Tag: Mac

  • To install macOS Mojave, or not to?

    InstallMojave

    Just the other day macOS Mojave was released and now the armies of Macs armed only with the AppStore are silently downloading the installer and ready to upgrade. You can’t hurry too fast to be on the bleeding edge, hurry faster!

    Just in case you don’t want everyone to install macOS 10.14.0 (dot zero!) in the first week of its release here’s a way to slow down the upgrade hordes using Erik Berglund’s AppBlocker script. Erik Berglund is also the author of ProfileCreator (for creating profiles) and the author of many other great scripts.

    Note: for true binary whitelisting check out Google’s Santa project and Upvote (and Moroz and Zentral, two other Santa sync servers).

    Step 1. Get it

    Clone or download the AppBlocker project from GitHub

    AppleBlockerProject.png

    Step 2. Do it

    Edit the AppBlocker.py script with the Bundle Identifier of your app to block, in this case for the Mojave installer from the AppStore it is:

    com.apple.InstallAssistant.Mojave

    You can also edit the alert message, and the icon that is shown, as well as decide if the blocked app should be deleted or not. The script is easy to edit in BBEdit, or nano (in Terminal). Use whatever your favorite text editor is to make the necessary changes.

    # List of all blocked bundle identifiers. Can use regexes.
    blockedBundleIdentifiers = ['com.apple.InstallAssistant.Mojave']
    
    # Whether the blocked application should be deleted if launched
    deleteBlockedApplication = False
    
    # Whether the user should be alerted that the launched applicaion was blocked
    alertUser = True
    
    # Message displayed to the user when application is blocked
    alertMessage = "The application \"{appname}\" has been blocked by IT"
    alertInformativeText = "Contact your administrator for more information"
    
    # Use a custom Icon for the alert. If none is defined here, the Python rocketship will be shown.
    alertIconPath = "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/Actions.icns"

    UPDATED NOTE:

    To determine the Bundle identifier of other applications you can use osascript

    osascript -e 'id of app "iTunes"'
    com.apple.iTunes

    If you want to block more than one app use a comma separated list in the AppBlocker.py script:

    ['com.apple.InstallAssistant.Mojave','com.apple.iTunes']

     

    Step 3. Run it

    Put the script where you want to run it. The default location as defined in the launchd plist included with the app is “/usr/local/bin”. Put the launchd.plist in “/Library/LaunchDaemons/” and start up your launchd to block your apps!

    launchctl load /Library/LaunchDaemons/com.github.erikberglund.AppBlocker.plist

    Step 4. Automate it

    For bonus points we automate! Bundle it all up in a package with munkipkg, then distribute it with Munki to all your clients.

    Using munkipkg is easy. Create the folder using munkipkg

    ./munkipkg --create AppBlocker
    
    munkipkg: Created new package project at AppBlocker

    Then you fill the payload folders with those items you downloaded from the AppBlocker project. LauchD plist in the LaunchDaemons folder and AppBlocker.py in the “usr local bin” (create each nested folder).

    AppBlocker-Munkipkg3.png

    And finally create a post install script (no “.sh”) with the launchctl action to start your plist.

    AppBlocker-Munkipkg4.png

    Last but not least add this package to your Munki repo as an unattended managed install  that everyone gets. Of course, only do this after testing your package locally somewhere to verify that it works properly. Remember the saying: “You may not test very often, but when you do it’s always in production.” Be very careful with your testing but always automate all the things.

    Updated after the initial blog post to explain how to add more than one app to block, and how to use osascript to determine the bundle identifier.

     

     

     

  • PostLab: FCP X + GitLab

    Final Cut Pro X and Shared Projects: FINALLY !!

    I’ve been playing with PostLab the last few days. It’s a free and open source app that lets you use GitLab with Final Cut Pro X to do version control of editing projects. Yes, this is very cool. Shared Projects, Read only versions of projects. Versions. Of. Projects. Commented. Makes it awesome to work on projects together.

    Of course, like any workflow app it can be annoying to those who don’t want to play along. But I like the price and the simplicity of it. Using GitLab means you can have free private repos for shared project sharing. You can use their website on the internet to act as your gateway or you can setup your own internal GitLab server. For Free.

