St. Ignatius College Prep Tech Blog

Installing MunkiReport

What is MunkiReport

MunkiReport is a web-based reporting interface for Munki clients. It's cool to deploy a bunch of Munki clients, but it'd be nice to know how many are out there, and any errors or pending installs there may be on those clients.

If you haven't set up your Munki server yet, do that first!

Assumptions (for simplicity's sake)

There are many different possible scenarios for installing MunkiReport, but for simplicity's sake, we're going to make some assumptions. If you're really advanced, you can obviously adapt these instructions for your particular case. If not, follow as is.

You are using a Mac computer as a server.
You installed munki_repo to a subdirectory of the server directory.
You are going to install MunkiReport to the root directory of your web server.
You are going to do all of these instructions from your web server (and not from a client computer).

Making sure the web server is PHP-ready

Apparently, Mac OS X by default does not interpret PHP correctly when you launch up the Apache service. So let's make sure that's good first.

In the Terminal.app, edit the appropriate file using nano (or your editor of choice)

sudo nano -B /etc/apache2/httpd.conf

If you see a line that looks like this:

#LoadModule php5_module libexec/apache2/libphp5.so

change it to look like this instead

LoadModule php5_module libexec/apache2/libphp5.so

Then save out (if you're using nano, Control-X we save).

Then restart apache

sudo apachectl restart

A) Downloading MunkiReport with Git

If you have Git installed, you can do a git clone on MunkiReport.

cd ~/Downloads
git clone https://github.com/munkireport/munkireport-php.git munkireport-php-master

B) Downloading MunkiReport with a web browser

Using a web browser on the web server itself, go to the MunkiReport GitHub repository and click the Download ZIP button to download the latest version. When you get the .zip file, you may have to double-click it to unzip it. Once it's unzipped, you should have a folder with all the necessary files in it.

Installing MunkiReport

Copy the contents of the folder (not the folder itself) to your web server's root directory. Make sure the file ownership/permissions match that of the other files or folders in there (e.g., whatever index.html file says It works! when you first got your web server up and running.

If you no idea, then make it all 755 permissions with ownership of root:_www.

Here's an example to paste into the Terminal.app:

sudo chown -R root:_www ~/Downloads/munkireport-php-master/*
sudo chmod -R 775 ~/Downloads/munkireport-php-master/*
sudo mkdir -p /Library/WebServer/Documents/munkireport
sudo mv ~/Downloads/munkireport-php-master/* /Library/WebServer/Documents/munkireport/
sudo cp /Library/WebServer/Documents/munkireport/config_default.php /Library/WebServer/Documents/munkireport/config.php

The last command just makes a copy of the default config to a new custom config file. You will need both (I thought, at first, that I could ditch the default config file, but then I got an error when I loaded up the page in a browser).

Note: If you're using OS X Server, the path is typically /Library/Server/Web/Data/Sites/Default and not /Library/WebServer/Documents

If all went well, you should be able to go to http://localhost/munkireport and enter a first username and password. This doesn't actually create a user. All it does is create a hash.

Once you have the password hash created, highlight the results and then paste them in at the end of the config.php file on the web server. If you ever need to generate another hash again, go to http://localhost/index.php?/auth/generate and enter in more credentials.

When you do log in, you should see... nothing. No clients.

To create a client, paste these commands into the Terminal.app

bash -c "$(curl http://nameofyourdomain/munkireport/index.php?/install)" bash -i ~/Desktop
/usr/local/munki/munkiimport ~/Desktop/munkireport-2.11.0.pkg

Replace nameofyourdomain with your actual domain name or the server's IP address.

Note: if you're using https with a self-signed certificate, you may want to run

bash -c "$(curl -k https://nameofyourdomain/munkireport/index.php?/install)" bash -i ~/Desktop

instead of the first command.

Note: the version number may change, so after you type ~/Desktop/munkireport-, just hit Tab to autocomplete, instead of typing in the number (it's faster to autocomplete anyway).

Once you have that package imported, and have rebuilt your Munki catalogs when prompted, go ahead and them to the appropriate manifests so they can be pushed out to your existing clients.

