The result of this interest has lead to some methods for finding hidden options in any command, although his specific example involves softwareupdate.  These methods are useful for poking around commands and looking for hidden functionality that isn’t exposed in the documentation.  Check it out over on Greg’s blog.

Last year the guys from the netatalk project released the 3.0 version of their AFP server. This third version came out with support for AppleDouble metadata, removed support for AppleTalk and made the configuration process much easier. Needless to say that this version is still AFP 3.3 compliant, so your OS X clients won’t feel the difference.

Usually you would need to download the source and compile it, but for RHEL-based distros you can use the rpm I created.  You can download it here.

The package has two dependencies that we need to clear before installing.

su -c 'yum install -y perl avahi'

The avahi component will be the one offering bonjour services so that OS X clients on the network identify the Linux server. Once that is done we can go ahead and install the rpm with

su -c 'rpm -ivh netatalk-devel-3.0.3-0.0.7.el6.x86_64.rpm'

We need to create a file that the installer does not create for us, but is necessary. To fix this, run:

touch /etc/afppasswd

Now let’s create a local user that the clients will connect as (ldap based authentication is also an option) and set a password. In this example I will be sharing the home folder of the newly created account.

useradd afpuser ; passwd afpuser

Add the new local user to the afppasswd database with

afppasswd -a afpuser

Now edit the main configuration file /etc/afp.conf with your favorite editor. A very minimal configuration to get the service running would look like this:

;
; Netatalk 3.x configuration file
;
;
[Global]
; Global server settings
;
; [Homes]
; basedir regex = /home
;
[afpuser's AFP share]
path = /home/afpuser 
valid users = afpuser

As you can see the configuration file has two distinct categories and for any new share you would add a new category at the bottom. Start the service and set it to start automatically on the next boot:

/etc/rc.d/init.d/netatalk start
chkconfig netatalk on

Only thing left is to open port 548 and for this you can use system-config-firewall or system-config-firewall-tui and you are done!

By changing the configuration file we can get some more features. For example, if we want to enable guest login to our share, the configuration file could look like this (the man page states that the username should be in quotes but should not) :

;
; Netatalk 3.x configuration file
;
[Global]
uam list = uams_guest.so uams_dhx.so uams_dhx2.so
guest account = afpuser
;
; [Homes]
; basedir regex = /home
;
[afpuser's AFP share]
path = /home/afpuser 
valid users = afpuser guest

Any afp share can be enabled to be a Time Machine destination by just adding one extra line:

[afpuser's AFP share]
path = /home/afpuser 
valid users = afpuser
time machine = yes

The following three tips apply to the [Global] section. We can enable the afpstats to see the number of active connections, source, time and status just by adding

afpstats = yes

Add a message to be displayed with every login by adding

login message = "Welcome to a Linux box"

Appear on Bonjour as an Apple machine with

mimic model = Macmini

As you can see, a basic configuration of the service is trivial. The performance and stability of this AFP fileserver makes it worth considering. I have reached 77MB/s downloads from an old Dell laptop. The project has support for ldap authentication and even variables for share names. It is a shame the variables are still not supported in file paths. For more advanced configurations check its documentation at http://netatalk.sourceforge.net/3.0/htmldocs/

Every day, Linux is more present in the Mac world.  For example, today you can have a Munki server, MunkiWebAdmin and offer pkg downloads from a Linux box while administering the server from your Mac computer using AFP.

What does it do?

To put it simply, Casper Focus allows a teacher to force specific supervised devices to all lock into a specific app.  The teacher can select any app that’s in the Mobile App Catalog (even if it isn’t installed on the teacher’s iPad, or the specific student iPads, or wasn’t deployed via JSS / Self-service).  The teacher can enable / disable this lock to a specific app with the push of a button (or two), and it’s a very simple interface.

There’s also the ability to clear the passcodes if the student puts on a passcode lock and forgets it, but that’s probably not the main feature people care about.

What does it look like?

When first launched, the Casper Focus app will ask you to put in the URL of the JSS.  JAMFNation’s knowledge base helpfully provides some information about how to configure this automatically using DNS-SD or Bonjour, so check out this article here for details.  Whether or not you’ve got it set up automatically, this really only has to happen the first time (unless your JSS URL changes for some reason).  As long as Casper Focus is on a network that can contact the JSS, you’ll never have to worry about it again.

Next, the user must enter in a name and password to authenticate as a teacher.  More on that below.

Once logged in to Casper Focus, the teacher will be able to see a grid of all available iPads listed in the Class, with two buttons on the bottom – Focus Class on App and Clear Passcodes.

The Requirements

You need CasperSuite 8.7 for iOS, you need iOS 5.1.1 or newer devices that are managed by the JSS, and they also need to be supervised by Apple Configurator in order for the Focus feature to work.  The “teacher” iPad has to download the free Casper Focus app from the App Store.

Setting Up Classes To Accommodate Casper Focus

In CasperSuite 8.7, there’s a new feature under the Management tab called Classes:

Entering the rabbit hole will allow you to set up the new feature of a Class, in which you specify a Class Name, the usernames of the accounts of teachers (more on that later) authorized to exert control via the Casper Focus app, and a group (either Static or Smart) you’ve created that lists all the devices belonging to that class.

