Recovering a locked down system with broken mobile user

Yesterday I set up a brand new MBA13''. Nice, but I prefer the MBPwRD for the same money. 
As usual I created an local admin account to access the system if anything goes wrong. The user account was an mobile user for obvious reasons. Both users had access to the filevault2. 

I gave the system to the user for data migration, task done.

Today I got it back with the trademark words "It Just Broke, I Did Nothing". First thing I noticed as I switched the thing on, no local admin account. And guest access was activated. Huh?

Logging in with the users password started the system, but dumped me to the normal login screen where only the guest user was visible and the "more..." button for other (normally network) accounts.

Trying to sign in with the "more..." button yielded nothing, so off to start from the recovery partition.

First bump: filevault2 encrypts the whole disk, how do I start the Recovery?
Quick Google: holding cmd-R works, even if the Recovery partition is not listed on the alt boot menue.
I still could enable the filevault2 partition with the old user password.

I tried to reset the password of the user with resetpassword (See blog post in Febuary) but it did not work. Well duh, it's a mobile user, of cause it does not work. The local admin stayed gone.

Well then, of to single user mode! (cmd-s at startup)
First, I fixed the file permissions like this:

> /sbin/fsck/ -fy

A look into the /Users directory showed the local admin account as deleted. Well, someone did something...

Ok, the user account was somehow borked, the local user was gone... what to do?

Easy:

(in single user mode) 

> mount -uw /
> rm /var/db/.AppleSetupDone
> reboot

After the reboot, the fresh installation assistent greets you, wants to register your device, show you how to natural scroll and creates a user with admin rights!

I took a gamble and gave it the same name and credentials als the deleted local admin account, and it worked like a charm.

Ok, after the system was accessible, the thing that caused all this was obvious:

The "Allow network users to log in at login window" login option was deactivated. Well durr, good lock signing in Mr Mobile User. Together with the deleted local admin account this was, well, stupid. 


At least I can now be sure that the local admin stayes on the system, that my colleges got a good laugh and I a blog post out of it. =) 

Kerberos Auth works again!

After trying again to analyse the problem, I've found that only the MCX prefs I've applied to the main group of the users would not get pulled down to the clients. 


Looking for this specific problem, I've found this:
http://lists.apple.com/archives/client-management/2012/Jun/msg00005.html

Durr, now everything is clear.
Just as the post stated, I've created a new group with the AuthWhiteList preference set and ... voila!

Chrome Kerberos auth breaks with MacOS 10.7.4 patch?

I have installed the new 10.7.4 update on my MacBook and promptly the Kerberos Auth of our Trac and FreePBX broke down in Chrome. I have not a clue why this is so, but it seems to affect only Mobile (account) users...

Puh... work, work.

- update -

It's still possible to give Chrome the Whitelist parameter manually:
open /Applications/Google\ Chrome.app --args --auth-server-whitelist="*.example.com"


- update 2 -

I've found the source file with all cmdline switches for chrome/chromium. Took me long enough to find, so I'm documenting it here:

http://src.chromium.org/svn/trunk/src/chrome/common/chrome_switches.cc

Get Chrome to work with Kerberos

A lot of stuff regarding Kerberos is broken on Lion. Some say everything. 

One thing that hit us soon after trying out Lion was that Chrome was not working with Kerberos anymore. We found the problem was with the "AuthServerWhitelist" parameter. 

We could fix it for network users with a change in the OD: 

• Access the opendirectory in the workgroup manager
• choose your main user group
• switching to "manage preferences" in the button bar 
• going to the "Details" tab
• Press +
• choose Google Chrome
• Select "Always"
• click on "New Key"
• Enter "AuthServerWhilelist" and give it the string value "*.<yourdomain.com>".
• Apply, and your done. 

It's more difficult for local users. There you need to access the local directory on the client. 

You can do this in Lion with the building "Open Directory Utility" but it cumbersome. 

I streamlined this by learning a bit of dscl: 

sudo dscl . mcxset /Users/<USER> com.google.Chrome AuthServerWhitelist always '*.<yourdomain.com>'

Replace USER and YOURDOMAIN, enter into terminal. Done.  

