Profile Manager HTTP Proxy
Hi there
Can someone please tell how to configure a HTTP proxy using Profile Manager to the schools OS X 10.9 iMacs. This would be for Ethernet, not WIFI which I know you can setup/push. There is not any settings in profile manager. I can only see custom settings, which I have no idea how to do.
Many thanks in advanced!
You may find this discussion helpful:
ML Server: How do i push my school proxy settings to our ML clients?
i.e. <https://discussions.apple.com/thread/4715399>
Similar Messages
-
Where can I find the profile Manager
I am trying to import my profile to a new computer and I understand I can do that by creating a new profile and copying my files into it.
Trouble is - I don't know how to do that !
regardsSee Profile Manager:
*http://kb.mozillazine.org/Profile_Manager
*https://support.mozilla.com/kb/Managing+profiles -
Profile manager wildcard options
Is it possible to use wildcards for such things as usernames in the profile manager for VPN? I'd like to preconfigure VPN for all Macbooks without having to setup a profile for each user. The username field is a required field so leaving it blank isn't an option.
I haven't tried this for a VPN profile but have done variables with an Exchange email profile. The user logs into the My Devices web portal with credentials that are then used for the installation of the profile substituting their real information for the variable. See these articles:
http://krypted.com/iphone/using-payload-variables-in-profile-manager/
http://help.apple.com/profilemanager/mac/10.7/#apd073333AA-30C6-4FD2-B2E0-E0C956 58A2C4 -
Access Mac Mini Server (profile management) through reverse proxy
Hi,
Newbie in Mac's world and yet trying to make it more complicated as it is.
As we recently (last month) decided to equip our sales force with iPads, they were configured through Apple Configurator tool running on a dedicated Mac Mini Mountain Lion.
Now, I'd be keen in moving this configuration to the Profile Manager, part of the OSx Server plugin. So far so good.
Problem is the following : another web server is already on the LAN using both 80 and 443 ports. So all incoming traffic on those ports was routed to this other server. As Mac Mini Server default http/s ports may not be altered, I installed a reverse proxy server (Oracle VM - Ubuntu 12.04LTS - pound), configured to deal differently traffic on those ports according to the domain name (host) of the web request (header). Each 'local' server has been allocated a domain name. Just to be clear, traffic is now routed by the WAN/LAN router, for those ports, towards the reverse proxy, configured to reroute the traffic to the correct destination.
So far so good, it works like a charm, except... as soon as we enter https protocol on Mac Mini Server Profile Manager.
Access from an iDevice to the Mac Mini Server Profile Manager login page is fine, but as soon as password is confirmed, safari is pending and finally a message 'An internal serer error occured. Please try later again' appears.
Looking to both reverse proxy system log and Mac Mini profilemanager.log files to trace the problem, the following lines are produced at this particular moment :
reverse proxy system.log
Jan 15 14:44:03 reverseproxy pound: 91.... GET /devicemanagement/console/apple_theme_v2/en/da56af0a69e733b259dac3991419fa928b4 94a56/resources/images/sprites/me_controls.png HTTP/1.1 - HTTP/1.1 200 OK
Jan 15 14:44:03 reverseproxy pound: 91.... GET /auth?redirect=http://osxsrv.fiks.net/devicemanagement/api/authentication/callback HTTP/1.1 - HTTP/1.1 302 Moved Temporarily
Jan 15 14:44:04 reverseproxy pound: 91.... GET /devicemanagement/api/authentication/callback?auth_token=336952DE-BDDE-4390-82F 7-8475B79FB2D3 HTTP/1.1 - HTTP/1.1 302 Moved Temporarily
Jan 15 14:44:04 reverseproxy pound: (b7680b40) e500 can't read header
Jan 15 14:44:04 reverseproxy pound: (b7680b40) e500 response error read from 192.168....:443/GET /profilemanager/ HTTP/1.1: Success (0.007 secs)
Jan 15 14:44:08 reverseproxy pound: 91.... POST /devicemanagement/api/magic/get_updated HTTP/1.1 - HTTP/1.1 200 OK
OSx Server profilemanager.log
Jan 15 14:44:05 osxsrv ProfileManager[1748] <Info>: Processing MagicController#do_magic (for 91.... at 2013-01-15 14:44:05) [POST]Jan 15 14:44:05 osxsrv ProfileManager[1749] <Info>: Processing MagicController#do_magic (for 91.... at 2013-01-15 14:44:05) [POST]
Jan 15 14:44:06 osxsrv ProfileManager[1748] <Info>: Completed in 492ms (View: 0, DB: 6) | 200 OK [http://osxsrv.../magic/do_magic]
Jan 15 14:44:06 osxsrv ProfileManager[1749] <Info>: Completed in 687ms (View: 0, DB: 5) | 200 OK [http://osxsrv..../magic/do_magic]
Jan 15 14:44:07 osxsrv ProfileManager[1750] <Info>: auth_token doesn't exist
Jan 15 14:44:07 osxsrv ProfileManager[1750] <Info>: Filter chain halted as [:verify_auth_token] rendered_or_redirected.
Jan 15 14:44:07 osxsrv ProfileManager[1751] <Info>: Processing MagicController#do_magic (for 91.... at 2013-01-15 14:44:07) [POST]
Jan 15 14:44:07 osxsrv ProfileManager[1751] <Info>: auth_token doesn't exist
Jan 15 14:44:07 osxsrv ProfileManager[1751] <Info>: Filter chain halted as [:verify_auth_token] rendered_or_redirected.
Jan 15 14:44:07 osxsrv ProfileManager[1751] <Info>: Completed in 4ms (View: 1, DB: 14) | 403 Forbidden [http://osxsrv..../magic/do_magic]
Jan 15 14:44:07 osxsrv ProfileManager[1748] <Info>: Processing MagicController#do_magic (for 91.... at 2013-01-15 14:44:07) [POST]
Jan 15 14:44:07 osxsrv ProfileManager[1748] <Info>: auth_token doesn't exist
Jan 15 14:44:07 osxsrv ProfileManager[1748] <Info>: Filter chain halted as [:verify_auth_token] rendered_or_redirected.
Jan 15 14:44:07 osxsrv ProfileManager[1748] <Info>: Completed in 45ms (View: 1, DB: 43) | 403 Forbidden [http://osxsrv..../magic/do_magic]
Jan 15 14:44:07 osxsrv ProfileManager[1750] <Info>: Processing MagicController#do_magic (for 91.... at 2013-01-15 14:44:07) [POST]
Jan 15 14:44:07 osxsrv ProfileManager[1750] <Info>: auth_token doesn't exist
Jan 15 14:44:07 osxsrv ProfileManager[1750] <Info>: Filter chain halted as [:verify_auth_token] rendered_or_redirected.
Jan 15 14:44:07 osxsrv ProfileManager[1750] <Info>: Completed in 55ms (View: 0, DB: 1) | 403 Forbidden [http://osxsrv..../magic/do_magic]
Jan 15 14:44:08 osxsrv ProfileManager[1749] <Info>: Processing AuthenticationController#callback (for 91.... at 2013-01-15 14:44:08) [GET]
Jan 15 14:44:08 osxsrv ProfileManager[1749] <Info>: Redirected to https://osxsrv..../profilemanager/
Jan 15 14:44:08 osxsrv ProfileManager[1749] <Info>: Completed in 149ms (DB: 5) | 302 Found [http://osxsrv..../authentication/callback?auth_token=[FILTERED]]
I guess the '302 Found' is causing or explaining the problem.
I agree this might not be a Mac issue, so I still knock your doors hoping some of you could at least give a hint for what to search for !
If the pound configuration file is of interest, just ask, but this is pretty trivial, saying basically listen these protocols (http/https) on these ports (80/443) and according to Header content (check destination host) and reroute packet to LAN device (with given LAN IP address).
As the default port(s) of the Mac Mini Web Services may not be altered (so far I know), I guess I am stuck using 80 and 443 anyway.
Maybe should I invest time in changing my other apache server ports to some more exotic 8080 or 88 or whatever so Mac Mini Server Profile Manager default ports 80 and 443 are maintained and can be easily and directly rerouted to my Mac server without any reverse proxy along the way.
