo...
Purchase a new Mac using Apple’s Education discount, and take up to $400 off MSRP. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount... Read more
Save $30 on Apple’s AirPods at these reseller...
Amazon is offering discounts on new 2019 Apple AirPods ranging up to $30 off MSRP as part of their Labor Day sale. Shipping is free: – AirPods with Charging Case: $144.95 $15 off MSRP – AirPods with... Read more
Preorder your Apple Watch Series 5 today at A...
Amazon has Apple Watch Series 5 GPS models available for preorder and on sale today for $15 off Apple’s MSRP. Shipping is free and starts on September 20th: – 40mm Apple Watch Series 5 GPS: $384.99 $... Read more
21″ iMacs on sale for $100 off Apple’s MSRP,...
B&H Photo has new 21″ Apple iMacs on sale for $100 off MSRP with models available starting at $999. These are the same iMacs offered by Apple in their retail and online stores. Overnight shipping... Read more
2018 4 and 6-Core Mac minis on sale today for...
Apple resellers are offering new 2018 4-Core and 6-Core Mac minis for $100-$150 off MSRP for a limited time. B&H Photo has the new 2018 4-Core and 6-Core Mac minis on sale for up to $150 off... Read more

Jobs Board

*Apple* Mobile Master - Best Buy (United Sta...
**732324BR** **Job Title:** Apple Mobile Master **Job Category:** Store Associates **Location Number:** 000013-Fargo-Store **Job Description:** **What does a Best Read more
*Apple* Mobility Pro - Best Buy (United Stat...
**723452BR** **Job Title:** Apple Mobility Pro **Job Category:** Store Associates **Location Number:** 001194-Greeley-Store **Job Description:** At Best Buy, our Read more
Best Buy *Apple* Computing Master - Best Bu...
**731319BR** **Job Title:** Best Buy Apple Computing Master **Job Category:** Store Associates **Location Number:** 000303-Arlington Heights-Store **Job Read more
Best Buy *Apple* Computing Master - Best Bu...
**733266BR** **Job Title:** Best Buy Apple Computing Master **Job Category:** Sales **Location Number:** 000144-Union City-Store **Job Description:** **What does a Read more
Geek Squad *Apple* Master Consultation Agen...
**732907BR** **Job Title:** Geek Squad Apple Master Consultation Agent **Job Category:** Services/Installation/Repair **Location Number:** 000360-Williston-Store Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.