TweetFollow Us on Twitter

MacEnterprise: Loco for Local MCX

Volume Number: 25 (2009)
Issue Number: 02
Column Tag: MacEnterprise

MacEnterprise: Loco for Local MCX

Using Apple's client-management settings on the Local machine. Following up on MCX

by Greg Neagle

Previously in MacTech...

In the November issue, we looked at getting started with MCX by using MCX records in the local directory service. We set some policies for the loginwindow using the Guest Computer object, verified they worked, and noted that the Accounts preference pane had certain controls grayed out to match our management settings.

Since local directory service entries in Leopard are simply plist files stored in /var/db/dslocal/nodes/Default, replicating MCX settings to multiple machines can be as simple as copying a few files.

Lod

Scalability and Modularity

If you are going to use the local directory service to store MCX data, you'll quickly discover that putting all your management settings into the Guest Computer object doesn't give you very much flexibility. If you want different groups of machines to have different management settings, you'll have to maintain multiple versions of /var/db/dslocalnodes/Default/computers/guest.plist, and mixing and matching management settings becomes tedious, as you'd have to create a version of the guest.plist for every needed combination of management settings.

A new feature of MCX in Leopard can help: Computer Groups. Prior to Leopard, MCX supported "Computer Lists", which were, unsurprisingly, lists of computers. Management settings could be applied to Computer Lists, which would then apply those settings to all computers in the list. The downside is that a given computer could be a member of only a single computer list at a time.

Leopard's new Computer Groups behave more like groups of users: a computer can be a member of multiple Computer Groups. This allows you to modularize your management settings. Create a Computer Group called "loginwindow" and apply all the loginwindow management to that Computer Group. Create another Computer Group called "screensaver" and apply your screensaver policies. If you want a machine to have both the "loginwindow" and "screensaver" policies, just add it to both Computer Groups. In this way, you can modularize your policy settings and mix and match them among machines. This approach even works if you are implementing MCX management in a traditional network directory environment.

Complications ensue

Perhaps now you're thinking, "Great! I'll create Computer Groups with my desired management settings, add the Guest Computer to each of those Computer Groups, and I'm all set!" Not so fast. There's a complication: even though Workgroup Manager allows you to add the Guest Computer account to a Computer Group, the MCX settings for the Computer Group are not applied to guest computers. So we'll need to use another way to take advantage of Computer Groups.

Use Workgroup Manager to connect to the local directory service as we did last time:


We will create a computer record that will represent the current local computer. Make sure you are working in the /Local/Default directory. Select the Computer accounts icon in the left pane, and click New Computer. Set the Name and Short Name to "local_machine", and click Save. You can leave all other fields empty.


You can now add this computer record to your Computer Groups:


We're not done yet - MCX still has no way to know that by "local_machine" you mean the current machine that this is running on. To do this, we have to add some data to the local_machine record.

MCX identifies machines by the MAC layer address of their en0 interface - this is usually the built-in Ethernet port, but in the case of a MacBook Air, this is the AirPort interface. Here's a way in the command-line to get this info:

root# ifconfig en0 | awk ' /ether/ {print $2}'
00:1b:63:93:8b:ac

So the MAC layer address for this machine is 00:1b:63:93:8b:ac. We can add that to the local_machine record like this:

root# dscl . -create /Computers/local_machine \
ENetAddress 00:1b:63:93:8b:ac

Checking our work:

root# dscl . read /Computers/local_machine
AppleMetaNodeLocation: /Local/Default
ENetAddress: 00:1b:63:93:8b:ac
GeneratedUID: 15BEE70A-A32D-4A33-B740-93CBE95F75A4
RecordName: local_machine
RecordType: dsRecTypeStandard:Computers

Note that the GeneratedUID will vary, as it is created when you create the computer record in Workgroup Manager.

To actually take advantage of this, we'll need to write a script that runs on each machine that modifies the local_machine record with the MAC layer address of the current machine. Here's a very simple version:

#!/bin/sh
MAC=`ifconfig en0 | awk ' /ether/ {print $2}'`
dscl . -create /Computers/local_machine ENetAddress $MAC

This script gets the current MAC layer address and updates the local_machine record accordingly. You'd want to implement this script as one that ran during startup. You could do this as part of a StartupItem, or use launchd.

Pulling it together

Now you have a computer object that corresponds to the local machine, and management settings attached to Computer Groups. To implement these management settings on another machine or machines, you need to copy to each machine:

  • /var/db/dslocal/nodes/Default/computers/local_machine.plist

  • The appropriate plists from /var/db/dslocal/nodes/Default/Computer Groups

  • Your startup script that modifies the local_machine record.

Testing and Troubleshooting

While testing your new MCX settings, you'll want to be aware of tools available to you so you can see which MCX settings have been applied to your machines. The easiest tool to use in Leopard is System Profiler. Under the Software section is a new Managed Client category. You can use this to see what preferences are being managed, and their source.


In the illustration, we can see that com.apple.TimeMachine's preference "DoNotOfferNew-DisksForBackUp" is set to "1", that this is applied "often", and these settings come from membership in the "timemachine" Computer Group.

Another tool is available at the command line: mcxquery. Prior to 10.5.3, mcxquery did not display proper results when MCX records were in the local directory service, but it now behaves as expected.

mcxquery -user shortname

will show you the effective MCX settings for the user on the current machine.

Conclusion and additional thoughts

In this series of articles, we've looked at ways of using the local directory service to implement MCX settings. This would be useful for environments that don't have Open Directory, and cannot or will not do schema extension for Active Directory or third-party LDAP directory services. Mac administrators can also use these techniques as a proof-of-concept for MCX client management, using the local directory service implementation as a prototype for what benefits your organization would realize by extending the schema on its existing directory services.

There are certainly applications of this concept outside the management of enterprise workstations. Parents could use Workgroup Manager to manage their children's user account and capabilities - a sort of Parental Controls on steroids. In another application, the author used MCX records in the local directory service to lock down a Mac used as an iTunes jukebox. Since you are using local records, you can experiment with various settings and not worry that what you try will affect other machines on your network.

If nothing else, taking advantage of local MCX records should lower the entry bar to using Apple's client management system. If you haven't been using MCX in the past, there is no excuse not to at least try it now, and see how it can help you better manage Macs in your organization and give your users a consistent user experience.


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Grab it now: Game Craft’s Legend of War...
The real time strategy game is now available for you to sink your teeth into, through the App Store and Google Play. Combining elements of skill, strategy and empire building, Legend of War is a real gamers’ game. [Read more] | Read more »
Skateboard Party 3 ft. Greg Lutzka (Gam...
Skateboard Party 3 ft. Greg Lutzka 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: Skateboard Party is back! This third edition of the popular sports franchise features professional skater... | Read more »
Cubious (Games)
Cubious 1.0 Device: iOS Universal Category: Games Price: $.99, Version: 1.0 (iTunes) Description: Cubious – How smart are you? How high is your IQube? Solve the impossible puzzles to find out, and help a lost little cube find his... | Read more »
Goat Simulator Waste of Space (Games)
Goat Simulator Waste of Space 1.1 Device: iOS Universal Category: Games Price: $4.99, Version: 1.1 (iTunes) Description: ** IMPORTANT - SUPPORTED DEVICESiPhone 4S, iPad 2, iPod Touch 5 or better.** | Read more »
Wildfulness - Unwind in nature and calm...
Wildfulness - Unwind in nature and calm your mind with nature sounds and illustrations 1.0 Device: iOS Universal Category: Healthcare & Fitness Price: $1.99, Version: 1.0 (iTunes) Description: Spending time in nature helps you to... | Read more »
Dr. Panda Racers (Education)
Dr. Panda Racers 1.0 Device: iOS Universal Category: Education Price: $2.99, Version: 1.0 (iTunes) Description: STEP ON THE GAS, RACE AND WIN!Fasten your seat belts and get ready to race! Speed your way to the finish line while doing... | Read more »
ROMANCING SAGA 2 (Games)
ROMANCING SAGA 2 1.0.0 Device: iOS Universal Category: Games Price: $17.99, Version: 1.0.0 (iTunes) Description: Romancing SaGa 2, originally released only in Japan in 1993, has been completely remastered and now receives its first... | Read more »
WRIO Keyboard (Utilities)
WRIO Keyboard 1.0 Device: iOS iPhone Category: Utilities Price: $2.99, Version: 1.0 (iTunes) Description: 40% OFF DURING LIMITED INTRODUCTORY OFFER | Read more »
Hatoful Boyfriend (Games)
Hatoful Boyfriend 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: The hit PC game that everybirdie loves has now migrated to your mobile device! Now you are free to explore the wonders of St... | Read more »
Warp Shift (Games)
Warp Shift 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: [ CHECK YOUR HARDWARE: Warp Shift does NOT run on iPhone 4, iPad 1 and iPod touch 4G or older devices! It requires at least iOS8... | Read more »