If you are well-versed in MySQL and prefer that to MunkiReport's default sqlite database, read Using MySQL with MunkiReport for some implementation tips.

À la carte Adobe CS6 Master Collection using Munki

Caveats

This tutorial assumes you know some Munki basics already. If you don't, check out Absolute beginner’s guide to setting up Munki (not monkey) first.

I'm still in the early stages of figuring out different ways to package Adobe CS6 Master Collection (assuming a site license here) using Munki. It isn't seamless, but it generally works. Two little issues I've found so far are Adobe After Effects not working in Yosemite until you install the updates (so you'll have to create an update package for it), and Adobe Illustrator not uninstalling when you mark it for removal (it appears to go through the uninstall procedure, but then Adobe Illustrator is still there and fully usable). I haven't had luck creating individual update packages, but if you use Adobe Remote Update Manager, it will install all the updates for all Adobe CS6 applications (so actually less work than creating update packages).

The Illustrator situation is a bit weird. I'll explain more about it below.

Problem?

If your organization has the Adobe Creative Suite Master Collection, it is a whole bunch of software, most of which your users won't need or even want. You can package the entire Master Collection as one package (which is more than 8 GB for your users to download—a lot, even on a fast connection). But what if you could allow your users à la carte installations of the programs they need (e.g., just Adobe Acrobat Pro or just Photoshop, Illustrator, and InDesign)?

Requirements before you begin

A Munki server, of course, which you've already set up.
A site license for Adobe CS6 Master Collection (this tutorial may work with CS5 with some tweaks; for example, you may have to use an older version of AAMEE).
At least one Munki client, of course, too. Preferably three or more.
The Adobe Application Manager Enterprise Edition 3.1, which you can get from the Adobe website.

The actual procedure

First, go get the AAMEE from Adobe's website.

3.1 is the one you'll want for Adobe Creative Suite 6.

While that's downloading, get your Master Collection install CD or .dmg ready to go. Once it's there, go ahead and close the window, but don't eject the disk or disk image.

Once Adobe Application Manager Enterprise Edition is downloaded and installed, go ahead and launch it up.

Random fact: if you try to keep AAMEE in the Dock and then launch the application again from the Dock instead of from the /Applications folder, the application may (i.e., probably will) crash.

For this first go-round, you want to create an Installation Package.

The Product Installation Folder is where the install.app is for your Adobe Creative Suite disk image that's mounted (see the next picture for more details).

The Package Name is whatever description you think makes sense.

For my own sanity, I created separate folders for each program for the Save To option. You're welcome to dump them all in one folder, as long as you can keep track.

Here you can see for Product Installation Folder where you should focus for the mounted disk image or disk.

When prompted, enter your organization's serial number, and then click Next.

Select the program you want to install.

These defaults are all right.

The installer will check for updates.

Uncheck all updates.

The official Munki documentation for CS6 says Do not repackage CS6 updates using AAMEE. Simply use munkiimport to import the diskimage as downloaded from Adobe. It doesn't give a reason, but I found my own reason. When I tried to package updates for one piece of the Adobe Creative Suite, it brought in a whole ton of other pieces that I didn't want.

Note: You can find the downloadable updates for later munkiimport on the Product updates page at Adobe.

Unfortunately, when I tried to package updates directly from Adobe, I got errors like this:

Installing Adobe Photoshop CS6 Update 13.0.1 (4 of 6)...
Mounting disk image Photoshop_CS6_13_0_1_upd-13.0.1.dmg...
Running Adobe Patch Installer...
ERROR: Error : Unable to complete Silent workflow.
ERROR: Adobe Setup error: 7: Unable to complete the silent workflow

It seems a terrible workaround, but apparently you're supposed to use a Adobe's Remote Update Manager instead. Update: The Adobe Remote Update Manager works great. It's just a simple binary file you can schedule (using Launch Daemons, not Munki) to run in the background.

Wait for the build.

If you're building only one package, click Close. If you're planning to do a whole bunch of packages, leave this open to click New Package on later.

Your mileage may vary, but I haven't had good luck using MunkiAdmin to import packages made with AAMEE (it seems to work fine for other software packages, though).

