Managing Spotlight

spotlightThe long hiatus is over, and The Mac Admin is back.  Here’s a short item to get started with…

Recently, I had been experiencing some frustration as my Spotlight results weren’t including items I’d expected, such as applications when my search term was the correctly spelled application title.  The solution to this is to reset Spotlight’s cache, causing it to be rebuilt.

The command used is  mdutil.  From the man page, mdutil’s purpose is to “manage the metadata stores used by Spotlight”.  Note that mdutil requires root privileges, so sudo may be needed for this command.  I used the command below to fix my own Spotlight problems.

mdutil -E /

The -E flag erases the spotlight cache on the volume(s) specified.  In this case, only the root, or booted, volume is specified, represented by the “/” character.  By adding the “a” flag and omitting the volume specification, the command will erase the caches on all volumes, like so…

mdutil -Ea

The “i” flag can be used to turn indexing on or off for the specified volumes.  For example, let’s say I have a flash drive volume called myFlashDrive. If I want to remove the existing cache and prevent Spotlight from creating a new one, I can run the following command…

mdutil -E -i off /Volumes/myFlashDrive

I hope this is helpful.

NSA Security Recommendations Part 1

securityThe United States National Security Agency has published a pamphlet titled Hardening Tips for the Default Installation of Mac OS X 10.5 “Leopard” (title links to document).  I consider many of these tips to be no-brainers, some to be best practices, and the rest have variable value depending on your organization’s requirements.  This article is the first of a series in which I’ll examine each of these tips, how to automate their implementation, and discuss any caveats for each.

Note: The NSA document, and therefore this series of articles, refer specifically to Mac OS X version 10.5 (Leopard). The ideas and techniques should transfer to 10.6 (Snow Leopard), but be sure to test carefully before putting into production. I will discuss any changes required to implement each recommendation in 10.6.

 

Don’t Surf or Read Mail using Admin Account

This falls into the “no-brainer” category.  I firmly believe that in an organization where the end user does not own his or her computer, there is no reason for that user to have administrative rights on the system.  For every so-called valid reason to grant administrative permission that I have encountered, there is a workaround that can give the user the ability to do their job without granting admin rights.  If you find yourself fighting against an organizational culture that wants admin rights for end users, you can counter with this statement:

 

“If end users have administrative rights, no IT group can make any guarantees or reliably satisfy any SLA regarding the performance, security or continued operability of the systems in question.”

 

Put simply, if unqualified people can mess with the works, then all bets are off.

 

Not being a technical procedure, this concept holds true for Snow Leopard, all other versions of Mac OS X and for any other OS as well.
If you believe you have a valid reason to grant administrative privileges to end users or your organization is forcing you to grant those privileges for a particular reason or reasons, please leave a comment. I’ll do my best to describe a solution to the given problem without granting administrative rights.

Script: Enable Remote Management (ARD)

terminalHere’s another script for zero-touch deployment. If you want to enable Remote Management for Apple Remote Desktop access, this script will get you there.

This script uses the kickstart command which is buried within the ARDAgent application. Entering the following command in Terminal will display the full listing of options and examples available with this tool.

/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart help

I have most commonly enabled the Remote Management service, granted all privileges to a single local admin user used by IT staff, and restarted the agent and menu extra to allow the agent to read the new configuration. The script below will accomplish these items. Reviewing the kickstart help will give you the syntax to write your own script to accomplish different Remote Management configurations.

#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_enableARDforAdminUser.bash
#
# Created 20081231 by Miles A. Leacy IV
# miles.leacy@themacadmin.com
# Modified 20090812 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
# remains intact.
#
# This script is provided "as is". The author offers no warranty or
# guarantee of any kind.
# Use of this script is at your own risk. The author takes no responsibility
# for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
# other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again. When you're certain it's ok, test
# twice more.
#
# This script:
# - enables the Remote Management service (ARD)
# - grants access and all privileges to the user "admin"
# - restarts the ARD agent and the ARD menu extra
#
# This script must be run as root (done automatically when deployed with
# the Casper Suite).
#
# When using the script with a Casper Suite configuration for imaging,
# set it to run At Reboot.
#
##### HEADER ENDS #####




/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users admin -privs -all -restart -agent -menu

Printing For Non-Admins In Leopard

printerThis is a topic I’ve seen covered in many places, however most of the articles I see on this topic only get part of the solution or solve it in a way that creates unnecessary security issues.  In light of this, I’ve decided to talk about what I consider to be the best practices on the subject and the reasons why.

