TweetFollow Us on Twitter

Desktop Systems Engineer and Analyst

Volume Number: 22 (2006)
Issue Number: 3
Column Tag: Interview

In The Trenches

Desktop Systems Engineer and Analyst

by Schoun P. Regan

Interviewing Kevin Denges: Kevin is in charge of the image creation and deployment for Conde Nast. I spoke with him in New York City, at his office.

Schoun: Kevin, tell me about the setup.

Kevin: We have a Windows Active Directory infrastructure for authentication. The Macs are bound to the Active Directory server and the Xserves are used as image servers, primary and secondary K4 servers. K4 is our Adobe InDesign workflow. Each server is setup using 2 Xserve's, one primary and a second mirror for failover. We started all this with Mac OS X 10.3.3, so we've been at it for some time.

Schoun: And for file servers?

Kevin: We are using Extreme z-ip version 4. We started to deploy them in Sept/Oct of this year to our Windows servers, and by doing so, now have single sign on using Kerberos.

Schoun: What about the Macs? How are they deployed? NetBoot?

Kevin: No. The Xserves are just image servers for the most part. We use FireWire drives to deploy our images, but we also store those images on a server. So if a tech ever needs to get a newer image, they boot off of a FireWire drive and install the latest image from our servers.

Schoun: Sounds like NetBoot may solve the booting from FireWire issue.

Kevin: We are looking into that, but for right now, FireWire drives are the most efficient for us.

Schoun: So one image to rule them all?

Kevin: Nope. We have an image that has all the software they need, and one main image. There are older images with 10.3 on them also. It depends on where the computer is placed and with whom as to what image they receive on their Mac.

Schoun: So the image build, it's stock Mac OS X?

Kevin: For the most part yes. We have leveraged the power of launchd to handle some initial binding and computer setup for us, but other than that, it's stock with Adobe's CS2 suite.

Schoun: Take us through the launchd file.

Kevin: Well basically it's very simple, it starts when the machine boots and runs a shell script that we have. Here's what it looks like:


Figure 1.

Kevin: We also have another launchd item that handles the fixing of ByHost files.

Schoun: First tell me about the AD binding launchd item:

Kevin: As you can see, it runs at boot time, waits 2 seconds, then renices to get processor authority, to run ahead of other items. It then calls the shell script ADhook.sh located in a directory I chose. Pretty simple actually.

Schoun: Is the ByHost launchd item the same?

Kevin: For the most part yes, except it calls another script of course.

Schoun: So lets look at the AD script then. We know that the Active Directory plug-in has a command line counterpart, dsconfigad. I assume you use this?

Kevin: It's now a small part of the script, but yes, it is the integral part. The script is divided into four major parts; network connectivity, AD binding, ByHost fixes, and file deletion.

Schoun: Can we walk through some of the major portions of the script?

Kevin: Sure, but keep in mind that some of this came from Mike Bombich's site, so credit goes to him for some of this.

Schoun: I'll let him know.

Kevin: So as we can see, the first part of the script creates a log file for us to write to, then we check for network connectivity.


Figure 2.

Schoun: I see Vicki in here.

Kevin: Yes. The problem we sometimes encountered was that a tech would download an image, and reboot the Mac only to find the Mac was not on the network. Or, in certain cases, the Macs would unbind and we would have to rebind them. Either way, the script now checks for not just network connectivity, but if the Mac is connected to our network. It announces its findings using the voice Vicki on the Mac. This way our techs know whether the machine is binding or not.

Schoun: Part of this script looks familiar.


Figure 3.

Kevin: [laughs] I borrowed-and gave credit to-Mike Bombich as this is based on the script called, "Who stole my Mac script". It was important to us, to make sure our techs knew what the status was, when they imaged a machine. This helps us track binding issues.

Schoun: Let's talk about the AD binding.

Kevin: Sure. Before I run the actual bind, I set all the parameters. This part of the script sets the parameters.


Figure 4.

Schoun: I see the uuidgen command in there! I should explain to our readers that uuidgen is a command that creates a unique ID, unique enough that the man page states, "The uuidgen command generates a Universally Unique Identifier (UUID), a 128-bit value guaranteed to be unique. A UUID is made unique over both space and time by combining a value unique to the computer on which it was generated--usually the Ethernet hardware address--and a value representing the number of 100-nanosecond intervals, since October 15, 1582 at 00:00:00." You gotta love Apple code writers sometimes. "Unique over space AND time" Ha.

Kevin: Well, the issue is that if a Mac binds to an AD domain, the AD domain cannot use that computer name to bind more than twice. So, if a computer's name is already in the AD domain, and our techs re-image it, the bind fails. Using a portion of the uuidgen output insures us a unique ID with which to bind the Mac.

Schoun: I also see that you did not put the password into this script for the actual bind. That you are calling the output of an AppleScript file. Why?

Kevin: Security. This way the script calls the AppleScript file and it returns the password. Just a little more secure this way.

