It's not Buffy, but it's close enough

OSX and I continued our unfriendly relationship today.

Did you know that if you had two OSX machines who each have the same hostname (internally to themselves) but different IP addresses, they'll figure it out and one will add a "2" to its name?  You might have noticed this if you've replaced one of your machines before.

Did you know that the only good way to tell the "2" machine to assume its real name is to use the scutil command?

Did you know that this won't fix any mailing list information you might have imported (which also got changed to "2" once the machine realized it had a twin), and you'll need to use the mailman "withlist" command to fix the hostname?  Like so:

/usr/share/mailman/bin/withlist -l -r fix_url my-mailing-list -u my.hostname.com

I didn't.  At least not that last little part.

For those of you whose eyes haven't already glazed over, I did think about things other than OSX today.  I had my second reassessment at PT today.  I'm doing well front and back, but when I lean from side to side I shake.  Apparently.  More strengthening needs to be done.  They're getting me permission to have more appointments.  I'd guess at least another month.  I haven't asked yet about maintenance - do I keep doing the same exercises I do there?  Do I try to increase intensity?  I dunno.  I should ask about these things.  However, I'm pretty sure I shouldn't work on my cobra pose immediately before doing the PT exercises.  That's what happened in the last 24 hours, and my back is going "yow!"

A coworker lent me a book today.  It's entitled "Carpe Demon (Adventures of a Demon-Hunting Soccer Mom)".  Charlaine Harris described it thusly:  "Shows you what would happen if Buffy got married and kept her past a secret."  My coworker immediately thought of me when he found it, what with my unmedicated obsession for all things Buffy.  I'm seventy pages in and it's pretty butt-kicking so far.  I'll have to give it back to him after I'm done.  He actually gave it to me to read first.  Wow.  Just goes to show that people can be much, much more considerate than me.  I'd have read that sucker first.

I want an operating system divorce

Life is kicking my butt a little bit.  I feel too busy.  Need some downtime.  A boring evening, perhaps.  Maybe even a boring weekend.  I'm thinking mid-March.

I spent my whole day wrestling with OSX.  I am so over that operating system.  Someday, if we sit down with some beer, I will tell you why, in great detail.  But for right now let's just say that it is not sys-admin friendly.  It's not server friendly.  It pretty much wants to eat your dogs and babies.  It's fine for the desktop, but trying to use it as a real server is just asking for trouble.

While I was still at work cursing at OSX and saying "Are you kidding me?"  (I feel the same way about OSX server that I do about trail layout in Maine) poor JD was home feeling sick.  I'm pretty sure he caught the cooties I brought home from Tennessee.  Poor guy.  He was already in bed when I got home from yoga tonight.  With luck I won't wake him up when I creep on up to bed.

Okay, Wednesday.  You're done.  Two more days, and then it's hiking time.  And dim sum time.  And then hiking time again.

Completely nerdy. Migrating OSX users, and weird login issues.

Well, with a clue from Sweth (to whom I now owe Vampire Wine) I finally came up with a workaround for my OSX problem.  It was weirder than I thought, and I still don't know all the ins and outs.

FWIW, for that one other OSX sysadmin out there:  IF  you have set up a global password policy to expire an account due to inactivity, and IF you have X11 forwarding enabled for the ssh server, a newly created user's account will be disabled the first time they attempt to ssh in.  If they ssh in before the inactivity password policy is applied, no problem.  If you or they disable X11 forwarding (ssh -x disables it on the user end), no problem.  A .Xauthority file in their account solves the problem.  My workaround was to put an empty .Xauthority file in the skeleton directory, which on osx is in /System/Library/User\ Template.  That way new accounts are created with an .Xauthority file and everyone is happy.

You're welcome, that one other guy in the world who has X11 forwarding enabled and is using the inactivity setting.

Also?  I think I have finally figured out how to migrate accounts between OSX servers.  It isn't super straightforward, and it isn't in the docs.  Part of it is, sort of.  You use dsexport to export the user information from directory services.  Like this:

dsexport export.out  /Local/Default dsRecTypeStandard:Users

In my case I then manually edited out of export.out any users I didn't want getting copied over.

On the new machine,  use dsimport:

dsimport export.out /Local/Default I

The I says "ignore the record if there is a conflicting name, UID, or GID".  There are other options.

Okay, so that imports the users.  The next part is the key.  The passwords are stored in /var/db/shadow/hash.  Copy the hash files for the users you have imported.  You'll need to know their generated UID, which you can get by reading their plist file (in /var/db/dslocal/Default/nodes/users/) or by using the Inspector in WorkgroupManager (turned on in WM preferences).  The hash files for each user are listed by the generated UID.

So, in theory, you just copy over the hash files (and associated state files) for the users and Bob's your uncle.  I only found this out when it was time to leave today so I won't know for sure until the morning.

Of course, you also need to copy over the normal stuff, like their home directories, and their mail if you're running a mail server.  In /var/spool/imap/dovecot/mail, if you were wondering.

BTW, if you already knew all this?  Why didn't you tell me BEFORE?

Oh well, I guess it was sort of fun figuring it out.