Why Did Apple Limit The Printing System?

Unless you know why Apple imposed security restrictions on the printing system, it seems pretty silly and detrimental to users.  After I understood the reasons behind the change, it made a lot of sense.

When you add a printer in CUPS (Common UNIX Printing System, the printing software under the proverbial hood) and specify a PPD file for that printer, the PPD file can, and often does, run software as root.  This function of the printing system could be used to run malicious code.  To help mitigate this risk, administrator authentication is required if the logged in user is not an administrative user or if the “Require password to unlock each System Preferences pane” box has been checked in the Security System Preferences Pane.  None of this is an issue in the “typical” home computer installation since there is only one user and that user is an administrator.  For environments that require extra security, indicated by having standard (non-admin) user accounts and/or system preference restrictions, this vulnerability is closed.

Make A Spare Key; Don’t Remove the Door

Many of the blogs and forum posts I’ve read on this subject advocate the removal of CUPS security features.  If this sounds like a good idea, ask yourself this; if you wanted to give someone access to your home, would you take your front door off its hinges or give this person a key?  I think the answer is clear.

Understanding The Lock

Before we can make our “spare key”, we need to understand how the lock works.  to do that, we’ll look at the default CUPS configuration file, found at /private/etc/cups/cupsd.conf and how it defines CUPS Operation policies.  Every Mac OS X Leopard installation includes detailed documentation on this subject at http://localhost:631/help/policies.html (link opens in a new window)  For our purposes, we’ll look at the specific section of the cupsd.conf file that covers adding, deleting and setting default printers, but this URL is your best reference for CUPS operation and configuration.

# All administration operations require an administrator to authenticate...
     <Limit CUPS-Add-Printer CUPS-Delete-Printer CUPS-Add-Class
CUPS-Delete-Class CUPS-Set-Default>
          AuthType Default
          Require user @SYSTEM
          Order deny,allow
     </Limit>

The line that reads Require user @SYSTEM is what dictates that administrative authentication is required.

Making the Spare Key

Many people are recommending deleting or commenting out this block of text. This is the equivalent of taking the door off of the hinges that I mentioned. Instead, we can modify this block to grant permission to groups that we define, rather than removing the security feature. If we add user or group names to the line that reads Require user @SYSTEM, those users and members of those groups will be granted the add, delete and set default permissions. See the example below…

# All administration operations require an administrator to authenticate...
     <Limit CUPS-Add-Printer CUPS-Delete-Printer CUPS-Add-Class
CUPS-Delete-Class CUPS-Set-Default>
          AuthType Default
          Require user @SYSTEM @admin @lpadmin @mycustomgroup
mycustomuser
          Order deny,allow
     </Limit>

This modification allows the members of the admin, lpadmin and mycustomgroup groups and the user mycustomuser to add, delete and set default printers. Group names require the preceding “@” character, usernames do not.

Going Further

There are other default policies in the default cupsd.conf file that govern pausing & resuming queues, holding & deleting print jobs, etc. These policies can be modified in the same way. The CUPS help file (link at the top of this article) contains details on 38 different printing system operations that can be governed by the cupsd.conf file and detailed instructions on creating your own policies within the file. Using that information, you should be able to configure virtually any required or desired security settings.

Script: Set Network Time Server

terminalMac OS X provides a one-stop command for viewing and setting several OS configuration items.  The systemsetup command is found at /usr/sbin/systemsetup.

Running the command:

man systemsetup

in the Terminal application will return a full listing of the options available in this command.  This script uses the systemsetup command to configure a target system to use a specified network time server.  The script, as written, is intended for use with The Casper Suite.  Replacing $4 with a static value or using another method of passing a value would be necessary if you are not using The Casper Suite.

#!/bin/bash
##### HEADER BEGINS #####
# scr_sys_setNTP.bash
#
# Created 20090627 by Miles A. Leacy IV
# miles.leacy@themacadmin.com
# Modified 20090627 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
# remains intact.
#
# This script is provided “as is”.  The author offers no warranty or
# guarantee of any kind.
# Use of this script is at your own risk.  The author takes no responsibility
# for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
# other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it’s ok, test again.  When you’re certain it’s ok, test
# twice more.
#
# This script sets a Mac OS X system to use a network time server specified
# by the value passed in the $4 parameter by the Casper Suite.
# Run as an “at reboot” script when imaging with Casper, making sure to type
# double-check the serial in the script parameters before imaging.
#
##### HEADER ENDS #####
systemsetup -setusingnetworktime on -setnetworktimeserver $4
#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_setNTP.bash
#
# Created 20090627 by Miles A. Leacy IV
# miles.leacy@themacadmin.com
# Modified 20090627 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
# remains intact.
#
# This script is provided "as is".  The author offers no warranty or
# guarantee of any kind.
# Use of this script is at your own risk.  The author takes no responsibility
# for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
# other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
# twice more.
#
# This script sets a Mac OS X system to use a network time server specified
# by the value passed in the $4 parameter by the Casper Suite.
# Run as an "at reboot" script when imaging with Casper, making sure to type
# double-check the serial in the script parameters before imaging.
#
##### HEADER ENDS #####

systemsetup -setusingnetworktime on -setnetworktimeserver $4

exit 0

Script: Set Mac OS X Server Serial Number

Continuing with the concept of automated server deployment, here is a small script that changes the serial number in a Mac OS X Sever installation.

A server system that has been deployed via disk imaging or automated deployment systems will boot, but to use the server features, a valid and unique serial number must be entered.  Luckily, Apple provides a command line utility to set the serial number.

The script, as written, is intended for use with The Casper Suite.  Replacing $4 with a static value or using another method of passing a value would be necessary if you are not using The Casper Suite.

#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_setServerSerial.bash
#
# Created 20081231 by Miles A. Leacy IV
# miles.leacy@themacadmin.com
# Modified 20081231 by Miles A. Leacy IV
# Copyright 2008 Miles A. Leacy IV
#
# This script may be copied and distributed freely as long as this header
# remains intact.
#
# This script is provided "as is".  The author offers no warranty or
# guarantee of any kind.
# Use of this script is at your own risk.  The author takes no responsibility
# for loss of use,
# loss of data, loss of job, loss of socks, the onset of armageddon, or any
# other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok, test
# twice more.
#
# This script sets a Mac OS X Server installation's serial number to the value
# provided in $4 by Casper.
# Run as an "at reboot" script when imaging with Casper, making sure to type
# double-check the serial in the script parameters before imaging.
#
##### HEADER ENDS #####

# Change serial to $4 from JSS

/System/Library/ServerSetup/serversetup -setServerSerialNumber "$4"

exit 0

 

Timed Automatic Shutdown With Notification and Client Opt-out

Note: I realize that parts of this script extend beyond the viewable area.  I am considering changes to the site formatting to prevent this in the future, but I have found that if you select the script text in Safari and copy it, the text beyond the viewable area will be captured.

I was recently confronted with a scenario…

  • Client Macs are required to shut down or restart daily at a predetermined time.
  • Clients who are still working at this time should be able to opt out of the shut down.
  • If a client opts out, the event should be cancelled and not recur until the following day.

I solved this problem with a shell script that uses osascript to display the GUI dialog.  The script can be delivered via a policy using The Casper Suite, or by creating a launchd item.

Note that Casper Suite users can declare parameter variables instead of static values if they wish to handle variable assignment through the Casper Suite.

The script follows…

#!/bin/sh

##### HEADER BEGINS #####
# timedForcedShutdown.sh
#
# Created 20050508 by Miles A. Leacy IV
# miles.leacy@themacadmin.com
# Last modified 20050508 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely
# as long as this header remains intact.
#
# This script is provided "as is".  The author offers no warranty
# or guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
# responsibility for loss of use, loss of data, loss of job,
# loss of socks, the onset of armageddon, or any other
# negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok,
# test twice more.
#
# This script will help to enforce a mandatory reboot or shut down.
#
# If no console user is logged in, the script will execute the command
# stored in the $shutdownAction variable.
#
# If a console user is logged in, a dialog is displayed informing the user
# of the number of minutes until shutdown followed by a configurable
# message stored in $notificationMessage.  The dialog contains two buttons.
#
# Clicking the "Postpone" button will cancel shutdown/reboot.
#
# Clicking the "Shut Down" button will execute the command
# stored in the $shutdownAction variable.
#
###########

###########
# Declare Variables
# Edit this section to change the script parameters
###########

minutesN=30
# Number of minutes to count down before shutdown

shutdownAction="echo The system would shut down now."
# The default echo command above is for testing purposes.
# Change to "shutdown -r now" to reboot
# Change to "shutdown -h now" to shut down

notificationMessage="Please save any files you are working on.nn
Click Shut Down to shut down immediatelyn
Click Postpone to postpone shut down until tomorrow evening."
# This message will appear in the initial dialog box following
# This computer is scheduled to $shutdownPhrase in $minutesN minutes.

shutdownPhrase="Shut Down"
# This variable should contain either "Shut Down" or "Restart"
# depending on the value of $shutdownAction.  This string will appear
# in the dialog and will determine the name of the button that causes
# $shutdownAction to be executed.

postponeAlert="Automatic shutdown has been postponed until tomorrow."

###########
# Script Body
# Do not edit below this line
###########

# If no user is logged in at the console, shut down immediately
consoleUser=`/usr/bin/w | grep console | awk '{print $1}'`
if test "$consoleUser"  == ""; then
$shutdownAction
fi

function timedShutdown {
button=`/usr/bin/osascript << EOT
tell application "System Events"
	activate
	set shutdowndate to (current date) + "$minutesN" * minutes
	repeat
		set todaydate to current date
		set todayday to day of todaydate
		set todaytime to time of todaydate
		set todayyear to year of todaydate
		set shutdownday to day of shutdowndate
		set shutdownTime to time of shutdowndate
		set shutdownyear to year of shutdowndate
		set yearsleft to shutdownyear - todayyear
		set daysleft to shutdownday - todayday
		set timeleft to shutdownTime - todaytime
		set totaltimeleft to timeleft + {86400 * daysleft}
		set totaltotaltimeleft to totaltimeleft + {yearsleft * 31536000}
		set unroundedminutesleft to totaltotaltimeleft / 60
		set totalminutesleft to {round unroundedminutesleft}
		if totalminutesleft is less than 2 then
			set timeUnit to "minute"
		else
			set timeUnit to "minutes"
		end if
		if totaltotaltimeleft is less than or equal to 0 then
			exit repeat
		else
			display dialog "This computer is scheduled to " & "$shutdownPhrase" & " in " & totalminutesleft & " " & timeUnit & ". " & "$notificationMessage" & " " giving up after 60 buttons {"Postpone", "$shutdownPhrase"} default button "$shutdownPhrase"
			set choice to button returned of result
			if choice is not "" then
				exit repeat
			end if
		end if
	end repeat

end tell
return choice
EOT`
if test "$button" == "Postpone"; then
	`osascript << EOT
          tell application "System Events"
	  activate
	  display alert "$postponeAlert" as warning buttons "I understand" default button "I understand"
          end tell`
        else
        $shutdownAction
	exit 0
fi
}

timedShutdown

 

Script: Create Mirrored RAID Volume

As of late, I have been tasked with managing Mac servers.  Since a Mac server is really only slightly different than a Mac client, I use the same general methodologies and tools to manage them.  My Xserve hardware standard includes three identical hard disks.  What follows is a script intended to be used with the Casper Suite as a “before” script in a configuration.  It will create a mirrored RAID volume from two of the three drives.

#!/bin/sh
#
##### HEADER BEGINS #####
# scr_sys_createServerMirror.sh
#
# Created 20081230 by Miles A. Leacy IV
# miles.leacy@themacadmin.com
# Modified 20090421 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely
# as long as this header remains intact.
#
# This script is provided "as is".  The author offers no warranty
# or guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
# responsibility for loss of use, loss of data, loss of job,
# loss of socks, the onset of armageddon, or any other
# negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok,
# test twice more.
#
# This script creates a mirrored RAID volume from the first two internal
# disks found.
# It is intended for use on Xserves with two or more identical internal disks.
# Run as a "before" script when imaging with The Casper Suite.
#
##### HEADER ENDS #####
i=0
diskcount=0

while [ $diskcount -lt 3 ]; do
if [ `diskutil info disk$diskcount | grep Internal | grep -c Yes` -gt 0 ] ;then
	if [ $i -eq 0 ] ; then
		raiddisk1=disk$diskcount
	fi
	if [ $i -eq 1 ] ; then
		raiddisk2=disk$diskcount
	fi
	let i++
fi
let diskcount++
done

diskutil createRAID mirror Server HD JHFS+ $raiddisk1 $raiddisk2

Script: Enable SSH & Limit to Admin Group

I’m always looking for ways to get to zero-touch deployment with less effort.  In that vein, I threw together this script which can be deployed as an “at reboot” script in a Casper configuration.  Using this prevents you from having to go into your base image and manually configure ssh.  The script can also be run locally on an existing machine that doesn’t have ssh enabled or limited to the admin group.  It may work with other imaging tools, but remember to test thoroughly.  This script has only been tested with Mac OS X version 10.5.6.

#!/bin/bash

##### HEADER BEGINS #####
# scr_sys_turnOnSshLimitToAdmin.bash
#
# Created 20090320 by Miles A. Leacy IV
# miles.leacy@themacadmin.com
# Modified 20090320 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
#
# This script may be copied and distributed freely
# as long as this header remains intact.
#
# This script is provided "as is".  The author offers no warranty
# or guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
# responsibility for loss of use, loss of data, loss of job,
# loss of socks, the onset of armageddon, or any other negative effects.
#
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok,
# test twice more.
#
# This script turns on remote login (ssh) and activates a SACL to
# limit access to members of the admin group.  It is intended to be used
# on a fresh image where ssh has not been enabled or limited previously.
#
# Run as an "at reboot" script when imaging with Casper.
#
##### HEADER ENDS #####

# Turn on remote login
systemsetup -setremotelogin on

# Create the com.apple.access_ssh group
dseditgroup -o create -q com.apple.access_ssh

# Add the admin group to com.apple.access_ssh
dseditgroup -o edit -a admin -t group com.apple.access_ssh

 

Expect more scripts and tips on building a zero-touch deployment in the future.

iPhone OS 3.0: The Medical Tricorder

So, there are about a bazillion blogs talking about the iPhone update.  I don’t have any exclusive insider info.  I’ll spare you the details you’ve already read about 3,000 times by now.  What I want to talk about are possibilities for the medical field.

One image that stuck in my head from the Apple presentation was one of a sphygmomanometer (blood pressure cuff) plugged into an iPhone.  Then, when the Johnson & Johnson representative described the blood glucose meter, I was struck by the possibilities.  A doctor equipped with an iPhone (or iPod Touch) can get multiple vital sign readings in a digital device which can upload that data to a database, which could be encoded in some sort of national health database, or encoded in a chip inside a MedicAlert style bracelet.  This way, all of the data from your last checkup is instantly available to doctors or emergency medical personnel.  Apple may have just enabled the creation of Dr. McCoy’s medical tricorder.

What’s great about this is that it’s a relatively inexpensive consumer device.  For the cost of a desktop or laptop Mac (with an Xserve as a desirable, but not strictly necessary, option), an iPhone or iPod touch, some medical peripherals for the mobile device, and the services of a system integrator, a doctor can have this system set up fairly quickly and inexpensively.  Over time, the cost of these systems should be less than the square footage needed to store those immense filing cabinets of patient records found in doctors’ offices.  As long as all data is stored in open standards compliant systems, the data will be portable to other doctors, hospitals EMTs, or whomever needs access to the info.