Usage:

# zonetype.sh -g or –global
Return 0: The machine is a global zone with 1 or more local zones
Return 1: The machine is not a global zone

# zonetype.sh -l or –local
Return 0: The machine is a local zone
Return 1: The machine is not a not a local zone

# zonetype.sh -v or –vmware
Return 0: The machine is running on a VMware hypervisor
Return 1: The machine is not running in VMware

#! /bin/bash
#
# When issued with the -g or --global flag, this script will return:
# 0 if the machine is a global zone and has one or more local zones.
# Otherwise, it will return 1
#
# When issued with the -l or --local flag, this script will return:
# 0 if if is a local zone and 1 if it is not
#
# When issued with the -v or --vmware flag, this script will return:
# 0 if it is a vmware host and 1 if not.
#

list=( `/usr/sbin/zoneadm list -civ | awk '{ print $1 }'`)

  case "$1" in
    -g|--global)
        # If the third element in our array is null, set it to 0
        if [ "${list[2]}" == ""  ]; then
        list[2]=0
        fi
        # This is a global zone only if it has one or more local zones.
        if [ ${list[1]} -eq 0 ] && [ ${list[2]} -ge 1 ]; then
        # 1 is returned if we have a global and local zone,
        # otherwise, we return 0
                exit 0
            else
                exit 1
        fi
              ;;
    -l|--local)
        # If the second element in our array is = or > 1, it is a local zone.
        if [ ${list[1]} -ge 1 ]; then
        # Return 1 if this is a local zone, otherwise return 0.
                exit 0
            else
                exit 1
        fi

              ;;
   -v|--vmware)
        # Don't run our check on local zones... Prtdiag can't run there
        if [ ${list[1]} != 0 ]; then
                exit 1
           else
                vmhost=( `/usr/sbin/prtdiag | grep System | awk '{ print $5 }'`)
                if [ $vmhost == VMware ]; then
                        #If the host is running on the vmware cluster return 0,
                        # otherwise, return 1
                        exit 0
                else
                        exit 1
                fi
        fi
              ;;
        *)
        echo "Usage: /local/adm/zonetype.sh {-l | --local | -g | --global | -v | --vmware}"
        exit 1
  esac

So what the heck is this UNIX time anyhow? Well, simply put, it’s actually the exact number of seconds since the the Unix epoch. This was 00:00:00 UTC on January 1, 1970.

From Wikipedia:

It is not a linear representation of time nor a true representation of UTC (though it is frequently mistaken for both) as the times it represents are UTC but it has no way of representing UTC leap seconds (e.g. 1998-12-31 23:59:60).

First, create and edit “/var/sadm/install/admin/custom”, adding a line similar to this:
basedir=/var/applications/$PKGINST

Next, issue the pkgadd command with the “-a” flag to call you alternative admin file:

pkgadd -d device -a custom PackageName

This really comes in handy when your customers want to retain control over their packages, but you don’t want to give them access to write packages into the system area. More detailed instructions can be found here.


/path/to/file/one/fileone.html
/path/to/file/two/filetwo.php
/path/to/file/three/filethree.htm
/path/to/directory with spaces/filefour.txt
and so on...


I worked out the "sed" command to do the in place editing, and Zach helped me whip up a quick PHP script to read the contents of "list.txt" into an array and iterate through it. He was also nice enough to show me how to use "str_replace" to escape any annoying spaces that happened to find their way into the names of directories.

It's a handy little script that I'm sure I will find a use for later, so I thought I would put it up here.

The OS itself is quite nice, although it is a bit strange to get used to the finder looking like iTunes. Stacks is a great idea, but part of me wishes it behaved more like a launcher-type application than a different interface to folders. Who knows though. Maybe after using them, I will come to appreciate the feature a lot more.

One thing that I am very glad to see is "Spaces". Basically virtual desktops, X Windows has had this feature since the very beginning, but it is just now becoming native in Mac OS. Granted, there has almost always been external applications that handle this, but it's nice to see it wrapped in.

There is a lot of buzz about the "Cover Flow" features that have been added to the finder. I have to admit that it is extremely aesthetically cool and very very slick. How much I use it in my day to day life remains to be seen, but it will be nice to browse documents visually without having to depend only on the title to find them.

Time machine, basically well integrated filesystem snapshots, seems like it will be a wonderful addition, but I have not had the chance to use it yet because I don't have an external fire wire drive. It's on my shopping list though, so I will be enabling it just as soon as I have the gear to make it run.

