Slashdot Mirror

From TFA, the specific configurations that allow this to happen: "Anyone who used FileVault encryption on their Mac prior to Lion, upgraded to Lion, but kept the folders encrypted using the legacy version of FileVault is vulnerable. FileVault 2 (whole disk encryption) is unaffected."

The problem is actually far more widespread than that. I have some Macs running Lion here that have never had FileVault enabled that have this problem. People on the MacEnterprise list have been discussing this bug for about a week now.

Using the legacy version of FileVault may be one method to trigger the bug but it definitely isn't the only one. Many are seeing the same bug when Lion is joined to an AD domain and some are also seeing it when using OD as well (Especially when using mobile home directories).

So far no one has been able to determine exactly what configurations trigger the bug since not all systems appear to be impacted, but the problem is definitely far more widespread than the article indicates.

My God... someone posts a full out technical question on Slashdot and all he can get in response are bull posts like the guy above telling him he's doing it wrong? It's time to hand in your geek card...

Incidentally, the original poster should send this question to the MacEnterprise mailing lists instead of Slashdot... they'll probably get a better response.

Wow, go-go-gadget misinformation. Mac OS X Server is BSD based, and I've had great success installing any open source project that I needed, using ports, fink, gems, or CPAN if what came with operating system didn't do what I needed.

Also, the vast majority of services available on OS X Server are open source, which Apple does contribute back. So if you don't like how the Server Admin tool works, you can be a r3@l l33t h4xx0r and edit the config files in vi or emacs and do it yourself.

As for the submitter's original question, there are a number of useful tools available for mass deployments of Macs across a network. Tools like radmind, LanRev, Apple's PackageMaker, InstaDMG, and Casper Suite all have varying degrees of management of machine images, image distribution, etc. Also consider at least downloading the PDFs Apple provides for their built in services to learn the ins and outs of their tools allow you to do and not do. You can even modify existing services to use more recent versions of projects that come with OS X if you're missing something or need to upgrade to a newer version for some reason (although this will likely make you have to freeze your OS version in place, or else future updates will probably overwrite your changes.)

Administration of a network of Macs falls somewhere in between an Active Directory environment and a roll your own Linux/BSD network. The client administration is great, but not as comprehensive as Active Directory. However, you still have the freedom to tinker with the services that come with OS X Server and borrow and add capabilities from open source. There are also many other forums out there that have a much lower troll count than what you'll find here, with many knowledgeable and helpful folks who will actually attempt to address and answer your question.

Because seriously, why go to Slashdot if not for the trolling?

I work at an all-Mac school district, with my school having 300 Macs alone. We have 8 laptop carts with 30 MacBooks each, 2 computer labs with roughly 20 iMacs each, 1 laptop or workstation for each staff and faculty, and we're piloting a 1:1 laptop program with about 30 students enrolled in the program. Here is a list of what I use to get the job done:

1 Server with OS X Server (preferably 10.6.)
1 24 port gigabit switch
NetRestore (you don't need this if you have 10.6 Server.)
Apple Remote Desktop Software

It's straight forward, there are lots of very easy to follow guides online. You can pick this up even if you know nothing about Macs at all. Basically you set up your server for NetBoot. Your clients will boot off the server, then block copy an image to their HDD. You can do this via NetRestore Helper which makes a simple-to-use GUI, or, if you have 10.6 Server, all of NetRestore's functionality is now apart of 10.6's NetBoot utility. You can also do it via CLI.

You can use shell scripts to automate tasks. They can be set to run before the computer is imaged (partitioning the HDD, for example) or after it has been imaged (setting the sharing name, joining a domain, setting up printers, or installing additional software.)

Apple Remote Desktop will allow you remotely manage each computer. You can do asset management, updates, software installs, etc. Coupled with ARD Server on the Server itself, you can automate these tasks. Similar to Active Directory.

If your organization has invested in LANDesk and/or Altiris, both will take advantage of an OS X Server and streamline the process. You'll be able to do all the aforementioned via both LANDesk and Altiris; they basically just relay commands to the OS X Server. Both integrate the process pretty well. I don't know about Norton Ghost.

If you're using Multicast IP and have a gigabit switch, you can image batches of 20 computers (or more, depending on the switch) in 30 minute intervals. This varies depending on how big your images are, of course. Target Disk Mode via FireWire is a great way to image 1 off machines or to get data off failing hardware. Prep time for such a set up is about 2 hours (power, ethernet, setup, etc.)

Also, remember that's it's UNIX. You can do everything I just mentioned via command line if you're a keyboard junkie.

Here're some indispensable links to help you get started:

http://www.bombich.com/
http://www.macenterprise.org/
http://www.wazmac.com/

Keep in mind that the hardware is more expensive, but I've found the support to be a lot easier than Windows. Cost savings is in the support of the machines. There are also no client access license fees if bound to OS X Server directly instead of ActiveDirectory.

Apple has a robust remote installation suite with OS X Server, which is darn cheap compared to most other commercial offerings.