The meeting times are actually somewhat important, as the Casper Focus feature that locks users into a specific app automatically expires at the end of the meeting time.  This way, you can basically recreate your school schedule into Casper and allow teachers only to apply focus management during the times it would actually be relevant – you don’t want teachers going home at 5 pm and then trolling students by randomly activating Casper Focus.

Adding Teachers as Users

While JAMF recommends you hook up the JSS to an LDAP, you can also simply add teachers as separate users by creating new accounts.  Under the Settings -> Accounts, you can create a new account and grant it no privileges.  They don’t need to be able to access anything in the JSS, so you don’t need to worry about potentially letting users muck around with things.  The only thing you need to do is add them to the Class as a Teacher, and it works.  This is great for testing, or creating unique accounts you want to use just for Focus.

Casper Focus users only have to log in to the app once, and it will save your user between launches.  For shared devices, you can always log out of Casper Focus and let another user have it.

Preparing the Clients

Once the teacher and Class aspects are set up, the devices must also meet certain requirements.  As mentioned above, they must be managed by the JSS, running iOS 5.1.1 or newer, and they must be Supervised by Apple Configurator to function.  The last bit is worthy of some discussion at the end, as Supervision makes for a significant impact on various deployment models used for iOS.  Suffice to say, without Supervision, Casper Focus doesn’t really do much (except clear passcodes), so it’s most certainly a one-trick pony.

The impact of Supervision means that users can’t plug the devices into their own computers, which does limit the take-home aspects or personalization aspects of the devices to a significant degree.  This is particularly significant when working with any kind of media, such as iMovie projects, or large amounts of photos.  Neither of those can be easily shared in bulk via tools like Dropbox (movies tend to be large and it takes time to upload and download them, and there aren’t any bulk-picture-upload features to mitigate photo sharing), so the decision to adopt Supervision should be made in accordance with your expected workflows for students.

Supervision with Apple Configurator doesn’t require you to use it as your app deployment mechanism, nor does it mean that all devices are inherently locked down.  It just restricts the device’s functionality for USB tethering.  If you don’t expect your students to need to plug devices into computers, then this won’t impact you significantly.  Keep in mind, however, that applying Supervision requires erasing the iPad first, so to all iOS admins out there, make sure you fully understand the workflow that you’ll need to adopt to deploy this feature.

Focusing Apps

Once the teacher is logged into Casper Focus and has a list of devices available to focus during the correct meeting time, the last step is to simply apply the desired focus.  The teacher will be presented with a list of all apps in the JSS’s Mobile App Catalog.  As I mentioned before, the teacher’s device does not need to have these apps installed, nor do the clients.  The apps don’t even need to have VPP spreadsheets, or any kind of scope, or even be managed by JSS deployment.  They just have to be in the catalog.

The teacher simply taps the “Focus Class on App” button (or selects an individual iPad to apply this to) and then chooses an app out of the list (or chooses “No App Focus” to allow free usage).  All class iPads are then forced to launch the app if it’s installed.  While this lock is activated, the Home button is disabled, and the users are unable to hold down the Power button to turn off the iPad.  The power button will still turn off the screen, but you cannot exit the app or otherwise get out of it until the Class meeting time ends (and the lock expires), or the teacher releases the lock.

What Actually Happens?

Casper Focus is leveraged using a specific restriction called “Guided Access” combined with the APNS (Apple Push Notification Service).  When the teacher uses Casper Focus to focus the iPads, it sends an immediate profile called “App Lock” (signed by the JSS) via APNS to the devices that enforces guided access.  The profile cannot be removed manually.  If the app isn’t installed, there will be a message overlaid on the screen that cannot be dismissed telling the class device to contact the administrator (and Casper Focus itself will report that the app may not be installed on the target device).  This message persists until the App Lock profile expires or is removed.

Casper Focus basically applies on-demand app locking profiles.  Many people use this restriction to create erstwhile kiosks (Apple uses this for demo iPads in its stores).  Casper Focus now lets you make on-the-fly changes to what app is being locked into the kiosk mode.  Note that you still can’t control what happens inside the app – making sure students are actually getting work done still requires the same teacher discipline and classroom skills that we’ve used for thousands of years.

Conclusions

Casper Focus has a very specific use – forcing students with Supervised iPads being managed by the JSS to use a specific app.  It doesn’t add any magic powers that we weren’t already aware of, and doesn’t take advantage of any hidden loopholes that nobody knew about.  It just leverages built in functionality with timing to allow for on-demand app locking.  In addition, students who lock themselves (or others) out can be rescued with the tap of a button.

It’s obviously aimed at education and it seems like it would apply more to younger ones.  The requirement for Supervision may give pause to iOS deployment models that revolve around user agency being paramount rather than administrative control.  We’ll most likely see this happen in Kindergarten – 4th grade classrooms, and not at all amongst the upper grades where we don’t apply Supervision.  Given that the tool is free and requires very little setup, though, there’s no reason not to test it out among teachers who may benefit from it and see what useful advances come of it.

Joel Bruner has a post that outlines how to get the available options for your printer using the lpoptions command.

A post on jamfnation led to some discussion on ##osx-server about an undocumented ASR command.  Rich Trouton blogged about how to view these commands using a very interesting method.  If you discover what some of these new-to-us commands do, feel free to comment here or over on Rich’s blog with what you discover.

Thanks goes to frogor (Michael Lynn), bruienne (Pepijin Bruienne), gneagle (Greg Neagle) and rtrouton (Rich Trouton) on ##osx-server for this discovery.