Price Scanner via MacPrices.net

Goal Zero and OtterBox Partner to Expand iPh...
Goal Zero, specialists in portable power, have announced a partnership with OtterBox, brand smartphone case protection, to offer the Slide and Slide Plus Batteries as modules compatible with the new... Read more
15-inch Retina MacBook Pros on sale for up to...
B&H Photo has 15″ Retina MacBook Pros on sale for up to $210 off MSRP. Shipping is free, and B&H charges NY tax only: - 15″ 2.2GHz Retina MacBook Pro: $1799 $200 off MSRP - 15″ 2.5GHz Retina... Read more
Clearance 2015 13-inch MacBook Airs available...
B&H Photo has clearance 2015 13″ MacBook Airs available for $250 off original MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 1.6GHz/4GB/128GB MacBook Air (MJVE2LL/A): $799... Read more
Apple refurbished Apple TVs available for up...
Apple has Certified Refurbished 32GB and 64GB Apple TVs available for up to $30 off the cost of new models. Apple’s standard one-year warranty is included with each model, and shipping is free: -... Read more
21-inch iMacs on sale for up to $120 off MSRP
B&H Photo has 21″ iMacs on sale for up to $120 off MSRP including free shipping plus NY sales tax only: - 21″ 3.1GHz iMac 4K: $1379.99 $120 off MSRP - 21″ 2.8GHz iMac: $1189 $110 off MSRP - 21″ 1... Read more
Kanex Introduces GoPower USB-C Rechargeable B...
Kanex has announced its GoPower USB-C portable battery for the USB-C MacBook, featuring the new industry standard connector and cable used for connectivity and power. Providing users with a new... Read more
Convertible and Detachable Devices Winning Ov...
According to the latest figures published by International Data Corporation (IDC), Western European shipments of ultraslim convertibles and detachables posted positive growth (44.7%) to account for... Read more
New MacBook Pros And Will MacBook Air Be Upgr...
With my mid-2013 13-inch MacBook Air closing on its third anniversary come November, I’m in system upgrade mode. Actually the Haswell CPU equipped Air is still doing a fine job, but my good wife is... Read more
Apple’s Education discount saves up to $300 o...
Purchase a new Mac or iPad using Apple’s Education Store and take up to $300 off MSRP. All teachers, students, and staff of any educational institution qualify for the discount. Shipping is free, and... Read more
13-inch 2.5GHz MacBook Pro on sale for $999,...
B&H Photo has the 13″ 2.5GHz MacBook Pro on sale for $999 including free shipping plus NY sales tax only. Their price is $100 off MSRP. Read more

Jobs Board

Editor, *Apple* News - APPLE (United States...
Job Summary The Apple News team is looking for a passionate and knowledgeable editor with experience covering entertainment/pop culture and experience running social Read more
*Apple* Nissan Service Technicians - Apple A...
Apple Automotive is one of the fastest growing dealer...and it shows. Consider making the switch to the Apple Automotive Group today! At Apple Automotive , Read more
ISCS *Apple* ID Site Support Engineer - APP...
…position, we are looking for an individual who has experience supporting customers with Apple ID issues and enjoys this area of support. This person should be Read more
Automotive Sales Consultant - Apple Ford Linc...
…you. The best candidates are smart, technologically savvy and are customer focused. Apple Ford Lincoln Apple Valley is different, because: $30,000 annual salary Read more
*Apple* Support Technician II - Worldventure...
…global, fast growing member based travel company, is currently sourcing for an Apple Support Technician II to be based in our Plano headquarters. WorldVentures is Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.