TweetFollow Us on Twitter

MacEnterprise: Snow Leopard Scavenger Hunt

Volume Number: 25
Issue Number: 11
Column Tag: MacEnterprise

MacEnterprise: Snow Leopard Scavenger Hunt

Changes in OS 10.6 of interest to systems administrators

By Greg Neagle, MacEnterprise.org

Introduction

With each new release of OS X, systems administrators have a bit of a scavenger hunt: hunting for what's new, what's changed, what's fixed, what's broken, what's moved, and what's gone. I have to admit that I find the hunt kind of fun - Apple's given us a new toy, and we get to find all the surprises inside. So instead of a column on a single topic or tool, this month we will be hunting through the new OS, looking for what's new and of interest to enterprise systems administrators!

Launchd

In a recent MacEnterprise column on launchd, I covered some of the changes to launchd in Snow Leopard. The most important change of interest to systems administrators is the change in how launchd handles the Disabled key in launchd plists.

In Tiger and Leopard, if you disabled a launchd job using launchctl like this:

launchctl unload -w /path/to/launchd.plist

The job would be unloaded, and the Disabled key in the launchd plist would be set to true. In Snow Leopard, the job is still marked as disabled, but the plist is not changed. The value of the Disabled key is stored elsewhere. The launchctl man page doesn't say where it is stored, but some hunting finds it in /private/var/db/launchd.db/.

Inside this directory, there are subdirectories like these:

com.apple.launchd/
com.apple.launchd.peruser.0/
com.apple.launchd.peruser.100/
com.apple.launchd.peruser.501/

The com.apple.launchd directory holds info for LaunchDaemons, and the com.apple.launchd.peruser.* directories hold info for LaunchAgents. Each of these directories contains an overrides.plist file. This file contains the current "effective" value of the Disabled key for each launchd job:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>com.apple.backupd-attach</key>
   <dict>
      <key>Disabled</key>
      <true/>
   </dict>
   <key>com.apple.backupd-auto</key>
   <dict>
      <key>Disabled</key>
      <true/>
   </dict>
[...etc...]
</plist>

To determine the current enabled/disabled state of a given launchd job, an admin must check the value of the Disabled key in the launchd job's plist, and then also check for an override in /private/var/db/launchd.db/.

An effect of this change is it now possible for non-admins to disable LaunchAgents that run when they login, by running

launchctl unload -w /Library/LaunchAgents/some_launchd.plist

This might be a problem if you rely on LaunchAgents to run at login and perform certain tasks for the user - the user can now turn these off.

Networksetup

OS X systems administrators should be familiar with the networksetup command, which allows you to configure network-related settings from the command line. This tool is ideal for use in setup scripts, or for remote configuration via SSH. In Snow Leopard, networksetup gains a few new tricks.

AirPort options

The AirPort options in networksetup have changed. If you have AirPort configuration scripts, you may need to revise them for Snow Leopard. The -getairportnetwork, -setairportnetwork, -getairportpower, and -setairportpower options all now require a hardware port to be specified. An example:

Prior to Snow Leopard:

networksetup -setairportpower  off

Snow Leopard:

networksetup -setairportpower "AirPort" off

Does this change portend Macs with multiple AirPort interfaces? Your guess is as good as mine.

There are four new options dealing with preferred wireless networks, which could be useful in a setup script that automatically added your organization's wireless network(s) to the preferred list:

   -listpreferredwirelessnetworks hardwareport
   -addpreferredwirelessnetworkatindex hardwareport network...
   -removepreferredwirelessnetwork hardwareport network
   -removeallpreferredwirelessnetworks hardwareport

Locations

networksetup can now work with network locations. This would allow you to script the creation and setup of Home and Work locations, for example.

