The 2005 Apple Sysadmin's Wishlist
Volume Number: 21 (2005)
Issue Number: 1
Column Tag: Programming
The 2005 Apple Sysadmin's Wishlist
by John Welch
What I would like to see from Apple in 2005
With 2005 rapidly approaching, (Indeed, it will already be here as you read this), I think it's time to
list out the ten eleven things that I, as a sysadmin, would like to see from Apple. One thing that won't be on
the list: Tiger/Mac OS X 10.4. We know it's coming, and by now, any features are locked down. Besides, much of
what I want isn't tied to any OS version, so Tiger really has no bearing on this list.
11) A group calendaring system. The lack of integrated calendaring in Mac OS X Server is problematic. There
may be other products out there, from Kerio, MeetingMaker, Now, etc., But now you have a "groupware" tax on
top of what you're already paying to get what is, to many organizations, basic functionality.
By shipping an integrated groupware solution, Apple could provide the workflow hooks that make Exchange and
Domino such a value - add above and beyond email and calendaring. Heck, get Domino running on Mac OS X, and
ship a client that doesn't suck. (The Domino client, is, without a doubt the most difficult groupware client
to use. People use Domino in spite of the client, not because of it.) Outside of Outlook and Entourage, most
integrated groupware clients, on the Mac or otherwise are just nasty to deal with.
If Apple shipped a full groupware solution, with a good, easy to use, functional, scriptable, secure, cross
- platform client, they could, just like with the Xserve RAID, get their product in places that might not ever
consider. There were a lot of people asking for this at the 2004 WWDC, and it stands to reason that the
complete set of sysadmins who want good groupware was not at the WWDC.
It's a hole in the feature set, and a market that is still, in spite of Exchange and Domino, a lot more
open than people think.
10) A better IT Pro section on the Apple web site. Apple still seems unsure as to how they should go about
supporting Enterprise IT. Right now, they mostly divvy it up between education and developers, and as a
result, most technical IT needs are left to be served by others. While Apple tends to say that this kind of
thing is a "third party opportunity", it ends up looking like Apple isn't really able to support the needs of
Enterprise IT. While Apple's support for Enterprise IT has gotten better, going from actively hostile to just
on the better side of inconsistent. (Note: This is what the company as a whole projects. Almost everyone I've
talked to in the trenches at Apple, including a small number of marketing people, 'get' what IT wants. But as
a company, Apple still seems to think of IT in terms of K-12 and Higher Ed. This is probably not the case, but
as with anything, impressions are important, and Apple needs to do a better job of managing theirs.) The K-12
Educational resources page, http://www.apple.com/education/technicalresources/ billed as, "The single site for
all your Mac OS X technical questions" is not even close. There's some articles that don't really help much,
(While the article on porting VB code to RealBASIC is cool, a light perusal of the various IT - oriented Apple
mailing lists shows that this is not even close to a major concern for Enterprise IT customers.) There's an
article on a Directory Services plugin for Novell eDirectory, (good) and there's ads for Tiger, and Apple
Certification, (standard for any company). As a marketing page, it's okay. As a technical resource, it's not
as good as it could be, except for the link to http://www.macenterprise.org/, which is the new identity of
macosxlabs.org. A good site, but foisting all of your IT info on volunteers is not how Enterprise IT views
vendor support. Apple's similar link for Higher Ed, http://www.apple.com/education/hed/admin/, is more of a
marketing piece than a technical resource, and doesn't really answer any questions. Oddly, there are more
links to information on financing Macs on this page than supporting them. Apple has an Enterprise IT section
on their developer site, http://developer.apple.com/enterpriseit/, but it is, not surprisingly, concerned with
corporate developers rather than sysadmins.
There is an IT Pro section on Apple's site though. It's found via one small link on the Mac OS X Server
site, and is at http://www.apple.com/itpro/. It's...a good start, but it's more of an
"IT Marketing" site as opposed to an "IT Help" site. There's no real meat here, just links to other people's
work, and lots of customer testimonials, good reviews, links to Apple products, etc. It says "IT Pro" but as
an IT Pro, there's not a lot of actual content that I could use on any given day.
