[tlarkin]

Another shot in the dark here, have you tried using sshfs at all? It has options to set mount points of home directories, you could write a function maybe that points the home directory back to the local machine when using ssh?

[tlarkin]

[QUOTE][u]Quote by: Ebonfyre[/u][p]What about all the supplemental apps that live in the less evident areas of the system, such as CoreServices? How can you possibly ensure that you have all those locations taken into consideration?[/p][/QUOTE]

You have to add the path. For example, Adobe puts an app that validates the license file online in /Library/Application Support/ so I have to approve that path for CS4 to run. I have not had any issues so far with anything from the CoreServices folder.

[tlarkin]

What is the differences between the Macs? OS versions? Are they bound? DNS is something you [u]must[/u] have working in order for services to function over the network.

[tlarkin]

Just to add something from my experience…

We had a state assessment testing software suite, which was written in Java and had a self update option, which was not optional. Anytime the State updated their server side, you had to update your client side. So to keep it simple, and easy for the IT staff when I built the package, I left the update folder writable, so that all updates could be downloaded and applied. Well, one student figured out that one nested folder in some application was writable, and they started dropping their own apps in that folder. Lone and behold, one student told another and with in like a week we had 100s of students dropping apps in this folder.

So, I had to create a network policy (via Casper) that hit every student machine, wiped out their Kansas Assessment testing software folder and copied the new one over, and this time that folder [b][u]was not[/u][/b] writable at all. This means that I had to repack the update and push it out manually anytime they put an update out. This is one of the caveats of using folder paths.

The upside to it, is it is really less work in the end. If I look at total “overall cost of ownership,” of my methodology of creating packages and images, this actually benefits me. Since I standardized everything from the base OS image, and then configure everything via post image scripts based on users/groups (students, teachers, middle schools, lower schools, etc.) I have to repack that application anyway to update the image. I use instaDMG and instaup2date python scripts to build my base OS. Then compile that base OS with all my packages in Casper. This allows me to have a pristine up to date image that will go on all my macs in my enterprise. Having this set up this way means I can keep a base image of what every Mac should have, whole deployment wide, and then build post image shell script that pull down packages for those specific group of users.

So, if you are going to keep your images up to date, you might as well repack your packages anyway when they get updated. This also gives you the chance to test the update.

The problem I ran into with the whitelist/blacklist options, were that if you did not use digital signing, the user could just rename the app whatever they wanted. If you did use digital signing, any and every single app with in the application’s contents. Some developers love to put other apps with in their App’s content folder. This gets super annoying to drill through each application with in it’s contents and put a digital signing onto every app with in it.

I went through this in 10.5.2 and gave up on it. It may have vastly improved, but even the iLife apps had issues. For example, garage band would not run because it was not allowing a bom file to go through. So I had to drill into that app in WGM, to that specific bom file in Garage Band, and allow it. After doing that once and seeing it fixed the issue I went to file path immediately.

[tlarkin]

May I make a suggestion? I am in a similar situation, I work for a school system and I have to be able to manage what apps users get and use. In OD, I use MCX to manage the absolute path apps can run from. So, I restrict applications to only be able to run from /Applications, and say all apps can only be ran from here. Then apps that I may want local admin to use but not the user I simply move them into /Applications/Utilities and that way the app is there, but the managed user cannot use them. This also prevents students from running skype from a thumb drive, because the path is not in /Applications. They don’t have the ability to write to the /Applications folder at all, so they cannot drop their own apps in.

Then you can set up a teacher group in OD and not even manage them at all for apps to run. This will be applied via their group policy. I find this more efficient than running approved software lists, because with out digital signing they can just rename the app to an approved one and get away with it, especially if they own it and it is running from their desktop. I tried digital signing in 10.5.2 and it was a hot mess, so I stopped using it. Could be way better now, but I haven’t changed my methods just yet.

[tlarkin]

Glad you got it working, because I was sort of taking shots in the dark at your issues, hahaha. Man I need to go to Europe one of these days on a side note!

[tlarkin]

[QUOTE][u]Quote by: DrKdev[/u][p]Ok.

Actually, that much *is* actually working for me.
As long as the users are only using the client macs, they can use the login-panels with their LDAP credentials.

My problems start when we consider them ssh-ing or login-paneling into the file-server (server1) or computation-server (server2).

Thanks for all your help so far, btw.

shawn[/p][/QUOTE]

Well I do use Casper at work, and there is an ssh account on every machine used for management. However, that ssh account is local and doesn’t really need a home directory, it just needs to be able to execute policy from the Casper Servers.

If your users are already going to be logging into their macs, and their home folders are already going to mount, why not just find a way to tell sshd to never mount home folders when a user authenticates over ssh? I am not sure if that is viable, but it seems like a work around that could possibly work.

[tlarkin]

I don’t give my users ssh access so, nope they cannot. They cannot even access the terminal. However, since OD is replicated across the board, they can be in any location and log in with their LDAP credentials into any machine bound to the directory.

[tlarkin]

I work for a school system, so Wyandotte is a high school and 2011 is a graduation year. It is a way that I nest home folders with in a share point. I do it by building and graduation year.

