macosxhints.com OS X Server tips

10.6 Server: Set the appropriate Software Update Server

Wed, 21 Oct 2009 07:30:00 -0700

With Mac OS X Server 10.5 and below, Software Update Server only had one catalog of updates -- thus, you could run a command like this one, and have it point Software Update to your server:

defaults write /Library/Preferences/com.apple.SoftwareUpdate CatalogURL "http://Server.local:8088/"

With Mac OS X Server 10.6, Apple has divided the catalog file into three separate catalogs: one for 10.4, one for 10.5, and one for 10.6. Each is a separate URL, and if you set the wrong catalog for the OS, you'll get the (incorrect) message that your software is already up-to-date. Having three separate scripts is a hassle, though, and is prone to error.

On the Hints Forums, users tw and Hal Itosis were instrumental in crafting this AppleScript. It checks the OS that you're cur...

Update the Software Update Server without re-downloading

Tue, 20 Oct 2009 07:30:02 -0700

I had the need to update a server that was acting as a Software Update Server. I knew that the machine had the update on it, but was unsure of how to get it to see the locally-hosted update. If you open Terminal and issue this command...

open /usr/share/swupd/html/index.sucatalog

...then Software Update will launch, looking at the localhost -- no need to re-download the update from Apple.

10.6: Using iCal Group calendars on Snow Leopard Server

Mon, 21 Sep 2009 07:30:02 -0700

Snow Leopard's iCal Server changed the location of the Wiki-based calendars, so that this previous hint no longer works. Intead of using the path of /principals/groups/groupname, the URL for wiki-based calendars has changed to one of the following:

https://ical.domain.com:8443/principals/wikis/groupname/
http://ical.domain.com:8008/principals/wikis/groupname/

When you add this in as a URL for an additional account, you can then access this shared calendar, with your changes reflected on the wiki page. You could alternatively create a specific user in workgroup manager to be used as the 'silent' owner of a group calendar, create your calendars, assign delegation to all the real users. But if done in that way, you don't get to see the calendar in the wiki, online.

Hopefu...

10.5: List service ACLs on Mac OS X 10.5 Server

Mon, 20 Jul 2009 07:30:00 -0700

Mac OS X lacks a good command line tool for following a Services Access Control List (SACL) tree of users and groups. If you don't want to, or just can't, use the GUI to list users in service ACLs of your Mac OS X server (or managed client), you need to parse the groups/nested groups/users tree one group at a time, using dscl. It's really painful. As an alternative, I've created a script to handle this for sys admins.

I won't promise you a killer command line tool with foolproof error and recursion handling, but I still believe I've designed a usable piece of shell script -- even if it looks like it's the worst code I've ever written (which is not true; I've made things way uglier). The source code is too long and messy to be just copy-pasted here; just download the getsacls.sh script (4KB) directly from my machi...

10.5 Server: Force certain folders into managed clients' Docks

Wed, 17 Jun 2009 07:30:00 -0700

I have recently discovered a solution to a long-time annoyance of mine with 10.5 server and managed preferences for 10.5/10.4 clients: How to force the Applications and Downloads folders into the Dock.

I 'took apart' and examined the com.apple.dock.plist file and found the options for the Applications folder and the Downloads folders. If you simply place these folders into the Workgroup Manager (WGM) area for dock preferences, you end up with a broken downloads folder and an Applications folder that won't show its contents. Instead, when you click on Applications in 10.5, you just get a new window instead of the list of its contents.

The secret is to take a com.apple.dock.plist file and take out everything but the entries for Applications and Downloads. Use this file in the Details tab of preferences plists that you can force out -- don't forget to ...

Upgrade to 10.5 Server without reboot on newest Macs

Wed, 11 Mar 2009 07:30:00 -0700

This is more observational than hint-like, but it's interesting. This morning we had a customer order a new 2009 Mac mini, and they asked to have it upgraded to Leopard Server.

When we put the DVD into the Mac mini slot, we were getting ready to boot from DVD to do the upgrade. However, with this new mini, it no longer requires a reboot. You can install the Leopard Server Install Package without booting from the DVD.

Use one Deploy Studio server with images on many servers

Tue, 03 Mar 2009 07:30:01 -0800

I am jumping on board the DeployStudio train, and with multiple sites to support, I ran into the issue of how to use one master Deploy Studio server, but host the images at each of the sites (especially the WAN locations).

The solution I came up with was simple. When Deploy Studio wants to mount the images volume (via AFP), I just have a preflight script that mounts the volume based on which location (based on subnet) the computer is being imaged at. For instance, our Deploy Studio is on our fiber network, but our satellite site is on cable. When the computer netboots and DeployStudio Runtime is launched, it connects up to the Deploy Studio server (again, hosted on the fiber network).

A preflight script will mount the correct AFP mount prior to imaging the computer. We are basing this on our subnets, but your mileage may vary. Hope this helps those other network administrators going through the same struggles. I h...