All and all, I think it's an outstanding upgrade, and well worth the money. Give it a shot... You won't be sorry.

If you have more than just one or two users, you should use the procedure to recover from one of your NetInfo database backups. A backup of your this database is made at 3:15 every day so long as the computer is running. It is stored in "/var/backups/", and here are some instructions on how to recover it from it. If, however, you don't care about re-adding users, and simply want to get into your system quickly, or if you don't have a backup to restore from, here is how you can do it:

BEWARE: THIS WILL COMPLETELY ERASE ALL USER ACCOUNT INFORMATION FROM THE SYSTEM!!! You are warned.

1) Start by booting your Mac into single user mode. To do this, hold down both the "Apple" and the "s" keys as the system boots.

2) The system will have mounted the "/" filesystem read-only to protect against data loss. To get "/" mounted read-write, we have to run two commands:

# /sbin/fsck -fy

# /sbin/mount -uw /

3) Now "/" is mounted read-write, so we can start with the real work. First, rename your existing NetInfo database to something else so the OS will not see it on the way up:

# mv /var/db/netinfo/local.nidb /var/db/netinfo/local.nidb.bad

# mv /var/db/netinfo/network.nidb /var/db/netinfo/network.nidb.bad

4) Next, remove the ".AppleSetupDone" file so the OS will kick you back into the installer upon boot and you can recreate your users.

# rm /var/db/.AppleSetupDone

5) Finally, reboot your system and recreate your users, making sure they are pointed towards their existing account directories.

# reboot

Even though I still feel the iPhone is too expensive, and that it is lacking in some basic features, this might just be the thing that gets me to buy one. After all, I love hacking hardware!

I heard an interview with Hots on the way home from work Friday. When asked to respond to internet rumors that former phreaker Steve Jobs was mad at him, he said "I want Steve to call me up. Let's he and I have a man to man about it." It was wonderful! If Steve Jobs can't remember his days hacking the phone system and respect Hots and the team for their accomplishments, he truly has lost touch with what hacking is all about.

Wonderful job guys! Congratulations.

useradd -g group -c 'User Name' -d /path/to/home/directory -s /bin/bash username

This script is chkconfig compatible, so call it the name of your new service and put it in /etc/init.d

The chkconfig: 235 section indicates the the default runlevels. For instance, if we called this script /etc/init.d/new-service and ran chkconfig new-service on, it would be active in runlevels 2,3 and 5.

The 98 and 55 numbers indicate the order of startup and kill. This means that using this tag, the startup symbolic link would be named S98new-service and the symbolic link to kill the process would be named K55new-service.

#### SNIP ####

#! /bin/sh
# Basic support for IRIX style chkconfig
###
# chkconfig: 235 98 55
# description: Manages the services you are controlling with the chkconfig command
###

case "$1" in
  start)
        echo -n "Starting new-service"
        #To run it as root:
        /path/to/command/to/start/new-service
        #Or to run it as some other user:
        /bin/su - username -c /path/to/command/to/start/new-service
        echo "."
        ;;
  stop)
        echo -n "Stopping new-service"
        #To run it as root:
        /path/to/command/to/stop/new-service
        #Or to run it as some other user:
        /bin/su - username -c /path/to/command/to/stop/new-service
        echo "."
        ;;

  *)
        echo "Usage: /sbin/service new-service {start|stop}"
        exit 1
esac

exit 0

#### /SNIP ####

Obviously change all instances of "new-service" to the name of your actual service... Enjoy!

for i in $(seq 1 100); do echo -n "file${i} "; touch file${i} 2>&1; done

The the above for loop will create 100 files (called file1, file2, etc.).

Better to use SSH X11 forwarding. This way the entire session is encrypted and nobody can snoop your passwords. The process of using SSH X11 Forwarding goes something like this:

On the server-side (the machine from which you want to forward the display, make sure this line is in your /etc/ssh/sshd_config file:

X11Forwarding yes

If you had to add it, restart the sshd service.

/sbin/service sshd restart

Now, from the client-side (the machine on which you want to display the forwarded X11 application) connect to the server-side machine with the -X flag. Like so:

ssh -X username@remoteserver

Now you should be able to start X applications and have them display on your client machine through an ssh tunnel. If you are like me, however, some Java applications will not display correctly. Instead of popping up a window with the full application in it, I would only see a totally useless blank window. This frustrated me for months until I found this article at kraftek.com that details how to resolve the problem.

