Slashdot Mirror
Mac Systems Management
johannacw writes "This story has in-depth info about managing Macs using Apple's Managed Preferences architecture. It covers how to use the 14 built-in systems-management areas, how preferences interact, how to secure workstations, and how to help users access resources including applications and printers. It's a must-read for any systems admin working in a Mac or mixed environment. Written by Ryan Faas, this is a follow-up to his popular Inside Apple's Workgroup Manager."
How easily deployable are settings of this sort?
Video Production Support
Why is this on Slashdot? I guess it might be of some interest to people who don't manage OS X professionally. But this is a fairly basic overview of features from an OS released over 2 years ago! I cannot imagine why anyone would spend time writing this now. It's not like the information isn't already out there... like in the product documentation. Seriously, why is this on Slashdot? Did the editor think it was about 10.5 or something?
iThey're ifree-spirited isystems ifor ifree-spirited ipeople, iremember?
The Schwartz space ain't from Spaceballs.
But where are the ready-made commands to paste into terminal? The neat perl scripts? I thought the whole point of Mac was that you could use the UNIX underneath for administration? I mean if the extent of possibilities is "click here, then click here" you might as well run server 2003.
but managing macs IS easy
1) turn on mac
2)periodically remind typical mac user that the computer is not thirsty and does not require watering like a plant.
Snowden and Manning are heroes.
Um, no. What are you even talking about? When you connect to that computer you have to authenticate with a username and password. You will only be able to access data remotely that you could access if you were logged in as that user locally.
And I don't get what your second problem is. If you had personal file sharing turned on, then your Linux box must've been connecting to your Mac via afp.
I think you're just very confused.
Its funny that you compare this to a MS product that hasn't been around in atleast 5 years and was orginally developed over 10 years ago.
Insert funny smart-ass comment here.
OK I'll bite, although you're AC and everything. This article said nowhere "why OS X blows Windows out of the water" it didn't say "why OS X is better than Windows", so I don't get why you would start advocating your borg mothership without anybody else involved even thinking about it.
Are you trying to turn any intelligent discussion into an OS flamewar? Yes, maybe your dick is bigger, but you still don't get laid. Get a life. Or a pussy. Or better both.
There are two rules for success:
1. Never tell everything you know.
So I'm modded Overrated and I have my sanity questioned by someone who didn't read my post well, just because I said something negative about Apple. What also is interesting is that the person who thinks I'm confused was modded Insightful. And I didn't get modded Offtopic. My post is Offtopic, because it's about the 'normal' version of OSX, not the server version. Way to go moderators.
-- Cheers!
I think the other poster makes a valid point. You took a very sensationalist approach in your post and made some assertions that just don't stand-up.
Although you say that the applications and user data are available for all to see, this is only true if you've chosen very bad passwords. You can disable sharepoints by removing the Sharedir property. Also, a change of permissions will yield similar results. Personally I prefer a more locked-down system by default but this isn't OpenBSD we're talking about, so it's reasonable to expect that you'd need to harden the system a bit - particularly when it comes to relatively minor risks like this one. All of what you ask can be configured manually but few users will need to. Those that need to will be able to find out how and those that don't will appreciate the current functionality.
Since guest logins can only access the public folders, it's not quite as open as your post would suggest.
-- Using the preview button since 2005
If you want to share a folder for use on a Windows computer, you can only share all home directories, or nothing.
/etc/smb.conf to their heart's content. The problem comes for the semi-advanced users, the mediocre types who are all too common these days, often talking the UN*X talk (particularly here on Slashdot) but who are too afraid to walk the walk. They want to share other Windows folders but are not sufficiently competent to edit /etc/smb.conf. Judging by your inability to configure passworded shares, it appears you may fall into this category...
... switched on in the Preferences, I could still access my whole harddisk remotely from my Linux PC.
/> tag. It makes what you write a hell of a lot more readable.
:P
Valid point, although it's not as though they aren't passworded (which your post almost seems to imply). Complexity is sacrificed for ease-of-use, though whether this is a good thing or not is, I suppose, ultimately down to who is using the system. For the average user, it won't be a problem, because they probably won't know what Windows File Sharing is, and if they do, it will be sufficient. Advanced users, too, will be fine, because they can simply edit
This will all probably be moot anyway, as I have a feeling I have seen they have re-done the Sharing Preferences in Leopard and more granularity will be offered.
(I should, however, take the opportunity to take a swipe at Windows, on which file sharing is hopelessly broken. The problem in Windows is that there is no easy way to turn such sharing off (i.e. like the tick box in Sharing on the Mac). By moving the sharing interface to the folder, one can share folders buried deep in the hierarchy and forget where they are, thus leaving sharing on very easily. Reliance is then placed on a firewall to secure the machine - not a good way of doing things.)