If you're a sysadmin, dealing with support and integration issues, Apple's site has, outside of discussion
forums, and mailing lists, a paucity of resources.
While the IT Pro section is a start, it needs to grow. It needs to encompass every piece of hardware and
software Apple makes, because that's what a Mac OS X sysadmin has to deal with. When a new version of Final
Cut Pro comes out, there needs to be an article up that day on remote installing it. When there's a new update
to the OS, there should be a complete list of bug fixes and changes, complete with RadarWeb numbers up the
same day. IT Pros need details, technical details, because without them, we can't do our jobs well, and Apple
is not helping us out as much as they should.
9) Quality IT Documentation. This is another area where Apple is really hurting itself. Documentation is
tedious, unglamorous, thankless and absolutely critical. There's no excuse for the entire Open Directory
section of the command line docs for Mac OS X Server being six pages long, and consisting of not a lot more
than variations on "see the man page". The man page is great if you need pointers. It's not so great if you
need real examples to get you started. It's not so great if you need some tips on integrating things like dscl
into other tools.
Apple prides itself on Mac OS X Server being good for new administrators, but the documentation has, by and
large, little in the way of examples, and that can be a killer. Yes, you can eventually find the third party
sites and mailing lists and user forums that make up for this, but those should be a value-add for Apple's
information, not the only good source of technical IT information for Mac OS X (Server). I can find books on
Final Cut Pro written for Apple by Peachpit, but the sysadmin side of the house is kind of neglected here.
This may seem like a small issue to some, but when you're used to the IT - targeted documentation available
from other platforms, Apple's offerings are too lean.
8) Professional Quality Server Tools. Apple's developer tools are top-notch. They can hold their own
against almost any environment, especially when price is considered, and they're going to get better in Tiger.
Apple's Server tools? Not so good. For example, the only client management software that ships with Server by
default are some poorly - documented command line tools, and Workgroup Manager, (WGM).
That's not enough. If I'm setting up a copy of Mac OS X Server, I need to have real client management
tools. Not just the MCX (Managed Client for OS X) stuff in WGM, but tools that let me get information from
clients in a meaningful way without paying the ARD, (Apple Remote Desktop) tax. There's no way to actually
view the structure of your Open Directory, (OD) setup. You can sort of view the raw data in WGM, but it's a
Server Admin is a great tool, but there's no easy way to extend it. Apple still hasn't published the API
for this, and that's a mistake. One of the smartest things Microsoft ever did was the MMC concept, where you
can write and distribute custom snap-in additions to the Microsoft Management Console. You can find all kinds
of really neat snap-ins out there, and you can modify the default ones if you like. There's no way Apple can
create the One True Tool. It's not realistic to even think you can. But, by allowing others to simply and
easily extend Server Admin, sysadmins can take the basic tool and make it work for them, and then share it
with their peers, so that Mac OS X Server gets a little better with every user.
Workgroup Manager needs to be integrated into Server Admin, the justification for them being separate tools
is long gone, and has been for some time, since Panther really. Client and user management is part of server
management, period. This would help with a lot of things that are just too tedious on a Mac. For example, when
I join a machine to an Active Directory domain, there's a lot of basic setup done on the spot. I don't have to
manually enter in a ton of information at the server, manually set up DNS, etc. Apple needs to get Mac OS X
Server and Open Directory to that level of use.
7) Straighten out support definitions. Apple has a real issue with this, especially the Xserve support. The
term "Up and Running" is too vague. If you buy an Xserve to help you link MCX clients to Active Directory,
that Xserve "Up and Running", as you'll find out, won't do you any good. That's considered networking
integration, and for that, you need a different support contract.
That's part of the Mac OS X Server Software Support, which covers OS X server issues, and it costs six
thousand dollars at the low end. For that you get unlimited Help Desk and 10 Enterprise - Level support
incidents. What's the difference? Help Desk covers Hardware diagnostics, installation, and support for system
configuration, server administration, and network administration from the GUI. However, that does not include
"advanced services" (A somewhat nebulous term from Apple), or Workgroup Manager integration with third party
directories. It also doesn't include any command line help, cross-platform home directory integration, cross
platform file and print, Application server support, or WebObjects deployment support. Not programming,
deployment. It does however include Video applications. So, six grand gets you better support for Final Cut
Pro than an Open Directory Master problem, at least according to Apple's chart.