Thanks in advance for your help
AlxHI All,
i'm also using reverse proxy technique to publish my server to the internet. The ip is used by twice domains. The problem is by using the profile manager
after login it redirects the url to the Local Area network addresse instead to the domain.
How to configure this on OS X Server and the Profile Manager Service?
Kind Regards
Oemer -
How Setting up global http proxy with profile in iphone(file.mobileconfig)
how Setting up global http proxy with profile in iphone(file.mobileconfig)
how Setting up global http proxy with profile in iphone(file.mobileconfig)
-
I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root: myname
admin: myname
sysadmin: myname
certadmin: myname
webmaster: myname
my_alternate: myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080 # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost # Default is localhost
REMOTEPORT_DEFAULT=3128 # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
-p) shift; # -p option
SSHPORT=$1;
shift;;
*) TUNNEL_DETAILS=$1; # 1st argument option
shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])} # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*} # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%@} # delete @
if [ "$CAR" != "" ] # leading or trailing port specified
then
USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ] # no hostname given
then
HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
&& echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
|| echo "SSH tunnel FAIL." -
Profile Manager Broken after Migration to OS X Server 10.8
After migrating from Lion Server to OS X Server 10.8, Profile Manager will not start. Server.app -> Profile Manager reports "Error Reading Settings". Apache Error log reports:
[Thu Aug 30 13:32:29 2012] [error] (61)Connection refused: proxy: HTTP: attempt to connect to 127.0.0.1:3329 (127.0.0.1) failed
[Thu Aug 30 13:32:29 2012] [error] ap_proxy_connect_backend disabling worker for (127.0.0.1)
I tried shutting down all web services (Profile Manager, Wiki, Web), ran "serveradmin command web:command=restoreFactorySettings", then turned back on Web and Profile Manger... same problem.
Any ideas what, exactly, is wrong and how to fix it?this might not be true in your case but when I've seen "error reading setting"it has been a permission problem on the Library/Server/profilemanager folder (or other service)
Profile manager should have owner _devicemgr RW, group _devicemgr R, everyone R
same for the Data folder inside.
Might be forth checking -
Enrolled devices don't show up in profile manager
Hi,
I am trying to setup profile manager up so I can manage 100+ iPads. Have never touched a mac server before this
I have successfully got it running with a self signed cert, I can open https://servername/mydevices on the iPads. Install the trust cert then enrol the device.
The iPad successfully installs the remote management profile.
After this no devices show up in the profile manager or on the mydevices site.
To be able to view the mydevices page I had to set up a VPN connection on the mac server and connect to the VPN on the iPads, although I am not sure why as the mac server is on the same network as the iPads.
This is being used in a school and we can't change the router settings or make the mac server have a public address. Is this a problem?
Hopefully I have simply missed a step in the process.
Any ideas?This is what the system log reports after I try enrol an iPad. Replaced the actual ip address with INTERNALIP
Jun 4 08:40:53 mini sandboxd[760] ([778]): applepushservice(778) deny network-outbound INTERNALIP:8080
Jun 4 08:40:53 mini sandboxd[760] ([778]): applepushservice(778) deny network-outbound INTERNALIP:8080
Jun 4 08:40:53 mini applepushserviced[778]: Got connection error Error Domain=NSPOSIXErrorDomain Code=1 "The operation couldn\u2019t be completed. Operation not permitted" UserInfo=0x7fa483b1a340 {NSErrorFailingURLStringKey=https://albert.apple.com/WebObjects/ALUnbrick.woa/wa/deviceActivation?device=Mac OS, NSErrorFailingURLKey=https://albert.apple.com/WebObjects/ALUnbrick.woa/wa/deviceActivation?device=Mac OS}
Jun 4 08:40:53 mini applepushserviced[778]: Failed to get client cert on attempt 2, will retry in 15 seconds
The server is pehind a proxy, but the address reported in the first two lines is an internal ip that I can ping from the lion server. -
Where do Apps uploaded via Profile Manager go?
I've just up updated around 30+ apps and I've had to manually add them via profile manager one by one!
I was just wondering if anyone knew the location where the apps are stored on the server as I thought I could perhaps just drag and drop all of the updated ipas at once.There are several tools which allow selecting network profile settings with respect to sites i.e. available network environment data:
ControlPlane - <http://www.controlplaneapp.com/>
Little Snitch - <http://www.obdev.at/products/littlesnitch/>
and maybe some more.
