Set Automatic Proxy Configuration through Command line in OS X 10.7

It took me a while to find it, but to set the Automatic Proxy Configuration url and tick the box through command line I found this helpful post which describes a script on how to do it.

First you need to find which network interface you want to change:

networksetup -listallnetworkservices
Ethernet

Use this in the command:

networksetup -setautoproxyurl Ethernet http://wpad.your.path.here/wpad.dat

By adding a url it automatically switches it on. To check:

networksetup -getautoproxyurl Ethernet

Simples. Don't know why it took me so long to find it. Don't think it's in the man page for networksetup for some reason!

Workgroup Manager Crashing on connecting to server

Recently I've had an issue with Workgroup Manager crashing when it connects to the Xserver:

Error of type eMemoryAllocError (-14901) on line 401 of /SourceCache/WorkgroupManager/WorkgroupManager-361.3.1/DirNodeRefController.m

Please not I'm using:

• Workgroup Manager Version 10.6.3 (361.3.1)
• OS X 10.6.8
• OS X Server 10.4.11

Doing a copy and paste in google brings up on 1 result which happens to be on Apple Discussions.  The discussion is exactly what I was looking for. Here it is.

Basically they describe the problem after a security update (not sure whether it was on the client or server). Luckily there is a work-around by ManuelSF, but people are not really liking it. Here it is:

1. open workgroup manager
2. click cancel at the login screen
3. go to server in the menu bar and select view directories
4. you should see your directory
5. click on the lock in the upper left-hand corner to unlock and edit the directory.

Works better then it did before surprisingly!

Password for printing on OS X 10.6 and changing every day

Here's some info:

The need a password tickbox in mcxprinting has limiting effects. It appears in Photoshop that it only prompts for a password if you change the print settings for the printer! Seems to only stop you if you're using the OS X printer interface. Any other interface might get around the password facility.

I suppose one option is to see if the CUPS printing facility has an admin password thingy.

Alternatively, you could just have one user which can log into the machine.

One thing we need to do is to get something automatic in place which automatically changes the password depending on the day.

Found this which describes the use of passwd command line utility to change a users password. We could set up something automatic which would change the administrators password every day and loop.

Another thought I had was to share the printer with the server, but call the instance on the machine something miscellaneous like -error-, and have another printer set up which connects to the server. That way we can use it like any other! I think this is the best solution yet.

So, I tried to setup a network printer:

1. I set up the printer on the machine and called it "-error1-" so no-one would use it
2. ticked the "printer sharing" box in system preferences
1. also ticked the windows sharing box
3. I read somewhere it was best to turn the firewall on, so I did. I checked to see the exceptions and printing and smb were listed
4. Next I went to the windows 2000 server added a 'local port' printer
1. using port "\\123.45.67.89\-error1-" and used the right windows driver for it so papercut would be able to work out paper size etc.
2. I shared this printer with the name "n239-Ep7600"
5. I did a test print from the windows server and it came out fine, although it wanted the roll paper instead of sheet paper feed.
6. On the Mac I set up the networked printer, using LPR, the ip address of the server and the queue name "N239-Ep7600"
1. gave it the correct print driver
7. I performed a test print from the OS X machine and it came up with some sort of "rasterize" error.

/Library/Printers/EPSON/InkjetPrinter2/Filter/rastertoescpII.app/Contents/MacOS/rastertoescpII failed

I can only assume that the print driver cannot cope with being sent through a network, and has to "rasterize" it on the fly?

Another option is to have the print queue paused for every printjob which requires an administrator to unpause it. Found this post which is for os x 10.5 and involves CUPs config file.

Installing UniFLOW client on Mac OS X 10.6 and deploying it

So, we're going to be using a UniFLOW system for our print management. Everythings working fine, just need to deploy it to all the Apple Macs under my control.

Simply set up the printers on one machine. Load up Workgroup Manager and add these printers to whatever managed computer lists you have (but make sure the managed computers have the drivers installed first!)

