MacOS X on Michael’s Domain

BackupPC and Macs

Wed, 13 Apr 2016 00:00:00 +0000

I myself have been using the backup software BackupPC for almost a decade, and I started to backup our lab computers to a central backup server about two years ago. BackupPC supports deduplication and therefore much data can be stored on a couple of 2 TB drives.BackupPC supports many protocols (smb, ftp, tar/rsync via ssh), but we mostly use rsync via ssh. The data is not encrypted before the backup. Strangely not even the upcoming version 4 will support pre-egression encryption. However, we store the backup on an encrypted volume. That way it is at least protected if the backup server is stolen. And during transit, the data is protected by ssh. However, the system is not TNO (“trust no-one”), since I (as the backupc administrator) can access the files. When using Linux, one feasible method would be to encrypt the user’s home directory using eCryptFS (which is an inbuilt option when creating users on Ubuntu ) and then backup the /home/.ecryptfs directory instead of the users home directory. However, recovery would be much more of a problem. You would be able to browse the diectory structure and files of the backup, but the filenames would be meaningless since they are also encrypted in the process.There is one peculiarity in backing up Mac OSX machines: BackupPC normally connects as root via ssh into the client computer and executes the rsync backup command. In order to make this possible on university-managed Mac OSX computers, we had to create a dedicated user (“backuppc”) on the client machines and allow for this user the execution of rsync with root privileges, which is done by adding this line in the /etc/sudoers file:backuppc ALL=NOPASSWD: /usr/bin/rsync. Then we have to change the ssh/rsync command for the Mac client on the backuppc server changing “root” into “backuppc”.

Stuff the Maverick upgrade broke

Tue, 24 Jun 2014 00:00:00 +0000

My 1.5 year old MacbookPro was starting to behave badly including failure to complete booting and other niceties. The computer support guy suggested to upgrade from Mountain Lion to Maverick to see whether it would fix things.Initially that seemed to work; however, many programs refuse to run under Maverick. This includes: Gnumeric and (importantly) nfs. It appears that mounting nfs via the finder is not anymore possible. However, I still am able to do it via the command line (using the resvport option, which should not be necessary, but which nevertheless does the trick):sudo mount -o resvport -t nfs mcblserver:/var/www /Users/mjeltsch/nfs And talking about Gnumeric: I guess I need to compile it newly for Maverick myself…

Reset MacOSX user passwords

Sun, 28 Apr 2013 00:00:00 +0000

Boot up with command key and S key pressed (Single user mode)
fsck -fy
mount -uw /
password username

x11vnc as a nxserver replacement

Thu, 29 Nov 2012 00:00:00 +0000

Now that nomachine ’s great nxclient is defunct on MacOS X and its new nxplayer is still in beta (and completely nonfunctional on my setup), I needed another solution to connect to my work desktop from home. I tried many things, but then settled for x11vnc . My work desktop is running Ubuntu Precise Pangolin (12.04) and I connect from a MacOS X 10.8 (Mountain Lion). I only had to install x11vnc and openssh-server on my work desktop and add an x11vnc.conf file to /etc/init with the following content:x11vnc -forever -rfbauth /etc/x11vnc.pass -bg -o /var/log/x11vnc.log -scale 1280x800 -display :0 -auth /var/run/lightdm/root/:0I have to create the password file:x11vnc -storepasswd password /etc/x11vnc.passThen I just have to get into my work desktop by some means or another. At the moment I jump there via the UNIX computers of the university, because direct ssh access is not possible because of a firewall. So I ssh into the UNIX mainframe and from there I ssh into my work computer. Once I am in, I establish a reverse ssh tunnel to my Macbook Pro at home:ssh -R 19999:localhost:5900 IP_address_of_homecomputerOn my Macbook at home I had to enable Sharing - Remote login first. Then I just use the inbuilt Screen sharing of the OS “Connect to server” and then I type “vnc://localhost:19999” and voila I can see my work desktop’s login screen.Alternatively I could use my openvpn server that I have installed on my Macbook and use an openvpn client on my work desktop to establish a connection to my Macbook. Then I could directly log in and avoid the hops via the university UNIX machines to set up the reverse ssh tunnel.Another, although very slow method to access the GUI of my work desktop is X11 forwarding via ssh. All I need is a working ssh connection to the server, X11 forwarding enabled in the ssh server configuration file and an X11 server on the local machine (e.g. XQuarz on MacOSX):ssh -X username@remote-server.comxclock &