It turns out that all you have to do is put this line in the ssh_config file on your client-side:

ForwardX11Trusted yes

After logging out and back into the server-side machine, everything worked perfectly.

The first thing we have to do is "ntpd" to free up the port for "ntpdate":

[root@server /]# /sbin/service ntpd stop
Shutting down ntpd:                                        [  OK  ]

This frees up the port for ntpdate. Next we run:

[root@server /]# /usr/sbin/ntpdate time.apple.com

Now the time should be set correctly. We then change the default time servers to something like the following in /etc/ntp.conf:

# --- OUR TIMESERVERS -----
time-a.timefreq.bldrdoc.gov
time-b.timefreq.bldrdoc.gov
time-c.timefreq.bldrdoc.gov


We can use any time server we want, but I like these and find them to be reliable.

Finally, start backup up your "ntpd" service, and your all set to go.

[root@server /]# /sbin/service ntpd start
Starting ntpd:                                        [  OK  ]

Remember to use "chkconfig" to make sure "ntpd" is enabled to come up when the system starts.

Its strongest points, in my opinion are that it does not depend in any way on Active Directory, and that it integrates well with open source standards like Open LDAP and University of Washington IMAP. Its downsides are that the documentation is sparse and scattered, that is is backed with PostgreSQL rather than MySQL, and that the package is bundled into a TON of RPM's.

I have not tried installing it from source, though I suspect that it would not be much more work than using the RPM's. Anyhow, if you want to install it for yourself, here are some quick scripts to help you, as well as some quick cookbook instructions. I installed it on RHEL 3 Workstation, though I suspect that it would work most Linux distributions.

The first thing we have to do is install the foundation for OpenGroupWare From the RHEL CD's or Website:

Install apache
Install PostgreSQL
Install PostgreSQL-devel
Install php
Install php_PostgreSQL

Next, run the following commands to get the database and webserver started:

# /sbin/chkconfig httpd on
# /sbin/chkconfig postgresql on
# /sbin/service postgresql start
# /sbin/service httpd start

Sendmail should already be installed and running, but if not, you will have to install it as well.

OK, so I said before that there are a TON of RPM's that you will have to install. These can be found at the OpenGroupWare website. Get them however you want, but if you have "wget" installed, you can use my script to fetch everything you need. You can omit the "devel" packages if you don't want to install the source code.

Ok, so now we have a directory filled up wit RPM's. Many of these have a lot of dependancies, so the order of install is important. The script below has them in the correct order, so you can either use it as a reference to install them yourself, or just save the script in the directory that has all your RPM's and run it. Your choice.

Some things to note about the install.

These all have to be done on one line or "rpm" will complain that it can's resolve dependancies:
rpm -Uvh ogo-webui-app-1.1.5-r1717.0.i386.rpm ogo-theme-default-1.1.5-r1717.0.i386.rpm ogo-webui-resource-en-1.1.5-r1717.0.i386.rpm ogo-webui-resource-de-1.1.5-r1717.0.i386.rpm

ogo-database-setup-1.1.5-0.i386.rpm sets up your PostgreSQL database and database user for you. The output should look something like this:

Preparing...                     ########################################### [100%]
1:ogo-database-setup             ########################################### [100%]
PostgreSQL seems to be already initialized
and I can see it running:
PIDS used: 3456 3458 3459
We're on PostgreSQL 7 (7.4)
checking /var/lib/pgsql/data/postgresql.conf
need to patch /var/lib/pgsql/data/postgresql.conf for 7.4
backup current one to /var/lib/pgsql/data/postgresql.conf.20061213-153319
checking /var/lib/pgsql/data/pg_hba.conf
need to patch /var/lib/pgsql/data/pg_hba.conf for 7.4
backup current one to /var/lib/pgsql/data/pg_hba.conf.20061213-153319
The changes we've made require that we restart PostgreSQL...
Stopping postgresql service:    [  OK  ]
Starting postgresql service:      [  OK  ]
OK! PostgreSQL runs again: (3909 3911 3912)
creating database user: OGo
creating the database itself: OGo
we've successfully created both the user OGo and the raw database OGo
we'll now fill the database with the scheme itself
checking the logfile created during scheme rollin...
/tmp/database_setup_psql.sh.20061213-153319.log
removing log - not needed anymore