Next is to install the client. Luckily it comes as a mpkg file! Just have to set the preferences to pick up the right server and settings

From what I can find the settings are in a plist file:
~/Library/Preferences/com.NT-Ware.UniFLOWMacClient.plist

Although In this file there were only a few things:

TEST
aaa

Doh!

But I have also found:
~/Library/Preferences/ByHost/com.NT-Ware.UniFLOWMacClient.001b6399ade5.plist

Which contains:





LogFileName

LogonNoName

PopupForEveryJob

Reditect

ServerName
put.your.server.dnsname.here.com

(it didn't put all of the "<" and ">" things in!!

Result. Not sure what the "ByHost" folder is all about. I might look into it if just getting this plist file and putting in workgroup manager doesn't work.

So, I saved this file in the ByHost folder as ~/Library/Preferences/com.NT-Ware.UniFLOWMacClient.plist and added it to the Workgroup Manager - Managed Groups - Preferences - Details tab and set it to "Always".

Now when I load up the UniFLOW - MacClient app it comes up with the right server!

But for some reason it hasn't popped up when printing. Might be to do with the user. I'll try my login.......
.... yep worked a charm.

Just emailing the guy in charge to see if he can set up my test user the same as myself (I think the main thing to do is change the threshold for when the user gets notified).

Yep, turns out the test user account didn't have any budget or anything. Now he's sorted the account out, everything works fine!

Managed Preferences not working on a few Apple Macs

I look after about 140 Apple Macs, now with OS X 10.6.6. It was noticed that at least two, in one classroom, were not picking up printers and autologin items specified in Workgroup Manager as a managed preference.

It took a while but I found this forum which gave a good insight into troubleshooting managed preference on the Apple Macs. Here are a few tools:

• Go to About This Mac > System Profiler > Managed Preferences. It will show you what preference are managed, if any.
• From terminal use the command: mcxrefresh
• Also from terminal use: mcxquery - much better then the refresh for troubleshooting

After trying all of these it was apparent that the machine was not picking up anything! Nothing appeared in any of these tools, so I finally referred to Workgroup Manager.

The computer was in the list, with the right MAC address. I finally had a look in the All Computers list and sorted in order of MAC Address. I found that this MAC address was listed twice! I deleted the other instance and what do you know, it worked.

Note: Always check for duplicate entries in workgroup manager!!

Sorted.


To properly refresh the MCX preferences from the client machine logged in as a user you can:

1. Open Terminal
2. Make sure you're a SUDO user
3. type:
1. sudo mcxrefresh -n USERNAME_HERE -a
2. Password:
4. It came up with this error though:
1. 07] CFURLCreateWithString was passed this invalid URL string: '/Applications/Safari.app' (a file system path instead of an URL string). The URL created will not work with most file URL functions. CFURLCreateWithFileSystemPath or CFURLCreateWithFileSystemPathRelativeToBase should be used instead.
5. but it did refresh all information and install the right printers!

New Web Filter - Bloxx and sendLogon deployment on OS X

So we've now got a new web filtering system which needs testing on the Macs and then deploying. The new system is currently running alongside the old, the later of which will slowly be phased out.

The new system does come with one small bonus for the Apple Macs as it works alongside a program called "sendLogon" which sends the credentials of the user to the server and automatically authenticating them to use the internet. This sendLogon was downloaded here, and comes with instructions:

Running sendLogon automatically on Mac OSX
You need to take the following steps:

1) Download the Send Logon program from http://www.bloxx.com/downloads/sendLogon_osx_10.4.universal.tar.gz to the desktop.
2) Browse to ‘Applications->Utilities’ and run the ‘Terminal’ application.
3) Type ‘cd ~/Desktop’.
4) Type 'tar zxvf sendLogon_osx_10.4.universal.tar.gz'.
5) Type ‘sudo cp sendLogon /usr/bin’ and enter your password when prompted.
6) Type ‘sudo nano /usr/bin/login.sh’.
7) Enter the following lines:

#!/bin/tcsh

/usr/bin/sendLogon 3898 $1

8) When finished, press ctrl-o followed by return, to save the file.
9) Press ctrl-x to exit.
10) Run the following commands to set the correct permissions on the utility and login script:

sudo chmod 755 /usr/bin/login.sh
sudo chmod 755 /usr/bin/sendLogon

11) Run the following command:

sudo defaults write com.apple.loginwindow LoginHook /usr/bin/login.sh

The sendLogon utility should now run for every user that logs on.