Additionally, you may find this discussion helpful:
ML Server: How do i push my school proxy settings to our ML clients?
i.e. <https://discussions.apple.com/thread/4715399> -
Profile Manager backend won't start
I'm having trouble starting Profile Manager on one of my servers. Near as I can tell, the Profile Manager is trying to reverse proxy through to a webapp called "devicemgr". This starts up four backend daemons running on TCP 3320, 3321, 3322 and 3323, as shown in this log.
Jul 24 00:38:18 loki com.apple.devicemanager[4234]: DEBUG: Initializing DeviceManagerDaemon with ports 3320,3321,3322,3323 (physmem = 4GB)
Jul 24 00:38:18 loki com.apple.devicemanager[4234]: DEBUG: Making sure Rails is configured properly
Jul 24 00:38:18 loki com.apple.devicemanager[4234]: DEBUG: Running rake command: /usr/bin/rake db:migrate
However the four backend daemons don't actually start. They try to start, but then fail, and try again, ad infinitum.
bash-3.2# ps ax | grep devicemgr | grep ruby
4234 ?? Ss 0:00.03 /usr/bin/ruby /usr/share/devicemgr/backend/devicemgrd
4348 ?? R 0:01.74 /usr/bin/ruby /usr/share/devicemgr/webserver/thin --chdir /usr/share/devicemgr/backend --rackup config.ru --address localhost --port 3321 --debug start
4350 ?? R 0:01.71 /usr/bin/ruby /usr/share/devicemgr/webserver/thin --chdir /usr/share/devicemgr/backend --rackup config.ru --address localhost --port 3320 --debug start
4352 ?? R 0:01.56 /usr/bin/ruby /usr/share/devicemgr/webserver/thin --chdir /usr/share/devicemgr/backend --rackup config.ru --address localhost --port 3323 --debug start
4354 ?? R 0:01.39 /usr/bin/ruby /usr/share/devicemgr/webserver/thin --chdir /usr/share/devicemgr/backend --rackup config.ru --address localhost --port 3322 --debug start
If I wait a few seconds then in the process listing the PIDs will all have changed; i.e. the backends are bombing out on startup.
The end result is the Profile Manager doesn't work. I see messages in apache's error_log, trying to connect to the failed backend daemons.
[Sun Jul 24 00:27:09 2011] [error] ap_proxy_connect_backend disabling worker for (127.0.0.1)
[Sun Jul 24 00:27:09 2011] [error] (61)Connection refused: proxy: HTTP: attempt to connect to 127.0.0.1:3321 (127.0.0.1) failed
[Sun Jul 24 00:27:09 2011] [error] ap_proxy_connect_backend disabling worker for (127.0.0.1)
[Sun Jul 24 00:27:09 2011] [error] (61)Connection refused: proxy: HTTP: attempt to connect to 127.0.0.1:3320 (127.0.0.1) failed
[Sun Jul 24 00:27:09 2011] [error] ap_proxy_connect_backend disabling worker for (127.0.0.1)
I've tried all the obvious stuff;
this is a clean upgrade to Lion, then a clean install of Server
hostname is correct (loki.local) and network is working
there is a loki.local Open Directory Intermediate CA certificate
the apache daemon starts up with SSL using that cert
under Hardware -> Settings the SSL certificate is correct
under Hardware -> Network the hostname is correct (loki.local)
stopped, started, rebooted, etc
Where else can I look to find out why /usr/share/devicemgr/backend fails to start? Despite having DEBUG turned on, very few messages are being logged, and nothing that helps my pinpoint what's going wrong.
I'd also be happy to just start from fresh, but I haven't found the "Reset" button for Lion Server, so to speak.Also having the exact same problem.
Also, when trying to manually run the process i get the following:
sudo -u _devicemgr /usr/bin/ruby /usr/share/devicemgr/webserver/thin --chdir /usr/share/devicemgr/backend --rackup config.ru --address localhost --port 3321 --debug start
./config/../vendor/rails/railties/lib/initializer.rb:271:in `require_frameworks': can't activate rack (~> 1.1.0, runtime) for [], already activated rack-1.2.1 for ["thin-1.2.8"] (RuntimeError)
from ./config/../vendor/rails/railties/lib/initializer.rb:134:in `process'
from ./config/../vendor/rails/railties/lib/initializer.rb:113:in `send'
from ./config/../vendor/rails/railties/lib/initializer.rb:113:in `run'
from ./config/environment.rb:41
from /System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/rubygem s/custom_require.rb:31:in `gem_original_require'
from /System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/rubygem s/custom_require.rb:31:in `require'
from config.ru:2
from /System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/gems/1.8/ge ms/rack-1.2.1/lib/rack/builder.rb:46:in `instance_eval'
from /System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/gems/1.8/ge ms/rack-1.2.1/lib/rack/builder.rb:46:in `initialize'
from config.ru:1:in `new'
from config.ru:1 -
Hosting web service on one Xserve and Profile Manager on another?
Hello.
I'm trying to get Profile Manager running on a second Xserve in our studio but I'm having an issue making connections to it from the WAN because I already have HTTP and HTTPS running on a different Xserve.
The set up is something like this:
Xserve001 (xs1.mydomain.com)
- DNS
- Web service hosting a secure site (via SSL) on port 443
- Web service hosting a non-secure site on port 80
Xserve002 (xs2.mydomain.com)
- Open Directory Master
- Profile Manager on ports 80, 443, 1640
Since the router/firewall (between the WAN and be two Xserves on the LAN) handles port forwarding, right now, http and https connections (i.e., ports 80 & 443) are forwarded to Xserve001 for the web hosting.
I would like to enable Profile Manager on Xserve002, but connections won't work from the WAN (via xs2.mydomain.com) because ports 80 & 443 are forwarding to Xserve001 (from within the LAN we're fine because DNS handles everything without going through the router).
So, what would I need to do to get this to work when attempting connections from the WAN?
Thanks,
Kristin.This is tricky to do, especially since you have multiple SSL certificates involved.
Ordinarily I'd say the easist option is to have xs1 proxy the connection to xs2 - that way all requests come into xs1 which then determines specific requests are for the profile manager and sends them across the local network.
This will work well enough for port 80 requests, but the SSL requests will fail unless you either have a wildcard SSL certificate (e.g. for *.mydomain.com) or you have a certificate that includes both hostnames.
Without one of these options on your server you're doomed to failure because clients will warn of a hostname mismatch in the SSL certificate (you asked for xs2.mydomain.com but I got a certificate from xs1.mydomain.com) and I don't think iOS or Mac OS X will allow you to connect in this manner.
The other solution hinges around your internet connection, and whether you only have a single IP address or multiple. If you have multiple then you can setup a different public IP address to map to xs2. This is probably the all-round easiest solution, especially when dealing with NAT networks. -
Unable to push user profiles to AD groups with Profile Manager since upgrade to Server v3
Since upgrading our OS X Mac server from 10.8.5 to 10.9.1, and OS X Server app to v3 (now 3.0.2) I have been unable to push or modify user profiles to AD groups (or AD users) using Profile Manager. This was working fine on OS X 10.8.5. Pushing device profiles is still working OK after the upgrade.
From what I can see from the logs on the client side and server side, it seems related to a problem with the mdm authtoken.
