Snow Leopard Client And Active Directory

Posted on June 18, 2013 by dave

In the midst of our migration to Active Directory, we’ve run into a snag…

To set the stage – We were forced to stand up a “temporary” AD Domain (running on Server 2008 R2) for a copier project with the understanding that our “real” AD Domain would take over duties for the temp. No biggie. After the fact, we’ve had a consultant on-site working with us to help plan out our migration. While testing Mac client binding with the Server 2008 domain, we ran into issues binding Snow Leopard clients to the domain. Trying to bind through the GUI gave us this lovely 5102 error:

aderror

Google was no real help with the error itself and any fixes we did find, did nothing to help us resolve the issue. Mindful of the fact that we would be running AD under Server 2012, our consultant suggested we try joining the domain he had set up in a VM on his laptop which was running Server 2012.

We go through the steps and Voila! Successful bind to 2012. Okay, no worries. Or so we thought.

We setup our new domain, running on Server 2012. There have been no major policy changes except to relax the password policy (due to our crappy existing passwords, which will be changed). Tried binding a Snow Leopard client and we’re back to the 5102 error. Try binding the same client back to the VM on our consultant’s laptop and it still works flawlessly.

We’re stumped. Sure, we could bring our OS up to speed on over 1,000 clients… If we had the time to do that, which we don’t.

So, here’s my cry for help. If anyone has run into this issue and found a fix, let me know. This one is making our consultant scratch his head and he’s pretty damn smart.

Obviously, if we do get it worked out or if someone has ideas, I’ll be posting them here to share with the next guy who runs into this problem.

(UPDATE 3/25/14 a.k.a. “Way After The Fact”)

The problem wound up being our content filter which sits between our clients and our DC. It had been patched to address a UDP attack vulnerability and stopped our 10.6 clients from correctly communicating with the DC. Our filter provider resolved the issue for us.

Posted in Active Directory, OS X, Servers, Software, Uncategorized | Tagged , | Comments Off on Snow Leopard Client And Active Directory

Yowza

Posted on May 31, 2013 by dave

Been a while since I’ve even checked on this site…

Lots of changes for the work side of things.

We finally upgraded our Zimbra install – I’ve been thinking about writing up the process, but don’t know if it makes a difference now. We migrated hardware and upgraded to version 7 and since Zimbra is now at version 8, I’m not sure how relevant the information would be. I am hoping to get an upgrade to 8 done this summer though. Which will probably be pretty painless.

And we’re planning to migrate away from Apple’s Open Directory to Active Directory. I’m not sure how I feel about that… Given Apple’s obvious focus on everything “i“, I am pretty much done with anything related to their “server” line of software. But I haven’t heard many good things about M$ lately either. Maybe I’m traveling in the wrong circles. If someone out there can provide reassurance that AD is not the work of the devil, please do.

As before, I’ll try to record the process and progress for both of these projects on the off chance it provides useful information for someone else some day.

Posted in News, Servers, Zimbra | Comments Off on Yowza

Speaking Of Xserves

Posted on August 18, 2011 by dave

We’re still running Zimbra at work and it’s still providing us with what we need as a collaboration suite. Unfortunately, we’re running on Leopard Server and still stuck on version 5 due to Apple’s unwillingness to fix the bugs in their server software.

Which is why we’ll be migrating from the Xserve to an Ubuntu server*. I have a conference call with Zimbra’s Professional Services people to begin the planning of the migration. I put the call into them due to the fact that we’re migrating hardware and software at the same time, as well as upgrading the storage system that mail resides on. Looking forward to the challenge and keeping my fingers crossed that all goes well.

*A server that will not have an HP logo on it.
Posted in OS X, Servers, Zimbra | Tagged , | Comments Off on Speaking Of Xserves

On A Happier Note

Posted on August 18, 2011 by dave

I finally got our authentication/home directories deployed. Running on Xserves.

The same Xserves that Apple discontinued 8 months ago.

<Sigh>

Posted in OS X, Servers | Tagged | Comments Off on On A Happier Note

HP Breaks Up With WebOS Devices

Posted on August 18, 2011 by dave

Today’s news that HP is discontinuing WebOS devices breaks my heart. I’m the proud owner of a launch day Palm Pre running on Sprint. I moved to the Pre from a Treo which had faithfully met my needs until the screen started losing it’s mind. It took a day for me to get used to the feel of the smaller phone, but beyond that I felt that I had found a phone/OS combo that worked for me. Sure, I could’ve changed carriers and gone with an iPhone, but it just didn’t reel me in the way the Pre had. The big appeal for me was the physical keyboard – virtual keyboards are nice, but I’ve always preferred the tactile response of a physical keyboard. With updates, the OS really began to take shape and provide me with the experience I was looking for as a user.