This all worked splendidly. Our server address is XXX.XXX.XXX.21. The proxy settings are XXX.XXX.XXX.23 port 8080 though. Just need to remember that the computer has to be in the list of this filter system as using the sendLogon program (took me 20 mins before I remembered this!).

To deploy this the idea is to create a pkg file which copies the two files login.sh and sendLogon to /usr/bin and also sends the command for the LoginHook.

Note that all the Macs I will run this on do not have any login scripts which run from the computer and hence it doesn't matter if you overwrite the login.sh file. For those who do have login scripts then they will need to append to this file, which isn't too hard.

I will use the Iceberg App to create the pkg file and run it through the task server to deploy to all computer suites and staff machines.

We did have a choice whether to control the LoginHook from the Xserver or just have the clients controled locally. We chose the later as ICT Services do not control the Xserver, which is just used for the one Directorate.

I shall note in a later post how I created the pkg file.

Guest Account on Mac OS X 10.6 and Guest1 problem

So after re-imaging half of the Apple Macs I look after I've found a problem logging into them as Guest. In the image I forgot to turn the Guest facility on and so using Workgroup Manager (found in this post) I used the preference MCX editor to enforce the Guest policy (only works on Workgroup Manager 10.5 and upwards).

After turning this on in the server, I found I could not log in using the Guest account by typing in Guest in the Username/password dialogue box. I later found this was due to the fact that the account was now called "guest1". After reading a few posts I found that there is probably some residual 'guest' account somewhere and hence the operating system calls the new account "guest1".

So my next question was "how do I revert it back to "Guest", as the login screen requires you to 'type' your username and password. Well, this post describes a process where you delete all mention of the old Guest account (switch off Guest account first) using the command:

sudo dscl . delete /Users/Guest


But it would be wise to also delete the newer Guest1 account:


sudo dscl . delete /Users/Guest1


I re-interpreted this post to try and find a quicker fix. I first turned off guest account on the server, deleted the guest account using the command above, rebooted and turned guest back on on the server but it still reverted to "guest1".


The only thing that has worked so far is using the dscl command above and then manually turning guest on, on that machine. It appears if I try and turn the Guest facility on, on the server the problems appear. It might be due to the fact that on Active Directory there is already an account called Guest which can't be deleted. This might conflict the local machines ability to make a new Guest account? But this seems unlikely as the local machine should be able to prioritise its' local accounts over any networked accounts!


So, for the time being, I'm going to:

1. turn off login window control on the server.
2. Delete the guest user account using sudo dscl . delete /Users/Guest
3. Manually turn on the Guest facility on each machine.

Now I have noticed that there is a plist file which controls the login window and also controls whether or not the guest facility is enabled. This is:

/Library/Preferences/com.apple.loginwindow.plist
NOPE, this is actually com.apple.MCX.plist

I can send a unix command to machines to turn this on. Something like:

defaults write /Library/Preferences/com.apple.MCX.plist       blar blar blar

Just need to figure out the end bit. I'll update this post when I have the answer.




So, the next day and it appears this problem only happens when setting Workgroup manager to control or "switch on" the guest user. If I do it manually, everything's fine!


I shall next attempt to send the above unix command to see if this works. I'll also re-test the theory that the Guest1 error only occurs when controlling it from the Xserver (OS X Server 10.4.11)

Mac OS X Default Paper Size plist file

For some reason in one room in particular when someone prints to the Dell Colour Laser 3110 the default paper size is Letter. I thought I'd set it up a long time ago not to be. So I've found this thread which mentions the file location for default paper size:

~/Library/Preferences/com.apple.print.PrintingPrefs.plist

It contains:

DefaultPaperID
iso-a4

Add this to a plist file to the "details" tab in a computer list group in workgroup manager and see what happens.