In the client console I can see this entry:
27/01/14 14:30:15.844 mdmclient[38557]: *** ERROR *** [Agent:636102071] Unable to proceed with connection to: https://ourserver.ourdomain/devicemanagement/api/device/mdm_connect (com.apple.mdmconfig.mdm) because don't have valid MDM AuthToken
On the server, in the php.log I can see the corresponding attempt to authenticate:
1::Jan 27 14:29:50.930 [158] <192.168.28.171> {require_once (mdm_checkin.php:11)} vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv - PUT mdm_checkin
0::Jan 27 14:29:50.931 [158] <192.168.28.171> checkin: 'UserAuthenticate'
1::Jan 27 14:29:50.936 [158] <192.168.28.171> {Target_for_incoming_request (target.php:209)} Found target NETWORK LS: <User[156]@ourclientmachine>
0::Jan 27 14:29:50.937 [158] <192.168.28.171> {LabSession_validate_auth_token (mdm_checkin.php:22)} Failed auth for target NETWORK LS: <User[156]@Device[1697]>, incoming_request={
0::Jan 27 14:29:50.937 [158] <192.168.28.171> 'MessageType'=>'UserAuthenticate',
0::Jan 27 14:29:50.937 [158] <192.168.28.171> 'UDID'=>'17aff5c5a40f51acbbd78023d0028c80',
0::Jan 27 14:29:50.937 [158] <192.168.28.171> 'UserID'=>'A5EA25B7-7CCD-4EF4-B240-F23DED275EEC'
0::Jan 27 14:29:50.937 [158] <192.168.28.171> }
1::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Sent Final Output (407 bytes)
1::Jan 27 14:29:50.965 [158] <192.168.28.171> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - /devicemanagement/mdm/mdm_checkin
0::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Completed in 34ms | 200 OK [https://ourserver.ourdomain/devicemanagement/api/device/mdm_checkin]
So I can see there is a failure to authenticate, but don't really know how to troubleshoot this further. Or maybe this is just a bug in the new server app?
I have tried to remove and re-enroll clients in Profile Manager but no joy there.
In the client's Keychain I can see an MDM user AuthToken linked to the correct user account.
Thanks in advance for any help or suggestionsI just wanted to update my post, as this issue for me is resolved.
I uninstalled and reinstalled the Server.app on our Mac server, since then I've been able to push profiles to AD Users and Groups. I guess that in my case the Server app got into a bit of a mess when it was upgraded to v3.
Now the next headache I have is that my AD Groups which are displayed in Profile Manager are not syncing any recent changes. I think I'm probably seeing the same issue as described in this post
https://discussions.apple.com/message/25420919#25420919 -
Cry for help: a decent network profile manager
Am I the only one that finds the default arch linux network profile management a bit.. lacking? Maybe I just don't have it set up right, but it only works for my ethernet connection and connecting to non-encrypted wireless networks. Problem is, I run WPA2-AES networks at home and at work. I finally got wpa_supplicant properly set up (I'm on wireless right now), but I can't just select the network profile from the menu and be on my way.
Here is what I have to do to get connected right now:
[root@cdl-magnesium chris]# wpa_supplicant -dw -c/etc/wpa_supplicant.conf -Dmadwifi -iath0
[root@cdl-magnesium chris]# dhcpcd ath0
and I'm connected, everything working great. That's fairly simple, right? I'm thinking my network profile has a lot more in it than necessary.
# Network Profile
DESCRIPTION="57 May"
# Network Settings
INTERFACE=ath0
#HOSTNAME=myhost
# Interface Settings (use IFOPTS="dhcp" for DHCP)
IFOPTS="dhcp"
#GATEWAY=192.168.0.1
# DNS Settings (optional)
#DOMAIN=localdomain
#DNS1=192.168.0.1
#DNS2=
# Wireless Settings (optional)
ESSID="Galactica"
#KEY=
#IWOPTS="mode managed essid $ESSID channel 6 key restricted $KEY"
WIFI_INTERFACE=wifi0 # use this if you have a special wireless interface
# that is linked to the real $INTERFACE
WIFI_WAIT=5 # seconds to wait for the wireless card to
# associate before bringing the interface up
USEWPA="yes" # start wpa_supplicant with the profile
WPAOPTS="-D madwifi" # use "" for normal operation or specify additional
# options (eg, "-D ipw")
# see /etc/wpa_supplicant.conf for configuration
#AUTOWPA="yes" # automatically configure WPA
If I do a /etc/rc.d/network restart and select the profile from the menu, I get all sorts of errors about not being able to connect to wpa_supplicant (because for some reason it isn't running.. was I supposed to do something about that?).
I'm a bit tired right now so pardon any incomprehensible sentences or questions
ps: while we're on the subject, is there a way to re-sort the items in the network profile list? It always wants to connect to this broken wpa2 profile first, as I think it just goes in alphabetic order or somethin. I guess I should just turn off the timeout so it always waits for me to choose.i'm working on one.
http://wiki.archlinux.org/index.php/Network_Scripts
James -
I'm using Vista, 32 bit - not even downloading the beta version of Firefox 4 helps; it downloads (just like the regular version of Firefox, 3.4) and I can install it, but trying to run it gives me nothing - no warning, no text; it just doesn't open up, but is still visible in my start menu, programs folder and in task manager. And not even profile manager opens up.