And a few days ago I discovered that even while I had everything but remote logon (which basically means sshd) and Windows Sharing
If I am parsing your sentence correctly, you had Personal File Sharing, Personal Web Sharing, FTP Service, etc. all switched on. Of course Personal File Sharing shares your hard disk - this is what it has done since time immemorial on the Mac. Again, though, as you note, it is passworded, so I fail to see the problem.
If, on the other hand, you meant that you only had Remote Login and Windows Sharing switched on, one can only assume you have a poor command of smb.conf's syntax (as well as of English - apologies). This would appear consistent with your earlier statements about the lack of passworded shares. A bad workman always blames his tools.
Finally, given that I seem to have decided to start taking swipes, you might also want to learn to use the enter key. Or HTML's <br
iqu
You're right, I made a mistake. In my post I said that I had almost all file sharing switched on, and then I could see my harddisk with my Linux PC. That was wrong, I had it switched off. Only Samba and sshd were running. My sincere apologies for this stupid typing error and the confusion it caused. The fact that I could see my whole harddisk on my Linux PC even with Personal File Sharing switched off still puzzles me. I'm certain it was not a samba issue.
The password handling problems of Samba in OSX are known, see here, here, and here. I hope that will be fixed in Leopard.
-- Cheers!
"The problem in Windows is that there is no easy way to turn such sharing off"
._.
Go to Control Panel, Networking, Right click on the interface you want to remove sharing from, and remove File and Printer sharing? You talk the talk, but can you walk the walk? (just kidding, I'm one of those mediocre Linux types, though I'd be fine with editing smb.conf now that I know it's there on OS X). Also you can check your shares by right clicking on My Computer, then choose Manage, then Shared Folders->Shares. Sadly I have come to know more about how to use Windows than any other OS these days, as part of my job
which is totally what she said
The fact that I could see my whole harddisk on my Linux PC even with Personal File Sharing switched off still puzzles me. I'm certain it was not a samba issue.
/etc/smb.conf.
:|
Interesting. The key thing is, though, were you able to see the whole hard disk via Windows File Sharing (i.e. port 139, SMB/CIFS) or via Apple File Sharing (i.e. port 548, AFP). It takes some effort to get Linux to talk to AFP shares, if memory serves, which means that it is far more likely that it was via Windows File Sharing. In the latter case, it is beyond doubt that it was due to your configuration changes, because, as you know, it only shares home folders by default.
As to your contention that password handling in Mac OS X's version of Samba is broken, I am still convinced that you are mistaken. The first two examples you cite refer almost exclusively to pre-Tiger versions of Mac OS X (really rather old versions of Samba) and in any case relate primarily to a Mac OS X client accessing a Windows or Linux server. Your problem is with a Mac OS X machine serving Windows shares. Having just conducted some experiments myself, it is clear that smbpasswd is troubled, but there is no problem with password synchronisation, at least not if you change a user's password using System Preferences.
It may be that smbpasswd is deprecated in Mac OS X 10.4 (which I assume you are using). Instead, Windows passwords are stored in the NetInfo database. Don't quote me on that though - it's just what I am inferring from
iqu
Go to Control Panel, Networking, Right click on the interface you want to remove sharing from, and remove File and Printer sharing?
:P
Ah yes. It's all coming back to me now. These days, I only venture into network device properties to turn off the fucking firewall...
iqu
Another alternative to a Golden Triangle is to use Centrify for the Mac if you have Windows sysadmins who just won't countenance a Mac server. Centrify uses the same underlying mechanisms as Workgroup Manager but lets a directory admin on a Windows server manage the Macs as though he were applying GPO's to Windows machines. While I think a Golden Triangle is preferable, Centrify works well when you just can't install a Mac OS X Server.
--Paul
Thanks again for your comments. I'm sure I saw the files via AFP. I don't know exactly what the problem is, but I am certain that samba definitely doesn't serve my whole harddisk.
As for the password handling in samba on my Mac, I'll look into that a bit more. It is confusing; I can't use the same smb.conf on my Mac as I have on my Linux box. For some reason that doesn't work properly. I'm at work now, and it has been a while since I last tried to configure Samba for the Mac, so unfortunately I can't tell you exactly how the Mac's behaviour differs from the Linux box.
-- Cheers!
It's worth noting that Workgroup Manager is a handy tool to run on your own Mac, even without an Open Directory domain, as it's a bit more flexible than Accounts.prefpane, especially for (for example) configuring limited accounts for family members.
n tools104.html
It's part in the Server Admin Tools: http://www.apple.com/support/downloads/serveradmi
I don't know if the license/installer says you have to have a Mac OS X Server installation to use them, because I haven't looked.