That's a real problem for sysadmins trying to justify this contract. I have no problem with great support
for Apple's video applications, but to give you unlimited support for Final Cut Pro, yet make you spend
incidents for even basic command line support is a real problem for sysadmins. It's almost impossible to set
up an Open Directory domain without needing the command line, and Apple's paucity of good command line
documentation, or any documentation beyond "Use the GUI tools" is a guarantee that you're going to need to eat
Apple has to redefine basic server setup to be more than a computer lab with an iBook cart. K-12 and Higher
Ed are not the only uses for Apple hardware and software anymore, but the way this support system is
structured; you can still see that assumption. This has to become more equitable for people doing the grunt
work so that artists can use Final Cut Pro. Making a sysadmin use incidents for what is considered by most to
be "basic" setup is a bad decision, and to essentially charge $600 per incident is even worse. No one expects
quality vendor support to be cheap, but it has to provide real value.
6) Fully support AppleScript Automation. This could also be called "Fish or cut bait". AppleScript is a
great technology, on top of a great architecture, and it's been hobbled for years by indifferent support from
the top. The core AppleScript team does a fantastic job, along with the AppleScript Studio team, but they're a
very small group, and they can only deal with the core OS and Xcode.
Application support is up to the application teams, and if they don't want AppleScript, then we as users
and administrators don't get it. The big glaring example are the "Pro" apps. "Pro" seems to mean "Professional
Artist" not "Production Environment". Yes, some of the pro app components are scriptable, but Final Cut Pro,
DVD Studio Pro are not. Keynote is not automatable, although PowerPoint is. (Yes, on a non - OS level,
Microsoft supports Applescript more consistently than Apple.) Keynote 2 has an AppleScript dictionary, but the
entire Keynote section is almost entirely read - only, so it's of little use to scripters, and Pages is not
scriptable at all. As well, XML doesn't count in this case. What I am talking about is procedural automation.
In other words the script replicates and extends the manual actions. XML is great for data collection,
aggregation, integration, and presentation, but it's not going to duplicate folder actions. That's not a knock
on XML by the way. It's just acknowledging that there are things XML is not designed to do.
This is not limited to Pro applications. Even sysadmin apps, which are used by automation fiends as a rule,
get a short shrift here. Apple Remote Desktop 2.1? Not automatable. Out of all the Server tools, Server Admin
is the only one that is directly scriptable, but just barely. Yes, you can get a lot of the server tools stuff
done with shell, but without proper documentation, that's really difficult, and if done right, AppleScript
allows you to record actions, which I have yet to see happen with shell, at least in Mac OS X.
Even in the OS, support is spotty. Setting up a network config is still far easier in Mac OS 9 than Mac OS
X with AppleScript, or shell for that matter. It's painful to do in shell if you don't have ARD 2.1 clients
installed on the system. If you do, then you can use shell with
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup and it's a little
easier. That client also gives you access to systemsetup in the same directory. Very handy, albeit hidden
If you want to create a printer, something you could do in Mac OS 9 with AppleScript, actually in Mac OS
8.6 through 9.2.2, you have to use lpadmin, which isn't hard, but not real straightforward. (Here's a tip...the
Printer Name you see in Mac OS X is actually the lpadmin printer description).
But there's a greater point here. Steve loves to talk about "eating our own dog food". "Apple eats its own
dog food". If AppleScript is indeed a critical technology, then show it. Mandate it in everything Apple makes,
not just the free stuff, or the geeky stuff. Adobe resisted automation for years until Cal Simone and
Photoscripter showed them how wrong they were. Now even After Effects is scriptable. So is Media 100. Even in
the creative industry, even in film, there are a lot of people doing repetitive work who would benefit from
automation. There are a lot of really cool things that you cannot predict you will do with AppleScript, yet
when you make it available, cool things happen. (Carbon Copy Cloner being a great example of what AppleScript
Studio gave the Mac community). AppleScript, like Cocoa and all the rest is an enabling technology, a "force
multiplier" if you will, and to only "kinda sorta" support it is hampering a really excellent tool.