Make sure that you do not remove your personal data when you uninstall Firefox. Then you won't lose personal data stored in a different location in the [http://kb.mozillazine.org/Profile_folder_-_Firefox Firefox Profile Folder].
See also http://kb.mozillazine.org/Profile_backup and [[Backing up your information]]
A possible cause is security software (firewall) that blocks Firefox.<br />
Remove all rules for Firefox from the permissions list in the firewall and let your firewall ask again for permission to get full unrestricted access to internet for Firefox.<br />
See [[Server not found]] and [[Firewalls]] and http://kb.mozillazine.org/Firewalls
See also http://kb.mozillazine.org/Browser_will_not_start_up
Do a malware check with a few malware scan programs.<br />
You need to use all programs because each detects different malware.<br />
Make sure that you update each program to get the latest version of the database.<br />
*http://www.malwarebytes.org/mbam.php - Malwarebytes' Anti-Malware
*http://www.superantispyware.com/ - SuperAntispyware
*http://www.safer-networking.org/en/index.html - Spybot Search & Destroy
*http://www.lavasoft.com/products/ad_aware_free.php - Ad-Aware Free
*http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Windows Defender: Home Page
See also "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked and [[Searches are redirected to another site]] -
firefox has been running slower. When this happens I'll reboot my computer and this speeds up firefox. When I restarted the computer firefox would not open. Just the spinning wheel with no access to the tools.
After I force quit - it says ignore or notify/report to apple. I tried sending a report, and it ques up the box with details, system config, etc... but when I click on send - it will not let me send one - I've never been unable to send a report before.
I uninstalled, then reinstalled. Upon opening I get the spinning wheel and nothing happens - I need to force quit. I see on this mozilla help site that I need to update my profile manager. I followed these instructions - Finding your profile without opening Firefox Open Finder and go to your home folder. Note: your home folder is usually the name of your Mac user account From your home folder open /Library/, then /Application Support/, then /Firefox/, then /Profiles/. Your profile folder is within this folder. but when I got to library - application support - there is no firefox listed.You can do a disk check with the chkdsk.exe program.
If you run the chkdsk.exe program from a cmd.exe Command window then you can read the response from the chkdsk.exe program.
Open a cmd.exe window:<br />
Start > Run: cmd.exe <press Enter>
At the command prompt (>) type or Copy&Paste: chkdsk.exe /f /r <press Enter> (put a space before /f and /r)
If you get something like: Would you like to schedule this volume to be checked the next time the system restarts? y/n then answer the question with "Y" and close all programs and reboot the computer.
A possible cause is security software (firewall) that blocks or restricts Firefox without informing you about that, possibly after detecting changes (update) to the Firefox program.
Remove all rules for Firefox from the permissions list in the firewall and let your firewall ask again for permission to get full unrestricted access to internet for Firefox and the plugin-container process.
See:
* [[Server not found]]
* [[Firewalls]]
* http://kb.mozillazine.org/Browser_will_not_start_up
Maybe you are looking for
-
Okay...how do I update my apps on Itunes
I did not see an "Update Apps" in the App store
-
Unable to open Webi report in edit mode
Hi All, While i am trying to open a web intelligence report in "Modify" mode, its throwing an error "The document cannot be created or opened. The error code is: FILE NOT FOUND." Please let me know how to retrieve the report as i am not having a back
-
Want the ipod to say my daughter's name not my sisters? Is this possible?
-
Append a file with date and name in the output file
I am running a script which produce an output in excel file, I would like the server name and the date in the output file, Both the servername and date has declared at the beginning of the script as $server = test1 $date = Get-Date -uformat %Y-%m-%
-
Old user accounts missing after repair
I just had the "random shutdown disorder" fixed on my MacBook at my local Apple Store. When the MacBook came back, and I powered it up, I had to go through the whole "new computer start up" stuff again. When I was done, I was surprised to see a deskt