pebble.it Blog

February Lightning Talks

pebble-it — Tue, 03 Mar 2015 15:50:43 +0000

Feburary’s lightning talks were the usual eclectic mix and we were able to record them for the first time. Thanks to Mark, Cheng and Graham for their talks. Lapel microphones are on their way for next month!
[00:23] Mark Durrant - XYZ Machines
Experimenting with plotters and 3D printing.
[12:48] Cheng Cui - Chinese Mobile Internet
A tour of the Chinese Mobile Internet Market
[27:00] Graham Gilbert - Sal & Sal +
Showcasing pebble.it’s Munki and Puppet based Mac Management Product

csshx

graham-gilbert — Sat, 10 Jan 2015 18:08:00 +0000

csshx is a tool that allows you to SSH into multiple hosts and send the same commands to them - think of the ‘Send UNIX’ command in Apple Remote Desktop, but one that actually works! Sometimes you won’t be able to have a configuration management tool in place, or perhaps you’ve been called in because what is there is broken and there are a few hundred machines that can’t talk to the server. Being able to perform commands on many machines at once lets you get these machines back into your desired state quickly.

Getting started

You can download the binary directly from the project’s website - it’s not been updated since 2011, so there’s not much fear of it becoming out of date. I am however a fan of Homebrew - a simple way of managing extra binaries on OS X. If you don’t have Hombrew already installed, follow the instructions on the Homebrew wiki.

Follow the prompts and you’ll be good to go. Once you’ve got Homebrew installed, install csshx:

$ brew install csshx

Bow before me, for I am root

Let’s say you’ve got a list of IP addresses for your machines - from your DHCP server, ARD or the excellent iNet (protip: export your scan as a CSV and only have the IP address field for an almost perfect file for csshx). You can feed the hosts file into csshx (using --hosts) and it will open up a SSH session to each of them. To specify the username, use --login.

$ csshx --hosts /path/to/some/file --login ladmin

You can then send your commands directly to the machines - if you have SSH keys set up, you don’t even need to enter a password.

But you don’t need to go to the trouble of feeding in a list of host names. csshx can be given a subnet to try and connect to - combined with the --ping_test option, csshx will ping each of the IP addresses in the range and only attempt a connection to those that are actually online.

$ csshx 10.50.1.0/24 --login ladmin --ping_test

Whether you just need to force a Munki run to urgently push out an update, or if they’ve managed to get disconnected from your management tool, as long as you have SSH access to the machine, you can always get the machines back in control.

MBHome

graham-gilbert — Fri, 19 Dec 2014 07:21:00 +0000

One of our clients, Moving Brands, puts together a project every holiday season. This year’s is really cool, using WebGL to chart the MB-ers journey home.

And for the nerds, as this year was all browser based, we’re hosting this from an S3 bucket - in the past MB’s holiday projects have included pretty much every web technology you can think of. Scaling these can sometimes be a bit of a challenge, as they’re always incredibly popular, but fortunately MB embraced the cloud early on, so Amazon EC2 and Elastic Load Balancers helped us out massively.

Twisting Munki at MacTech

graham-gilbert — Mon, 10 Nov 2014 13:07:42 +0000

Last week, I gave a talk on some of the things we do with Munki at pebble.it - if you came to the talk, thank you! If you weren’t able to make it you can get my slides and code from the GitHub repository.

Sal: Enterprise Mac Management

thatsinthebook-blog — Thu, 30 Oct 2014 09:59:00 +0000

pebble.it built Sal to report on and manage a very large number of Macs. Sal combines an intuitive user experience with powerful backend reporting and management features. We built it because we could not find anything else out there that would do what we needed. Now you can use it too.

At pebble.it we have been managing devices, networks and infrastructures for our clients since 2006 and so know quite a bit about what is needed to manage a large Mac estate.

Sal is from the mastermind of our very own Graham Gilbert and has been tried, tested and improved into something that you can now use and benefit from too. Our sister company, pebble {code}, who build bespoke business applications, has been involved to make it Enterprise ready.

The great news is that Sal is available for free and all the details and setup instructions are available on Github. Go and get started now.

Sal+

We have also built Sal+ to give you more. Sal+, together with your own Munki server, or our hosted Munki server, lets you have full control of all software that your users can access via self service. We think this will make your job significantly easier.

