Day: April 14, 2013

Recently we acquired a new firewall to place in between our datacenter and the rest of our network.  This is a fairly standard security procedure used to isolate the servers from the rest of a network that can be loaded with all kinds of nasty spyware, malware and viruses, not to mention really nifty people that want to violate the security of the data.

Security is a two-edged sword for many systems folk. Firewalls are really great security tools, yet they can also get in the way of nice tools that provide access into the servers for remote administration.

Prior to the placement of the new firewall, I often used XDMCP sessions to access my unix servers from the comfort of my office, rather than traipsing to the data center to use the console.  While these servers do have iLOM ports, there are some interface issues that make their use less elegant that I would wish.

After the new firewall entered the equation, I found that my normal XDMCP setup using Xephyr on my iMac no longer worked for some reason.  It appeared that some of the rulesets were blocking either the particular TCP or UDP traffic necessary for the communication to work.  Rather than worry our firewall administrator with troubleshooting the issue, I decided to find another way in via ssh.

It turns out that I could easily tunnel an X11 login session through an ssh session.  Given that I have sshd configured to allow for TCP forwarding I was able to use an Xnest session that was initiated after logging in via ssh.  Here’s the process I used:

First you need to initiate the ssh session while enabling X11 TCP forwarding.  Depending on your particulars this can be done by one of the following commands:

bash-3.2$ ssh -X server.example.com

bash-3.2$ ssh -Y server.example.com

The next command is executed on the server, but the X11 session is actually running under the X11 installation on the local workstation:

Xnest :1 -geometry 1280x1024 -query localhost -terminate

Here’s a breakdown of the command parameters:

:1

determines the X11 screen to be used on the local workstation, screen 0 is the default screen used for X11

-geometry

set the screen resolution to use for the X11 window on the local workstation

-query localhost

determines which host to actually make the connection with

-terminate

closes the XDMCP session once the user logs out

All of this can actually be accomplished with a single step, by chaining the ssh login command with the Xnest command:

ssh -X REMOTESERVERNAME Xnest :1 -geometry 1280x1024 -query localhost -terminate

When doing system administration it is often more convenient to connect to a server through some sort of remote connection setup rather than having to sit at a console in a datacenter.  The comfort of one’s office (or living-room) is often far superior in terms of noise and temperature than the environs of the datacenter itself.

When setting up the RHEL5 server this week here at VSU, I was forced to use the Sun iLOM connection to do the initial install of the server.  While I generally use command-line only tools, the ease of use one gains from the GUI tools can often make some tasks much simpler.  Towards this end I decided to setup the server and my client to allow XDMCP sessions so that I could have full access to the GUI when necessary.

On the server there are a couple of things that you need to configure in order to make this workFirew:

1. Firewall ports
2. GDM configuration options

On the client you will need to configure the OS X firewall, as well as use the correct Xephyr connection syntax.
Continue reading

When doing system administration it is often more convenient to connect to a server through some sort of remote connection setup rather than having to sit at a console in a datacenter.  The comfort of one’s office (or living-room) is often far superior in terms of noise and temperature than the environs of the datacenter itself.

When setting up the RHEL5 server this week here at VSU, I was forced to use the Sun iLOM connection to do the initial install of the server.  While I generally use command-line only tools, the ease of use one gains from the GUI tools can often make some tasks much simpler.  Towards this end I decided to setup the server and my client to allow XDMCP sessions so that I could have full access to the GUI when necessary.

On the server there are a couple of things that you need to configure in order to make this workFirew:

1. Firewall ports
2. GDM configuration options

On the client you will need to configure the OS X firewall, as well as use the correct Xephyr connection syntax.
Continue reading

One of the standard methods of configuring Mac OS X in the enterprise has become known as the magic triangle or golden triangle. This is generally described as a setup involving Active Directory (AD) for authentication of the clients and services and Open Directory (OD) for managing the client preferences.  The triangle comes from the fact that you have the Mac clients talking to AD, the clients also talking to OD, and the Mac server talking to AD. (Apple officially calls this the magic triangle setup in the Snow Leopard Server Open Directory Administration documentation.)