OK... Now everything is installed, and if you run the following command:

# /sbin/chkconfig --list | grep ogo

You should see the following output:

ogo-zidestore   0:off   1:off   2:on    3:on    4:on    5:on    6:off
ogo-webui       0:off   1:off   2:on    3:on    4:on    5:on    6:off
ogo-xmlrpcd     0:off   1:off   2:on    3:on    4:on    5:on    6:off
ogo-nhsd        0:off   1:off   2:on    3:on    4:on    5:on    6:off

Now, let's fire up these services:


# /sbin/service ogo-zidestore start
# /sbin/service ogo-webui start
# /sbin/service ogo-xmlrpcd start
# /sbin/service ogo-nhsd start

Everything should be up and running now, so you can grab a web browser and go to the following RUL:

http://server.domain.com/OpenGroupware

You will be logged in as the root user, so make sure to change the password.

If you are using this system as a stand-alone server, you are pretty much all set. We needed to authenticate it against our central LDAP, and point it towards our IMAP server though, so I added the following lines to "/var/lib/opengroupware.org/.libFoundation/DefaultsNSGlobalDomain.plist":


LSAuthLDAPServer = "ldapserver.domain.com";
LSAuthLDAPServerRoot = "dc=mydomain,dc=com";
imap_host = "imapserver.domain.com";
UseSkyrixLoginForImap = YES;


Make sure to put these lines at the end of the file, but before the closing braces.

The file should look something like this:

###### SNIP #######
{
"skyrix_id" = "server.domain.com";
LSConnectionDictionary = {
  databaseName = OGo;
  hostName = "127.0.0.1";
  password = "";
  port = 5432;
  userName = OGo;
};
  LSNewsImagesPath = "/var/lib/opengroupware.org/news";
  LSNewsImagesUrl = "/ArticleImages";
  Languages = (
  English
);
  TimeZoneName = GMT;
  WOHttpAllowHost = (
  localhost,
  "127.0.0.1",
  "localhost.localdomain"
);
  LSAuthLDAPServer = "ldapserver.domain.com";
  LSAuthLDAPServerRoot = "dc=domain,dc=com";
  imap_host = "imapserver.domain.com";
  UseSkyrixLoginForImap = YES;
}
###### /SNIP #######

Since the system won't let you authenticate the "root" user against the local database if your are using LDAP, you have to create a root user on your central LDAP.

Create an LDIF file called root.ldif like so:

###### SNIP #######
dn: uid=root,ou=People,dc=mydomain,dc=com
objectClass: organizationalPerson
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
uid: root
uidNumber: 0
gidNumber: 0
sn: Root
cn: Root
homeDirectory: /root
loginShell: /bin/bash
gecos: Root
###### /SNIP #######

Finally, run the following command to add the root user:


ldapadd -x -D "cn=Manager,dc=mydomain,dc=com" -W -f root.ldif"


You should now be authenticating against your central LDAP server. Have fun!

In order to manage the automatic mounting and unmounting of filesystems on RHEL, we use the Automounter service. Here is how.

First, The main configuration file is "/etc/auto.master". It should look something like this:

#
# $Id: auto.master,v 1.3 2003/09/29 08:22:35 raven Exp $
#
# Sample auto.master file
# This is an automounter map and it has the following format
# key [ -mount-options-separated-by-comma ] location
# For details of the format look at autofs(5).
#/misc  /etc/auto.misc --timeout=60
#/misc  /etc/auto.misc
#/net   /etc/auto.net

Let's assume that we want to set up an NFS mount on "/misc/backups". We would first create an entry in this file that looks something like this:

/misc   /etc/auto.misc --timeout=120

This tells the autofs service that we want to use it to manage mounts from within "/misc", that the configuration file is "/etc/auto.misc", and that it should disconnect after 2 minuets of inactivity.