It's A Trap!When Palm looked to be on the verge of collapse, HP swept in and bought them. My fears of not being able to migrate to new hardware were relieved. HP promised a path to the future for WebOS and seemed to be delivering with announcements of two new phones, the Veer and Pre3, and a tablet, the Touchpad back in February of this year. I was hopeful that the Pre3 would come to Sprint and when indicators pointed to that not happening I actually started looking at other carrier’s plans – my allegiance is to WebOS, not my carrier – preparing to make a move if it came to it. I purchased myself a Touchpad and despite the negative reviews it’s received, have found it to be more than capable of handling the tasks I put it to.

Today’s news has, to put it bluntly, pissed me off. Barely a month and a half after launch, the Touchpad isn’t meeting sales expectations and apparently the Veer hasn’t done well either, so HP is getting out of the WebOS hardware game. It remains to be seen what exactly will happen to WebOS, although the best decision HP could make at this point is to license the OS to manufacturers that are willing to invest in building a hardware platform that could take advantage of everything WebOS has to offer – something, it seems, HP was never willing to do.

For now, I will push forward with my poor launch day Palm Pre. My phone is a trooper – it’s been dropped more times than I can count, survived 3 foot + drops, and endured unintended torture that would’ve destroyed other phones. I’ve considered going the Franken-Pre route and dropping my radio into a Pre2 for a hardware refresh as well as trolling eBay until I find an original Pre in good condition. But eventually, unless WebOS is licensed out and a manufacturer can produce a phone that works as well as my Pre has worked for me, I may have to become an iPhone user.

Nothing wrong with the iPhone. But I will miss my physical keyboard.

Update

The PreCentral Round Up covers all of my thoughts on today’s news quite nicely as well as this comment.

Update 2

Best response to HP I’ve seen from the PreCentral Forums:

“Regarding today’s upper “managers” of HP, I’ve only got one comment:

You morons aren’t worthy to hold the used jock straps of Hewlett and Packard in your hands.”

Posted in Palm, WebOS | Tagged , , | 1 Comment

WordPress Install

Posted on January 1, 2011 by dave

I decided awhile ago to switch I/O from Movable Type to WordPress after doing the same on another site of mine. The other site was a clean install with no content carried over and took about 30 minutes from WP download to being content with the results. Making the switch here took a little longer since I wanted to carry over my content (not much here, but I still wanted it to make the transition). I also had redirections to worry about since my “Zimbra External Directory Sync” article gets a lot of traffic and I know from experience that 404 errors suck when you’re searching for something.

The Why

When I first decided to start I/O I used MT, mostly because I was familiar with it and liked the comfort level. Then I made the mistake of starting with MT4. Up until then, I had used versions 2 and 3. For some reason I thought 4 would carry on with what MT had achieved in previous versions. What I got was an entirely new interface and a lot of headaches. I tried to like it, but eventually gave up on it which is why the previous post here is from August of 2009. I recently moved another site to WordPress, fell in love with it, and decided to do the same here as soon as I could.

The How

Otherwise known as “The Easy”. Downloading and installing WordPress takes all of 5 minutes – WP isn’t exagerating when they call it the “Famous 5-minute install”. Set your database connection info, run the installer, and you’re done. So easy, even a caveman could do it. Before I started this process, I exported what little there was in my MT install using the built in exporter. It churned out a text file which I used with the Movable Type/TypePad importer WP plugin. *POOF* – seconds later, here’s the content. Again, very easy. Granted, there wasn’t a lot here to import… I’m sure a larger content site would take longer but the ease of use here is great.

Finally it was time to handle the redirection aspect of this endeavor. MT’s permalink structure is different from WP’s – even after I changed the WP permalinks to match what MT had been using, I still had an issue. MT used hyphens to handle spaces in post titles and WP uses underscores. Not wanting to go down the road of hacking WP files for one high traffic article, I started looking into using mod_rewrite. Here’s where my eyes glazed over and I lost a couple of hours in reading and trial and error. Yes, hours – I like learning about methods I’ve never used before and mod_rewrite fits the bill. Unfortunately my ability to harness the power of the mod_rewrite voodoo left me with redirects that weren’t working. Thankfully, one thing I’ve learned about WP is, there are plugins for damn near everything. Enter the “Quick Page/Post Redirect Plugin“, which was the first plugin I looked at. This plugin had my redirect up and running in seconds.

The End

The transition is complete, users coming here via links to the external sync article should get to where they’re going, and when I finally click “Publish” on this article, it won’t take minutes to actually publish. I will miss MT a little. It’s what I started with years ago. But WP looks like it’s going to suit my needs a lot better for the immediate future. The only other thing I have to work on is the theme – not sure if I like the current one, but that’s something that can wait for another day.