So I would recommend using munkiimport instead.

Most of the answers to the questions should be obvious, but the version number will automatically fill in a 6 for everything. Even though we're install software from Adobe Creative Suite 6, not all of the software we're installing is version 6.

I've done the legwork for you here a bit and put in the initial versions for CS6

Adobe Acrobat X Pro 10.1.1
Adobe After Effects CS6 11.0.0
Adobe Audition CS6 5.0x708
Adobe Dreamweaver CS6 12.0.0.5808
Adobe Encore CS6 6.0.0
Adobe Fireworks CS6 12.0.0.236
Adobe Flash Builder 4.6
Adobe Flash CS6 12.0.0.481
Adobe Illustrator CS6 16.0.0
Adobe InDesign CS6 8.0.0.370
Adobe Photoshop CS6 13.0.0
Adobe Prelude CS6 1.0.0
Adobe Premiere Pro CS6 6.0.0
Adobe SpeedGrade CS6 2012.7766.34

I also didn't have any luck getting Munki to recognize any icons from the AAMEE-generated files, so if you want an icon, you may have to figure that out later.

When the package info for the piece you're preparing comes up, scroll down to the installs key. According to HowMunkiDecidesWhatNeedsToBeInstalled, Munki tells whether a piece of software is installed by whether certain files or other things are present in this part of the package info file.

Note: Going by the visible path to the file will work for most of the packages. Illustrator was a bit weird, and I had to run

makepkginfo -f /Applications/Adobe\ Illustrator\ CS6/Adobe\ Illustrator.app

to find out that the real path (when running that command above, use tab completion—don't fully type out the path) is /Applications/Adobe Illustrator CS6/Adobe Illustrator.app.

Special thanks to Tim Sutton and Greg Neagle for sleuthing this for me on the Munki dev mailing list.

Also important to note: the commands in the terminal will use escapes (backslashes) before spaces in names, but the path in the Munki info file will not use escapes before spaces in names.

Just leaving the default in there, you'll run into a problem of Munki thinking every piece of the Adobe Creative Suite is installed if only one piece is installed.

So we're going to modify it to add in a new path to the exact location of the launcher file. Even though it is a .app file, the string for type should be file and not application. I tried application, and it didn't work.

When you're asked to rebuild the catalogs, go ahead and say yes (y).

You should then be able to see the software in your client's Managed Software Center after a fresh check for updates.

Mounting an external drive when users are logged out in Mac OS X

Problem?

In older versions of Mac OS X, you could create a special .plist file that auto-mounts disks even when a user isn't logged in. You can see that (no longer working) procedure here. I don't know exactly when support for that ended, but some people have suggested around Mountain Lion. (If you try it in Yosemite, your Mac will get stuck in bootup at Waiting for DSMOS if you run it in verbose mode... or just half a progress bar if you're booting it up in normal mode.)

People still want this feature, though. Here's a recent thread of frustrated people not being able to do it:
10 *still* requires users to be logged in for backup to work.

Major Prerequisite

I'm assuming you already know how to create a script. If you don't, use method #2 in Deleting Mac Keychains in an Active Directory Environment as an example.

Find the UUID of your external drive

There is a universally unique identifier for your drive. Unfortunately, the normal diskutil list command won't show it to you. Instead, when you launch up the Terminal.app, you should run this command (make sure the drive is physically plugged in before you run the command):

diskutil list -plist

and that will show you your external drive's UUID.

Highlight and copy the UUID.

Mount the drive via UUID

To do a quick test of mounting the drive, run a command similar to this:

diskutil mountDisk yourreallylonguniversallyuniqueidentifierfordrive

Whether that drive was already mounted or not, it should (if the command worked) display a message that says Volume(s) mounted successfully.

A visual example

Here you can see an example.

So fire up those launch daemons and go ahead and put that mount command into your script!

Getting started with pygame on a Mac

There are a lot of pygame tutorials out there, but I haven't yet found a simple, step-by-step how-to on how to just get pygame installed on a Mac, and then actually use it. So, hopefully, this will work for you. This example was done using Macs running OS X 10.10 (Yosemite). Your mileage may vary.

Installing pygame

Go to the pygame downloads page and scroll down to the Mac section.

Find the download titled Lion apple supplied python: pygame-1.9.2pre-py2.7-macosx10.7.mpkg.zip and download and install it.

It says Lion, but it will work with Yosemite.

Creating a short sample pygame

Just so you can see how it works basically (and then later on, you can create/tweak your own games), here's one you can start with.

Open up a text editor (e.g., a terminal editor like nano or a graphical one like TextWrangler—avoid TextEdit, unless you know the difference between plain text and rich text).

Paste into the text editor the following:

import sys, pygame
pygame.init()

size = width, height = 320, 240
speed = [2, 2]
black = 0, 0, 0

screen = pygame.display.set_mode(size)

ball = pygame.image.load("ball.gif")
ballrect = ball.get_rect()

while 1:
        for event in pygame.event.get():
                if event.type == pygame.QUIT: sys.exit()

        ballrect = ballrect.move(speed)
        if ballrect.left < 0 or ballrect.right > width:
                speed[0] = -speed[0]
        if ballrect.top < 0 or ballrect.bottom > height:
                speed[1] = -speed[1]

        screen.fill(black)
        screen.blit(ball, ballrect)
        pygame.display.flip()

Save it to your desktop as pygametest.py

Then, save this beach ball image file to your desktop as well.

In Terminal.app (which you can find in /Applications/Utilities or using Spotlight), paste in this command:

cd ~/Desktop

This will change focus to your desktop directory (that's where you saved your Python script and your beach ball image).

Paste this command in next to run your script:

python pygametest.py

If it worked, you should see a beach ball bouncing around a black background.

Credit where credit's due

I didn't make up this tutorial out of thin air. This is a synthesis of a couple of online resources I found.

Pygame Intro, for the beach ball tutorial.
Ubuntu Forums thread on Pygame error, for the tip about changing directories before running the script.

Movie projects disappear after iMovie upgrade

When you upgrade to the new iMovie, there's a quick prompt to update your old iMovie projects, but if you dismissed that and don't know how to go back and update again...

Go to File > Update Projects and Events...

More info at Apple:
Update projects and events from previous versions of iMovie in iMovie (2014)

Don’t display last logged-in user at login screen for Windows

The Problem

You may have noticed that Windows will remember by default the last logged-in user. This is supposed to be a convenience, but when you have a lot of users sharing computers, it will often add an extra step to have to click Switch User before entering a username and password.

There are two ways to disable this.

Solution #1

One way is through the registry. If you hit Windows-R and type regedit you will launch up the registry editor.

Navigate to HKEY_LOCAL_MACHINE > Software > Microsoft > Windows > CurrentVersion > Policies > System

Double-click dontdisplaylastusername and then change the 0 to 1

Solution #2

Alternatively, if you want to change it through Group Policy, you can hit Windows-R and type gpedit.msc which will launch up the Group Policy editor.

Go to Windows Settings > Security Settings > Local Policies > Security Options

Then double-click Interactive logon: Do not display last user name and change it from Disabled to Enabled

Post-Solution...

Then, you should no longer see the last logged-on user at the login screen.

Adding a carriage return within a cell in Numbers

If you want to do a carriage return within a cell in Numbers (iWork), hit Option-Return on your keyboard.

This will not work in Microsoft Excel (Office 2011).

Troubleshooting AirPlay to AppleTV

This is less of a step-by-step tutorial and more of "this is a situation we encountered and what ended up fixing it... your mileage may vary" post.

We had one laptop that had trouble connecting to one Apple TV in a classroom. My own laptop could AirPlay to it just fine.

When the non-connecting laptop would try to connect, sometimes there'd be an incorrect password error. Other times it would seem to connect (as extended display) but then not actually display. Trying to change from extended display to mirrored display would just keep it on extended display that wasn't really extending to the Apple TV.

I double-checked the Apple TV software was up to date. I rebooted the Apple TV. I rebooted the laptop. I tried taking the password off of the Apple TV AirPlay. No change after any of that.

Then I tried changing the broadcast name of the Apple TV, and the previously non-connecting laptop was able to connect! I changed the name back to the original name, and the laptop could still connect. I added the password back in, and the laptop could still connect.

So, I don't know if the renaming and naming back method will work for others experiencing AirPlay connectivity issues, but it's worth a shot!

Resetting a Windows password with ntpasswd

Proper Use Case

You may encounter situations in which you have forgotten the administrator password on a Windows computer, and you need to reset the password. This tutorial will walk you through how to reset it using an open source tool called ntpasswd.

Improper Use Cases

If your Windows computer is joined to a domain, and you're trying to reset a domain account password, you need to do that through Active Directory. ntpasswd will not help you reset domain accounts, only local accounts.
If you are trying to find out (instead of reset) an admin password, you cannot do so through ntpasswd. You may have some success doing so using Ophcrack, but it doesn't always work and may take a very long time. For more details on why, check out the FAQ page for Ophcrack.
Try to break into an active (but locked) session. In order to use ntpasswd to reset an admin password, you have to reboot the computer. Really, you shouldn't be breaking into people's sessions anyway!

Download and use the USB / burn the CD

If you go to the ntpasswd website and scroll down, you should see some downloads available. There's one for USB, one for floppy, and one for CD. Even though you "waste" a CD, I think for first-time use of ntpasswd a burnt CD is the best way to go.

Download the .iso (disk image) zip file and unzip it.

Then you want to burn the .iso to CD as a disk image (not as data). For more details on how to do so, check out this tutorial, which uses a Ubuntu .iso as an example, but the same procedure works for any .iso, really.

Once you have the CD burnt, plop it into the optical drive for your old Windows computer and boot from the CD. You may have to press a special key during bootup (e.g., Esc, F12, F10, etc.) to get the computer to boot from the CD instead of its internal hard drive.

The actual password resetting

Once ntpasswd boots up, you'll see some special boot options.

You can type in boot and hit Enter. I believe you can even just hit Enter without typing boot. There are some special options, but try the default one first unless you run into problems.

ntpasswd will automatically scan the hard drive for any existing Windows installations. Some people have dual-boot Windows installations but in all likelihood you'll have only one, so you can just select the default by hitting Enter (otherwise, type in the number of the drive/partition you want, and then hit Enter).

Hit Enter, because you want to select Password reset [sam].

Hit Enter, because you want to select Edit user data and passwords.

You'll see a list of users. You can select a particular admin users you want to reset the password for. For the sake of this demonstration, we're going to use the built-in Windows Administrator account.

To select the user you want, type in the RID number. Since I'm selecting the Administrator account for this demo, I'm typing in 01f4.

In this particular case, the Administrator account is locked (which it is by default in Windows). So I'm going to type 2 to unlock the account. You do not need to do this most likely for any normal (not built-in) administrator account.

Type 1 to blank out the existing user password.

Type q to quit.

Type q to quit again.

This part is super important! When you're asked if you want to write the files back, you definitely want to type y to write them back, even though the default is n.

You may get a cryptic error that says cat: can't open '/tmp/disk': No such file or directory. Ignore it. It's probably fine.

If you're done with everything, type n to not run the whole process again.

When prompted, hit Control-Alt-Delete to reboot the computer, and then eject the ntpasswd CD so Windows will boot up.

You should now be able to click on the account (in this case, Administrator) to log in without a password.

Depending on your settings, you may just get a username and password prompt—in which case, enter the username and leave the password blank.

Wait to log in...

Go to the Control Panel and set or reset any passwords you want, now that you are again administrator of the Windows installation.

How many times do you have to write zeros or random data to a drive to securely delete data?

Conventional wisdom says that you need to do many passes of zeros, ones, combination of zeros/ones, and then random numbers in order to securely erase a drive so that its data cannot be recovered. But is this true?

The folks at HowToGeek make a good case for one pass of zeros being enough:
HTG Explains: Why You Only Have to Wipe a Disk Once to Erase It

From StackExchange, here is a shorter sum-up of the situation, though:
StackExchange answer to "Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?"

And an even shorter tl;dr version:
Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption.

The bottom line seems to be that there are some misinterpretations or misapplications of the Gutmann method, but more importantly that it's all about what can be done in theory. When it comes to practice, a single wipe of zeros is pretty much enough to take care of any basic data recovery methods.