One of the issues I ran into was granting a non-admin in AD the ability to perform administrative functions on the clients bound to AD.  The way this is handled with the Windows clients is for the particular AD user to be a member of a group that grants local administrator privileges.

Unfortunately there is no simple equivalent on the OD side of the equation to allow this for the technicians working on the Mac OS X clients.  If you add an AD user to the system level group Open Directory Administrators using Workgroup Manager (WGM) this has no effect on whether a user is granted local administrator privileges to a connected client machine.

The solution to this involves:

1. creating a group in OD to hold the members of AD that should have local administrative privileges,
2. adding this OD group to the requisite local workstation groups to mimic the standard administrative privileges, and
3. adding the OD group to the sudoers file

Continue reading

At work we currently use version 3.3.3 of the Luminis III platform by SunGard Higher Education.  This product handles our mail and portal needs for the time being.  While it is definitely not the best web-based mail client in the world I have seen worse.

Recently I had received a notice from a friend that he couldn’t read my signed e-mail in the web-client.  After having him forward the message to me as an attachment, I determined that the problem had to do with my digital signature.

I use Apple’s Mail client for OS X 10.5.  Currently I also have GPGMail by Stéphane Corthésy installed so that I can seamlessly use my GPG keys to sign and encrypt my e-mail.  After sending an unsigned message and finding out that it went through with no problems, I started investigating the options provided by GPGMail.

It turns out that I had checked the option to use OpenPGP/MIME by default.  Apparently this creates an message body that the Luminis III web-mail client can’t read.  So if you are running into this problem with a web-based client, check to see if your messages are going out as OpenPGP/MIME.

At work I am in charge of running our Macromedia Adobe Contribute Publishing Server.

Since I like to duplicate my work environment on my laptop for local development, I needed to install JBoss 4.0.5.GA.  I won’t go into why we are running such an old version, that’s all Adobe’s fault.

Installing JBoss

1. Download the JEMS installer for 4.0.5.GA from the JEMS Installer Downloads page at jboss.org.
2. Execute the installer:
   java -jar jems-installer-1.2.0.GA.jar
3. If you get asked to allow java to talk through the firewall, choose Allow.
4. The default installation location is: /Applications/jboss-4.0.5.GA

   It will create the directory if it doesn’t exist already.

5. During the install process choose the Advanced install method.  This allows you to pick your database environment, as well as making the process of securing the JMX Console and JBoss Web Console much easier.

Starting JBoss

1. Open a terminal
2. Goto the install location binary directory (I used the default)
   /Applications/jboss-4.0.5.GA/bin/
3. execute run.sh
   ./run.sh -b 127.0.0.1 &
4. You will see the output of the startup process show up in the terminal window.

Stopping JBoss

1. Open a terminal
2. Goto the install location binary directory
   cd /Applications/jboss-4.0.5.GA/bin
3. Run the shutdown script (don’t forget to authenticate!)
   ./shutdown.sh –server=localhost:1099 –shutdown -u admin -p password

Notes

• The default port for the HTTP connector is 8080
• The SSL connector is disabled by default

In the application selection process for 10.5, the X11 maintainers elected not to include Xnest.

While most users will probably not need this, since you can export X11 application through a SSH connection, sometimes it is quite handy to have the entire gui session available from a remote server.

I use this when managing some of my Solaris servers. With X11 on 10.4 this was readily available, but after installing 10.5 I found that it had not been included. Initially I just copied the binary from my 10.4 install into the expected location and tried to use it. However, as I expected, the results were not particularly satisfactory, given that the binary was built against a different X11 source tree.

After posting some of my compile issues to the X11-Users mailing list (archives are here), the code maintainer released a patch to the xorg code that fixed the symbol issues that had reared their ugly heads.
For those who are interested in making it work here’s what you need to do:

1. Follow the first seven lines under the section Source installation on the XDarwin wiki page
2. Change the configure instruction line to be as follows:
   ./configure --prefix=/usr/X11 --enable-xnest=yes --with-mesa-source=`pwd`/../Mesa-6.5.2
3. Continue with the rest of the source instructions as posted in the wiki page
4. After copying the new Xquartz binary over, copy the Xnest binary as well:
   sudo cp hw/xnest/Xnest /usr/X11/bin/
5. Don’t forget the manpage:
   sudo cp hw/xnest/Xnest.1 /usr/share/man/man1/

Now you have a nicely patched install of the latest fixes for Xquartz as well as the Xnest binary.