   -listlocations
   -getcurrentlocation
   -createlocation location [populate]
   -deletelocation location
   -switchtolocation location

802.1X

networksetup has gained the ability to work with 802.1X-secured networks. You can set the System profile, the login profile, or user profiles:

   -listalluserprofiles
   -listloginprofiles service
   -enablesystemprofile service on | off
   -enableloginprofile service profile on | off
   -enableuserprofile profile on | off
   -import8021xProfiles service path
   -export8021xProfiles service path yes | no
   -export8021xUserProfiles path yes | no
   -export8021xLoginProfiles service path yes | no
   -export8021xSystemProfile service path yes | no
   -settlsidentityonsystemprofile service path passphrase
   -settlsidentityonuserprofile profile path passphrase

These new options don't help with the actual creation of 802.1X profiles, but with the import and export options, you should be able to create them on one machine and deploy them on others.

Lights-Out Management

Finally, networksetup gains options for configuring the Lights-Out Management interface on Intel Xserves:

   -resetBMCToDefaults
   -showBMCSettings
   -setupBMC portindex static | dhcp ipaddress subnetmask 
         routeraddress adminname adminpassword

For more details on all of the new networksetup options, type "man networksetup" at a command prompt.

Cisco VPN Support

Since we're talking about network configurations, this is a good time to note that Snow Leopard now has Cisco VPN support, accessible from the Network preferences pane. When adding a VPN interface, "Cisco IPSec" now appears as an available VPN Type.

With Cisco's client, an administrator could distribute the client software and some pre-configured profiles. Administrative configuration looks to be more difficult with Apple's built-in client. networksetup did not gain any new capabilities as far as VPN configuration, so that's no help. You can export and import configurations, and since they are XML files, you might be able to generate configurations programmatically.


Figure 1 - Cisco VPN support

Mcxrefresh

mcxrefresh is a new command-line tool to cause a client machine to re-read its MCX settings from the directory services. It must be run as root. You can specify a user id or shortname to refresh the Managed Preferences for a specific user as well as the computer settings. This might be useful when testing changes to MCX settings - you can instantly force a machine to refresh its Managed Preferences.

   mcxrefresh -n joeuser

Directory Utility

You've booted up your first Snow Leopard machine and you want to point it at your Open Directory or third-party LDAP server for directory services. In Leopard, you'd head to the /Applications/Utilities folder and look for Directory Utility. But on your Snow Leopard machine, it seems to be missing. Instead, you can open the Accounts pane in System Preferences as in Figure 2.


Figure 2 - Accounts Preference Pane

When you select Login Options, you'll see a new section for a "Network Account Server." Click Edit, and you'll see the sheet in Figure 3.


Figure 3 - Directory Services pane

From this pane, you can add directory servers, or open Directory Utility for more options. Or you can just skip all this, and go directly to the new location of Directory Utility: /System/Library/CoreServices/Directory Utility.app.

Keychain password Enhancements

A common problem in enterprise environments is keeping the login keychain password in sync with the directory services password. Many environments use a web page to allow their users to change passwords. In other environments, users may have access to multiple machines (say a Mac and a Linux box), sharing a common directory service. If they change their password on their Linux box, or use a web page to change their password, the login keychain on the Mac is not updated with the new password. When the user then logs into their Mac, the login keychain is not unlocked, and access to mail accounts, web pages, file servers and the like might be affected. Prior to Snow Leopard, many administrators used AFP548.com's Keychain Minder to handle this situation. When configured to run as a login item, Keychain Minder would check to see if the login keychain was unlocked at login, and offer to help the user reset the login keychain password if needed.

Snow Leopard builds in most of Keychain Minder's functionality. If the user password is changed, and the login keychain can't be unlocked at login, you'll see a dialog like the one in Figure 4.


Figure 4 - Update Keychain Password dialog

You can then update your keychain password, create a new keychain, or ignore the issue.

Screen Saver

Since the release of OS X 10.0, large organizations have wanted the ability to run a screen saver when the machine is at the login window. Apple's opinion always seemed to be that you should have your machines (or at least the displays) sleep when idle at the loginwindow for a long time. High schools, colleges, and other organizations instructional labs often wanted the machines to stay on with active displays so students could quickly identify available machines. When presented with a machine that was asleep, or with a darkened display, many students assumed the machine was broken. In my organization, we had a number of Macs connected to color-calibrated CRT monitors. These monitors needed to be left powered up and with an active display in order to maintain their calibration.

Whatever the reason, when an organization wanted/needed the display to remain active when the machine was at the loginwindow, they had a new challenge to deal with: screen burn-in. A machine left for hours or days at the loginwindow could burn the image of the loginwindow into the phosphors. (And although LCDs are supposedly immune to the effects of burn-in, I've seen evidence to the contrary.) So it's understandable to want the screen saver to run over the loginwindow to prevent burn-in. Some organizations also saw this as an opportunity to run a screensaver that presented news or announcements about the organization.

Unfortunately, Apple did not support running the screen saver at the login window. Various workarounds were developed. An application called Screen Preserver could be used to display slideshows over the loginwindow. In 10.3 and 10.4, enterprising administrators developed scripts that allowed Apple's screen saver to run over the login window. But Leopard brought that practice to an end, as the built-in screen saver no longer would run over the loginwindow.

So it was with some surprise when testing Snow Leopard this summer that I noticed the screen saver kick in while I was logged out. This new behavior persisted into the final release. There's no user interface to control which screen saver runs, or how long to wait until activation. I haven't yet figured out any other way to control these options, but I'm sure someone will before long. Still, this is a welcome change, and only took eight years for Apple to implement!

Exchange integration

We can't finish our scavenger hunt without mentioning a new feature of great interest to many enterprise systems administrators (and regular users!) - support for Microsoft Exchange. If your organization is running Exchange Server 2007 (and alas, my organization isn't yet...), you can configure Mail, iCal, and Address Book to talk to your organization's Exchange server. While this doesn't give you the full range of functionality you can get from Entourage 2008 Web Services Edition (let alone Outlook on Windows), it may be sufficient for some user's needs.

The Exchange integration in Snow Leopard is based on Exchange Web Services, a new protocol first available in Exchange Server 2007 SP1. Older Exchange servers support only MAPI (a protocol extremely difficult to replicate outside of Windows - even Entourage, a Microsoft product, doesn't use it), or the limited OWA (Outlook Web Access) protocol, which is on its way out. For this reason, the Exchange integration in Snow Leopard doesn't work with older Exchange servers.

Since this is a new feature, and Exchange support is notoriously difficult to implement (otherwise, why would Entourage still have issues?), it may work well in your environment, or not at all. Early reactions on the MacEnterprise mailing list are mixed: some organizations are reporting great success; others are having difficulties. If your organization is running Exchange 2007, try it yourself and see.

Figure 5 shows the dialog in Mail.app for adding an Exchange 2007 account. Note the options to also setup Address Book and iCal. If you don't configure them here, each of these applications also has an interface for configuring Exchange 2007 accounts.


