Archive

Author Archive

Creating multiline login banners

March 25, 2017 2 comments

In a number of Mac environments, there is a need or requirement for a login banner (otherwise known as a lock message). This message appears in the following locations:

  • FileVault 2 pre-boot login screen
  • OS login window
  • Screensaver lock window

Brevity is best, as staying within a maximum of three lines permits the banner text to be displayed consistently in all three locations. Exceeding the three-line limit may result in the text being cut off and not fully displayed.

You can set this banner text from the command line using the following defaults command, which should be run with root privileges:

/usr/bin/defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText "My Login Window Text Goes Here"

LWScreenShot 2017 03 25 at 11 31 14 AM

Being able to consistently set when lines begin and end can be challenging though, as the defaults command is not able to interpret a newline command natively. However, it is possible to set a multi-line login banner and be able to consistently set when lines begin and end. For more details, see below the jump.

Read more…

Downloading individual Slack emoji using Safari

March 24, 2017 1 comment

Thanks to participating in multiple Slack instances, I’ve been in the position more than once where I’ve wanted specific emoji available in one Slack to also be available in another Slack instance. While Slack themselves provide a stock set of emoji for all Slack instances, custom emoji can help you express yourself better. For example, one of my favorites on the MacAdmins Slack instance is :headdesk:, represented by this animated emoji.

Headdesk

While there are solutions to moving emoji en masse, I usually just want to selectively download emojis as I see them. Fortunately, there’s a relatively straightforward way to do that using Safari. For more details, see below the jump.

Read more…

Categories: macOS, Slack

Disabling login to the root account by changing the root account’s user shell

March 19, 2017 1 comment

While discussing various issues with a colleague, he mentioned that he was seeing the root account enabled on several machines where it should not have been. In general, the root account on macOS is not needed for system administration and should be disabled so he asked if there was a way to use the dsenableroot command to disable the root account without also needing to provide a password.

Unfortunately, disabling the root account by using the dsenableroot -d command does require providing a password as part of the command.

Screen Shot 2017 03 19 at 4 55 17 PM

However, it is possible to disable logins to the root account without using the dsenableroot -d command. For more details, see below the jump.

Read more…

Creating a Jamf Pro Cloud Distribution Point using Amazon Web Services

March 7, 2017 3 comments

In a number of environments, Mac admins are transitioning from hosting their Mac-supporting services in on-site datacenters to now hosting them with various cloud service providers. These service providers can include Jamf Cloud, Amazon Web Services, Akamai or Rackspace.

For Mac admins using Jamf Pro, one way to start this transition is to use a Cloud Distribution Point (CDP). This allows a Jamf Pro server to use several specific cloud services’ content delivery networks to host installers and (if applicable) in-house developed applications and eBooks.

For my own needs, I was looking into setting up a CDP on Amazon Web Services (AWS). Jamf provides some documentation on how to set a CDP up with AWS, but doesn’t provide specific guidance. After some research and testing though, I was able to figure out the process for Jamf Pro 9.97x. For more details, see below the jump.

Read more…

Resizing a virtual machine’s boot drive to use all available space

March 3, 2017 1 comment

Every so often, it’s necessary to resize the boot drive of an existing virtual machine. The process of resizing the VM’s boot disk from outside the VM is usually pretty straightforward:

1. Shut down the VM
2. Go into the VM’s drive settings

Screen Shot 2017 03 02 at 5 02 10 PM

3. Resize it to the desired size

Screen Shot 2017 03 02 at 5 02 23 PM

Screen Shot 2017 03 02 at 5 05 45 PM

4. Power on the VM.

However, when the VM boots up, the disk space used by the OS won’t have changed.

Screen Shot 2017 03 02 at 5 07 55 PM

However, the OS can detect that there is available unallocated disk space that it isn’t using.

Screen Shot 2017 03 02 at 5 08 58 PM

Fortunately, this is a correctable condition and the fix can be applied without needing to shut down the VM or boot from another drive. For more details, see below the jump.

Read more…

Providing access to Apple software updates from Jamf Pro’s Self Service

February 26, 2017 Leave a comment

For shops that want to help their customers stay on top of Apple software updates without forcing those updates to be applied, there is a convenient URL that can be used:

macappstore://showUpdatesPage

When this URL is called from the command line using the open command, the following actions take place:

  1. The App Store application launches
  2. The Updates page loads.
  3. The Mac automatically checks for Apple OS updates and updates for applications purchased through the Mac App Store (MAS).

The relevant command is shown below and can be run without root privileges:

open macappstore://showUpdatesPage

For folks using Jamf Pro (the management solution formerly known as Casper), this command can be leveraged to provide a way for customers to easily check for Apple and MAS software updates on their own schedule. For more details, see below the jump.

Read more…

Using FileVault 2 recovery keys on FileVault 2-encrypted Macs to provide access for local admins

February 23, 2017 1 comment

It can be difficult to provide consistent access for Mac admins when using a local admin account on FileVault 2-encrypted Macs, due to the way password changes are handled for FileVault 2-enabled accounts. The reason for the difficulty is that FileVault 2’s encryption doesn’t care about passwords, it only cares about encryption keys.

When an account on a particular Mac is enabled for FileVault 2, the account’s password is used to generate an key which can be used to unlock the encrypted Core Storage volume that FileVault 2 sets up on the Mac. When the password for the enabled account gets changed, the password and its associated key are updated by first requesting the previous password (and its associated key) to authenticate the change to the new password and associated key.

Assuming that the old password is provided as part of the password change process, no problem. However, if the old password is not provided as part of the password change process, the new password does not get an associated key to unlock FileVault 2 because the old password’s key was not invoked to authorize the change to a new key. The result of this is that the new password can be used to log into the OS and provide whatever password authorization duties are needed for the OS, but you still need the account’s old password to log into the Mac at the FileVault 2 login screen.

The usual fix for this situation is to run the following commands with root privileges:

1. Remove the user from the list of FileVault 2-enabled accounts

fdesetup remove -user username_goes_here

Figure 25 Using fdesetup remove with username


2. Add the user back to the list of FileVault 2-enabled accounts

fdesetup add -usertoadd username_goes_here

Figure 21 Using fdesetup add usertoadd to enable additional accounts


When the account is re-enabled using the fdesetup add -usertoadd command, a new key is set up for the user and the passwords are back in sync. However, there are two drawbacks to this approach if a Mac admin wants to automate this:

  • You need to provide the password in a non-encrypted format of the account being enabled.
  • You need to provide in a non-encrypted format either a recovery key or the password of another FV 2-enabled account on the Mac.

In short, the passwords and/or recovery key used to remove and re-enable the account in question need to be provided “in the clear”, where anyone successfully intercepting the passwords will be able to read them.

Fortunately, for those Mac admins who have a way to capture and escrow FileVault 2 personal recovery keys, there is an alternative to enabling the local admin account. For more details, see below the jump.

Read more…

%d bloggers like this: