Slashdot Mirror
Throttle Shared Users With OS X — Is It Possible?
whisper_jeff writes "I work in a design studio where the production director is also the owner's son (translation = he can do no wrong). He is fond of accessing a designer's computer via filesharing and working directly on files off of the designer's computers rather than transferring the files to his computer to work on them there. In so doing, he causes the designer's computer to grind to a near-halt as the harddrive is now tasked with his open/save requests along with whatever the designer is doing. Given that there is no way he's going to change his ways (since he doesn't see anything wrong with it...), I was wondering if there was a way to throttle a user's shared access to a computer (Mac OSX 10.5.8) so that his remote working would have minimal impact on our work. Google searches have revealed nothing helpful (maybe I should Bing it... :) so I was hoping someone with more technical expertise on Slashdot could offer a suggestion."
Disable file shares on workstations. Use a file server.
Put a 10 MBit switch between his computer and the network... that'll do it... 8-)
Well, I don't think you want to mess with how the operating system handles its network and file system so you have two options. You can either throttle at the router or throttle at the neck. The router option requires you have a capable enough network router connecting you two in order to be able to write a rule for his machine (by IP address or machine name usually) that limits the amount of information he can transfer (I believe this is possible in DD-WRT and is called throttling or traffic shaping). This will cause his experience to become slow and he will most likely complain and bitch to daddy if he knows you did something.
The other option is throttling the neck of the user. This requires somewhat strong hands and forearms applying a pressure to the neck of the user until he stops moving or goes limp. It may result a decreased experience for the user, difficulty breathing, death and in some cases an erection. Use with caution and have an alibi.
My work here is dung.
chmod the files so that only the appropriate user has read/write, and that the boss' son has read access. only allow him to replace the files in a different directory, so that you can evaluate the changes.
Who cares about throttling. Why isn't your data on a file server? Especially if there's intentions to share it.
I want to throttle just about every OSX user I've ever met.
It's really easy, I swear:
Write a script that will hammer the everlasting fuck out of his shared drive when he's trying to do something. As (I assume) the IT department, he will complain to you. When he does, politely say, "Yeah, I think that can happen when users constantly access files on a remote shared drive. Someone must be doing that to your box. It really sucks, huh?"
When someone acts like a child, you must treat them like a child. Some people just have to find out what "Think about how that would make you feel" really means the hard way.
Support the EFF and Creative Commons. The war is coming, and they're supporting you...
Is it not possible to explain to this person the negative impact that his actions have? You explained it to us with one sentence:
In so doing, he causes the designer's computer to grind to a near-halt as the harddrive is now tasked with his open/save requests along with whatever the designer is doing.
Right after that line you say he doesn't see anything wrong with it. Have you not explained this to him?
And why are you sharing every workstation instead of using a single file server?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Store all the files on the offendor's computer. Let the other designers work off of his computer. Done!
But seriously, why should anyone be able to access anyone else's files? Secure everyone's computer. You should put shared files on a shared file server.
And why not use revision control?
-Peter
Why not just set the file permissions to not allow write access - then said director will be forced to work on and save files locally..
You can configure a firewall rate limiting statement based on source ip address using ipfw. Then just have an applescript that toggles this than can be run as soon as you notice the computer getting slow.
Try using the advice in this tip: http://www.macosxhints.com/article.php?story=20080119112509736 which demonstrates bandwidth throttling by port number
but add a rule that limits by ip address as well as port number
see http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man8/ipfw.8.html for details of the ipfw rules
I haven't tried this combination myself but I can't see why it wouldn't work.
His mac grinds to a halt due to samba? Lower the process priority of samba on the mac serving the files.
But the better question is, if these are shared files that he's working on, why aren't they on a central server thats made to serve files. Why are they on individual machines anyway? If your network is fast enough that it can make the server mac get loaded down with disk IO than its certainly fast enough to serve the files from a central share for both users anyway.
The solution is to throttle the 'workstations' file server by turning it off and moving the files to a proper server.
The hack'd solution is to realize that you're talking about a mac serving files ... which means samba ... which has all the power you need to limit the user in question to a sane rate.
man smb.conf and be prepared for lots of reading.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Somehow, I find it surprising that you're managing to saturate a modern hard drive via a single network connection. Are you running extremely slow PCs on a ridiculously fast network? The workflow that you describe sounds pretty normal for a design studio.
-- If you try to fail and succeed, which have you done? - Uli's moose
OS X uses ipfw as its firewall. Look up 'ipfw throttling' in google. If you don't want to edit ipfw files by hand, hunt out WaterRoof as well.
You have to throttle the port the file sharing is running on. Probably 548 or/and 427. To throttle these ports you have to go into terminal and type this:
sudo ipfw pipe 1 config bw 15KByte/s
sudo ipfw add 1 pipe 1 src-port 548
To remove the throttling just type:
sudo ipfw delete 1
Source: http://www.macosxhints.com/article.php?story=20080119112509736
http://homepage.mac.com/car1son/static_port_fwd_firewall.html
Say NO to unpaid Internships!
This twit isn't your problem. Throttling him on your own initiative is both passive-aggressive and might overstep what the owner expects, which could land you in hot water. Don't do that. Here's what you do instead. Go to the owner's office and say the following:
Give a few people lag switches.
http://images.google.com/images?q=lag+switch
it is a button on a network cord that when you press it the cord stops working. If he is working on another machine and it keeps giving him network errors, he will figure out another way.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
plant some weed in his desk and call the cops anon.
THL phish sticks
You missed the part where he said "design studio" and "OS X."
Which raises the question: why don't they have a $1000 Mac Mini Server already?
