[tlarkin]

How exactly did you import them? If you inspect the raw data of a user account that doesn’t work and compare it to one that does work do you see any differences? Negative UIDs, or FQDN paths changed for home directories, or anything like that?

You can enable inspector from WGM preferences.

[tlarkin]

Well you are probably going to have to run a script that wild cards out the desktop out of each user’s home directory on the network share that holds the home directories. Test one out. Mount the share point with the home folders, pick out a user, and do the chmod command to the complete path to their desktop, then try to save something to their desktop.

[tlarkin]

[QUOTE][u]Quote by: jeffh[/u][p]I used passenger to import my users from a tab delimited file, but there were duplicates when creating the user name since I used the first initial and last name. In passenger, I set the parameter to append a number and that is the other thing I wanted printed out. It is too bad that WGM can’t export in a “readable” format.[/p][/QUOTE]

You can get a list of user names by using the dscl command, for example:

[code]

dscl . list /Users

[/code]

You would need to do this into your LDAP and you may need to point dscl to the path of your LDAP to get a full list. You could then pipe it out to text files if you wanted to. You could even go further and do it through a UniqueID range, since Open Directory users are typically UID 1000 and greater, thus leaving out all the local users accounts that are n the systems.

[tlarkin]

[QUOTE][u]Quote by: jeffh[/u][p]Too many students never remember the passwords that you give them and if they create their own, they don’t remember that either and then I or the teacher does not know what it is so there is too much time wasted. I want to print out a list of users and their username and password so the teacher has a list for each class.[/p][/QUOTE]

Jeff, if you are using 10.5 Server then comments and keywords are your best friend for this. For example, when I want to import user accounts into OD I have someone in enrollment send me a spread sheet of every student in the district that will log into my LDAP. Which is only middle and high schools, the elementary and other schools don’t tie into my directory. I have them send me a spread sheet of every students first name, last name, graduation year, building they go to school at, and their 6 digit date of birth. I then create import files off that spread sheet to do the following:

Full Name = First + last

short name = grad year + part of first name + part of last name

password = 6 digit date of birth

Comment = building and grade

Keyword = 6 digit date of birth

So I can see their password in WGM under their account, under the advanced tab in keywords. Their birth date is their password so they should never forget it and since I work in 1:1 Macbook deployment and kids take their laptops home, we need to ensure parent’s can access the student machines whenever they want. So that is why we use their 6 digit birth date as their password. I know it is not the most secure way, but if students set their own passwords they would definitely try to lock their parents out of their laptops.

Comments and Keywords in WGM can be your best friend when it comes to information like that. Then only people who have access to WGM can look that stuff up. Plus if you have the original spread sheets you can parse the data from there and compile it into reports and what not.

Now for faculty and staff they can set their own passwords so I just have to reset it when they forget it, and they hate the 90 day policy to change passwords, but we need their machines to be a bit more secure than the student machines.

[tlarkin]

I have had similar problems in the past. I had it at one point using 10.5.3 and 10.5.4 where WGM would spit out all sorts of errors and give out users negative UIDs. After trying a bunch of different things and talking with our enterprise support from apple we deemed it as LDAP corruption. Exported LDAP users and groups, demoted all servers, wiped and reloaded, then repromoted and then improted back in users and groups. I had to reset master passwords for users and I used passenger to apply passwords to other users.

Haven’t had those problem since, no more crazy WGM errors, no more negative UIDs (still get negative UIDs once in a while), and our problem has been a lot better. We also migrated all clients and servers to 10.5.5. I submitted another enterprise ticket on WGM and they Apple replied that there are some more kinks to work out and it will be fixed in a future major software update. Meaning, 10.5.7 or who knows, 10.6? Couldn’t tell ya.

I also had some DNS issues too, but those are now taken care of. I can’t say that our problems are exactly the same, but I was getting tons and tons of errors in WGM and PasswordServer service was going off the wall. slapd was also bending over my ODM server running at like 380% usage out of the servers four cores.

[tlarkin]

In Server Admin, under the Open Directory service you can archive your LDAP, which does preserve passwords but saves them to an encrypted disk image. I don’t know of anything off hand that will output a password into plain text, that would defeat certain security aspects I am sure.