5) A Sysadmin Version of The Developer Connection. Right now, the only program of worth to a sysadmin is
the Apple's developer program, and it's not a perfect situation, it's better than nothing. The Apple
Consultant Network (ACN) program, while great for consultants, is not really set up for IT administrators. (As
an example, the ACN referral program, where you can register for client referrals from a local Apple Store is
a little useless to someone who is an IT administrator, not a consultant.)
We need a program designed for us. Where, instead of a DVD full of APIs, we also get sample scripts for
remote LDAP configuration, and examples of problem resolution. Basically, for internal IT shops, we need a
direct line to all the documentation and experience that Apple's SE's rack up every day. (No, this wouldn't
hurt the SE's ability to earn a living. In fact, it would enhance it by turning them from yet another
consultant to a valued, and trustable resource. They'd probably, in the long run, MAKE more money for Apple
because they'd be seen as being useful outside of a contractual obligation.)
We need a program that understands that in the Enterprise IT world, there is no such thing as a homogenous
network, so we need reliable, reproducible information that lets us integrate our Mac OS X networks with
everything else. We need seed programs that are designed for our needs outside of what developers want. We
need support lines ala Developer Tech Support, (DTS), that allows us to get the same kind of support as with
DTS, but for sysadmins. Without a six thousand dollar contract.
We need for Apple to create something akin to IBM's Redbook concept, where you can tap into Apple's
internal support library. Having one or two people from Apple's internal IT organization give a session at the
WWDC once a year isn't enough.
4) An Apple World Wide Sysadmin Conference. Anyone who was at the 2004 WWDC can back me up here...there
wasn't enough room for all the sessions. The Enterprise IT track was consistently packed full. Yes, there is
overlap, but not that much. It's a disservice to IT people to have to watch tapes of an earlier session
because the Enterprise IT track couldn't get the big room. It's a disservice to developers when the same thing
happens to them.
The Sysadmin complement of the WWDC is growing rapidly every year, and there's' no reason to think it will
slow down. If anything, the new features in Tiger will accelerate this trend. It's time to split the
Enterprise IT track into its own conference. Yes, it will mean a drop in the attendance of the WWDC, but
that's not a bad thing. For one, the WWDC has always been small. 5,000 attendees is an astounding number.
Secondly, it would allow for more in-depth sessions at each conference on the issues that matter the most to
the attendees. It would allow for greater offline conversations with attendees and Apple/ISV engineers. These
conversations are at least half the value of a WWDC for me, and many of my compatriots, so increasing the
number of these is a good thing.
Finally, it would make it easier for sysadmins to go to the conference at all. It can be, sometimes very
hard, to convince the powers that be of the fact that yes, it's called the Worldwide Developer's Conference,
but a good fifth to a quarter of it is all IT. If the Enterprise IT component increases, the conference is
going to get overloaded, and become gradually less useful to the attendees.
3) More partnerships with existing IT ISV's. Apple doesn't' need to be the sole provider of every tool that
a sysadmin needs. In fact, it shouldn't try. But it does need to create more partnerships with various
companies in the IT space so that sysadmins have more tools to work with. For example, DB2, (or whatever it's
become) should have a Mac OS X version. While surveys and customer demand can help, Apple needs to be taking
the initiative here to work with IBM to get its enterprise DB running on Mac OS X.
There are dozens of existing SAN products, yet the only one with explicit Mac OS X support, (via XSAN) is
ADIC's Stornext. That's because XSAN is Stornext. Yes, XSAN will be a great product, but sometimes, people
already have an existing SAN implementation, and Apple needs to do what it can to make sure that the Xserve
can plug into those implementations with a minimum of fuss. There's no reason that people should be forced to
exclude Apple's enterprise products because they didn't buy the one SAN that Apple can play with. There's no
reason why integrating with Active Directory should still be as painful as it is, even with the Panther AD
Partnerships are the name of the game in this space, and if Apple can do it with the iPod, they can do it
with the Xserve and Mac OS X Server.