    PostLab is pretty awesome with its Final Cut Pro X project sharing and it’s not $100K app that is expensive to setup and everyone hates it. It’s free and some people might not use it, but it could allow for effective remote workflows and nice finely grained version control for projects that need it even in an internal on site production SAN environments.

    It’s worth checking out.

    https://www.postlab.app/

    Install PostLab, and the Xcode cli tools. Then launch PostLab, agree to the license, authorize accessibility for PostLab to enable it to launch FCPX. And you’re on your way.

    All that’s left is to configure a GitLab account. Set u a group and a project. Configure token in GitLab to Enable PostLab with GitLab account access. Then start sharing projects. Enjoy.

    Lots of cool set up videos on the PostLab website. Robot narrator says Jit-Lab instead of “Git” Lab, but it’s still worth watching. Do it now.

    PostLab-FCPX-added-fx

     

  • P5 on the Jellyfish: Archiving Gotchas

    TL;DR

    Using Archiware P5 to Archive files to tapes is awesome, but watch out for little things you might miss, such as the path to the files and backing up your Archive Db.

    P5 Archive on the Jellyfish

    Using P5 Archive with the Lumaforge Jellyfish is a great way to preserve your digital archives. See this post for how to set up P5 on the Jellyfish

    Using Archiware P5 for archiving makes sense. You want your completed projects and original camera footage on LTO tape. But how do you do archives? There are several different ways, and there be gotchas.

    P5 Archive vs P5 Archive app

    Using P5 Archive to manually archive completed projects to LTO tape is a process of logging into the server via a web browser and selecting the the project folder you want to archive to tape.

    The completed project folder could be on the storage visible to the server or it could be storage the client sees. And that can make a difference. Where the storage is mounted is different on a Mac vs Linux. Its’ the difference between “/Volumes” and “/mnt”.

    The same Jellyfish storage, either SMB or NFS, when seen on a Mac is mounted by default at “/Volumes” (this can be changed but for most people leave it at the default). But when archiving the storage via a Jellyfish client you will get “/mnt” path.

    p5-smb-test2.png

    Using the P5 Archive app, which is a Mac only companion application to P5 Archive, to run the archives you will see the storage archived as “/Volumes”.

    This first Archiving gotcha is if you’re archiving the Jellyfish storage with the web application of P5 Archive you will have to find your footage and restore from the “/mnt” path vs if you’re archiving from the P5 Archive app which is running from a Mac and will see and store the footage using the “/Volumes” path.

    All this to say that using both ways to archive may double up your footage in your archive which may be unintended. And from a restore in the web browser finding your footage may be confusing if you’re used to seeing it mounted in “/Volumes” and you actually find it under “/mnt”.

    Note: the reason to use the P5 Archive app is because of the simplicity of right-clicking files in the finder which are on your storage and telling them to archive right then and there. Files are copied to tape then the original files on the storage are replaced with stub files. Right-click again to restore. Simple.

    p5-archive-app-job-monitor.png

    Backup your Archive!

    Don’t forget to backup your archives. Or rather, your archive Db. A more recent addition is the ability to automate the backups on the Archive index, so don’t forget to enable it.

    In the managed index section, choose your Archive index.

    Set the target client where the backups are going and the backup directory. Choose a time and don’t forget to enable it (check the checkbox and hit apply before closing the windows).

    Note: Repeat this setup for each Archive index you want to backup.

    Archive Backup db setup3.png

    Monitoring your Archive!

    Don’t forget to enable email notifications for your P5 server to get your inbox full of status notifications and errors and other important stuff. But if you want to cut down on email notifications or you have multiple P5 servers (many different clients, perhaps), then you might want to check out Watchman Monitoring and the P5 plugin that is built-in). Find out easily when your tape pools are getting low, the tape drives needs to be cleaned, the support maintenance needs renewing etc. All in one dashboard. How convenient!

    Maybe everything is going well…

    Watchman-P5-info.png

    Or maybe not!

    Archiware-P5-Jobs-Watchman-tapes-required.png

     

  • Install P5 on the Jellyfish

    TL;DR

    You can easily install Archiware P5 backup and archive software on a Lumaforge Jellyfish storage server. Once you’ve done that you can backup to tape or disk or the cloud directly or through another P5 server. Backups are good. Archive are good. Restores are better.

    P5 install on the Jellyfish (Linux) How-To:

    Note: Thank you to Lumaforge’s CTO Eric Altman who gave me some basic instructions to get me going.

    Step One: Download the latest Linux P5 rpm file 

    http://p5.archiware.com/download

    p5-Linux-rpm.png

    Copy the downloaded rpm file to the root folder of your SMB or NFS file share.

     

    Step Two: Install the rpm file

    Open Terminal and ssh into your Jellyfish. Login as root or as another appropriate user.

    yum localinstall /mnt/Primary/ShareSMB/awpst554.rpm

     

    Step Three: Browse to server on port 8000 to test that the server is up

    e.g. https://jellyfish:8000

    Or in Terminal and ssh into your Jellyfish and ping your P5 server

    cd /usr/local/aw 
    
    ./ping-server
    
    Pinging PresStore application servers...
    
      lexxsrv pid: 4840 (server is running)
    
      lexxsrv url: http://127.0.1.1:8000/login 
    
    Pinged 1 from 1 application servers.

     

    Step Four: Decide if the Jellyfish storage will be a P5 client or a server.

    Note: If configuring the Jellyfish storage as the main P5 server you may wish to set up a user that only has access to the shared volumes.

    For my set up the Jellyfish storage is going to act as a P5 client to a main P5 server on a Mac mini (yes, they are useful for something). The Mac mini is this case is the P5 server and is attached to theOverland tape library via a Promise SANlink2 Thunderbolt Fibre Channel adapter.

    NEOs-T24-large-new.jpg

    macmini-ports.png

     

    Step Five: Set up the Jellyfish storage as a P5 client

    Log into your P5 server and add the Jellyfish by the IP known to the P5 server. In this case the P5 server is connected via 1GB to the Jellyfish in Port 1.

    P5 clients jellyfish setup1.png

    Note: You could also choose to plug into the Jellyfish via a 10GB port, but in my setup these 10GB ports are reserved for the edit stations. You should choose what’s appropriate for your setup.

    P5 clients jellyfish setup2.png

    Resource utilization of P5 on the server is low, topping off generally at 1GB of RAM at peak usage. While this does technically take resources from ZFS caching, the impact should be super minimal.

    In my observations the CPU never spiked too high while both serving NFS and SMB mount points to multiple Final Cut Pro X workstations even with backups or archive jobs going to tape at the same time.

    jellyfish-cpu-resources-graph.png

    More Jellyfish P5

    See the follow up post on Archiving gotchas with the Jellyfish here

     

  • macOS Server is dead. Long live macOS.

    Yes, it’s been a hot topic in the MacAdmin community both on Mac Enterprise list (oh no it’s the end of the world!) and MacAdmins Slack (told you it was coming, don’t be surprised).

    My professional opinion is: “Don’t panic!”

    My MacDevOps conference is all about supporting MacAdmins who have been writing code as infrastructure to manage Macs. And do it while replacing macOS Server in the server room with Linux and other OS.

    Xsan is staying in macOS Server so I am happy and that’s my main use for the Mac Mini and macOS Server.

    I have other Mac Minis doing file sharing for small work groups and moving that out of Server.app in the last revision was unfortunate (it is in the standard OS and usable there but less manageable). There’s also Synology and QNAP NAS for small workgroup file sharing and so much more And many enterprise storage vendors for larger setups.

    Imaging has been dying a slow death for years and has been replaced with a thin or “no imaging” concept supported by tools such as AutoPkg and Munki.

    Profile Manager is a demo version of MDM and should not be used to actually manage Macs.

    Wikis, DNS and Mail should be hosted on Linux, in VMs, AWS, GCP or anywhere other than macOS Server so no problem.

    Overall it might be disconcerting to some. But change is constant. And especially at Apple change comes fast and often. We have to get used to it.

    Reference:

    Apple Support article

    Apple to Deprecate Many macOS Server Services – TidBITS http://tidbits.com/e/17760

  • macOS High Sierra vs Server.app

    Upgrading to macOS High Sierra is akin to walking on the bridge of peril. Too perilous!