If you're dealing with highly sensitive data, it probably still won't be recovered in any meaningful way after a single wipe of zeros, but you may not want to chance it, and end up doing several passes of zeros, ones, and then randoms, in addition to physically incinerating the drive.

DBAN's "autonuke" setting does three passes, and the nice thing about DBAN is that you can use it on pretty much any computer (it's a live CD or USB—so good for Windows, Mac, or Linux).

Mac OS X's Disk Utility has several built-in options.

If you launch up Disk Utility, select the drive you want to delete, and then click Erase, and then Security Options..., you'll see a pop-up window with a slider.

The first option doesn't do a secure wipe at all. It just "deletes" the data by marking it available for use.

The next option will be secure enough in 99% of use cases (e.g., you have a personal computer with family photos and other personal documents that will not financially benefit any criminals or politically benefit any governments).

This third option is about the same as the "autonuke" setting for DBAN.

And this last option—according to Gutmann himself, to HowToGeek, and to a bunch of other folks who've examined the issue closely lately—is just overkill.

A lot of the discussion you'll read in the links I posted above have to do with theory (could someone with limitless time and really expensive equipment possibly recover some tiny scrap of data from your hard drive) and a lot less to do with practicality. More importantly, it's difficult to track down actually successful (and verifiable) experiments of the theory [that traces of previous data exist even when you zero out everything or write random data over the previously existing data].

Practical security focuses a lot more on how badly criminal elements want your data and how difficult you make it for them to get to the data. If all a criminal gets is unusable scraps of what might have been a text file, and all that's really on the drive to begin with is some music, family photos, and Word documents, who is really going to spend hours trying to get that stuff back?

If, however, I have a computer with millions of people's financial data or with highly classified military documents... I'm probably going to do at least three passes before totally incinerating (Terminator 2–style) the drive. And that drive would have been fully encrypted to begin with.

As a simple, practical test, though, I did the second Disk Utility setting (one pass of zeros over the entire disk) on a 500 GB drive. Then I did data recovery on it using both Photorec and Recuva.

Here are the results...

Photorec took about 10 hours to scan the 500 GB drive, and it came up with 3 files—three .plist files and one .xml. I'm not 100% certain, but I believe those might be created by OS X itself when formatting the drive to HFS+

Recuva took a little over 2 hours to scan the 500 GB drive, and it came up with 3 files. Again, not 100% certain on this, but I believe those may be hidden files created by Windows when formatting the drive to NTFS (Recuva wouldn't recognize an HFS+ drive, so I had to use Windows' disk management to reformat the drive as NTFS before scanning).

If you're inclined to say 3 passes isn't enough...

Make sure you know what you're disagreeing with. I am not (nor is the StackExchange response or the HowToGeek post) saying that a drive with highly sensitive documents should be disposed of after a single pass of zeros. Those should have been encrypted to begin with, have three passes, and then be incinerated. But doing the full 35 is overkill and, worse yet, doesn't offer any additional security over the three passes. So if you're going to disagree, disagree with the correct assertion. Don't engage in any of this business.
I am, however, saying that for a basic home user with no extremely sensitive information (maybe some family photos and a handful of documents with no financial information), you can safely dispose of a drive after doing a three-pass on it (and, most likely, even a one-pass).
Don't say "I have software that can easily recover one-pass deletions" without saying what software you use. I used Photorec and Recuva. If you believe another piece of software can actually recover data that's been wiped, say what software it is, and then prove that using it you were able to recover usable data after a one-pass or a three-pass.
If you can recover fragments of data that are totally useless, who cares? If it's a text file, it has to have readable text. If it's an image file, it has to be a viewable image. You can't just prove that there used to be "in theory" data there previously, but it's data you can't recover.

I'd love to hear that I (and the wise StackExchange user, and Gutmann, and HowToGeek) are all wrong, but if that's the case... prove it.

Further reading:
Securely disposing data on hard drives and other storage media
The urban legend of multipass hard disk overwrite and DoD 5220-22-M
Overwriting Hard Drive Data: The Great Wiping Controversy