Figure 5 - Mail setup for Exchange 2007

Conclusion

That concludes our scavenger hunt. If there's a theme to the changes in Snow Leopard, it's "refinement". Lots of little things have been subtly refined, providing a better user experience, or making things work the way they should have earlier. We have by no means covered all the changes in OS X 10.6 - there are many more. Have fun on your hunt!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Posterino 4.4 - Create posters, collages...
Posterino offers enhanced customization and flexibility including a variety of new, stylish templates featuring grids of identical or odd-sized image boxes. You can customize the size and shape of... Read more
Chromium 119.0.6044.0 - Fast and stable...
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. List of changes available here. Version for Apple... Read more
Spotify 1.2.21.1104 - Stream music, crea...
Spotify is a streaming music service that gives you on-demand access to millions of songs. Whether you like driving rock, silky R&B, or grandiose classical music, Spotify's massive catalogue puts... Read more
Tor Browser 12.5.5 - Anonymize Web brows...
Using Tor Browser you can protect yourself against tracking, surveillance, and censorship. Tor was originally designed, implemented, and deployed as a third-generation onion-routing project of the U.... Read more
Malwarebytes 4.21.9.5141 - Adware remova...
Malwarebytes (was AdwareMedic) helps you get your Mac experience back. Malwarebytes scans for and removes code that degrades system performance or attacks your system. Making your Mac once again your... Read more
TinkerTool 9.5 - Expanded preference set...
TinkerTool is an application that gives you access to additional preference settings Apple has built into Mac OS X. This allows to activate hidden features in the operating system and in some of the... Read more
Paragon NTFS 15.11.839 - Provides full r...
Paragon NTFS breaks down the barriers between Windows and macOS. Paragon NTFS effectively solves the communication problems between the Mac system and NTFS. Write, edit, copy, move, delete files on... Read more
Apple Safari 17 - Apple's Web brows...
Apple Safari is Apple's web browser that comes bundled with the most recent macOS. Safari is faster and more energy efficient than other browsers, so sites are more responsive and your notebook... Read more
Firefox 118.0 - Fast, safe Web browser.
Firefox offers a fast, safe Web browsing experience. Browse quickly, securely, and effortlessly. With its industry-leading features, Firefox is the choice of Web development professionals and casual... Read more
ClamXAV 3.6.1 - Virus checker based on C...
ClamXAV is a popular virus checker for OS X. Time to take control ClamXAV keeps threats at bay and puts you firmly in charge of your Mac’s security. Scan a specific file or your entire hard drive.... Read more

Latest Forum Discussions

See All

‘Monster Hunter Now’ October Events Incl...
Niantic and Capcom have just announced this month’s plans for the real world hunting action RPG Monster Hunter Now (Free) for iOS and Android. If you’ve not played it yet, read my launch week review of it here. | Read more »
Listener Emails and the iPhone 15! – The...
In this week’s episode of The TouchArcade Show we finally get to a backlog of emails that have been hanging out in our inbox for, oh, about a month or so. We love getting emails as they always lead to interesting discussion about a variety of topics... | Read more »
TouchArcade Game of the Week: ‘Cypher 00...
This doesn’t happen too often, but occasionally there will be an Apple Arcade game that I adore so much I just have to pick it as the Game of the Week. Well, here we are, and Cypher 007 is one of those games. The big key point here is that Cypher... | Read more »
SwitchArcade Round-Up: ‘EA Sports FC 24’...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for September 29th, 2023. In today’s article, we’ve got a ton of news to go over. Just a lot going on today, I suppose. After that, there are quite a few new releases to look at... | Read more »
‘Storyteller’ Mobile Review – Perfect fo...
I first played Daniel Benmergui’s Storyteller (Free) through its Nintendo Switch and Steam releases. Read my original review of it here. Since then, a lot of friends who played the game enjoyed it, but thought it was overpriced given the short... | Read more »
An Interview with the Legendary Yu Suzuk...
One of the cool things about my job is that every once in a while, I get to talk to the people behind the games. It’s always a pleasure. Well, today we have a really special one for you, dear friends. Mr. Yu Suzuki of Ys Net, the force behind such... | Read more »
New ‘Marvel Snap’ Update Has Balance Adj...
As we wait for the information on the new season to drop, we shall have to content ourselves with looking at the latest update to Marvel Snap (Free). It’s just a balance update, but it makes some very big changes that combined with the arrival of... | Read more »
‘Honkai Star Rail’ Version 1.4 Update Re...
At Sony’s recently-aired presentation, HoYoverse announced the Honkai Star Rail (Free) PS5 release date. Most people speculated that the next major update would arrive alongside the PS5 release. | Read more »
‘Omniheroes’ Major Update “Tide’s Cadenc...
What secrets do the depths of the sea hold? Omniheroes is revealing the mysteries of the deep with its latest “Tide’s Cadence" update, where you can look forward to scoring a free Valkyrie and limited skin among other login rewards like the 2nd... | Read more »
Recruit yourself some run-and-gun royalt...
It is always nice to see the return of a series that has lost a bit of its global staying power, and thanks to Lilith Games' latest collaboration, Warpath will be playing host the the run-and-gun legend that is Metal Slug 3. [Read more] | Read more »