2) More sysadmin - targeted feature integration. This may seem to be a part of item 8), but it deserves its
own bullet. There are a lot of really useful open source network utilities, such as Nagios, Snort, MRTG, etc.
that don't have binary installers for Mac OS X, or take a lot more configuration to work with Mac OS X, etc.
Mac OS X may be a Unix derivative, but despite POSIX dreams, Unix is not Linux is not BSD. Apple needs to,
for Mac OS X Server at the very least, start making things like MRTG, RRDTool, etc., a standard part of the
Server tools, and integrate them with Server Admin. Running a network is more than just application/ther
services, and user/computer management. A huge part of it is the management of the network as a thing unto
itself, and Apple needs to make Mac OS X Server, out of the box, be able to not just be a human network
management system, but also able to take over and monitor a network outside of Open Directory.
Note: It doesn't just have to be Open Source tools either. Apple already includes limited versions of third
party tools such as Intermapper, or LanSurveyor, etc. But they're not a part of Mac OS X. Bundling isn't
enough. Work with Neon, Dartware, etc. to create Server Admin plugins so that these tools can be run from the
same console, ala Microsoft's MMC concept.
Within this concept, create a DVD/CD installer version of Mac OS X server that can run these tools ala
Knoppix. There are cases where you need an always - clean version of various network utilities, and the
Knoppix concept is a great one. Boot from a DVD, and you have a complete network toolkit in your hand with a
great UI to boot. If nothing else, consultants would throw flowers at Steve Job's feet for the capabilities
this would give them. Apple really needs to expand its definition of network management. It isn't just file,
print, web, and MCX anymore.
1) Citrix capabilities in Mac OS X Server. This was one of the most consistent requests at the WWDC, and I
was only one of many people making it. A low - bandwidth GUI remote login is a major feature for any server
OS. I don't ever use Virtual PC for my Windows administration tasks, and I haven't used the keyboard on my
Windows box in a year. I just use Microsoft's RDP client, and run my network from there. I can RDP into any of
my Windows servers to administrate them from any Mac in my company, and have all my tools at my fingertips
with a lot more speed, and a lot less sacrifice of disk and CPU to the VPC gods. I would love to be able to do
the same with my Xserve, without the network overhead of ARD, or the limitations of SSH.
This would be a huge boon to anyone wanting to more centrally manage their networks. It makes application
maintenance a breeze. The only physical copy resides on the server, everyone else remotes in to use it. It's
great for remote work over slow lines. I can get better than VPC performance over a modem with a B&W G3 via
RDP, and have fewer installation headaches.
While NetBoot is a way of providing this, it's far more limited. You need fast networks for NetBoot a LOT
of storage on the server end, and it's never going to work on anything but a Mac.
Terminal Services for Mac OS X server, especially with non-Mac clients would make Mac OS X attractive to
places that wouldn't consider it, the same way that the Xserve RAID's ability to function outside of Mac OS X
made it more attractive and gets Apple into shops they'd never be in otherwise. It would be huge for lab
administrators who can't yet afford a massive hardware upgrade.
It would end up being a profit generator for Apple, since they could make money on the licensing, (I don't
care what Apple's margins on hardware are, selling a terminal server license makes them a lot more profit,
percentage-wise, per sale), and it would be a profit generator for Mac OS X ISVs, for the same reasons. It's a
win-win for Apple all the way, and it should have been a part of Panther Server.
There you have it. My big wish list for Apple and Mac OS X. I don't expect to see all eleven points handled
by the end of 2005. If three go away, I'll be ecstatic. But you have to start somewhere. Next year at this
time, we'll take a look at what happened throughout the year, and what we need to add, or subtract from the
list. Hopefully, the list will be noticeably smaller.
John Welch, firstname.lastname@example.org, is an IT Staff Member for Kansas City Life Insurance, a Technical
Strategist for Provar, (http://www.provar.com/) and the Chief Know-It-All for TackyShirt,
(http://www.tackyshirt.com/). He has over fifteen years of experience at making Macs work with other computer
systems. John specializes in figuring out ways in which to make the Mac do what nobody thinks it can, showing
that the Mac is a superior administrative platform, and teaching others how to use it in interesting, if
sometimes frightening ways. He also does things that don't involve computertry on occasion, or at least that's