    I don’t recommend macOS 10.13.x for production, but it is necessary to test and for this reason back in September I did upgrade my test Mac. Of course, when the installer detects server it will give you a warning about it not being compatible and you’ll have to download a compatible version from the App Store. Be warned!

    ThisVersionOfServerNoLongerSupported2

    Which is no big deal as long you are warned and have backups and maybe you can download the compatible version from the App Store. Trying to launch the old version will get you a warning to go to the App Store and be quick about it.

    ThisVersionOfServerNoLongerSupported

    Some people are reporting that the macOS installer is erasing their Server.app and refusing to upgrade their Server with the macOS 10.13 compatible version (v.5.4).

    In that case, restore from Time Machine or other backups and start again?

  • Device Enrolment Program

    Apple’s DEP allows you to have new Macs (and old) quick added to your MDM. Signing up for the Device Enrolment Program allow you to use Mobile Device Management with your Macs  and iOS devices.

    You’ll need an email address that is not associated with an Apple ID and you’ll need your DUNS number among other things.

    Program requirements are spelled out in the help documents.

    You’ll need your DUNS number. Don’t know it? Look it up!

    Basic intro to DEP for Business

     

  • Root Me Baby One More Time!

    UPDATE: Apple has posted a security update. 2017-001

    Root-a-pocalyse. Root down. Root a toot toot. Many funny tweets today about a very serious issue. A bug was discovered in macOS 10.13 that enabled anyone to login with a root account. With no password. Wow. Seriously. Yeah, that’s bad.

    Bug discovered by Lemi Orhan Ergin.

    I tested by clicking on the lock icon in System Preferences. Normally this requires an admin account. I was able to authenticate with “root” and no password. This actually also set root to no password. You can choose a password here and this makes it for you. How convenient. You can also login to the Mac via the login window. With root. And no password. Crazy.

    If your Mac is off it’s safe. Not joking. If your FileVault protected drive is encrypted and your mac is turned off then you’re good. If you Mac is turned on and you’ve logged in at least once (or at least decrypted the drive on boot) then you’re not safe.

    What can you do? Change the root password and set the shell to false. Until Apple fixes this. Should be anytime now. Or soon.

    dscl . -passwd /Users/root “random or very secure password here”

    dscl . -create /Users/root UserShell /usr/bin/false

    Read a comprehensive explanation on Rich Trouton’s site:  Der Flounder blog

     

  • I don’t get High — Sierra!

    Friends don’t let friends install macOS High Sierra in production. Don’t get High, Sierra.

    macOS 10.13 was released on Sep 25, 2017, and almost two months later with only one point release update, it’s still too new for production. Download it on a test machine or two or more, test it with your apps and systems, file bug reports and radars, but for the love of all that is Python and Monty! don’t run it on your production Xsan. Well, at least not yet. Wait until next year. Or as long as you can. Or until the new iMac Pro is released with 10.13 pre-installed or wait until they ship the new Final Cut Pro X 10.4 that may or may not require macOS High Sierra.

    With that out of the way, I’ve just upgraded the production Xsan to … macOS Sierra. Yes, macOS 10.12.6 is stable and it’s a good time to install last year’s macOS release. Time to say good bye to macOS el Capitan 10.11.6, we hardly knew ya. Besides guaranteed security updates, stability and the annoying newness of a changed macOS, what else is there? In Xsan v5 they introduced a new “ignore permissions” checkbox for your Xsan volumes. Looking forward to that feature in production. No more Munki onDemand nopkg scripts to run chmod. No more tech support requests for folders, files, FCP X projects that won’t open because someone else used it, owns it, touched it. We’ll see how that pans out. I’ll let you know.

    Upgrading Xsan to v5

    Step 1. Back up your data

    You’re doing this, right? I’m using Archiware P5 Backup to backup the current projects to LTO tape. I’m using Archiware P5 sync to sync the current Xsan volumes to Thunderbolt RAIDs, and using Archiware P5 Archive (and Archive app) to archive completed projects to the LTO project archive. That’s all I need to do, right?