Schoun: So with all the variables set, now the bind?

Kevin: Yes. Again we used the dsconfigad command line tool for that. We of course write to the log file, check for an older edu.mit.Kerberos file and get rid of it, if one exists, and set the search policies.


Figure 5.

Schoun: I see a sleep command in there.

Kevin: It seemed to go smoother when we did this.

Schoun: Then the ByHost issues? Why the problem?

Kevin: As you know, ByHost files are MAC address specific, so we have them set the way we want, then we put all Xs in the place of the address. We then copy these and replace the Xs with the local Mac's MAC address. We do this for the template for any user's that log in via AD, our local administrator account, and a hidden account we have.


Figure 6.

Schoun: And the last part of the script?

Kevin: Checking the bind, having Vicki notify the tech, and then deleting the launchd item, the AppleScript file with the password, and then deleting itself, killing the loginwindow process and having it come back. This way, the AD user can log in and get a newly created home folder, with all the customized tweaks we've added in the user template, such tweaks to the .GlobalPreferences file, the Dock, the menu bar, the screen saver, the background, and so on.


Figure 7.

Schoun: This is in incredibly powerful script. Again I see some of Mike's work in here, but you have done a nice job of pulling it all together.

Kevin: Thanks. Our next step is to take this and make a launchd item that watches the bind and if it fails, it deletes the /Library/Preferences/edu.mit.Kerberos file, the DirectoryServices directory inside of the same location, and pulls them from a hidden location on the local disk and rebinds the machine automatically.

Schoun: I would also suggest, you use the mail command to email an administrator account, when this occurs. In this way, your techs can be a bit more proactive than reactive. They will know when a machine unbinds.

Kevin: Yea. We want to do more with launchd and scripts.

Schoun: Kevin, this is all we have time for, but I know you have more to say about your setup. I think this script is an excellent place to start. It gives the reader a clear- cut way of implementing this type of bind. I'd like to talk to you more about how this interacts with the local NetInfo database and what other tweaks you've done to the system.

Kevin: Be happy to. We are very confident in our process, and have moved to cut down time to under 5 minutes, if possible.

Schoun: I think our readers will be excited to learn about what else you have done.

Ed Note: Kevin has much more to say about his infrastructure but this time I wanted to focus on the script itself.

Vital Stats

Years in IT industry : 6

Information: Kevin is in charge of the image creation and deployment for Conde Nast.

Computers: About 2700 Macs, 42 Xserves, 4 Xserve RAIDs, Windows Active Directory Servers, wireless networks.

Programming Languages:Shell Scripting, AppleScript


Schoun P. Regan is CEO of ITInstruction.com, which specializes in Mac OS X training and consulting. He speaks regularly to CEOs and CFOs on how to control IT department spending, the myths surrounding cross-platform integration, and the lunacy of expected lost revenue stemming from a culture bred to tolerate IT staff and operating system inadequacies as "normal". He seeks to change self-fulfilling IT departments that breed complacency for their jobs and contempt for the end user, neither of which are conducive to business.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Evernote 6.13.2 - Create searchable note...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more
HoudahSpot 4.3.4 - Advanced file-search...
HoudahSpot is a versatile desktop search tool. Use HoudahSpot to locate hard-to-find files and keep frequently used files within reach. HoudahSpot will immediately feel familiar. It works just the... Read more
calibre 3.14.0 - Complete e-book library...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital librarian... Read more
Evernote 6.13.2 - Create searchable note...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more
calibre 3.14.0 - Complete e-book library...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital librarian... Read more
HoudahSpot 4.3.4 - Advanced file-search...
HoudahSpot is a versatile desktop search tool. Use HoudahSpot to locate hard-to-find files and keep frequently used files within reach. HoudahSpot will immediately feel familiar. It works just the... Read more
Hopper Disassembler 4.3.10- - Binary dis...
Hopper Disassembler is a binary disassembler, decompiler, and debugger for 32- and 64-bit executables. It will let you disassemble any binary you want, and provide you all the information about its... Read more
Hopper Disassembler 4.3.10- - Binary dis...
Hopper Disassembler is a binary disassembler, decompiler, and debugger for 32- and 64-bit executables. It will let you disassemble any binary you want, and provide you all the information about its... Read more
Paparazzi! 1.0b7 - Make user-defined siz...
Paparazzi! is a small utility for OS X that makes screenshots of webpages. This very simple tool takes screenshots of websites which do not fit on one screen. You specify the desired width, minimal... Read more
Amadeus Pro 2.4.4 - Multitrack sound rec...
Amadeus Pro lets you use your Mac for any audio-related task, such as live audio recording, digitizing tapes and records, converting between a variety of sound formats, etc. Thanks to its outstanding... Read more