BackupPC (and MacOS X)

Fri, 25 May 2007 00:00:00 +0000

BackupPC seems to be a cool application. Except for the fact that it is not easy to start working with in the first place. I downloaded BackupPC-2.0.0.tar.gz and installed it into the directory /usr/local/backuppc. Then I executed the config.pl and answered all I could. The place where I want to backup my stuff is my second hard drive /dev/hdb5 which is formatted as reiserfs and mounted at /mnt/hdb. After the config script there was a new directory in /mnt/hdb: backuppc, which contained 6 other directories: conf, cpool, log, pc, pool and trash.BTW you cannot use a smbmount to store the backup data (at least not easily). The configure.pl script tries to chown the stuff on the smbmount and this leads to the abortion of the perl script (could be modified and the chown could be done manually by defining the correct uid and gid in the fstab). I struggled with this for a day (gave the smbmount even fmask=777,dmask=777 and the correct owner/group), but to no avail as apparently the scripts wants to execute the chown command. I probably need to solve this problem as I need to backup via the network to a Macintosh running OS X and thus need to use samba (or nfs…).I use tar over ssh to backup my client (actually server and one of the clients are in my case physically the same machine). Anyway I have to setup ssh. As I have RH9, it’s OpenSSH (ssh2).Another client is running MacOS X (10.3). Works quite well after I figured out that the tar command on MacOS X is neither in the PATH nor in its normal location, but in /usr/bin/tar. I just made a link and BackupPC worked:sudo ln -s /usr/bin/tar /bin/tar

Apache on Mac OS X

Wed, 23 May 2007 00:00:00 +0000

I still use one of our ancient Macintoshs (Blue/White G3) as a web server ( msbl.helsinki.fi ). I had set up some access restrictions for some of the pages containing confidential data. And of course I forgot how I did it. Now I needed to figure out as I wanted to add some new stuff. For the general server, the accession is restricted based on individual .htaccess files in directories. In my own user directory ( msbl.helsinki.fi/~michael ) only one folder is access restricted ( msbl.helsinki.fi/~michael/presentations/confidential ). This setting is done in the main configuration file of Apache (/etc/httpd/httpd.conf) and only two users (michael and mcbl) have access via the following entry: AuthType Basic AuthName "Confidental" AuthUserFile /Users/michael/.htpasswd require user michael mcbl

Creating groups and changing group membership in Mac OS X

Wed, 23 May 2007 00:00:00 +0000

I want to store some files on a Macintosh (OS 10.2). They should be in the Public folder, but only accessible (= only readable) by certain people. Thus I would like to create a new group that has accession rights to these files. Strangely, the group command doesn’t exist on MacOS X (chgrp does exist though). I downloaded the User Manager application. But the version for OS 10.2 was not really easy to use. Thus I used the NetInfo Manager. I duplicated an existing group, changed its name to “gck” and id number and added two users (if you have more than one entry, you have to add them in brackets and comma-seperated). Then I created a directory in my Public folder and changed its group to “gck”. Permissions for this directory are drwxr-x—. The files inside this directory also belong all to the “gck” group and have -rwxr—– permissions.

Making the Staden applications clickable in MacOS X

Thu, 05 Apr 2007 00:00:00 +0000

I have installed Staden on MacOS X and have been playing around with it. I used the ebiotools package created by Anders Nisters described in issue 10/1 of the embnet.news for the installation. It works, although not according to the Mac philosophy:

Staden on MacOS X (ebiotools)

Thu, 05 Apr 2007 00:00:00 +0000

Today I installed the Staden Package on Tanja’s Macintosh G4 computer (MacOS 10.3). I recommend using the ebiotools package made by Anders Nister. It includes other useful software such as EMBOSS, Blast, etc.). Installation instructions are available in the embnet news issues 9/1, 9/2, 9/3 and 10/1 or gathered into one pdf file from here .

winmail.dat (TNEF) attachments and non-Windows operating systems

Wed, 04 Apr 2007 00:00:00 +0000

My sister has sent me again an attachment which was encoded in the winmail.dat attachment. Sucks big time. Not only Linux users get pissed but also Macintosh users. Of course you can open it as long as you know how. On Mac OS X you need TNEF’s Enough and on Linux you need tnef . Suse Linux 9.2 has an rpm that works well with KMail. Just click the winmail.dat and select “Open with tnef”. You will get the list of attachments that are hidden in the winmail.dat attachment and you can open and/or save them from there.

