New networksetup Features in Snow Leopard

The networksetup command is pretty useful for deploying static network information, which is otherwise tedious (to say the least).  In Mac OS X 10.6 there are three major additions to networksetup that have not gotten a lot of attention yet.  The first is that you can now use networksetup to import and export 802.1x profiles (and link them to certificates that you import from pkcs12 into Keychain), which will hopefully ease implementation burdens for environments with supported 802.1x setups.  The second is that networksetup can now be used to manage a Baseboard Management Controller (BMC), which is the chip that enables ipmi/Lights Out Management.  The third new option is the addition of network locations control from within networksetup.  This means that networksetup can now be used to configure basically the entire network stack. 

Read on for more…

First let's look at the options that have been added to ease
the burden of integrating 802.1x.  In the Network System Preference
pane, if you've enabled 802.1x on a Mac host, you may have noticed that
you have User Profiles, Login Window Profiles and a System Profile.
 The options in networksetup correspond to these, with
-listalluserprofiles and -listloginprofiles showing available user and
login profiles respectively (you can only have one System Profile so
there's no need for listing all one of them).  Additionally, any
profiles that you generate will need to be enabled.  You will use the
-enablesystemprofile to enable the system profile for a given service.
 And if you are integrating 802.1x with the loginwindow you'll need to
enable one of the profiles that you listed earlier, using the
-enableloginprofile option to networksetup along with the service
followed by the profile followed by an on or off switch.  For example,
if we wanted to enable a profile called mycompany for the login window
and we wanted to use the service that we'd setup called PrimaryEthernet
then we could use the following command:

networksetup -enableloginprofile PrimaryEthernet mycompany on

But,
where are these profiles coming from?  Well, the easiest way to get
them on your system is to use the -export8021xProfiles to export all
profiles for a given service on an imaging station and then the
-import8021xProfiles followed by the service to import the profiles
into, followed by the path to the export file.  You can also export
just the user profiles using the -export8021xLoginProfiles or the
-export 8021xSystemProfiles options to export just the login profiles
and system profiles respectively.  TLS will be a bit trickier.  Apple
includes the -settlsidentityonsystemprofile and
-settlsidentityonuserprofile to assist with pkcs12 integration
(currently the only supported format).  While Snow Leopard also
introduces an option in the GUI to connect to an 802.1x environment
immediately, I've yet to find command line support to test the
supplicant.

In addition to 802.1x options, Snow Leopard also
comes with the ability to manage that Lights Out Management (LOM) port
on those shiny Xserve's all the cool kids are talking about (without
compiling ipmitool on your own).  To see the LOM settings, you would
use networksetup along with the -showBMCSettings option.  To setup LOM,
use the -setupBMC option, along with the port to use it on followed by
whether it will be static or DHCP (yes, I said DHCP but I don't think
I'd do that), the IP, subnet mask, gateway and finally the admin user
name and password (keep in mind those passwords need 8 characters).  So
let's say that I wanted to configure my LOM interface to use Ethernet
1, using 192.168.210.2 with a subnet mask of 255.255.255.0 and a
gateway of 192.168.210.1, with a LOM username of admin and a password
of mysecretpassword1.  I would then use the following command:

networksetup -setupBMC 1 static 192.168.210.2 255.255.252.0 192.168.210.1 admin mysecretpassword1

Finally,
locations have always been pretty straight forward in the Network
System Preference pane and they still are in networksetup.  Simply use
the -getcurrentlocation option to show you which location is active (if
you haven't ever customized network locations this should be
automatic).  You can see all of the locations (not just the active one)
by using the -listlocations option.  When you know which locations you
have, if you need more, go ahead and do a -createlocation followed by
the name to be assigned to the location.  By default the default
services will not be included in this location, so use the populate
option to add them.  If we were creating a new location called
8021xenabled then our command would look something like the following:

networksetup -createlocation 8021xenabled populate

To
then make that location our active location use the -switchtolocation
option.  For example, we could use the following to activate that
location we just created:

networksetup -switchtolocation 8021xenabled 

And to delete it if we did something wrong use the -deletelocation (to continue on with our previous example):

networksetup -deletelocation 8021xenabled 

While
this doesn't seem very earth shattering the ability to programmatically
create (and delete) locations allows administrators to build new test
packages for home vs work settings and also be able to send users
packages with locations built into them to help test for problems,
potentially a huge time saver!

cedge

More Posts - Website