If only compiling Xpehyr was working now…sigh.

Resources:

• Applications supplied with the default X11 install on 10.5

When doing system administration it is often more convenient to connect to a server through some sort of remote connection setup rather than having to sit at a console in a datacenter.  The comfort of one’s office (or living-room) is often far superior in terms of noise and temperature than the environs of the datacenter itself.

When setting up the RHEL5 server this week here at VSU, I was forced to use the Sun iLOM connection to do the initial install of the server.  While I generally use command-line only tools, the ease of use one gains from the GUI tools can often make some tasks much simpler.  Towards this end I decided to setup the server and my client to allow XDMCP sessions so that I could have full access to the GUI when necessary.

On the server there are a couple of things that you need to configure in order to make this workFirew:

1. Firewall ports
2. GDM configuration options

On the client you will need to configure the OS X firewall, as well as use the correct Xephyr connection syntax.
Continue reading

A few weekends ago I had the privilege of being assigned to evaluate an iPad for use as a support tool by my boss. (thanks Ike!)

The first order of business was to figure out some basic tasks that we would need to accomplish as sysadmins that we could realistically use the iPad for.

Remote control via ssh for a unix server

For ssh I already had the iSSH application by Zinger-Soft [iTunes]. Fortunately they updated the application to be a universal application for both the iPhone and the iPad. I had used it with a fair amount of success on my iPhone in the past to reboot several servers over both WiFi and 3G data, most notably when I needed to reboot a MySQL server will on the way to Atlanta on I-75.

I was pleased with the changes that they made for the expanded screen real estate of the iPad. The split screen function when in portrait mode is quite useful when you need to juggle two connections at the same time, even if it can be a bit confusing at first.

The ability to handle X11 forwarding is also a nice touch, because there are some administration activities that require the GUI even on a unix system (think that favorite Oracle installer that we all know and love).

Remote access via RDP to Windows servers and desktops

Generally this is actually an easier task to sort out, due to the number of RDP clients that exist of the iPad. There are more clients out to handle this than you can shake a stick at, however they don’t all have the same features. The fly in the ointment with RDP support is the ability to work with the widest variety of server and desktop os installations, with encryption, etc. The large majority of them did state that they supported Server 2003, 2008 as well as Windows XP, Vista and 7.

What took some doing to was to find a client that would work in our security environment. Currently we require that all off-site RDP connections be tunneled through SSH. It turns out that none of the RDP clients out there support this yet. One of the most promising from this standpoint looks like iTap RDP by Honeder Lacher Wallner Softwareentwicklung OEG [iTunes]. This client supports FIPS and NLA. They have a nice compression algorithm that makes the connection work well even on a 3G network. While they don’t currently support RDP over SSH tunnels this is a planned feature in a future release.

Another possibility, depending on where we go with our VDI initiative is Wyse PocketCloud by Wyse Technology [iTunes]. PocketCloud for iPad supports both VMWare View connections and standard RDP connections.  This is the application I ended up testing, and I must say, I was pretty happy with it.  The manner in which it handles the mouse functionality is superb.  The support for the application seems a little subpar, but there is a fairly active forum.

Currently the only solution that I was able to find was to use iSSH for a tunneled VNC connection, since iSSH supports this. Of course, this means that you will need to install a VNC server on your desktop or server, but in my testing it did seem to work fairly well if a little sluggishly. One advantage to this is the fact that Mac OS X includes a VNC server by default, making connections to Mac servers and clients a fairly easy thing to accomplish. With WIndows 2008, it was a little more challenging due to the changes in security that were added by the UAC system from MS. I was unsuccessful in getting RealVNC Enterprise trial to work properly, however the beta of TightVNC worked nicely.  The latest version of iSSH does support ssh tunnels.  When you combine this with multitasking support on iOS 4 you then have ability to access a remote machine through a perimeter firewall without the need for VNC server. Unfortunately, this support is useless on the iPad until we get iOS 4, but it is nice to know that it is there.

Access to various web-based support services

This is not really much of a challenge, however it is worth mentioning that there are a number of web-based systems that don’t cooperate easily with Mobile Safari for various reasons. Some of them are Flash-based, which obviously won’t work, others are just not designed to work properly on a touchscreen device. Your mileage may vary.

Password storage

As is the case with most system admins, I have way too many passwords to keep up with than I can easily remember. When you combine that with the necessity of locking accounts after a certain number of failed attempts, it becomes rapidly necessary that I have a secure method of carrying passwords with me.

On my iPhone I have been using Lockbox Pro by GEE! Technologies [iTunes] for a while now, however in investigating an app for the iPad I spent a fair amount of time playing around with SplashID by SplashData [iTunes]. (Also, it looks like GEE! Technologies is having issues, since the company website link for their app in the AppStore doesn’t work and the support website looks fairly similar to the myriad of web-squatter websites that are out there.) Now if you use password managers, you most likely have run into SplashID before. One of the major points in it’s favor is the use of both 256-bit Blowfish encryption. New for the iPad version is the ability to use a swipe pattern to unlock the application, similar to the process that you can use to unlock some Android-based devices. It also supports numeric and alpha passwords for unlocking the database.

One of my favorite features of Lockbox Pro is the ability to have a large number of additional fields for an entry, not just a username and password. SplashID also has this feature. Also, another great advantage to SplashID is the ability to have a desktop application (both Mac and Windows) that you can sync your mobile device to. Not only does SplashID support the iPhone, iPad and iPod Touch, they also have clients for Android, WebOS, PalmOS, Blackberry and Series 60. The simple fact that I can sync my password data between multiple devices as well as my desktop makes this an ideal application. SplashID also supports auto-fill for websites, if that is your thing.  Of course, if you want it all on your the iPhone, iPad and the desktop your are going to have to fork out a lot of money, since each application is a separate charge.

Access to notes, procedures and documentation

As an admin, one of the most useful applications is one that allows me to have notes, procedures and documentation available when I need it. It can be difficult the juggle a keyboard, serial cable and a big fat, dead tree manual when in a datacenter, so having the essential docs on hand in a mobile environment is a must.

I think there are actually more possibilities in this particular category than any other I researched for this post. I have been a big fan of Evernote by Evernote Corp [iTunes] since it was released. It syncs to both the iPhone and iPad, as well as to the client on my desktop. Combine those abilities with web-clipping functionality in both Safari and Firefox on the desktop and you have a great tool for support.

Of course, sometimes you will need to store large documents, and unless you feel like paying for storage with Evernote, it might not work to upload the entire Solaris 10 reference, or the latest edition of the PHP function reference. To begin with I started searching for the perfect sysadmin application in the App Store, then I realized that I already had it, iBooks [iTunes]. With iBooks 1.1, Apple made PDF storage easy. Just drag the PDF into your Books section in iTunes and sync. Voila! Of course to make the docs more useful, they need to be converted into eBook format so that you can use the highlighting and search features, but in a pinch a raw PDF is quite handy.

I wish I could do that

There are still somethings that I wish I could do with the iPad, however I doubt I will get them.  One item on my wishlist would be a mechanism to allow me to use the iPad as a serial terminal.  Frequently I have to use a laptop with a serial port (or USB-to-serial adapter) to connect to a server in order to access the console.  It would be really nice to be able to do this from the iPad.  Another feature that would be nice would be something along the lines of the certificate management that you have in the Keychain Access application on the Mac.  I can see where it could come in handy to be able to import and export SSL certs from the device.

When doing system administration it is often more convenient to connect to a server through some sort of remote connection setup rather than having to sit at a console in a datacenter.  The comfort of one’s office (or living-room) is often far superior in terms of noise and temperature than the environs of the datacenter itself.

When setting up the RHEL5 server this week here at VSU, I was forced to use the Sun iLOM connection to do the initial install of the server.  While I generally use command-line only tools, the ease of use one gains from the GUI tools can often make some tasks much simpler.  Towards this end I decided to setup the server and my client to allow XDMCP sessions so that I could have full access to the GUI when necessary.