10.6 includes a first party version of NetRestore (full system image deployment, similar to Ghost or Flash Archive on Solaris), but most people deploying across a large number of systems should roll their own images with packaged based tools like DeployStudio or InstaDMG:

http://www.deploystudio.com/
http://code.google.com/p/instadmg/

Some other good sites for finding info:
  http://www.afp548.com/
  http://www.macenterprise.org/

Here is an excellent resource (at least last time I checked and it has been awhile, they used to be called macosxlabs.org). http://www.macenterprise.org/ As far as tools, the built in tools are very good. A third party tool that can be very useful for bootable drive images is Carbon Copy Cloner. When you say large, do you mean hundreds or thousands, or less? It will definitely change things for you. I think that you will be surprised by both the ease of the transition, and the things that should be easy that are not. Really I don't know how we can help you unless you have specific areas where you are interested in learning solutions (and I don't say that to be a jerk, I'll try to answer questions where I can). How many servers? Directory Server? File Sharing? Exchange Server/POP/IMAP? Calendaring? Centralized home directories? Budget per user? Of course there are cool things that cost money and are not really needed, and hard things that are cheap but work well once set up etc. I would help more, but I don't know where to start... take a look at the link above, and ask questions as you get a better idea of he scope

"It's silly to call Apple a "Unix vendor". Yes, MacOS is built on top of Unix. But blah blah blah."

Mac OS X 10.5 Leopard is now an Open Brand UNIX 03 Registered Product, conforming to the SUSv3 and POSIX 1003.1 specifications for the C API, Shell Utilities, and Threads. Come October Mac OS X is UNIX®, and it will have a larger market share then Solaris, AIX, and HP-UX combined.

http://www.apple.com/science/
http://www.macenterprise.org/
http://www.apple.com/itpro/

I haven't used DirectControl personally -- though I know of some other folks who have said it works for them. The MacEnterprise folks did a webcast on it a while back, and they have their slides archived here:

http://macenterprise.org/webcasts/2005-10-25_slide s.pdf

Which gives a lot more detail on how it works.

I think, cost wise, that there is a "per seat" cost. I don't know the exact price, probably along the lines of a CAL, so $50-ish sounds a bit right. I'm sure it depends on the # of seats and the time of the year or quarter you're negotiating with a sales rep ;-)

There are a number of solutions for pushing software to Mac clients. I don't know if Centrify does it -- I typically use Apple's Apple Remote Desktop to do it, but this is not cross-platform. There are a number of cross-platform solutions... NetOctopus, and 3 or 4 others whose names elude me right now as I'm in Sunday mode. If you really need details let me know and I'll eventually scare them up.

Maybe you should read up a bit on Mac solutions before you comment- software like Apple Remote Desktop, FileWave, NetOctopus, NetBoot/NetRestore, Radmind, HP OpenView, Deep Freeze and resources like AFP548, Mac Managers, MacOSX Labs, MacEnterprise, and of course Apple itself (I'll leave finding Apple's website as an exercise for the reader ;) make running large Macintosh installations fairly easy. There are plenty of UNIX/CLI tools and scripts out there, and Apple offers professional certifications if you want paper to show a potential employer.

Having quite a lot of experience with macs in an enterprise environment, I can assure you:
You do not want your clients to update automatically!
1. When you are responsible that hundreds of persons can work using the clients you are responsible for, you will want to check if an update has any unwanted impact on those clients before you update them.
Maybe you cannot imagine the trouble you get in if one of your major application does no longer work with the newest update that was installed automatically.
If you just for example look at the dependencies between Micorsoft Office 2004 and Mac OS X then you know what I'm talking about.
You will want to test those updates first. Believe me.
2. If you have a lot of clients then you will definitely want to set up your own software update server.
Otherwise your clients will eat away you internet bandwith. Just imagine your 100 clients each downloading that 150MB 10.4.8 update from apple.com. It will block your network for hours...
3. For a method on 'Auto-Update using Apple's Software Update' there's an interesting article here http://macenterprise.org/content/view/198/84/

But you are definitly wrigth. There should be some sort of mechanism so that once set up, a mac client can be forced to update all of its software to the newest releases.
I would also like to see an uninstaller that allows me to uninstall an update that has side-effects...
I don't like to admit it but at this point windows offers better solutions.

Easy even with the older ARD v.2 - just send the unix command "softwareupdate -i -a" to the workstations in question, and they will automatically download and install all needed updates.

Best of all, schedule it to wake the workstations at 3:00 a.m., download and install the updates, restart the machines, and put them back to sleep or turn them off. Easy as pie with Apple Remote Desktop and scheduled scripting.

For more: http://macenterprise.org/content/view/117/140/

http://www.informit.com/articles/article.asp?p=445 094&seqNum=4&rl=1

You set up your permissions in advance. All I'm saying is that Apple provides all the software to do, in some way or another, everything Deep Freeze does. And chances are the price of "included" is better than some kind of per seat licensing scheme for 3rd party software. Not to mention there are many free tools to also assist in achieving parity.

http://www.macenterprise.org/ is a site that has developed over the years from the roots of macosxlabs.org into something with all sorts of advice on how to manage Mac OS X in different environments. For a lab take, look back to their archives. http://archive.macosxlabs.org/

Universities have been doing enterprise deployment of Macintosh desktops since before MS Windows existed, even since before the term "enterprise deployment" existed. The early days were pretty rough, of course. But now OSX and its Unix core have a full set of enterprise desktop management tools available. Check out MacEnterprise and tools like Radmind. Many Universities are now doing large-scale deployments of Mac desktops. And since those tools are all Unix-based, perhaps many of the same techniques will work for Linux desktops?