But Sal+ does not stop there. If you truly want full control of all your Macs, software, security, printers and more, pebble.it can utilise Sal+, Munki and Puppet to make this happen. Visit salsoftware.com or drop us an email to find out how we can make your lives easier.

Sal+ starts at $1 per Mac per month. Drop us an email to find out more.

Why Share?

graham-gilbert — Mon, 08 Sep 2014 09:00:18 +0100

This post was originally going to be titled “why open source”, but after I received my feedback following my talks at Penn State MacAdmins, I decided to expand it a little.

Ever since I thought I had something that someone else my be interested in hearing, I’ve wanted to give back to the Mac admin community. As someone who’s worked in the commercial sector, this might seen a bit strange. I mean, we’re basically giving away what makes pebble.it money, right?

To a certain extent, that’s 100% correct. The vast majority of what we’ve done over the past few years is open source - lunacy!

One developer or a hundred?

Usually when I make a script or some other tool, it’s because I have a need for it. That means I’m going to have to write it anyway. Then OS X Spinal Tap 10.11 comes out and breaks my script. I might not find out until I actually come to deploy the OS if it’s working. When I open source it, I’ve hopefully got many people using it and willing to file bug reports. If I’m really lucky I might have someone willing and able to contribute code to fix it.

Something that might have taken me weeks to get around to fixing can be sorted in days.

The most important reason of all

I doubt anyone reading this has never been helped by anyone. Whether it’s blog posts from the likes of Rich Trouton, looking at code by Greg Neagle, or one of the many posts on Mac Enterprise, there are scores of people offering their knowledge and expertise, asking for nothing in return. Sharing helps our community thrive; without people able to support OS X in the enterprise, OS X won’t be deployed to the enterprise. In short, it’s the right thing to do.

Restricting access to OS X 10.10

graham-gilbert — Tue, 26 Aug 2014 21:47:00 +0100

We’re as excited as anyone about Yosemite at pebble.it - I’ve been running it as my day-to day OS since Developer Preview 2. However, Apple changed the game a little bit when they announced the Public Beta Program. What was previously only available to members of the paid developer program, is now available to all. If you want to keep your users to stay on the stable version of OS X until you’ve tested it, Apple have published a profile that will restrict access to unreleased versions of OS X. Their suggestions for deploying this are either Profile Manager (which isn’t suitable in any environment) or emailing it to users and asking them to install it (which is incredibly optimistic!).

If you are using a tool that can install packages, such as Casper, Apple Remote Desktop, or our preferred method Munki, you fortunately have a better option. Using Tim Sutton’s Make Profile Pkg, you can make a package that will deploy your preferences. First off, you’re going to need to install the command line tools for Xcode. Everything preceded with a $ should be typed into a terminal window.

$ xcode-select --install

Once you’ve got the tools installed, we can get Make Profile Pkg downloaded:

$ cd ~/Desktop

$ git clone https://github.com/timsutton/make-profile-pkg.git

And assuming you’ve downloaded the profile from Apple and have left it in your Downloads directory:

$ cd ~/Desktop/make-profile-pkg

$ ./make_profile_pkg.py ~/Downloads/HT6311-BlockYosemiteBeta.mobileconfig

And you get a package out of it! Or, you could just use this pre-built one.

Sal hits the Docker Index

graham-gilbert — Mon, 03 Mar 2014 20:48:54 +0000

Pepijn Bruienne has just released his Dockerfile to set up a Docker Container for Sal, the open source version of the pebble.it Client Dashboard.

What is Docker?

Docker is an open-source project to easily create lightweight, portable, self-sufficient containers from any application.

Essentially, it’s the modern way to distribute applications that run on Linux - rather than shipping a whole virtual machine like you would in the old days, you get only the parts that make that application unique.

Big thanks to Pepijn for making it even easier to get up and running with Sal.

littlebigdetails: Apple - The CSS class for legal fine print on...

sebbo-blog — Mon, 03 Mar 2014 12:29:41 +0000

littlebigdetails:

Apple - The CSS class for legal fine print on Apple product pages is “Sosumi.”

Example

More info

pebble.it Client Dashboard

graham-gilbert — Fri, 17 Jan 2014 12:34:04 +0000

pebble.it have made no secret about what our Mac management solution of choice is. We’ve worked hard over the last few years to develop a best in class solution for our clients, but one thing was still missing - visibility.

