Insert Citations and Bibliography from Mekentosj Papers to Word 2011

One of my users requested help today with inserting document citations from Mekentosj Papers into Word 2011, where the user wanted to use the Papers Word 2008 export feature instead of using Endnote. The procedure was not intuitive, so I’ve documented it and posted it here in the event anyone else needs it. See below the jump for the procedure.

Rotating the FileVault 2 Master Password

If you want to use FileVault 2 with FileVaultMaster.keychain as a managed recovery key, the issue of regularly changing your institution’s Master Password may come up if your worksite mandates password rotation. Since the Master Password’s sole function is to act as the password used to unlock the FileVaultMaster.keychain, this should be relatively straightforward. As long as the public key on your Macs and the private and public keys in your escrowed FileVaultMaster.keychain stay the same, the password to unlock FileVaultMaster.keychain can be updated as often as needed.

There’s two strategies you can use here:

1. You can change the password on a copy of your institution’s FileVaultMaster.keychain and push the updated FileVaultMaster.keychain to /Library/Keychains on your Macs – In my opinion, this is probably the most secure way to do this because you’re replacing one encrypted file with another encrypted file, without revealing in transit what the new password is. The main danger would be an incomplete or corrupted copy of the keychain file somehow being pushed to the machines.

2. You can use the security command to update the existing FileVaultMaster.keychain on the machines – In this case, you’re using the security command’s keychain password functionality to update the password used to unlock /Library/Keychains/FileVaultMaster.keychain from a known old password to a known new password. You would need to use sudo, or run it as root, as the FileVault keychain should be owned and writable only by root. Here’s the command to use (command should be all on one line):

sudo security set-keychain-password -o old_master_password -p new_master_password /Library/Keychains/FileVaultMaster.keychain

The main security concern here would be that the passwords referenced in the command would be sent in the clear, and all sudo-using commands will show up in /var/log/system.log. Running the commands as the root user without using sudo would mean that the command should not show up in /var/log/system.log, but it may show up in the root user’s history.

Unlock or decrypt your FileVault 2-encrypted boot drive from the command line

In addition to using Disk Utility, you can also use the command line to unlock or decrypt a FileVault 2-encrypted drive. In order to make sure it all works, I recommend that you use the Recovery HD partition or the Recovery HD partition cloned onto an external drive. See below the jump for the procedure.

Using Disk Utility to unlock or decrypt your FileVault 2-encrypted boot drive

Bad things happen and sometimes those bad things cause your FileVault 2-encrypted Mac to be unbootable. In the event that you find yourself in this place, or you’re about to be, here’s how you can unlock or decrypt your FileVault 2-encrypted drive using Disk Utility and the password of an account that’s authorized to log in at the FileVault 2 pre-boot login screen.

---

Update – June 11, 2013: As of Mac OS X 10.8.4, you will need to unlock the encrypted volume first, then you will be able to decrypt it. See this post for details.

---

1. Boot your Mac and hold down ⌘-R (Command –R) to boot from the Mac’s Recovery HD partition.

Note: You can also boot from a 10.7 installer drive , boot to Target Disk Mode and connect it via Firewire or Thunderbolt to another Mac, or use some other 10.7-booting drive. As long as you have 10.7’s Disk Utility, this should work.

2. Open Disk Utility.

3. Select your locked hard drive.

4. Under the File menu, select Unlock “Drive Name” or Turn Off Encryption… , based on what you want to do.

  

5. When prompted for a password, you can enter the password of any authorized account on the drive.

6. If you unlock the drive, you should then be able to use Disk Utility’s repair tools to hopefully fix the problem that’s preventing your Mac from booting.

7. If you turn off the encryption, the encrypted drive will decrypt. Once it’s finished decrypting, you should be able to access your data again using normal recovery methods (booting from another 10.6 or 10.7 boot drive, utility drive, etc.)

Updated FileVault 2 status check script now available

Since releasing the original version of my FileVault 2 encryption status check script , it was brought to my attention that there was a reporting problem with it. It worked fine with one FileVault 2 encrypted drive in the Mac but multiple encrypted drives (like an encrypted Time Machine backup drive) on the same Mac were causing the script’s reporting to have problems. Fortunately, I now have not one script where the problem has been fixed, but two! Both Peter Bukowinski and Mike Osterman stepped up and sent me fixes. If you had previously downloaded a copy of my script, I encourage you to get the new version.

Mike’s fixes have now been posted as part of my regular script and have been rolled into both the Casper Extension Attribute and the Absolute Manage Custom Info Item. Peter’s fix was a complete rewrite of my script to make it leaner and more efficient.