Changing userid on Mac OSX

Tue, 06 Mar 2007 00:00:00 +0000

Change the userid in NetInfoManager from another administrative account (ex. 502->1000).2. Change the file permissions:sudo find / -xdev -user 502 -print -exec chown 1000 {} \;

Importing email from Kontact to Apple's Mail App

Tue, 06 Mar 2007 00:00:00 +0000

If you store your email in Kontact as mbox files just straightforwardly import them into Apple’s Mail application. 2. If you store your email as mailbox folders, the procedure is a bit more complicated. - in each mail folder to be imported run the script converting mailbox into mbox (the script doesn’t support nested folders so one has to run it for each folder separately, spaces are not allowed for the script to work) - import mbox into Mail TBC…

Installing Gramps on MacOSX

Tue, 06 Mar 2007 00:00:00 +0000

This should work, at least in theory:

Install xserver
Run darwinports installer
Update the darwinports sudo port -d selfupdate
Install gramps in xterm running sudo port install gramps
Install gnome-themes sudo port install gnome-themes
Run gramps in xterm

A permanent static route for Macintosh OS X (10.4.7)

Sun, 10 Sep 2006 00:00:00 +0000

I have set up OpenVPN on our pribvate network, but our special setup requires manually adding a static entry to the routing table of computers that we want to access from the outside via our VPN server. In SuSE Linux this is a nobrainer as Yast provides a section where to add static routing information. On MacOS X the command line works, but upon reboot the route is lost:route add 10.8.0.0/24 192.168.0.2Check what the route is for a specific IP:route get 10.8.0.1The same command has a different syntax on Linux though:route add -net 10.8.0.0 netmask 255.255.255.0 gw 192.168.0.2In order to preserve the routing information over a reboot I created the folder AddRoutes in /Library/StartupItems. Inside this folder there have to be two files: AddRoutes and StartupParameters.plist . The content of these files is the following:AddRoutes:#!/bin/sh# Set up static routing tables. /etc/rc.commonStartService (){ ConsoleMessage "Adding Static Routing Tables" route add -net 10.8.0.0/24 192.168.0.2}StopService (){ return 0}RestartService (){ return 0}RunService "$1"StartupParameters.plist:{ Description = "Add static routing tables"; Provides = ("AddRoutes"); Requires = ("Network"); OrderPreference = "None";}These files need to be readable and executable by everybody for MacOS X 10.4.7. However, MacOSX might wipe these files with each system upgrade (at least from Mountain Lion to Mavericks my settings disappeared completely). After recreating them, I got the error message “Insecure Startup Item disabled” at boot and I needed to give the directory and the files the following permissions to make the error to disappear:drwxr-xr-x 4 root wheel 136 Aug 6 22:44 AddRoutes``-rwxr-xr-x 1 root wheel 238 Aug 6 22:43 AddRoutes-rwxr-xr-x 1 root wheel 123 Aug 6 22:44 StartupParameters.plistHowever, the route does not get added in Mavericks by this procedure and I could not find any information how to do this.The original information is from the following website: http://macosx.com/forums/showthread.php?t=267209 .

How to enable VPN clients to access LAN computers that are not running VPN software

Tue, 08 Aug 2006 00:00:00 +0000

I installed an OpenVPN service on our server. The default setup worked right out of the box. However, I wanted to use a VPN client to perform offsite backups of the computers in our LAN (using the backuppc software). First I installed OpenVPN clients on all of the LAN computers to be backed up, but OpenVPN on MacOS X seems to be a bit unreliable. Therefore I wanted to setup the VPN server to forward requests to our LAN network. The following changes were necessary: