TweetFollow Us on Twitter

Desktop Systems Engineer and Analyst

Volume Number: 22 (2006)
Issue Number: 3
Column Tag: Interview

In The Trenches

Desktop Systems Engineer and Analyst

by Schoun P. Regan

Interviewing Kevin Denges: Kevin is in charge of the image creation and deployment for Conde Nast. I spoke with him in New York City, at his office.

Schoun: Kevin, tell me about the setup.

Kevin: We have a Windows Active Directory infrastructure for authentication. The Macs are bound to the Active Directory server and the Xserves are used as image servers, primary and secondary K4 servers. K4 is our Adobe InDesign workflow. Each server is setup using 2 Xserve's, one primary and a second mirror for failover. We started all this with Mac OS X 10.3.3, so we've been at it for some time.

Schoun: And for file servers?

Kevin: We are using Extreme z-ip version 4. We started to deploy them in Sept/Oct of this year to our Windows servers, and by doing so, now have single sign on using Kerberos.

Schoun: What about the Macs? How are they deployed? NetBoot?

Kevin: No. The Xserves are just image servers for the most part. We use FireWire drives to deploy our images, but we also store those images on a server. So if a tech ever needs to get a newer image, they boot off of a FireWire drive and install the latest image from our servers.

Schoun: Sounds like NetBoot may solve the booting from FireWire issue.

Kevin: We are looking into that, but for right now, FireWire drives are the most efficient for us.

Schoun: So one image to rule them all?

Kevin: Nope. We have an image that has all the software they need, and one main image. There are older images with 10.3 on them also. It depends on where the computer is placed and with whom as to what image they receive on their Mac.

Schoun: So the image build, it's stock Mac OS X?

Kevin: For the most part yes. We have leveraged the power of launchd to handle some initial binding and computer setup for us, but other than that, it's stock with Adobe's CS2 suite.

Schoun: Take us through the launchd file.

Kevin: Well basically it's very simple, it starts when the machine boots and runs a shell script that we have. Here's what it looks like:


Figure 1.

Kevin: We also have another launchd item that handles the fixing of ByHost files.

Schoun: First tell me about the AD binding launchd item:

Kevin: As you can see, it runs at boot time, waits 2 seconds, then renices to get processor authority, to run ahead of other items. It then calls the shell script ADhook.sh located in a directory I chose. Pretty simple actually.

Schoun: Is the ByHost launchd item the same?

Kevin: For the most part yes, except it calls another script of course.

Schoun: So lets look at the AD script then. We know that the Active Directory plug-in has a command line counterpart, dsconfigad. I assume you use this?

Kevin: It's now a small part of the script, but yes, it is the integral part. The script is divided into four major parts; network connectivity, AD binding, ByHost fixes, and file deletion.

Schoun: Can we walk through some of the major portions of the script?

Kevin: Sure, but keep in mind that some of this came from Mike Bombich's site, so credit goes to him for some of this.

Schoun: I'll let him know.

Kevin: So as we can see, the first part of the script creates a log file for us to write to, then we check for network connectivity.


Figure 2.

Schoun: I see Vicki in here.

Kevin: Yes. The problem we sometimes encountered was that a tech would download an image, and reboot the Mac only to find the Mac was not on the network. Or, in certain cases, the Macs would unbind and we would have to rebind them. Either way, the script now checks for not just network connectivity, but if the Mac is connected to our network. It announces its findings using the voice Vicki on the Mac. This way our techs know whether the machine is binding or not.

Schoun: Part of this script looks familiar.


Figure 3.

Kevin: [laughs] I borrowed-and gave credit to-Mike Bombich as this is based on the script called, "Who stole my Mac script". It was important to us, to make sure our techs knew what the status was, when they imaged a machine. This helps us track binding issues.

Schoun: Let's talk about the AD binding.

Kevin: Sure. Before I run the actual bind, I set all the parameters. This part of the script sets the parameters.


Figure 4.

Schoun: I see the uuidgen command in there! I should explain to our readers that uuidgen is a command that creates a unique ID, unique enough that the man page states, "The uuidgen command generates a Universally Unique Identifier (UUID), a 128-bit value guaranteed to be unique. A UUID is made unique over both space and time by combining a value unique to the computer on which it was generated--usually the Ethernet hardware address--and a value representing the number of 100-nanosecond intervals, since October 15, 1582 at 00:00:00." You gotta love Apple code writers sometimes. "Unique over space AND time" Ha.

Kevin: Well, the issue is that if a Mac binds to an AD domain, the AD domain cannot use that computer name to bind more than twice. So, if a computer's name is already in the AD domain, and our techs re-image it, the bind fails. Using a portion of the uuidgen output insures us a unique ID with which to bind the Mac.

Schoun: I also see that you did not put the password into this script for the actual bind. That you are calling the output of an AppleScript file. Why?

Kevin: Security. This way the script calls the AppleScript file and it returns the password. Just a little more secure this way.

Schoun: So with all the variables set, now the bind?

Kevin: Yes. Again we used the dsconfigad command line tool for that. We of course write to the log file, check for an older edu.mit.Kerberos file and get rid of it, if one exists, and set the search policies.


Figure 5.

Schoun: I see a sleep command in there.

Kevin: It seemed to go smoother when we did this.

Schoun: Then the ByHost issues? Why the problem?

Kevin: As you know, ByHost files are MAC address specific, so we have them set the way we want, then we put all Xs in the place of the address. We then copy these and replace the Xs with the local Mac's MAC address. We do this for the template for any user's that log in via AD, our local administrator account, and a hidden account we have.


Figure 6.

Schoun: And the last part of the script?

Kevin: Checking the bind, having Vicki notify the tech, and then deleting the launchd item, the AppleScript file with the password, and then deleting itself, killing the loginwindow process and having it come back. This way, the AD user can log in and get a newly created home folder, with all the customized tweaks we've added in the user template, such tweaks to the .GlobalPreferences file, the Dock, the menu bar, the screen saver, the background, and so on.


Figure 7.

Schoun: This is in incredibly powerful script. Again I see some of Mike's work in here, but you have done a nice job of pulling it all together.

Kevin: Thanks. Our next step is to take this and make a launchd item that watches the bind and if it fails, it deletes the /Library/Preferences/edu.mit.Kerberos file, the DirectoryServices directory inside of the same location, and pulls them from a hidden location on the local disk and rebinds the machine automatically.

Schoun: I would also suggest, you use the mail command to email an administrator account, when this occurs. In this way, your techs can be a bit more proactive than reactive. They will know when a machine unbinds.

Kevin: Yea. We want to do more with launchd and scripts.

Schoun: Kevin, this is all we have time for, but I know you have more to say about your setup. I think this script is an excellent place to start. It gives the reader a clear- cut way of implementing this type of bind. I'd like to talk to you more about how this interacts with the local NetInfo database and what other tweaks you've done to the system.

Kevin: Be happy to. We are very confident in our process, and have moved to cut down time to under 5 minutes, if possible.

Schoun: I think our readers will be excited to learn about what else you have done.

Ed Note: Kevin has much more to say about his infrastructure but this time I wanted to focus on the script itself.

Vital Stats

Years in IT industry : 6

Information: Kevin is in charge of the image creation and deployment for Conde Nast.

Computers: About 2700 Macs, 42 Xserves, 4 Xserve RAIDs, Windows Active Directory Servers, wireless networks.

Programming Languages:Shell Scripting, AppleScript


Schoun P. Regan is CEO of ITInstruction.com, which specializes in Mac OS X training and consulting. He speaks regularly to CEOs and CFOs on how to control IT department spending, the myths surrounding cross-platform integration, and the lunacy of expected lost revenue stemming from a culture bred to tolerate IT staff and operating system inadequacies as "normal". He seeks to change self-fulfilling IT departments that breed complacency for their jobs and contempt for the end user, neither of which are conducive to business.

 
AAPL
$567.77
Apple Inc.
+43.02
MSFT
$39.86
Microsoft Corpora
+0.17
GOOG
$525.16
Google Inc.
-1.78

MacTech Search:
Community Search:

Software Updates via MacUpdate

Ember 1.5.1 - Versatile digital scrapboo...
Ember (formerly LittleSnapper) is your digital scrapbook of things that inspire you: websites, photos, apps or other things. Just drag in images that you want to keep, organize them into relevant... Read more
Cyberduck 4.4.4 - FTP and SFTP browser....
Cyberduck is a robust FTP/FTP-TLS/SFTP browser for the Mac whose lack of visual clutter and cleverly intuitive features make it easy to use. Support for external editors and system technologies such... Read more
TechTool Pro 7.0.3 - Hard drive and syst...
TechTool Pro is now 7, and this is the most advanced version of the acclaimed Macintosh troubleshooting utility created in its 20-year history. Micromat has redeveloped TechTool Pro 7 to be fully 64... Read more
MacFamilyTree 7.1.6 - Create and explore...
MacFamilyTree gives genealogy a facelift: it's modern, interactive, incredibly fast, and easy to use. We're convinced that generations of chroniclers would have loved to trade in their genealogy... Read more
EtreCheck 1.9.9 - For troubleshooting yo...
EtreCheck is a simple little app to display the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support... Read more
TeamViewer 9.0.28116 - Establish remote...
TeamViewer gives you remote control of any computer or Mac over the Internet within seconds, or can be used for online meetings. Find out why more than 200 million users trust TeamViewer! Free for... Read more
DiskAid 6.6.3 - Use your iOS device as a...
DiskAid is the ultimate transfer tool for accessing the iPod, iPhone or iPad directly from the desktop. Access data such as: music, video, photos, contacts, notes, call history, text messages (SMS),... Read more
Viber 4.1.0 - Send messages and make cal...
Viber lets you send free messages and make free calls to other Viber users, on any device and network, in any country! Viber syncs your contacts, messages and call history with your mobile device,... Read more
Apple iOS 7.1.1 - The latest version of...
The latest version of iOS can be downloaded through iTunes. Apple iOS 7 brings an all-new design and all-new features. Simplicity Simplicity is often equated with minimalism. Yet true simplicity is... Read more
1Password 4.3 - Powerful password manage...
1Password is a password manager that uniquely brings you both security and convenience. It is the only program that provides anti-phishing protection and goes beyond password management by adding Web... Read more

Latest Forum Discussions

See All

Pen & Ink Review
Pen & Ink Review By Jennifer Allen on April 24th, 2014 Our Rating: :: CONVENIENT ARTISTRYiPad Only App - Designed for the iPad Pen & Ink is an ideal way to sketch down some visual ideas or simply spark your imagination.   | Read more »
Sonic & All-Stars Racing Transformed...
Sonic & All-Stars Racing Transformed Now Free, to Add New Iconic Characters and Elements Posted by Tre Lawrence on April 24th, 2014 [ | Read more »
Soccer Rally 2 Review
Soccer Rally 2 Review By Carter Dotson on April 24th, 2014 Our Rating: :: GOALKEEPINGUniversal App - Designed for iPhone and iPad Soccer Rally 2 is the most serious vehicular soccer game ever created.   | Read more »
Galaxy Conquerors Review
Galaxy Conquerors Review By Jennifer Allen on April 24th, 2014 Our Rating: :: RETRO SHOOTINGUniversal App - Designed for iPhone and iPad Old school shooting is fun but inaccurate in Galaxy Conquerors.   | Read more »
Yomi Review
Yomi Review By Rob Thomas on April 24th, 2014 Our Rating: :: C-C-C-COMBO BREAKERiPad Only App - Designed for the iPad Round One – Fight! No quarters required for this iOS adaptation of a tabletop adaptation of the arcade fighting... | Read more »
Injustice: Gods Among Us Updated with Ne...
Injustice: Gods Among Us Updated with New Characters, Leaderboards, Gear, and Online Multiplayer Posted by Rob Rich on April 24th, 2014 [ | Read more »
Spin It Review
Spin It Review By Jordan Minor on April 24th, 2014 Our Rating: :: SPIN ME RIGHT ROUNDUniversal App - Designed for iPhone and iPad Spin It has a fine puzzle game model, but its execution lacks energy.   | Read more »
Productivity App NoteSuite is Having its...
Productivity App NoteSuite is Having its Biggest Sale Ever, Just for One Week Posted by Rob Rich on April 24th, 2014 [ permalink ] | Read more »
Wayward Souls Review
Wayward Souls Review By Carter Dotson on April 24th, 2014 Our Rating: :: CARRY ON, WAYWARD SONUniversal App - Designed for iPhone and iPad Wayward Souls is a roguelike-inspired action-RPG that sets a high bar for other games to... | Read more »
The Sandbox Gets Update, Receives New Ca...
The Sandbox Gets Update, Receives New Campaign and New Elements Posted by Tre Lawrence on April 24th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »

Price Scanner via MacPrices.net

Strong iPhone Sales Drive Apple Record March...
Apple on Wednesday announced financial results for its fiscal 2014 second quarter ended March 29, 2014. The Company posted quarterly revenue of $45.6 billion and quarterly net profit of $10.2 billion... Read more
Award-Winning NoteSuite Productivity App is $...
Minneapolis based Theory.io has announced an 80-Percent Markdown NoteSuite for iPad. NoteSuite helps users stay organized by capturing their notes, to-dos and documents in one organized place.... Read more
16GB 1st generation iPad mini available for $...
Radio Shack has a select number of refurbished 1st generation 16GB WiFi iPad minis available for $199.99 on their online store. Choose free shipping or free ship-to-store. We expect these to sell out... Read more
13-inch 2.5GHz MacBook Pro on sale for $100 o...
B&H Photo has the 13″ 2.5GHz MacBook Pro on sale for $1099 including free shipping plus NY sales tax only. Their price is $100 off MSRP. Read more
iPad Sales “Lull” A Reality Correction Of Unm...
I have lots of time for Jean-Louis Gassée, the former Apple Computer executive (1981 to 1990) who succeeded Steve Jobs as head of Macintosh development when the latter was dismissed in 1985. Mr.... Read more
Apple Makes OS X Betas Available To All – Wit...
Apple’s OS X Beta Seed Program, which lets you install the latest pre-release builds, try it out, and submit your feedback, is now open to anyone who wants to sign on rather than to developers and... Read more
Apple Releases iOS 7.1.1 Update
The latest iOS 7.1.1 update contains improvements, bug fixes and security updates, including: • Further improvements to Touch ID fingerprint recognition • Fixes a bug that could impact keyboard... Read more
Logitech Announces Thinner, Lighter, More Fle...
Logitech has announced an update to its Ultrathin for iPad Air, iPad mini and iPad mini with Retina display, improving the flexibility and design of its award-winning predecessor with an even thinner... Read more
Logitech Introduces Hinge, Big Bang and Turna...
Logitech has announced expansion of its tablet product line with three new cases – the Logitech Hinge, the Logitech Big Bang and the Logitech Turnaround – each for the iPad Air, iPad mini and iPad... Read more
WaterField’s Rough Rider Leather Messenger Ba...
WaterField Designs have announced the new 15-inch size of their popular Rough Rider leather messenger bag, a vintage-looking bag that combines Old West charm and ruggedness with distinctly modern... Read more

Jobs Board

*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
Position Opening at *Apple* - Apple (United...
…customers purchase our products, you're the one who helps them get more out of their new Apple technology. Your day in the Apple Store is filled with a range of Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
*Apple* Inc. Research Data Specialist - Appl...
…of Worldwide Market Research & Intelligence. The team is responsible for conducting Apple branded consumer market research. It is also responsible for analyzing data Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.