April 2008 Archives

I've been doing some mucking around with my Leopard 10.5.2 dev server and came across what I think is a bug (or at least a problem). It seems that if you have a folder on a Mac OS X Server 10.5.2 sharepoint, shared via Samba, and the folder has (certain, common) extended attributes, Vista (and possibly XP) users will get an error when they try to download the folder. The error the Vista user will get is: "Error 0x800700FE: The specified extended attribute name was invalid."

It seems that if you 1) have extended attributes on 2) a directory that 3) has a colon in the attribute's key or value, Vista will produce an error and prohibit downloading. Naturally, this is problematic, because users can't always control how EAs are applied. And just about every EA has a colon with MOSX.

I needed to get WebAuth working on my Leopard server, but out of the box, there are some issues with building the modules. I want it to work with the included Apache 2.2, so that I and other admins can use Apple's Server Admin tool to configure sites and directories. (Admittedly, I get that tingly, satisfying feeling when third-party tools fit like a puzzle piece in your operating system of choice. Can't discount that motivating incentive.)

But time pressures prevailed, so I had to prioritize a workaround to meet a looming deadline. Personally, "workarounds" almost always gives leave me dissatisfied, but in this case, it's a necessity. Here's how I implemented WebAuth, opting to give up the web server administration utility of Server Admin (which, at the end of the day, isn't too great a loss).

In short, you'll 1) build Apache 2.2 from source, 2) build WebAuth, 3) add the WebAuth Kerberos keytab, 4) add an SSL certificate, 5) hand-configure your conf files to protect your sites and 6) add a launchd file to start it all automatically.

I wrote a simple bash script to help monitor some aspects of Mac OS X Server. You might find it helpful. You'll need to edit it accordingly for your purposes, and of course, there are no guarantees. Feel free to modify it to your purposes and environment.

I tried to make somewhat agnostic regarding hardware (specifically, which NIC reflects the primary IP). And since I use Tivoli Storage Manager to back up some of our hosts, it includes a grep statement to send notices about TSM.

I'm quite certain it can be made more sophisticated, as I'm a scripting newbie, I'll admit. Nevertheless, you can find it at http://stanford.edu/~nbfa/files/daily-report.sh.

On my 10.4 and 10.5 servers, I made a launchd process that runs this script daily. On my 10.3 server, I made a cron job.

If it helps you learn, then all the better. If you repurpose and use it, then rock on. If you have suggestions to make it better, please comment.

I've deployed WebAuth on Mac OS X 10.5.2 Server a couple times now on dev servers. It involves compiling Apache from source. Blech. Now your server will have three Apaches on it—a whole band, if you will.

I'm writing up an article now on how to do some of this. There are Mac OS X-specific considerations that a systems admin needs to take into account, which might not be obvious.

Two conferences of note:

LabMan 2008 is happening this year in MN. on June 2nd-4th, 2008. Here is the official announcement.

And of course, the other conference of note (which is much, much bigger, not to mention more Mac-related) is Apple's World Wide Developer's Conference (WWDC). It's June 9-13, 2008 in San Francisco.