Slashdot Mirror

Wow, go-go-gadget misinformation. Mac OS X Server is BSD based, and I've had great success installing any open source project that I needed, using ports, fink, gems, or CPAN if what came with operating system didn't do what I needed.

Also, the vast majority of services available on OS X Server are open source, which Apple does contribute back. So if you don't like how the Server Admin tool works, you can be a r3@l l33t h4xx0r and edit the config files in vi or emacs and do it yourself.

As for the submitter's original question, there are a number of useful tools available for mass deployments of Macs across a network. Tools like radmind, LanRev, Apple's PackageMaker, InstaDMG, and Casper Suite all have varying degrees of management of machine images, image distribution, etc. Also consider at least downloading the PDFs Apple provides for their built in services to learn the ins and outs of their tools allow you to do and not do. You can even modify existing services to use more recent versions of projects that come with OS X if you're missing something or need to upgrade to a newer version for some reason (although this will likely make you have to freeze your OS version in place, or else future updates will probably overwrite your changes.)

Administration of a network of Macs falls somewhere in between an Active Directory environment and a roll your own Linux/BSD network. The client administration is great, but not as comprehensive as Active Directory. However, you still have the freedom to tinker with the services that come with OS X Server and borrow and add capabilities from open source. There are also many other forums out there that have a much lower troll count than what you'll find here, with many knowledgeable and helpful folks who will actually attempt to address and answer your question.

Because seriously, why go to Slashdot if not for the trolling?

For freebies InstaDMG http://www.afp548.com/article.php?story=20090812091929480 and DeployStudio http://www.deploystudio.com/Home.html with Radmind (if you need it). For pro stuff try Jamf http://www.jamfsoftware.com/. Join the system-imaging list with Apple. The people on there are far less 'flamey' than on the OSX server list and will be able to advise you on the different tools, their experiences etc and really are helpful.

I've overseen the management of ~600 macs running an SOE for the last 9 years.

We use
AD for authentication
OSX servers for the applicaton of the mac equiverlent of Group policy settings
and Radia to deploy software (now called HP openview something arrather)

We have not been happy with Radia since HP bought it a few years ago, so after a review of products last year we are now moving to Casper (the friendly ghost) from JAMF

see http://www.jamfsoftware.com/ for more info, it works fine

Check out the Mac management software from JAMF software. It pretty much covers it all, from package management to image deployment to remote desktop to inventory. Used in many mac-based school districts and Universities.

This is what $WORK will be using when they starting officially deploying Mac stuff. We're also going to use Centrify to link Macs to AD (for single login).

I know Google uses Puppet for all of their Mac workstation/laptops, but that isn't very clickity-click friendly, so not an option for a lot of our technicians.

Check out the Mac management software from JAMF software. It pretty much covers it all, from package management to image deployment to remote desktop to inventory. Used in many mac-based school districts and Universities.

::blink::

It's not that hard to run management software which checks these things and resets them on a daily (or hourly) basis. e.g. http://www.jamfsoftware.com/

Can a student (who doesn't have an admin account on the box) get an admin account by booting off an external DVD and resetting the password, and then remove the software? Why yes. Yes they can. Will the administrator notice within a day that it's no longer running the admin software and thus not reporting in? Why yes, yes they will. What then? Well, the same thing as if they'd gone to your care with a baseball bat... a little visit to the principal's office.

No, you don't need to lock down the machine like it's Fort Knox. Set sensible policies, and then verify them regularly and punish non-compliance accordingly. It's really not that difficult, there are regulations and precedents to help in an edu setting, and there are millions of Macs being used for just this purpose. TPM, access keys, trusted computing... LOL.

No i didn't RTFA, but one of my biggest concerns has always been remote central management in the enterprise structure. IT can't always make "house calls" to each and every computer, there has to be ways of remotely accessing, configuring and maintaining the systems and I haven't seen much that supports OSX. Even with Linux there are tools that allow you to do that, and most all central configuration tools are Windows based.

Our method involves authenticating to AD via LDAPv3, and automouting a volume over SMB. We've just put this doc together over the last few hours, but will try and work more on it in the next few days. It can be found here at the bottom.