It's GUI based. You can either install the Application version, or the "System Preferences" version, both which are available in the download.
You can setup SMB shares for Windows/Linux/Mac clients, or AFS shares for Mac/Linux clients (not sure if Windows does AFS - never looked into it).
After setting up a SMB share, ensure that "Windows Sharing" is enabled under "Sharing" in "System Preferences." Also, click on the "Accounts" button there and enable one or more local accounts to access the share remotely. Then, on a Windows box, it's as simple as connecting to: \\ip-address\sharename\ Enter in the username and password credentials, you'll connect, and bam, you have access to the share.
Local access rights apply to the local user connecting to the share remotely.
Make sure you un-share folders when you're done.
Perhaps this program would make things easier?i nts
http://www.macupdate.com/info.php/id/8658/sharepo
it may give you some correctly configured config files that you can then just copy over to all the client computers.
Since it just uses an absolute path, you should be able to set up a Windoze shared folder that's the same path on every computer. I use this to share a non-home-folder folder, with it's own user/pw.
What the original poster is trying to say, and repeatedly getting misunderstood about, is that turning on either FileSharing or Windows Files Sharing shares his entire home directory, including all of his personal files, and any home directory applications, and there is no built-in way to only share particular folders.
I agree with this point, as I wish that I could specify a particular folder to share, but overall, since I am running client software, and use file servers when in an environment of other users, it doesn't bother me too much.
I use Ubuntu. Apparently I have these packages installed.
-- Cheers!
I've spent the last year cleaning up the mess left behind by AdmitMac at my company. This software is awful, so bad in fact that Thursby has removed their online support forum due to the tidal wave of complaints.
The worst bug: AdmitMac will simply refuse to allow a user, and sometimes even a local administrator from logging in! It did this from the earliest version we used in 2006 to the last version in early 2007. I would get late night and weekend calls from the CFO or the CEO that they couldn't log in and it didn't matter how many cached logins were specified in the prefs.
AdmitMac is shit, my dislike stoked even more by how expensive it is and how poor Thursby's support has been. The closest I got to any satisfaction was when I received an apology from a VP of Thursby after posting at their support forum that I was about to stack up all my copies of AdmitMac in the parking lot and set them on fire.
It's really that bad.
"This article said nowhere "why OS X blows Windows out of the water" it didn't say "why OS X is better than Windows""
...a discussion about an AC's genitals??
Of course it didn't. On Slashdot, those two things are just assumed.
"Are you trying to turn any intelligent discussion into"
"But this one goes to 11!"
Turning on sharing doesn't share every users home directory. It shares the public directory inside their home directory.
What? Mac has systems management? That's impossible, everyone knows Mac is so easy to use, and virus-free, that it's the toaster of computers.
Slashdot: Playing Favorites Since 1997
Or if you want to do it from the command line there is a perl script here to do it:
1 119095823908
http://www.macosxhints.com/article.php?story=2001
I've used this in an all-Mac environment. You can't beat it with anything. I have it for home now.
It's kinda like Active Directory but much more simple, open and you can integrate it with other (non-Mac) systems since it's pure LDAP (over SSL) and Kerberos. There is even a feature to integrate and manage your Windows machines without using Active Directory. Combine it with Apple Remote Desktop and Apple's Software Update Service and you can deploy whatever package or update you want within seconds (it uses multicasting to save on bandwidth, eat that Microsoft)
Custom electronics and digital signage for your business: www.evcircuits.com
I can't use the same smb.conf on my Mac as I have on my Linux box.
:|
Indeed you cannot, and this has a lot to do with what I alluded to in an earlier post - I suspect that rather than using the smbpasswd file (as Linux does), Mac OS X uses NetInfo. Just transplanting a Linux-oriented smb.conf into your Mac will thus not work.
I think you need to be a bit clearer about what's doing what. It is certainly true that Apple File Sharing will share your whole hard disk, but you need to log on as one of the users registered on your Mac. The reason I and others are skeptical that this is what was happening is because it is non-trivial to get Linux to see AFP shares. You can't just go into GNOME's browser and see them.
iqu
The fact that this is a story show how far behind Apple is in remote management. Everything here I could do on *inx or MS computers for at least a decade, why is this news? I guess there has to be some padding between the regular blowjobs that /. likes to give Apple. oh wait, this is one of those huh. Geeze get a room.
well, normally I'd say RTFA, but i think we can go back to the old adage RTFM. Sideshow's right. What's your admin password set to on your mac. do you have other unsecured accounts? and please tell me you're running OSX. Also, I'd like to make a note, that i have personally worked in mixed windows domain, Mac environments. Macs handle the role of windows domain controllers better than windows machines. (over 5000 users)
"10001110101 - periodic table with a centerpiece of mind" -Clutch