On the server there are a couple of things that you need to configure in order to make this workFirew:

1. Firewall ports
2. GDM configuration options

On the client you will need to configure the OS X firewall, as well as use the correct Xephyr connection syntax.
Continue reading

While re-loading the OS and apps on my iMac at work, I ran into major issues whilst updating MS Office 2008.  When running the first update, Office 2008 SP1 (12.1.0) I had no problems, however none of the other updates would run.  I kept getting the error “You cannot install Office 2008 Updates on this volume. A version of the software required to install this update was not found on this volume.”

At first I thought that this might be due to some permissions shenanigans revolving around my AD/OD setup, since the logged in user was not a local admin, but had been granted administrator privileges through a nested group trick.

After more searching I ran across a post on the forums MacRumors.com pointing out problems when running updates on an Office 2008 install that had been altered by using Monolingual or XSlimmer.

Both of these programs were developed to slim down the sizes of binary applications on OS X.  Monolingual strips the “additional languages” from OS X programs and operating system files, while XSlimmer is designed to remove both the extra language information and the unused binary code in a fat binary.  I have never used either of these programs, since I was not concerned about the amount of disk space they utilize.

After more searching, I ran across a post in the Entourage Help Pages discussing troubleshooting Office 2008 installations.  While this page also mentioned issues with installations being altered by Monolingual and XSlimmer, it also pointed out an issue with a workaround created to handle a bug in how Safari deals with the docx file extension.  While the automator workflow mentioned does not appear to actually affect anything other than the names of files, it did jog my memory about something else Safari related that occured when installing Adobe CS 4 earlier the same day.

While installing CS 4 and the available updates, I was prompted to not only quit Safari, but also to quit XMarks for Safari.  For those that don’t know, XMarks is a great service for synchronizing your browser bookmarks between multiple machines, platforms, and browsers.

On a hunch I quit XMarks for Safari, as well as the browser itself.  No dice, I still got the error.  Knowing how easy it would be to reinstall the helper application, I uninstalled XMarks.  Eureka!  The Office updaters now ran without a hitch.  So, if you are having this problem, try deactivating or removing anything plugins that effect the default nature of Safari.

Lately I have noticed that when browsing the web my external hard drive would spin up when there seemed no need.  I had just given into the mysterious and not concerned myself with this until yesterday.

After a few searches, I turned up a post on Apple’s discussion boards entitled Safari pauses & spins up ext HDs with ATS Autoactivation errors.  While I have not found the errors in my logs refered to by the OP, I have noticed the exact same symptoms.

Using the symptoms and discoveries by W. Raideer and strangebirds as a guideline, I found a solution to the issue.  While this may in fact be a bug, it turns out that if you disable Spotlight on the external drive this activity ceases, at least in my case.

To quote the Help documentation for Font Book on the Automatic Activation feature:

Note that if you turn off Spotlight searching for any folder or disk connected to your computer, Font Book can’t find and enable fonts in those locations.

After listing my external drive in the Spotlight preference pane section labeled Privacy, I have ceased to have this particular issue.  While this may not be advisable or desirable, depending on the content of the external drive, I have noticed no detrimental effect by disabling Spotlight on the drive.

I noticed something today in the new iTunes Store interface.  When you hover over a song in the store you are presented with a nifty play icon that replaces the track number in the album listing.  This is quite similar to the iTunes Store interface functionality on the iPhone/iPod Touch OS.  Clicking on the play icon or double-clicking on the song title starts the 30-sec preview of the track.

Just like the iPhone version, the new iTunes Store desktop interface then displays a round blue icon with the ubiquitous stop square with the progress of the 30-sec preview rotating in a contrasting blue color.

Clicking on the stop square does not always stop the playback of the preview.  What should happen when you click on the stop icon is that the preview ceases to play and the icon goes away to be replaced once again by the track number.  On some albums in the store this function works.  On other albums it does revert back to the track number, however the preview continues to play until it finishes or until you hit the pause button in the iTunes window.  Also when you let the preview play out to the end, the stop icon does not disappear either, to release the icon you must click the stop button even though the preview has completed.

This definitely seems like a bug in the interface.  I have confirmed this in both the Mac OS X and Windows versions of iTunes 9 running on Snow Leopard and Windows Vista, respectively.