What is it exactly you need help to accomplish?

[tlarkin]

You probably have to run that command post the user account logging in or being created since it copies the user account info form the user template and I am sure the user template gives ownership to that user of ~/Desktop.

I guess you could also try modifying the default user template.

For the common desktop you should be able to do under managed preferences for that group. You can disable them from changing it and then set it via the command line or push out a pref.

How many Macs are you managing? Are you just using OS X Server to manage all of them, and what versions of Client and Server are you running?

[tlarkin]

[QUOTE][u]Quote by: jeffh[/u][p]That didn’t work.
[/p][/QUOTE]

So if you did a send unix command via ARD admin to the machines in question and did this?

[code]

chmod 555 /Users//Desktop

[/code]

You may need to the add the -R switch if there are already tons of items on the desktop. That should make everything read and execute only for owner, group, and everyone.

[tlarkin]

I had the same problem and it was DNS related with mapping home directories with FQDN. Just to make sure if you use changeip -checkhostname everything resolves right?

Also if you blew away your old LDAP and did fresh imports you may also have to reapply new ownerships since the users probably have different UIDs if you did not copy it from an export. Which is easy to do with Passenger.

[tlarkin]

You could simply set the permissions to their desktop to read and execute only. That would be in their home directory of their account. Then they couldn’t save anything to the desktop period.

[tlarkin]

Well, in an unrelated event, I was doing some work in the dscl interactive command line and saw that the dscl command line in 10.5 now has MCX settings for commands. This could be scriptable, pushed out via ARD admin task server, or third party like Casper.

I actually did not know this was here until earlier this week….

[code]
> -mcxhelp
MCX Extensions:
-mcxread [optArgs] [ []]
-mcxset [optArgs] [ []]
-mcxedit [optArgs] []
-mcxdelete [optArgs] [ []]
-mcxexport [optArgs] [ []]
-mcximport [optArgs]
-mcxhelp

The specifies which record in the directory node is to be operated
on (i.e. ‘/Users/mcx1’). This parameter is always required, but if you are in
interactive mode, you can use ‘.’ to mean ‘current directory’ (the directory
that was last set using the ‘cd’ command).

The parameter is something like ‘com.apple.dock’

The parameter is something like ’tilesize’

The parameter is a path to a sub-plist within an existing key value.
For example ‘mount-controls:dvd:1’ means the 2nd element within the array with
the key name ‘dvd’ within the key called ‘mount-controls’

The is the type of management applied to the key. Legal values are:
‘none’ (not managed)
‘always’
‘once’
‘often’
‘unset’

The is the new value to be used for a key. This parameter can be
specified using the same syntax as used by the ‘defaults’ command line tool.
NOTE: When specifying plist or xml values, you will need to enclose the parameter
in single quotes. For example:
dscl … ‘(authenticate, eject)’
dscl … ‘64.0‘

The MCX extensions follow the same syntax as other dscl comamnds and follow
the same authentication rules as dscl commands. They can be used in both
interactive and command-line modes (with exceptions noted below). For example:

Local command-line example
————————–
$ dscl . mcxread /Users/mcxtest com.apple.dock tilesize
$ dscl -u admin -P apple . mcxset /Users/mcxtest com.apple.dock tilesize always -float 32

Local interactive example
————————-
$ dscl
> cd /NetInfo/Users/mcxtest
> mcxread . com.apple.dock =
** for write-based commands you must first ‘cd’ to the appropriate node and then issue the ‘auth’ command **
> cd /NetInfo/Users/mcxtest
> auth admin apple
> mcxset . com.apple.dock tilesize always -float 32

Remote command-line example
—————————
$ dscl -u diradmin -P apple 10.0.116.132 mcxread /LDAPv3/127.0.0.1/Users/phd1 = =

NOTE: It’s not currently possible to use commands (e.g. ‘mcxset’) that require write access
to the node remotely due to Radar 4122565

Remote interactive example
————————–
$ dscl -u diradmin -P apple 10.0.116.132
> mcxread /LDAPv3/127.0.0.1/Users/phd1 com.apple.SoftwareUpdate CatalogURL
** for write-based commands you must first ‘cd’ to the appropriate node and then issue the ‘auth’ command **
> cd /LDAPv3/127.0.0.1
> auth diradmin apple
> mcxset Users/phd1 com.apple.dock tilesize always -float 62.5

mcxread [optArgs] [ []]
=========================================================
Used to display existing values for MCX preference key(s).