Kerberos client config with OD on SL and Lion

I've dived into the murky, two-colored waters of Kerberos on MacOS SL and Lion. Our installation works, but the tickets are issued without the Renewable and Forwardable flags, which complicate usage with Linux. I needed to find a way to config the Kerberos Client on the Macs….

After a lot of searching, I've found that Snow Leopard clients with network users read an Open Directory config entry and uses it as its krb5.conf

This entry is (seen from the OD host (SL Server)): 

/LDAPv3/127.0.0.1/Config/KerberosClient/XMLPlist

You can edit this list with the Inspector tab in your Workgroup Manager (again SL). The entry is formatted as an XML file, but you'll see the similarities to a normal krb5.conf right away. 

Don't forget to increment the GenerationID at the end of the XML to apply changes on your clients. The entries should be applied on the next login but you can enforce the sync by using the tool "kerberosautoconfig".  Add the parameter "-v 4" to it to get some feedback: 

$> sudo kerberosautoconfig -v 4 

Alternatively, you can copy a regular krb5.conf file to the file /Library/Preferences/edu.mit.Kerberos.

Lion Clients ignore the entry in the OD. They hilariously still accept the edu.mit.Kerberos file, even though Lion uses Heimdal Kerberos instead of the MIT flavor. Lion is missing the "kerberosautoconfig" tool as well, but the SL version still runs on Lion. Get the file from somewhere and copy it to "/sbin/".

You can generate a local "/Library/Preferences/edu.mit.Kerberos" file by running: 

$> sudo kerberosautoconfig -f /LDAPv3/<yourODhost>  -v 4

The configuration does not refresh by itself, so you need to run this again if something changed. 

I still have a lot to learn about Kerberos on Mac, I'll keep you posted. 

Referencing files via VolumeID and InodeID

I found a strange way to adress files in MacOS: Direct referencing via VolumeID and InodeID.

MacOS has a special folder for that: "/.vol"

If you list all files in there it seems empty...
But if you try this for example:

cat /.vol/234881026/4321840

you will get the file referenced by the volume (first part) and the inode (second part).

An example:

>:/$ stat /etc/hosts
234881026 4321840 -rw-r--r-- 1 root wheel 0 236 "Feb 22 12:04:33 2012" "Feb  2 21:25:28 2012" "Feb  2 21:25:28 2012" "Feb  2 21:25:28 2012" 4096 8 0 /etc/hosts


>:/$ cat /.vol/234881026/4321840
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1 localhost 



Groovy! =)

Create a bootable Lion USB Stick

To install Lion on a new HDD or SSD you need some kind of installation medium (at least on older Macs). Here is an easy way to create a bootable Lion USB Stick from your "Install Mac OS X Lion" App. You'll need an empty 8 GB USB Stick. 

0. Redownload the "Install Mac OS X Lion" Program from the App Store: 

"(While holding down the OPTION key, click on the “Purchases” section

You should see “OS X Lion” and “Install” should now be gray and you can click that to re-download Lion (you may have to re-authenticate within the App Store with your Apple ID)."

(Thanks asorta from MacRumors)

1. Locate the "Install Mac OS X Lion" program in your application folder with the Finder. 

2. Right click on it, and choose "Show Package Contents".

3. Navigate to "Contents/SharedSupport/InstallESD.dmg". This is the install disk.

4. Start "Disk Utility" 

5. Click on your USB Stick (the device not the partition) and click on the "Partition" tab 

6. Click on "Current" and choose "1 Partition". Choose "Mac OS Extended (Journaled)" as Format.

7. Press Apply. Now, choose the "Restore" Tab. 

8. Drag your "InstallESD.dmg" disk image from the Finder into the left side of the Disk Utility. 

9. In the Restore Tab, choose the InstallESD.dmg Image as Source, and your USB Stick as Destination. 

10. After 30 Minutes (depends on the Stick), you are done. You can test it now by booting from your stick. Hold "alt" at startup to go into the boot device selection...

This stick is good fixing a broken installation, for installing Lion from it, reseting passwords or change the partition layout of your disks. Have fun!