10.5: Fix cron for LDAP Users in Mac OS X Server 10.5

Mon, 26 Jan 2009 07:30:01 -0800

To the best I'm able to determine, Mac OS X Server's cron does not recognize crontabs of users who exist in LDAP, nor the flat files (e.g., /etc/passwd). This is because cron starts prior to LDAP, and thus sees the crontabs of such users as "orphans." If you log in and re-establish the crontab, all is well ... but a simple reboot shouldn't cause crontabs to become disabled.

The system cron is a launchd service, and so it's quite difficult to control the order in which it launches. One can make the argument that it's cron's fault that it doesn't check for LDAP when it starts, but I think that the blame is really Apple's to bear. I spent hours today trying to figure out a graceful way to delay cron's launch without installing a new cron or hacking things up too badly, all in vain.

...

A basic how-to for using System Image Utility

Wed, 24 Dec 2008 07:30:00 -0800

I am a system administrator on a small network of five servers with around 80 to 90 clients. Recently I wanted to image a group of 25 MacBooks to get them ready for staff to use. Searching the web, I found a lot of information about using SIU (System Image Utility). Based on my searching and my experiences, I'd like to offer up this "How to use SIU" how-to. Please note that this process is best done when the load on the server (from the users) is at it lowest. If done when you have users accessing the server, you will have complaints about things going slowly. So here goes...

Set up your client machine as you would like it. Install apps, download updates, and set up preferences for a user as you would like.
Once complete, restart while holding down the T key to boot the Mac into Target Disk Mode.
Attach a FireWire cable between your server and the client machine that has been configured. You should see the main disk of the client mount on the desktop of th...

10.5: Set up host-specific mandatory TLS in Mail Service

Wed, 03 Dec 2008 07:30:01 -0800

I recently had an instance in which a client company was insisting that all email communications between our servers being encrypted with TLS. We're using Leopard Server 10.5.5 (which includes Postfix 4.3.1), but it took some extra tweaking to make it work, so I thought I'd pass it on in case anyone else here ever needs it.

This hint assumes that you have a Leopard Server running Mail Service which needs to be able to receive email from servers out on the Internet, and a security certificate for your mail server. (In Server Admin GUI for Mail Service, that would translate to having SSL set to Use (not Require) for SMTP with the correct certificate selected.) You will need a certificate for this to work, and preferably one issued by a certificate authority.

When we're done, you'll be using Opportunistic TLS (offers TLS but doesn't require it, since most ISP email servers don't use i...

Avoid a hardware model filter bug in OS X Server

Fri, 03 Oct 2008 07:30:00 -0700

This is more of a workaround than a hint, but will hopefully save some folks the hours of annoyance I've had to deal with.

The problem can be summarized as follows: In the Server Admin application, installed with Apple's Server Admin Tools, you can manage many of Mac OS X Server's features, including Netboot and Netinstall images. Once you have created a Netinstall image, you have the option in Server Admin to specify what types of Apple hardware are allowed to boot the image over the network. I refer to these filters as hardware model type filters, though I'm not sure of their official name. Anyway, once a model type filter is set for a given Netinstall image, a workaround is required to make future edits to the same filter in the GUI.

Steps to Reproduce the bug:

Create a netinstall image.
Edit the hardware model type filter by clicking the pencil button, then click OK, then Save.
Try again to edit the same hardware model type filter, ...

Create a CSV list of all pages in an Apple WikiServer wiki

Wed, 24 Sep 2008 07:30:00 -0700

An interesting request came in today from a coworker. She wanted to create a spreadsheet that contained all of our intranet's wiki pages (which uses the Apple WikiServer), presumably because Apple doesn't provide an easy way to "list all pages" in the wiki itself. Along with the page title, she also wanted to extract its internal ID, its URL, and the time the page was created as well as the time it was last modified.

I spent about an hour looking into this this afternoon, and it turns out that much of this information is readily available on the filesystem in the Apple WikiServer's data store. I whipped up the following shell script to extract this information in CSV format, exactly as requested. I'm submitting this script here in case someone else wants similar "export a list of WikiServer pages to a comma-separated values (CSV) file" functionality, but isn't sure how to go about getting it.

To use this script, just edit the line that reads http://my-server.e...

Monitor Xserve temperature, voltage, power via Munin Mon, 22 Sep 2008 07:30:02 -0700 Many system administrators are using Munin to monitor and make graphs of many details about their servers. However, there is no official plug-in for Mac OS X Server and Xserve to monitor temperature, power, or voltage. Aqua Ray, however, provides some of them; that page has download links for G4, G5, and Intel Xserves, along with explanations on how to install them on a current version of Munin. [robg adds: These plug-ins appear to be free, but I haven't tested them to see how well they work.] 10.5: Remove Time Machine from menu bar on clients Tue, 05 Aug 2008 07:30:00 -0700 Well, if you're like me and already have backup solutions running in your Open Directory, you may not want your users using Time Machine, for whatever reasons you may have. In Work Group Manager (WGM), select your groups (or your parent group) and select the Details tab. Then add the following to the details list: /System/Library/CoreServices/ManagedClient.app Once you add that in to the Details part of WGM, you can select the menu items and click on the pencil icon to add a string to disable Time Machine from the menu bar. So, click on the pencil icon and a new window should pop up. It should display Once, Often, Always. Select and expand the arrow key on Always, and then click on the New Key button. Select Edit from the drop-box, and name it TimeMachine.menu, then for Type, select boolean, and for Value, select false. Attached is a ... .htaccess, Open Directory, and Leopard Server Wed, 02 Jul 2008 07:30:02 -0700 I was looking to set up .htaccess on Leopard server, and as I was testing the .htpasswd file I set up for the user (myself), I tried the wrong password and it let me in! It turns out I had used my regular password that's set up through Open Directory. So I deleted the .htpasswd file, and I removed all references to it in the .htaccess file to further test. This is the resulting .htaccess file: AuthName "Server Access" AuthType Digest require valid-user Just by using the above .htaccess file, I am able to login with any user that has an Open Directory account. Nice treat, for me anyway. I'm guessing others will have to add restrictions for users they don't want to have access. [robg adds: I have no way of testing this one...] Limit OS X Server VPN connections to one per user Thu, 26 Jun 2008 07:30:00 -0700 VPN in Mac OS X Server (all versions, I think) allows users to have as many sessions from as many different computers as they want to the VPN server. I didn't like this, so I tried to find a way to restrict them to only one session. I tried looking at plists, thinking maybe Apple had some hidden option for this, but I couldn't find it. I then dug around in man files for vpn and pppd and such, and found something of interest in pppd's man page: /etc/ppp/auth-up A program or script which is executed after the remote system successfully authenticates itself. It is executed with the parameters: interface-name peer-name user-name tty-device speed Note that this script is not executed if the peer doesn't authenticate itself, for example when the noauth option is used. Great! All I need now is some code and a way to find out which users are curren... 10.5 Server: Add group calendars to iCal Wed, 16 Apr 2008 07:30:00 -0700 This is actually a hint for both OS X Server 10.5 and iCal. I was trying to implement the calendaring feature in OS X Server and hit a wall when Apple's documentation did not explain how to set up multiple calendars for a single group, and how to manage them in iCal. After much searching, I found the answer (not supported by Apple) in this Apple Discussions thread. In order to create a group calendar, you have create a group and enable calendars for that group. This is reasonably well explained in the "iCal Service administration guide for Version 10.5 Leopard" guide. In order to view the group calendars, open iCal (it has to be iCal 3), open its Preferences, and click on the Accounts tab. There you will create an account by hitting the "+" sign and entering the following: A description... Serial port access through Terminal in Leopard Server Wed, 27 Feb 2008 07:30:00 -0800 Having a pressing need to access a Cisco router via the console cable, and not having a PC with a serial port laying around anywhere, I decided to look into how to access the serial port on an Xserve that's running Leopard Server. Previous hints targeted at Tiger Server and below, however, do not work any more as the serial support files are no longer found in /System » Library » StartupItems/. Through some digging, I found the solution to the problem and can now access the router via the serial port at any time, even from my iPhone (through Terminal, of course)! Leopard Server moved the SerialTerminalSupport shell script to /usr » libexec » serial. The syntax for launching it remains the same, though, just the location has changed. Thinking that was all it took, I stopped the SerialTerminalSupport service with this command (run all thes... Improve Squirrelmail compatibility with Mail in Server Thu, 20 Dec 2007 07:30:04 -0800 Squirrelmail as included with Mac OS X Server lets you remotely access your Inbox via a web-browser. It also automatically creates sub-folders to store drafts, sent, and trashed emails as done during a Squirrelmail session. These have a folder structure like this: Inbox Drafts Sent Trash When you look at this in Apple Mail, you will see a triangle next to your Inbox, and turning it down reveals the same sub-folders. The purpose of this posting is that this structure is not the same as the default Apple Mail structure, and as such, Apple Mail and Squirrelmail will not automatically be using the same IMAP folders to store drafts, sent, and trash. It is possible in Apple Mail to select one of these Squirrelmail-created folders, and go to the Mailbox menu and select the "Use This Mailbox For..." command to make it the folder to use for that purpose. It is also possible to edit the Squirrelmail config.php file to adjust its settings which a... 10.5: Enable full RADIUS support on OS X Server Thu, 13 Dec 2007 07:30:02 -0800 OS X 10.5 Server comes with a Radius server, but at the surface, it seems that Apple only ships with support for wireless access stations. However, the foundation is a fully working FreeRadius server. When trying to get the Radius server to work together with our Checkpoint firewall for VPN authentication, I found that the Radius server tries to authenticate the users against the /etc/passwd file. However, for authorization, it correctly queries the OpenDirectory. I opened a support call with Apple, and I eventually received the following instructions to change the behavior. Read on to see the response I received from Apple... Here's what Apple told me...(robg adds: I have trimmed the email from Apple, and edited it a bit for easier reading, but I didn't modify any of the actual instructions): Apple included RADIUS services in Leopard server to Apply sup...