I’ve added Peter’s script to a new directory named scripts_by_third_parties. If anybody else wants to send me their own FileVault 2 status check scripts, please do so. I’ll be happy to host them here in my GitHub repo after testing them out and making sure they work.

Updated script to activate the Java web plug-ins setting in 10.7

A few months back, I posted a way to activate the Java web plug-ins from the command-line and also posted an accompanying script using PlistBuddy. At the time, I was only targeting the default user template as I was mostly doing test installs of 10.7 where I was creating new users. However, recently I’ve begun testing upgrades on machines with existing users and those users weren’t getting the new settings.

To fix this, I went digging in the latest build of DeployStudio. DeployStudio had recently included the ability to suppress the iCloud and gesture demos in ds_finalize, so I took a look to see if I could adapt what the DeployStudio developers had done for my own purposes. Sure enough, the answer to my problem was included as a for loop inside DeployStudio’s ds_finalize.sh script. (For those interested and who have DeployStudio handy, this script is in stored in /Applications/Utilities/DeployStudio Admin.app/Contents/Frameworks/DSCore.framework/Versions/A/Resources/Tools/Common/ds_finalize.sh.) The new script is also now using defaults instead of PlistBuddy (hat tip to Chris Hotte for posting how to use defaults to set the correct plist values.)

See below the jump for what the new and improved Java-enabling script looks like.

Active Directory home directory lookup AppleScript now updated for 10.7.x

A while back, I had posted an AppleScript that Peter Bukowinski and I had built to provide an easy-to-use way to look up the location of an Active Directory home folder. With the changes to the Active Directory plug-in on Mac OS X 10.7.x, the script also needed to be updated so I’m posting the updated script and code. The script should be usable on AD-bound 10.6.x and 10.7.x Macs, and Peter has added some new functionality to display the correct fileshare connection information for both Macs and Windows boxes.

Assumptions:

In order to work correctly, the script needs for the Mac to be bound to an AD domain. The AD-bound Mac also needs to be connected to the AD domain via a domain-reachable network connection or via VPN.

Using the script:

Launch the script and provide the username in the blank provided, then click OK.

The home folder’s address will then be displayed in a dialog box, with the correct fileshare information for both Windows and Mac. You’ll also be prompted to copy the home folder information to the Mac’s clipboard for pasting (if needed.) Click OK to dismiss the dialog without copying the information. Clicking any of the buttons will quit the script.

As before, it should be pretty generic but the only location I’ve tested it at is here at my workplace. If you’re planning to use it on 10.7.x AD-bound Macs, check the code as you will need to make some edits.

Click here to download the script

Click here to download the source as a PDF document

FileVault 2 encryption status script now available as an Absolute Manage custom information item

Patrick Gallagher of Emory University has adapted my FileVault 2 encryption status check script for use with Absolute Manage. He was kind enough to share back a copy of his adaption of the script, so I am hosting it here on my GitHub repository.

Using Firmware passwords with FileVault 2-encrypted Macs

While I was giving my FileVault 2 talk at Jamf’s 2011 National User Conference, a question came up at the end with regards to using firmware passwords with FileVault 2-encrypted machines. This isn’t something I tested, so I admitted I hadn’t tested it and didn’t know. However, some of the Mac support folks at Sandia National Laboratories were also attending my talk and they had tested this very scenario. Here’s my notes on what they had found:

—-

When the firmware password is set, you will need to enter the firmware password before being able to boot to the Recovery HD partition or any other drive that weren’t selected as a startup volume in Startup Disk.

If booting to your FileVault 2-encrypted boot drive, you should be taken to the pre-boot login screen as normal. You should only need to authenticate at the pre-boot login screen and you will not be asked for the firmware password.

—-

I was able to test this on my own end and my results bear this out. If you have the firmware password set and you hold down Command-R to boot from Recovery HD, you’ll be asked for the firmware password before the Mac will boot from Recovery HD. You will also be asked for the the firmware password if you’re using any of the options described as blocked in this KBase article on setting up the firmware password. You are not asked for the firmware password if you are booting from a FileVault 2-encrypted boot drive.

Setting custom vibration alerts in iOS 5

I almost always have the mute switch on my iDevices engaged, so I’ve only had the one vibration signal to let me know about incoming emails, texts, phone calls, etc. With the one signal, I’ve always had to pull my iPhone or iPad out and see exactly what had come in. No more.

Thanks to iOS 5’s new Accessibility options for the hearing impaired, it’s possible to set custom vibrations for your muted phone. You can choose from Apple’s pre-set options, or you can record and set your own by using your iDevice’s touch screen as a drum pad for your fingers. See below the jump for how.