Finding the right case for you iPhone can be a challenging and somewhat frustrating process.  Not only do you have to contend with the sheer number of case types, but you also have to balance the needs of your particular listening and working environments.  If you are like me you may have found that you actually need more than one type of case.  While it would be nice to have the ultimate iPhone case that I could comfortably and easily use in any situation, I have yet to discover it.

Recently I purchased an Otterbox iPhone 3G Defender case for use with my iPhone 3GS.  The main motivation behind this particular purchase was the ruggedness of the case.  Next summer I am going to be riding a self-supported bike tour with a couple of friends in Pittsburgh, so I was in the market for a case that could handle the shocks, drops and dust that I would encounter both on the tour and while training for it (man, do I ever need to start the training).

My daily driver of a case to this point has been a red and black (Goooo Dawgs!) iFrogz Luxe.  This is a very nice case that adds minimal bulk to the iPhone design while providing a basic level of protection from scuffs and bumps that can occur during average daily use.

While the iFrogz Luxe turned out to be great for a daily case, it became rapidly apparent that it was not going to withstand the rigors of an extended bike tour and training process.  After determining this, I turned to the Otterbox.  Otterbox is known for making very rugged cases, waterproof cases, and water proof equipment boxes.

Otterbox states that the iPhone 3G Defender is not intended for protection against water intrusion, due to it’s openings for the microphones and speakers of the iPhone 3G design.  This being said a friend that also has one said that it will protect your phone from an occasional spill, like when someone knocks over a coke on the table at a meeting.  I can personally attest to the drop and bump protection, having purposefully dropped my phone while incased onto a concrete sidewalk from a height of three feet.  (Not recommended for the faint of heart!)

I really liked the additional grip that the case provides.  Sometimes the slick plastic back of the iPhone 3G and 3GS can be a little hazardous.  The buttons are fairly easy to operate even while incased in the poly-carbonate shell and silicon rubber cushioning.  All of the ports with the exception of the speakers and microphone are firmly covered with silicon rubber flaps that interlock into the plastic shell when not in use.  This is great, since the water sensors on the 3G and 3GS are located in the headphone jack and inside the dock connecter port.  With the openings firmly covered and protected it is possible to fudge a little on reporting water damage when attempting to get a warranty or AppleCare replacement.

If you want to dock your phone while in the 3G Defender, however, you maybe out of luck depending on the dock connector design.  Due to the nature of the case design, there is a fairly deep recession that has to be navigated in order to connect anything to the dock connector.  A cable or two won’t be a problem, but if you use a device like the iHome or a car mount then you will most likely be out of luck, unless you buy something like the iStubz from CableJive.

Another problem you may run into has to do with the sheer extra bulk added by the case.  I frequently use my iPhone while in my 2007 Toyota Tundra, both for music and for navigation.  I mounted my iPhone on the console in place of the ashtray using a mount and device holder combination from ProClip.  While the combination is a bit pricey, I like their product choices.  Fortunately my device holder is adjustable enough to hold the 3G Defender case, but unfortunately the dock connector plug does not extend high enough to connect with the iPhone while in the case.

Beyond those two issues, which are fairly easy to overcome, I am still having trouble getting used to the confinement of the screen itself.  The 3G Defender enclosure leaves all of the screen itself usable, but some functionality is tricky when using the onscreen keyboard and sliders.  This will be especially noticeable by those of us that don’t trim our fingernails all the way to the quick.  I know that many of my female friends, as well as some males, will find the edges of the case get in the way.  The one application feature I am having the most trouble with is the address bar in mobile Safari.  When using Safari and trying to get the browser to re-display the address bar, I find myself having to use the side of my finger tips instead of end of the finger.

I would judge that the 3G Defender is a great case for use in a physically demanding environment.  I am not completely sold on its use in an average daily environment that doesn’t involve lots of physical abuse.

Pros

• shock protection
• dust protection
• better overall grip (especially for individuals with larger hands)

Cons

• dock connector recessed farther than desired
• added bulk may make accessories unusable without additional cabling
• some on-screen functionality can be impaired due to the side of the case surrounding the screen

Overall I would say this is an excellent case and well worth the price being charged for it.  Paying $50 to protect your $400 investment is a no-brainer.