Everybody Staze...

Nobody leavz...

Open Directory oddities…

By

Just this last weekend, I upgraded our primary systems from 10.5.8 Server to 10.6.2 Server, and the Xsan to 2.2.1 from 2.1.1. All and all, everything went well, though there’s been an odd issue that arose.

Since the update, I’ve seen something like the following error every 2 hours on the 10.6 machines: “Dec 25 14:03:26 server DirectoryService[29]: Misconfiguration detected in hash ‘Global GID’ – see /Library/Logs/DirectoryService/DirectoryService.error.log for details”

You look in DirectoryService.error.log, and you find:
2009-12-25 14:03:26 PST - T[0x0000000104781000] - Group 'wheel' (/LDAPv3/od.example.com) - ID 0 - UUID 9E733C05-88DE-4F83-9E09-038A887F1327 - SID S-1-5-21-4096-2147483678-1391576524-1001
2009-12-25 14:03:26 PST - T[0x0000000104781000] - Group 'wheel' (/Local/Default) - ID 0 - UUID ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000 - SID S-1-5-21-4171259825-3059450906-1974363594-1001

This error is there for several system level groups: daemon, kmem, sys, wheel, etc. Basically, the OD clients are all complaining that there is a conflict between the local group “wheel”, and the “wheel” that exists in the directory. These accounts, seemingly, shouldn’t exist within the directory, as they’re local accounts that exist on all the OD clients.

So, at this point, I think I’m safe removing them from the directory at this point. Looking at an ldif dump of the directory, it shoes these groups were created in 2003, when I upgraded the directory server from 10.2 to 10.3 (Netinfo to LDAP).

All told, there are probably 15 of these groups. They all conflict with other groups on the local directories, or are antiquated and don’t need to exist on the directory.

UPDATE: I successfully removed all of these groups, and it seem to have resolved the error messages, and had no ill effects. So, if you’re getting a bunch of the above errors, check to make sure you don’t have some weird group sitting on your directory that’s conflicting with a local system group. In general, all the groups you create should start with UID 1000 or above. There are only a few that are supposed to exist on the directory (admin, staff, domainadmins, domaincomputers, domainusers… I think that’s it).

Good luck, and hopefully post again shortly after the new year and students return from vacation.

How to make iPhone WP app work with Self Signed SSL Certs

By

This post assumes the user is using a Macintosh running 10.5.x or greater. It will still work with Linux or other Unix OS’s, but you’ll need to do some digging to get the proper commands. This way is all GUI driven.

Assumptions:

  • Have access to a computer running ≥10.5.x
  • Have a self signed certificate your web server is using for SSL
  • Have configured WordPress to require SSL for XMLRPC and Login (using “define(‘FORCE_SSL_ADMIN’, true);”) (Admin over SSL).

Assuming all of this, the process is not too difficult.

The basic gist is that you need to create a Certificate Authority, and then sign your SSL web cert with this CA. Once you’ve done that, you can then take the CA certificate, and email it to your iphone, and install it there.

So basically, you need to create a CSR (Certificate Signing Request) from your SSL cert you’re using on your webserver. If you’re using Mac OS Server 10.4 or greater, you can do this in Server Admin very easily. If you’re not, then you need to do some command line magic.

Something like this here: http://sial.org/howto/openssl/csr/

Once you have that CSR, you then can go into Keychain Access on your mac, and under the “Keychain Access” menu, go to “Certificate Assistant” and say “Create a Certificate Authority…”. Walk through that wizard, and most of the defaults are fine. You’ll want to put in your name, email, etc.

Once that’s done, you can go back into Certificate Assistant, and say “Create a Certificate for Someone Else as a Certificate Authority…”. This basically will sign your certificate. It’s like a self-signed certificate, only you actually have the CA cert to “trust”. Walk through that, though you may have to change the defaults for what the certificate is for.

Once you’ve done that, you’ll need to use this new certificate, as your SSL certificate. You do that by exporting the SSL cert as a .pem, and then replacing your public SSL cert with this one. Restart your web server, and you should have a signed cert. Assuming you trusted your own CA, you also shouldn’t get any warning about it being untrusted.

Now, once that’s done, you can export the public CA cert, as a .crt, and email than to your iphone. Once you get that, you can click it, choose to install the profile, and you’re done. The wordpress app should now work.

Please contact me if none of this makes sense, or if you need additional info. I was going to put up screen shots, but that just delayed me posting this. Which I wanted to get done.

Have a great rest of the week, and weekend!

Flash player and network homes on Mac OS 10.5+

By

So, along the lines of my previous post, today I decided to look into Flash Player performance on 10.5 clients with a 10.5.8 server, using network home directories.

I had noticed a couple days ago that users playing youtube videos got occasional skips and stops in the video. This is on a brand new Intel iMac, with 2gb of ram. It should easily be able to handle a non-full screen, non-HD youtube video. Doing a `fs_usage AppleFileServer | grep <username>` (where <username> is the username of the user logged in) on our AFP server showed a LOT of traffic to ~/Library/Preferences/Macromedia/Flash Player/… First, seems like Adobe hasn’t touched that part of the Flash player code, if it’s still writing to a “Macromedia” folder. Second, why the hell is it caching information in the Preferences folder?! That’s what ~/Library/Caches is for (which I already redirect). But, I know there’s been a lot of complaining in the past about Flash caching data in non-standard places that aren’t affected by clearing the browser cache.

So, given that amount of traffic it was producing, I figured that was probably the cause (what a leap!), so, I open up the NHR scripts I use, and add a redirect for that folder to the local HD, and install those on the client. Guess what? No more Flash Player skips or stops on network home users.

At this point, I’ve copied those changes out to all our clients, and dropped them into our DeployStudio workflow (for machines that we image between now and the next image update). On the plus side, this should result in a sizable decrease in server IO and network traffic in the case of a whole class watching Flash videos.

So, once again, shoddy programming. The only caveat I can think with this would be any install bases that are using Macromedia Dreamweaver (already checked Dreamweaver CS3, and it doesn’t write to that folder), or maybe Macromedia Director. If you’re running those, I’d recommend just redirecting the “Flash Player” folder within the Macromedia folder. But, I’m not positive those other programs write to that folder, it’s just a guess.

So, good luck.

UPDATE: So, a student came up to me today and said Pandora stopped working. Looking into the issue, it looks like the newest full release of Flash doesn’t really like this “hack”. So, after beating my head against the wall for 2 hours with this, I decided “what the hell” and installed the beta of Flash player that adobe just released (which is Intel only, even though it claims to be a Universal Binary in the installer, and the Plugin itself), and what do you know, it fixed the issue. So, my guess at this point is Adobe is just slowly updating Macromedia’s code, and they found/fixed this issue while fixing something else (since they don’t support Network Homes).