Price Scanner via MacPrices.net

Clearance M1 Max Mac Studio available today a...
Apple has clearance M1 Max Mac Studios available in their Certified Refurbished store for $270 off original MSRP. Each Mac Studio comes with Apple’s one-year warranty, and shipping is free: – Mac... Read more
Apple continues to offer 24-inch iMacs for up...
Apple has a full range of 24-inch M1 iMacs available today in their Certified Refurbished store. Models are available starting at only $1099 and range up to $260 off original MSRP. Each iMac is in... Read more
Final weekend for Apple’s 2023 Back to School...
This is the final weekend for Apple’s Back to School Promotion 2023. It remains active until Monday, October 2nd. Education customers receive a free $150 Apple Gift Card with the purchase of a new... Read more
Apple drops prices on refurbished 13-inch M2...
Apple has dropped prices on standard-configuration 13″ M2 MacBook Pros, Certified Refurbished, to as low as $1099 and ranging up to $230 off MSRP. These are the cheapest 13″ M2 MacBook Pros for sale... Read more
14-inch M2 Max MacBook Pro on sale for $300 o...
B&H Photo has the Space Gray 14″ 30-Core GPU M2 Max MacBook Pro in stock and on sale today for $2799 including free 1-2 day shipping. Their price is $300 off Apple’s MSRP, and it’s the lowest... Read more
Apple is now selling Certified Refurbished M2...
Apple has added a full line of standard-configuration M2 Max and M2 Ultra Mac Studios available in their Certified Refurbished section starting at only $1699 and ranging up to $600 off MSRP. Each Mac... Read more
New sale: 13-inch M2 MacBook Airs starting at...
B&H Photo has 13″ MacBook Airs with M2 CPUs in stock today and on sale for $200 off Apple’s MSRP with prices available starting at only $899. Free 1-2 day delivery is available to most US... Read more
Apple has all 15-inch M2 MacBook Airs in stoc...
Apple has Certified Refurbished 15″ M2 MacBook Airs in stock today starting at only $1099 and ranging up to $230 off MSRP. These are the cheapest M2-powered 15″ MacBook Airs for sale today at Apple.... Read more
In stock: Clearance M1 Ultra Mac Studios for...
Apple has clearance M1 Ultra Mac Studios available in their Certified Refurbished store for $540 off original MSRP. Each Mac Studio comes with Apple’s one-year warranty, and shipping is free: – Mac... Read more
Back on sale: Apple’s M2 Mac minis for $100 o...
B&H Photo has Apple’s M2-powered Mac minis back in stock and on sale today for $100 off MSRP. Free 1-2 day shipping is available for most US addresses: – Mac mini M2/256GB SSD: $499, save $100 –... Read more

Jobs Board

Licensed Dental Hygienist - *Apple* River -...
Park Dental Apple River in Somerset, WI is seeking a compassionate, professional Dental Hygienist to join our team-oriented practice. COMPETITIVE PAY AND SIGN-ON Read more
Sublease Associate Optometrist- *Apple* Val...
Sublease Associate Optometrist- Apple Valley, CA- Target Optical Date: Sep 30, 2023 Brand: Target Optical Location: Apple Valley, CA, US, 92307 **Requisition Read more
*Apple* / Mac Administrator - JAMF - Amentum...
Amentum is seeking an ** Apple / Mac Administrator - JAMF** to provide support with the Apple Ecosystem to include hardware and software to join our team and Read more
Child Care Teacher - Glenda Drive/ *Apple* V...
Child Care Teacher - Glenda Drive/ Apple ValleyTeacher Share by Email Share on LinkedIn Share on Twitter Read more
Cashier - *Apple* Blossom Mall - JCPenney (...
Cashier - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple Blossom Mall Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.