Latest Forum Discussions

See All

WWE Mayhem guide - beginner tips and tri...
WWE Mayhem brings all of the familiar faces from your favorite wrestling league to mobile in this exciting new fighting game. Build up a team of your favorite WWE superstars and fight your way to the championship title, or battle against your... | Read more »
The best new games we played this week -...
We've made it through another week, so let's treat ourselves to some of the best new games to launch in the past few days. It was another exciting week with some long-awaited indie games making their debut, and some big console titles making the... | Read more »
Match blocks to pull off dance moves in...
Ferdinand: Unstoppabull is a brand new match three puzzler based on the animated movie of (almost) the same name. As you can expect, you have to match blocks together to complete a bunch of puzzling levels and earn a high score. [Read more] | Read more »
Lineage 2: Revolution’s end of year upda...
Now available in 54 countries worldwide, Lineage 2: Revolution is continuing its global quest to be the most popular mobile MMORPG by launching a jam-packed end of year update. Complete with many subtle tweaks to help improve users’ online... | Read more »
The 5 best Star Wars games on iOS
The time has almost come.Star Wars: The Last Jedifinally hits theaters in the cinematic event that might be bigger than Christmas. To celebrate, we're taking a look at the best--and only the best--Star Warsmobile games to date. [Read more] | Read more »
Life Is Strange (Games)
Life Is Strange 1.1 Device: iOS Universal Category: Games Price: $2.99, Version: 1.1 (iTunes) Description: Life Is Strange is a five part episodic game that sets out to revolutionize story-based choice and consequence games by... | Read more »
Oddworld: New 'n' Tasty (Game...
Oddworld: New 'n' Tasty 1.0 Device: iOS Universal Category: Games Price: $7.99, Version: 1.0 (iTunes) Description: ** PLEASE NOTE: Requires 3.6GB free space to install. Runs at variable resolutions based on device capabilities.... | Read more »
Gorogoa (Games)
Gorogoa 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: Gorogoa is an elegant evolution of the puzzle genre, told through a beautifully hand-drawn story designed and illustrated by Jason... | Read more »
Why Guns of Boom will be big for mobile...
Earlier this week, Game Insight, the minds that brought you Guns of Boom, revealed plans for an esports mode in the popular FPS title, with big implications for the game's future. Guns of Boom has been quite popular for some time now, so it's... | Read more »
The best mobile games to play on lazy ho...
With the holidays in full swing, there's hopefully going to be a lot of time off work lazing around the house. With all of that free time, it's a perfect opportunity to catch up on some mobile games that you might have missed out on earlier this... | Read more »

Price Scanner via MacPrices.net

Sunday flash sale: Beats Solo3 Wireless On-Ea...
Amazon has Beats Solo3 Wireless On-Ear Headphones on sale for $199.99 including free shipping. Their price is $100 off MSRP, and it’s the lowest price available for Beats Solo3. Multiple colors are... Read more
B&H Holiday sale: MacBooks for up to $300...
B&H Photo has Apple MacBook Pros, MacBook Airs, and 12″ MacBooks on sale for up to $300 off MSRP as part of their Holiday sale. B&H charges sales tax in NY & NJ only, and overnight... Read more
The lowest prices on Apple 13″ MacBook Pros t...
Save $300-$300 on the purchase of a 2017 13″ MacBook Pro this weekend with Certified Refurbished models at Apple. In many cases, Apple’s refurbished prices are the lowest available for each model... Read more
Lowest prices of the Holiday season: 15″ Appl...
Save $360-$420 on the purchase of a 2017 15″ MacBook Pro with Certified Refurbished models at Apple. In many cases, Apple’s refurbished prices are the lowest available for each model from any... Read more
Apple discounts Beats products by up to 30% t...
Apple has Beats by Dr. Dre (BeatsX, Powerbeats3 Wireless, and Beats Solo3 Wireless) on sale for up to 30% off their retail price from now until December 26th: – BeatsX: Was $149.95, now $99 –... Read more
Updated Price Trackers: Macs, iPads, iPhones,...
Scan our Apple Price Trackers for the latest information on sales, bundles, and availability on systems from Apple’s authorized internet/catalog resellers. We update the trackers continuously: – 15″... Read more
How to preorder a new iMac Pro and pay zero s...
B&H Photo and Adorama are accepting preorders on multiple configurations of the new Apple iMac Pro. Both resellers charge sales tax for residents of NY & NJ only, and shipping is free.... Read more
Apple Macs back in stock at Amazon with model...
Amazon has MacBook Pros, MacBook Airs, MacBooks, and iMacs on sale for up to $200 off MSRP as part of their Holiday/Christmas sale. Shipping is free. Note that stock of some Macs may come and go (and... Read more
Apple offering free overnight delivery on all...
Apple is now offering free overnight delivery on all in stock products until 3pm local time on December 22nd. This includes new as well as refurbished computers. Click here for more information. Read more
Beats Holiday sale at B&H, headphones and...
B&H Photo has Beats by Dr. Dre headphones, earphones, and speakers on sale for up to $80 off MSRP as part of their Holiday sale. Expedited shipping is free, and B&H charges sales tax to NY... Read more

Jobs Board

*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.