Check the nice manual page
Increment it slowly and he won't know whats going on (mu-ha ha)
My ism, it's full of beliefs.
If the user already enjoys immunity due to nepotism, what do you think the boss will do to you if he finds out you are specifically targeting his favorite employee? You can't win here, not matter what you do.
I would wonder whether the designer has considered simply talking to the boss and explaining the impact in terms of dollars and hour?. If his boss does not try to correct his sons behaviour, then I would consider the throttling approach and then what other job opportunities there are. If this continual behaviour results in you wanting to leave the company, then you shouldn't really be worried about being getting fired for bringing the issue up with your boss.
Jumpstart the tartan drive.
The FreeBSD solution to this would be to use Netgraph to set his jitter to 0-5 seconds, so any file operation involving seeking became painfully slow, but copying was still fast. Netgraph, however, is not part of the XNU kernel. so this is not an option.
I am TheRaven on Soylent News
Wait till the machine is slow..call the boss over and give him a demonstration of something that you have been working on that will get him excited. Have him wait around while the pizza wheel turns... apologise profusely, use task manager or look for active connections to track down the problem voila new computer or action
Brisbane Aikido Republic
All the 'throttle the process/port/ip' answers are wrong. I'm surprised people here can't see that.
The issue is that the idio^H^H^H^H user in question is using AFP/SMB/whatever to open the file, but that's the same process he would use to transfer the file over the network.
If you throttle the file server daemon to 10kbps/nice 20/whatever, all that will serve is to make network transfers excruciatingly slow to the point where he'll be complaining "but it takes _hours_ to copy the file over the network, which is why I work on it remotely".
If there is a throttling solution it is in allowing fast file copies while maintaining slow open/writes. I don't know that exists (at least at the user-manageable level). Read-only shares might help (that way he can't save his edits back) but will end up with fragmented file stores (and someone has to keep track of where the latest version of any file is).
You might be able to craft a possible solution via Mac OS X's ACLs - maybe write/add_file on the directory, but read-only files so he can create new files but not edit/save/overwrite existing files.
At the end of the day, though, without a network infrastructure change (e.g. a central file server) this problem isn't going to go away.
-- Always borrow money from a pessimist; they don't expect to be paid back.
If you have root access and the kid does not then there are some kludges you can do. For example, write a launchdaemon that runs
renice -n 20 -u kidsudername
every 5 minutes.
that will squish the CPU activity more than the Disk activity, but it should improve things a lot.
if you want to be a little passive aggressive you could move the login port to another port then put another process on that port that pipes to the real one but with a small delay. It will make the whole connection mysteriously intolerable. Again it's the launch agents that do this port mapping. so you move ssh from port 22 to port 5022. then have a job running that runs on port 22 and sends it to port 5022. if you don't want bother writing that socket process then you can fake it with
nice -20 ssh -C -L 5022:localhost:22 localhost
to connect the two ports on the local host. toss in some compression on the SSH connection to slow it down a little. and renice this ssh tunnel to 20 so it bogs if you are busy.
Some drink at the fountain of knowledge. Others just gargle.
IN Leopard Apple went from ipfw to an application firewall. But ipfw is still there and can be run. you can configure ipfw to limit the bandwidth to specific IP addresses. Your problem is exactly what this is for.
http://www.macgeekery.com/hacks/software/traffic_shaping_in_mac_os_x
THere is probably some way to do this with the application firewall too but I don't know how.
Some drink at the fountain of knowledge. Others just gargle.
This should help: sudo nano -w /System/Library/LaunchDaemons/com.apple.AppleFileServer.plist
Add in the following lines:
LowPriorityIO
This will cause the AFP server on the file share to have only spare access to the disk.
"liberty and justice for all those who can afford it"
how to set up ipfw in leopard:
see here and here:
http://www.netmojo.ca/2007/10/31/fixing-leopards-firewall/
http://securosis.com/blog/help-build-the-best-ipfw-firewall-rules-sets-ever
or use the GUI tool wateroof to configure the firewall.
add the rules decribed here:
http://www.macgeekery.com/hacks/software/traffic_shaping_in_mac_os_x
then turn it on at boot like this:
http://lists.macosforge.org/pipermail/macports-users/2008-May/010337.html
and then turn off the application firewall in system preferences.
Some drink at the fountain of knowledge. Others just gargle.
Someone has already written an app to do all of this Throttled
About
throttled is a bandwidth shaping application for Mac OS X and FreeBSD which allows you to cap your upstream bandwidth, prioritize ACK packets, and keep your download speeds high even when your server is sending out at full speed.
Features
* Allows you to set a global bandwidth cap for all your applications, or multiple caps with different speeds to guarantee all your servers a certain amount of bandwidth.
* Allows you to setup wighted queues for your network data to guarantee low-latency ssh, telnet, etc connections on your server.
* Includes optimizations for many online games including Unreal Tournament 2004, World of Warcraft, Call of Duty, Ghost Recon, Starcraft, Warcraft II, Warcraft III, and Diablo II.
* Prioritizes TCP ACK packets to allow consistent bandwidth in both directions even under heavy server load.
* It uses almost no resources. CPU usage is around 0 - 3% and it uses less than 500k of RAM.
* Source code is freely available, and released under the GPL. Please read the COPYING file in the distribution.
[Disclaimer: I'm a friend of the guy who wrote it and did early early beta testing.]
On linux, there is ionice which solves this problem conveniently. Just run the file-share program (e.g. ftp server, CIFS server etc.) with a lower IO priority, and there is no effect on the person working on it. Isn't there anything comparable for Macs?
Bingo Dictionary - Pragmatist, n. A myopic idealist.