Now, let's edit the "/etc/auto.misc" file. The file has three columns: the mount point from within the /misc directory, the options for mounting the filesystem, and the filesystem to be mounted. It also includes the remote server's name since we are using NFS. It should look something like this when you are done:

#
# $Id: auto.misc,v 1.2 2003/09/29 08:22:35 raven Exp $
#
# This is an automounter map and it has the following format
# key [ -mount-options-separated-by-comma ] location
# Details may be found in the autofs(5) manpage

cd              -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom
backups         -rw,soft,intr remoteservername:/path/to/nfs/export

# the following entries are samples to pique your imagination
#linux          -ro,soft,intr           ftp.example.org:/pub/linux
#boot           -fstype=ext2            :/dev/hda1
#floppy         -fstype=auto            :/dev/fd0
#floppy         -fstype=ext2            :/dev/fd0
#e2floppy       -fstype=ext2            :/dev/fd0
#jaz            -fstype=ext2            :/dev/sdc1
#removable      -fstype=ext2            :/dev/hdd

Next, we create the directory for the mount point in /misc:

# mkdir /misc/backups

And finally we restart the autofs service:

# service autofs restart

That should pretty much do it. If you don't have autofs configured to start up, you can use chkconfig to enable it. "/misc/backups" will now be mounted whenever a user or process attempts to access data on it, and it will be automatically disconnected after 120 seconds of inactivity. Last, but not least, you can always confirm that it is running with the "service" command:

# service autofs status

As always, change the details to match your own requirements.

du -sk * | sort +0nr

This will display the size of all directories and sort them from largest to smallest. If you want to sort them from smallest to largest, simply remove the "r".

du -sk * | sort +0n

If you have nested directories, you will need to incorporate foreach to recurse through and get all the directory names.

There were no permissions issues, which was substantiated by our unhindered ability to do UNIX copies to the same share, and the smb.conf file had not changed. After searching the groups and finding nothing of use, I set up a test environment with all the same versions and settings, and replicated the error.

Because the Samba share is mounted over NFS on the server, and because the Mac Finder creates that annoying place holder file before actually copying the real file, I suspected that the problem had something to do with file locking. With this in mind, I systematically turned off all Samba locks one by one until I found the ones that worked.

Finder Copy Error

IMPORTANT NOTE: The Samba share point in this environment is mounted over NFS on the server. The error did not occur when the Samba share point was on a filesystem local to the server.

Here is what our share looked like before making the changes:

[your-directive]
read only = no
preserve case = yes
short preserve case = yes
csc policy = disable
share modes = no
level2 oplocks = no

Adding either of the two following directives resolved the problem:

locking = no
posix locking = no

Either one would have worked, but we ultimately decided to turn off posix locking because we wanted Samba to continue locking files for Windows connections, but stop locking them over NFS. Below is our share after making the change:

[your-share]
read only = no
preserve case = yes
short preserve case = yes
csc policy = disable
share modes = no
posix locking = no
level2 oplocks = no

The smb.conf man page has the following to say about posix locking:

posix locking
The smbd daemon maintains an database of file locks obtained by SMB clients. The default behavior is to map this internal database to POSIX locks. This means that file locks obtained by SMB clients are consistent with those seen by POSIX compliant applications accessing the files via a non-SMB method (e.g. NFS or local file access). You should never need to disable this parameter.

Default: posix locking = yes

The smb.conf man page has the following to say about locking:

locking
This controls whether or not locking will be performed by the server in response to lock requests from the client.

If locking = no, all lock and unlock requests will appear to succeed and all lock queries will report that the file in question is available for locking.

If locking = yes, real locking will be performed by the server.

This option may be useful for read-only filesystems which may not need locking (such as CDROM drives), although setting this parameter of no is not really recommended even in this case.
Be careful about disabling locking either globally or in a specific service, as lack of locking may result in data corruption. You should never need to set this parameter.

No default

Hopefully this is helpful. If anyone has anything to add, please post a comment.

First, find your way into the directory you want to protect.

% cd /path/to/secure/directory

Next, create a file in this directory called ".htaccess" and insert the following lines:


AuthUserFile /path/to/secure/directory/.htpasswd
AuthGroupFile /dev/null
AuthName "Secure Document"
AuthType Basic

<LIMIT GET PUT POST>
require user username
</LIMIT>


Remember to change "/path/to/secure/directory" to your path, and "username" to the the username you want. You can use any username you wish, and it does not need to exist as a UNIX user.

Now we can create the username and password. The following command does this by creating a file called ".htpasswd" with the username and encrypted password inside.

% /path/to/apache/install/bin/htpasswd -c .htpasswd username

Again, remember to change "username" to the username you have chosen, and enter the password twice when prompted.

Finally, we just have to make sure these two files are readable, and we are all done.

% chmod 755 .htaccess
% chmod 755 .htpasswd

This directory and all subdirectories will now prompt for this username and password whenever they are browsed to.