[tlarkin]

Can your users log in normally in the OS, this only happens when you try to ssh with that user’s credentials correct?

[tlarkin]

users are local users or OD users? Server2, is part of OD?

Let me give you a bit of info on my deployment and see if it sheds any light for you…

I have got 40 Xserves, and 8,000 Mac clients. All running OD. 1 ODMaster, 6 Tier 1 replicas (or relays as Apple calls them), 12 Tier 2 replicas and the rest are file servers. I bring everything into OD so Kerberos is running, and I have home folders scattered across all the servers with their own back up devices in play. We run portable home directories on most users, as most of the computers are macbooks. Any user can log into any machine in my enterprise with a few exceptions of computer groups that only allow local accounts, so users cannot sync their PHD to the machine.

To make this work, I think you need to have DNS running properly. You need to have your servers in OD, that way authentication and home folder placement is all handled by LDAP, and kerberos is in place so once you get a ticket you are golden.

Your share points them self should be owned by root:admin and the home folder owned by the user. You can set POSIX and ACLs in Server Admin.

[tlarkin]

So, I am a bit confused now….

A user logs in and if their home folder is on server2 it does not mount? I think I may have not gone in the right direction, but so we are on the same page can you please explain to me your issue you have so I can totally grasp it.

Thanks

tom

[tlarkin]

Are all your replica servers, either added manually into WGM or are they all bound to your Open Directory Master? I would assume that this is an issue with DNS and BIND. Unix OSes depend heavily upon BIND to talk with one another in this fashion. Is your file server bound and part of the directory to your master server?

Otherwise, I am still on 10.5.8 here at my job and have not really worked with 10.6 in a large production environment.

[quote]When I try to set the home directory to /Network/Servers/server1.disney.ch/Volumes/team1/users/user1 it works poifectly on server1 and on my client macs,.. but not at all, on server2 :-([/quote]

In WGM when you look at file shares, it literally has the absolute full path in the bottom field, maybe I can attach a screen shot to better display what I am talking about one sec….

Maybe, it is me, Maybe it is Monday, maybe it is a lack of coffee this morning but for the life of me I cannot see an attachment option on this forum…. :question: So, I will just host it online and link it, and here you go…

[IMG]http://i120.photobucket.com/albums/o189/tlarkin80/Picture6.png[/IMG]

[url]http://i120.photobucket.com/albums/o189/tlarkin80/Picture6.png[/url]

It also looks like you cannot post pics either, so I linked it to my photobucket…

As you can see on the screen shot at the very bottom, it lists the full path, but the top field is the share point, and the middle field is any nested folders with in the share point to the end users home directory, while the bottom is the absolute full network path. Just keep in mind this is all 10.5.8

[tlarkin]

In work group manager you can specific the complete network path of the home directory, for example:

[code]
/Network/Servers/mycompanmy.com/Volumes/data_hd/homefolder/username
[/code]

The home folder can exist anywhere on your network. So what I do, and I also have tons of laptops and many users in many different buildings, is that I set up one central Open Directory Master in our downtown data center. Then each building as a replica server, which has attached storage for the user’s home folders. Then I create a dummy test account in WGM, with the full path of where I want the home folder to reside. Test it out, make sure that the home folder is created on it’s proper share point and then save that test dummy user account as a template user. Then I create my lists of new users to import that fit into that group and import them based on that template. Obviously I don’t want a user who is 8 miles away from the data center to sync their home folder over the WAN. So instead I set up a replica server in their building or as near as I can and I actually BIND the client to that server instead of the ODM, and then I actually put their home folders on storage nearest their location. That way I don’t have 6,000 clients all over the city trying to hit one sever to authenticate and sync home folders.

I do this and it works great, and since they are portable home directories if the user goes off campus and logs off their computer they can still log back in while being off campus, as long as they did their initial log in and sync on the campus network.

[tlarkin]

Well, as of 10 minutes ago I had finally gotten around to having enough time to test out my new OS build. This is what I did:

1) download newest version of InstaDMG
2) Used a 10.5.4 Drop-in DVD
3) Ran the python scripts to create image of the Drop-in DVD
4) Ran the instaup2date python script
5) compiled a 10.5.8 pristine disk image

Now, I didn’t want to have to repack all my extra packages I wanted in Casper into InstaDMG. Since in Casper these were all in DMG format. So I dropped my 10.5.8 base into Casper Admin v7.2 and created a smart configuration. That smart configuration consisted of all the apps I wanted standard in my base OS image, plus the pristine 10.5.8 image created by InstaDMG. Then I compiled them into one flat image.

I created an asr script that would block copy the image I created to the client and then created Smart configurations based off the parent configuration of the asr script. This allows me to add building and location specific packages and scripts, and allows me to keep one master image for every Mac in my enterprise (just under 8,000 mac clients).

Everything worked out great, except it seems Java 6 update did not install for some odd reason. No idea why it didn’t install, but only missing 1 update is not that bad, as I can push that out via policy later on.

Just thought I’d give this thread an update in case anyone else every searched the forums for a similar solution.

[Author]

Posts