    Step 2. Back up your servers

    Don’t forget the servers running your SAN! I use Apple’s Time Machine to backup my Mac Mini Xsan controllers. External USB3 drive. I also use another Mac Mini in target disk mode with Carbon Copy Cloner to clone the server nightly. (Hat tip to Alex Narvey, a real Canadian hero). And of course I grab the Xsan config with hdiutil and all the logs with cvgather. Because, why not?! For Archiware P5 backup server I also have a python scripts to backup everything, another scripts to export a readable list of tapes, and BackupMinder to rotate the backups. Add some rsync scripts and you’re golden.

     

    Step 3. Upgrade the OS

    Unmount the Xsan volume on your clients or shut them down, disconnect the fibre channel. Do something like that. Stop your volume. Download the macOS Sierra installer from the App Store. Double click upgrade. Wait. Or use Munki. I loaded in the macOS 10.12.6 installer app into Munki and set it up as an optional install to make this portion of the upgrade much quicker and cleaner.

    In my case after the OS was upgraded I checked the App Store app for any Apple updates (you can also use Munki’s Managed Software Center to check) and of course there were some security updates. In this case the security upgrade hung on a slow network connection and the server crashed. Server down! I had to restore from Time Machine backup to the point where I just upgraded the server. It took some extra time  but it worked (can’t wait for next year’s mature APFS / Time Machine and restoring from snapshots instead).

    Step 4. Upgrade Server

    After macOS is upgraded you’ll need to upgrade the Server.app or just upgrade the services used by Server (even those not used by Server get upgraded).

    Step 5. Upgrade the Xsan

    Bur first we have to restore the Xsan config. Don’t panic! It may invoke bad memories of data loss and restoring from backups. Xsan PTSD is real.

    Restore-previous-Xsan.png

    Step 6. Upgrade the rest

    Next you have to upgrade the Xsan volumes.

    Xsan-volume-needs-upgrade

    New version of Xsan, ch-ch-changes! Ignore permissions check box will remount the xsan with the “no-owners” flag. Let’s test this out.

     

    Upgrade the OS and Server app on the backup controller. Upgrade the OS on the clients using Munki or App Store if you like doing it the hard way. Ha Ha.

    Step 7. Enjoy

    Plug those Thunderbolt to Fibre adapters back in, mount those Xsan volumes and be happy.

    Step 8. Wait for the complaints

    The next day the editors walked in and went straight to work with Final Cut Pro X. No one noticed anything. Xsan upgraded. Workstation macOS upgraded. Everything appeared to be the same and just worked. Thankless task but well worth it.

     

    Reference: Apple’s iBook guide here

     

     

  • Be a NoMAD!

     

    NoMAD stands for “no more AD” and has nothing to do with a nomadic lifestyle, nomads, ronin or other wandering IT professionals. Sorry.

    NoMAD allows you to stop binding Macs to a corporate domain and instead get your kerberos tickets as needed. Connect to those file shares, change your password, and other fun tasks, without being stuck on the domain and constantly resetting your keychain from the insanity of password retention policies.

    NoMAD-intro

    Using Autopkg and Autopkgr to feed trusted apps into your Munki repo you can easily deploy NoMAD to your fleet of Macs.

    And for bonus points you can add your preference settings as “updates for” NoMAD in Munki. One such add on is a setting for an auto mounting sharepoint.

    Name your file: “menu.nomad.shares.plist” and open up your favourite text editor.

    <?xml version=”1.0″ encoding=”UTF-8″?>
    <!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
    <plist version=”1.0″>
    <dict>
    <key>Shares</key>
    <array>
    <dict>
    <key>AutoMount</key>
    <true/>
    <key>ConnectedOnly</key>
    <true/>
    <key>Groups</key>
    <array/>
    <key>LocalMount</key>
    <string></string>
    <key>Name</key>
    <string>Corp_Share</string>
    <key>Options</key>
    <array/>
    <key>URL</key>
    <string>smb://winserver5000/Corp_Share</string>
    </dict>
    </array>
    <key>Version</key>
    <string>1</string>
    </dict>
    </plist>

    Create a package with munkipkg and add this to Munki. Set the package as an update for Munki and as your NoMAD agent gets installed your updates for NoMAD go with it.

    More tips and tricks in the future.