Posted in Software | Tagged , | Comments Off on WordPress Install

Call For Assistance

Posted on August 5, 2009 by dave

If there are any OS X Server gurus out there, I’m having issues with Tiger client Netinstall images and Leopard server.

They just don’t work!

The machines netboot just fine and look like they’re going to image properly but the installation ends after 3 seconds with a “Software successfully installed” message. The only thing that’s happened is the machine name has been changed.

If anyone can point me in the direction of a solution, give me a holler!

Thanks!

Posted in OS X, Servers | Tagged | Comments Off on Call For Assistance

Zimbra Update

Posted on January 5, 2009 by dave

Just a quick note:

We rolled out Zimbra back in October to our 2,000+ users with some last minute account insanity. Aside from quickly adding over one hundred last minute accounts, the roll out was a success. We’ve had a few issues since then, but nothing major and all issues were addressed by Zimbra’s support team within a reasonable amount of time.

So far it seems to be a hit with most of our staff and I’m extremely happy with our decision. If you’re looking for an email system, I definitely recommend checking them out.

Posted in Servers, Software, Zimbra | Tagged , | Comments Off on Zimbra Update

Zimbra External Directory Sync

Posted on September 13, 2008 by dave

One of the first problems I had to resolve after installing Zimbra, was how to keep Zimbra’s internal LDAP directory in sync with our Open Directory server. This problem was compounded by the fact that out of the box, all Zimbra mail boxes have to be provisioned by hand. Granted, there are command line tools and scripts that can be used to batch provision accounts but who wants to manually put together scripts to do the bulk provisioning? Authentication and GAL lookups from an external source are working beautifully so far and to me, Zimbra’s lack of an auto-provisioning from an external directory feature is almost insane.

Currently there is an RFE in Zimbra’s bug tracker for such a feature, but that doesn’t help those of us who could use a solution now.

After a great deal of searching through the forums and bug tracker, I literally stumbled across Bug 14772 – include zmexternaldirsync in build. It’s a discussion about including a Perl script called zmexternaldirsync in the Zimbra builds. From what I can tell, the team was getting it ready to include it in a build and then decided against it. I grabbed the script and documentation and fiddled around with it and got it working.

And now I’m posting it here to (hopefully) make someone else’s life a little easier.

    WARNING: This script is provided as-is. The author of this blog is not responsible for any potential damage it may do to your install. The author of this blog is also not responsible for supporting this script. Be aware that any future Zimbra updates could break this script. I doubt it’s supported by the Zimbra team since it isn’t included in any of the available builds (AFAIK). Use it at your own risk!

With that said… I’ve been using it since earlier this year. So far it’s auto-provisioned new mail accounts for every new user I’ve added to our directory server. It’s made my job a lot easier than I thought it was going to be. It’s survived two software updates and an OS/hardware migration. It’s everything that should’ve been included with Zimbra to help system administrators maintain user accounts.

When I first set it up, I was running Zimbra on an Xserve running Tiger server (10.4.11). I had to install the Perl modules referenced in the spartan documentation. I also had to modify the script itself – I’ll be honest, it’s been so long I can’t remember what I had to change and I was bad about keeping notes… I think it was a case change in three lines of the script. I’ve included my modified script in the zip file to save you the time and trouble. I’ve set the script up to pull the cn from our directory and set that value to Zimbra LDAP’s displayName value… I’ve found it handy to have full names in the account listing screens. I just finished migrating to a newer Xserve running Leopard server (10.5.4) and haven’t run into any problems with the script so far. If I do, I’ll post them here.

zmexternalsync.zip (67 KB)

Posted in Servers, Software, Zimbra | Tagged , | 3 Comments

Just Curious

Posted on August 25, 2008 by dave

This one is for any other sysadmins that happen to stumble across this blog…

Our school district has the worst data management possible. We have had active email accounts for people who haven’t worked for us in years.

It’s that bad. Actually it’s worse (although I don’t know if this counts as worse)…

We have no directory services in place – For each system or application we have that requires authentication, that system or app has had it’s authentication information maintained manually. It’s been a nightmare to say the least.

We’re finally implementing directory services (Apple’s Open Directory) and we’re planning on having it drive everything authentication-related. But we still have a problem with the data we get (or don’t get) from our HR department. A plan has been fashioned to use a PHP/MySQL customised system to give multiple people access to the data in our directory and update it as needed. I’d go into more detail, but I’ll be honest – this thing seems like it’s grown to monolithic proportions and I’m at a point where I A) don’t really know anything about it, B) don’t even think I understand it anymore, and C) don’t even have access to it.

So… my question is… is it wrong that I feel extremely hesitant (borderline refusal) to allow that much access (pretty much everyone in district – user password changes will theoretically be handled by this system) to the directory data?

Or am I just looking at it from a ‘Chicken Little’ point of view?

Posted in OS X, Servers | Comments Off on Just Curious