HCS Blog

It is not uncommon for Mac users to login with local user accounts, even in a directory environment.  The question becomes, how do we enforce password policies on those local accounts?  There are many schools of thought on this but here is how I did it recently with the combination of a configuration payload and a simple script.

As a technician, you will most certainly find yourself working with multiple networks and configurations.  If you use the line of Ubiquiti Unifi products, it includes the Unifi app which you can launch and use a web based controller.  The problem is that after you run through the setup assistant once, you are not prompted again if you set up a new Unifi network in the future.  So here is the workaround rather than doing an uninstall/re-install of the product:

In a recent security update (December 14, 2015), Apple implemented a security measure that disallows the ability to remotely click Keychain Access windows (synthetic clicks).  For instance, if you are remotely assisting a customer with retrieving a password, upon opening a Keychain Access entry, you wil not be able to click Allow or Always Allow in order to reveal a resource password.  The user will have to click locally.  This can also be especially troublesome if working remotely on a headless server as there may be no local user to assist.

An interesting new feature of Caching Server 5 is the ability to cache personal iCloud data.  There could be a variety of reasons why this may not be desirable in some environments, one of which could be concerns over storage capacity on the caching server.  Here is how to disable that feature using the serveradmin command in Terminal:

sudo serveradmin settings caching:AllowPersonalCaching = no

Change that boolean field to yes to re-enable this feature.

Since the changes to SMB in recent versions of OS X Server, many printers that use the "scan to folder" destination, have ceased to function.  So FTP was a good alternative.  This just serves as a quick reference to make that happen properly.  If you go to the web administration page or on screen display of a Ricoh, Savin, or similar multifunction, it will ask for an FTP Server Name and Path.  For the server name, enter the IP address or FQDN of the server - do not put any slashes in the name.  For the path, leave it completely blank if you want it to go to the root of the FTP folder.  It is tempting to put the name of the FTP share point but this will not work.  If you wish to scan to a subfolder on the FTP share, enter the path like this /subfolder.  Again, do not enter the name of the FTP root folder.  Only place a slash and the name of the sub folder.

Rumpus is a great FTP product that has a web interface as well.  The issue with installing Rumpus on OS X Server is that the default web ports are used by the server itself.

So if you are not planning on using web services or, more importantly, Profile Manager.  You can follow the steps in Maxum Development's blog post to disable the built-in apache service in OS X Server.  You can then enable Rumpus on port 80 or 443.