[optArgs]
-v
Specifies which version of the key should be retrieved. If this
parameter is omitted, version 1 keys are searched for.

-o
Specifies the output file where results should be written. If
this parameter is omitted, results are written to stdout.

-format
Specifies how the output should be formatted. If omitted, the
default is ‘text’.

Specify the application domain you want to retrieve keys from. If
this parameter is omitted or is equal to ‘=’ then all application
domains will be dumped for the specified record.

Specify the name of the key you want to retrieve. If this
parameter is omitted or is equal to ‘=’ then all keys will be
displayed.

Examples:
mcxread /Users/mcx1 com.apple.dock autohide
Displays the value of the ‘autohide’ key in the ‘com.apple.dock’ application domain

mcxread /Users/mcx1 -format xml com.apple.dock =
Displays, in XML format, all the keys in the ‘com.apple.dock’ application domain

mcxread . -format plist = =
Displays, in plist format, all keys for all application domains for the current record

mcxset [optArgs] [ [ []]]
=======================================================================================
Used to set values for a new or existing MCX preference key.

[optArgs]
-v
Specifies the version of the key to set. If this parameter is omitted,
version 1 keys will be created.

Specify the application domain in which the key is to be set.

Specify the name of the key being set

Specify the type of management to be applied to the key. See above for
valid values. Additionally, if this parameter is missing or ‘.’ then
an existing key will be searched for and the existing management value
will not be changed. Setting management to ‘none’ is the same as deleting
the key (will remove management for that key in the specified record).

Specify the new value for the specified key. Values can be specified using
the same syntax as used by the ‘defaults’ command line tool. If the value
parameter is omitted, then the existing value for the key will not be updated.

The (optional) value for the Union Policy Key. If present, the UPK *must*
be specified as a dictionary. The valid keys for the dictionary include:
mcx_input_key_names (single string or array of strings)
mcx_output_key_name (single string)
mcx_remove_duplicates (boolean)
mcx_union_as_dictionary (boolean)
mcx_replace (boolean)
You can specify ‘input’ as a shorthand for ‘mcx_input_key_names’.
You can specify ‘output’ as a shorthand for ‘mcx_output_key_name’.
If either mcx_input_key_names or mcx_output_key_name is omitted, the value
of will be used for the missing value(s).

Examples:
mcxset /Users/mcx1 com.apple.dock autohide always -bool 1
Sets the ‘autohide’ key in the com.apple.dock domain to a value of
TRUE with ‘always’ management.

mcxset . com.apple.dock autohide once
Moves the ‘autohide’ key to ‘once’ management, preserving the existing
value of the key.

mcxset . com.apple.dock autohide none
Removes management of the autohide key in com.apple.dock domain for
the current record.

mcxset . com.apple.dock autohide . -bool 0
Sets the value of autohide to FALSE, preserving the existing management level

mcxset . com.apple.dock tilesize . 64.0
Sets the tilesize key to the floating point number 64.0

Examples specifying UPKs:
mcxset . com.apple.test testkey-Raw always ‘(1,2,3)’ ‘{ input=testkey-Raw; output=testkey; mcx_remove_duplicates=1; mcx_replace=1; mcx_union_as_dictionary=0;}’
mcxset . com.apple.test testkey-Raw always ‘{ keya=a; keyb=b; keyc=c; }’ ‘{ output=testkey; mcx_union_as_dictionary=1;}’

mcxedit [optArgs] []
==================================================================
Used to update the value of an existing MCX preference key.

[optArgs]
-v
Specifies the version of the key to set. If this parameter is omitted,
version 1 keys will be edited.

Specify the application domain in which the key is to be set.

Specify the path to the EXISTING key to be edited.

Specify the new value for the specified key path. Values can be specified using
the same syntax as used by the ‘defaults’ command line tool. If the value
parameter is omitted, then the key path will be deleted.
NOTE: It is not permissable to delete an entire key using this command. To delete
an entire key, use ‘mcxset’ and specify a management domain of ‘none’.

Examples:
mcxedit . com.apple.dock autohide -bool 1
Change the autohide key to TRUE, preserving current management setting

mcxedit . com.apple.systemuiserver mount-controls:dvd ‘(authenticate, eject)’
Sets the ‘dvd’ key within the ‘mount-controls’ dictionary to the array
containing two strings: ‘authenticate’ and ‘eject’

mcxedit . com.apple.systemuiserver mount-controls:dvd authenticateeject
Same effect as previous example, just using xml syntax

mcxedit . com.apple.systemuiserver mount-controls:dvd:1 deny
Change the 2nd array element within the ‘dvd’ key of the ‘mount-controls’
dictionary to the string ‘deny’

mcxedit . com.apple.systemuiserver mount-controls:dvd
Remove the ‘dvd’ key of the ‘mount-controls’ dictionary

mcxdelete [optArgs] [ []]
===========================================================
Used to remove management of MCX preference key(s). This is equivalent to using
the mcxset command with a ‘mcxDomain’ value of ‘none’.

[optArgs]
-v
Specifies the version of the key to delete. If this parameter is omitted,
version 1 keys will be deleted.

Specify the application domain in which the key is to be set. Omitting this
parameter, or specifying ‘=’ means all application domains will be processed.

Specify the name of the key to be deleted. Omitting this parameter, or
specifying ‘=’ means all keys in the application domain will be deleted.

Examples:
mcxdelete . com.apple.dock autohide
No longer manage the ‘autohide’ Dock key.

mcxdelete . com.apple.dock
Delete management of all Dock-related keys.

mcxdelete .
Delete management of all keys for the current record.

mcxexport [optArgs] [ []]
=========================================================
Same functionality as the ‘mcxread’ command but produces output in a format that
can later be imported using ‘mcximport’. Usually you will also want to specify
the -o optional argument to cause the output to be written to a file.

Examples:
mcxexport . -o /tmp/export.plist com.apple.dock

mcximport [optArgs]
=============================================
Imports the keys/values previously exported using ‘mcxexport’. Each key/value in
the import file will be processed as if the data were passed to ‘mcxset’. This
means the data in the import file is added to the existing data in the record.

[optArgs]
-d
Causes mcximport to delete any key found in the import file from the
record. This is equivalent to calling mcxdelete for every key in the
import file. The value of the key in the import file is ignored.

Specify the location of the file containing the data to be imported.

Examples:
mcximport . /tmp/export.plist
mcximport . -d /tmp/export.plist

—————

>
[/code]

[tlarkin]

[QUOTE][u]Quote by: Carter[/u][p][quote]’ve got a newly created 10.5.6 server setup as an OD master. DNS is running and Server Admin says Kerberos is running. Now I’m trying to bind my first client to it and it won’t bind.[/quote]

See my original post for all the details.. Thanks.[/p][/QUOTE]

That is where I am getting confused. So, the log says it can’t bind because the server is a stand alone? Yet you say it is configured as an Open Directory Master? Well, what happens if you launch kerberos manually from /System/Library/CoreServices/Kerberos (or where ever it is located, that is just my best guess with out being near a Mac at the moment) and see if you can get an ticket from your ODM manually. Then try to bind, log in, etc and whatever else you are trying to accomplish.

I have a very simple set up at work. 1 ODM 6 T1 ODRs and 10 T2 ODRs, and I just set up open directory, sync’d LDAP, and all of my clients can bind to the ODM or a replica no problem. I didn’t turn on anything special. I also have all my IPs and DNS in order though.

[tlarkin]

Is it an Open Directory Master? You may need to have that enabled for kerberos to work in full effect. I am not sure on that though, but it would be easy to try.

[tlarkin]

Have you guys tried making the server a replica, then after it replicates demoting it to just part of a directory? Just wondering if that made any difference. Kereberos works fine on my servers but all of mine are replicas of a master.

[tlarkin]

That is great. I already have a netboot/imaging document I am working on for my site and I want to publish a whole document on just managing the OS both locally and through MCX. I will be working on that one shortly as well.

[Author]

Posts