We were collecting all kinds of information on the Macs we manage - how much memory they have, how long they’ve been turned on, what software is installed, but this information was only visible to the pebble engineers. We wanted a way to expose this to our clients to give them the information to help them make smarter IT choices. We looked far and wide for a solution, but we didn’t find anything that we could use - so we made our own.

The pebble.it Client Dashboard gives our clients a complete overview of their Mac estate. It’s clear enough for non-IT staff to read, but can be drilled down into to give all of the information an in-house IT dept needs to effectively manage their Macs.

The Dashboard is an integral part of our Managed Mac solution, giving a face to the work our other tools do invisibly in the background.

Cyber Monday

sebbo-blog — Mon, 02 Dec 2013 13:46:59 +0000

Mac Admin eBook recommendations

It’s the Monday after Thanksgiving in the US, so it must be Cyber Monday; the busiest online shopping day of the year.

Many online retailers are offering large discounts or other promotions. With plenty of other blogs covering gift ideas for your techie friends and loved ones, here we’ll be making some on-sale[1] book recommendations that IT bods[2] will enjoy.

Although both Amazon and the iBooks Store are having sales, we’re going to be linking direct to the publisher’s store. All the books listed can be downloaded in one or more of the ePub, Mobi or PDF formats; allowing greater flexibility to read on almost any device — iPad, Kindle, OS X or future gizmos.

O’Reilly

Cyber Monday special offer, save 50% on all ebooks and videos with discount code CYBER3.

Learning Unix for OS X — Mac folks love the GUI, but don’t be afraid to get under-the-hood!
Learning Python — the fisticuffs have ceased and the Mac Admin community has pretty much settled on Python as its scripting language of choice.
Version Control with Git — now you’re scripting, get that code under version control! Then go on to win praise and adoration by sharing through GitHub.
Vagrant: Up and Running — nothing beats virtual machines for developing and testing your admin skills. Create and destroy your VM minions with a ruthless efficiency!

Apress

Cyber Monday sale, every ebook just $15.

Pro Puppet — we rely on Puppet a lot at pebble.it to manage a great many of servers and Macs. This is a pre-release version of the 2nd Edition (which should be released any day now). See our other posts on Puppet on this site or on our Lead Engineer’s blog.

Peachpit

Black Friday sale, 45% off one, or 60% off two or more ebooks or videos, with discount code BFDIG2013.

Peachpit publish the Apple Training Series books for certifications such as ACSP and ACTC. These Mavericks titles are not yet released, but purchase them now while they’re discounted and you’ll be able to download from the date of publication.

Happy reading!

Today only! ↩
With perhaps a slight Mac bias… ↩

OS X Mavericks

graham-gilbert — Wed, 23 Oct 2013 12:41:00 +0100

The team at pebble.it has been testing the new version of OS X, dubbed Mavericks, since it was announced at WWDC this year. It brought some features that we’ve been crying out for Apple to include in OS X for years, most notably a tabbed Finder, greatly improved full screen mode and a whole new power management system.

Tabbed finder

Have you ever been lost in a sea of Finder windows, desperately hunting for that Photoshop file that you know is there somewhere? With tabbed Finder windows, they’re all collected into a handy group, so you can see what you’ve got open at a glance.

New full screen mode

When full screen mode was introduced in Lion in 2011 we had big hopes for it. Our laptops were getting smaller and smaller and we needed to see more of our apps. And it worked magnificently. Until you added a second screen to your Mac. The minute you went full screen on one screen, the other was filled with grey uselessness.

Now you can be busy looking for inspiration in Safari in full screen mode on your secondary screen with Indesign open on your primary screen, or even have two different full screen applications open at the same time.

Power management

We’ve all been there, you’re working away and suddenly your battery meter plummets. You know something is sucking all the power, but you have no idea what. The battery meter in Mavericks will let you know which applications are using lots of power so you can decide whether you really need them open.

But you might not even need to keep such a beady eye on your battery - with App Nap, any apps that you just have sat in the background doing nothing will quietly shut itself down until you bring it to the front again, saving your processor from having to think about it and saving you from worrying (so much) about where your next power point will be.

iOS for Whitehall

pebble-it — Fri, 18 Oct 2013 09:47:00 +0100

The rise of the tablet and mobile device in business, education and Government presents something of a challenge for most IT teams. Many default to excluding them from internal networks, unaware that these devices can be easily and rapidly brought in-line with IT policy, and can greatly enhance the technical landscape for an organisation and its users.

Mobile Device Management

Most laptops and desktops in a corporate network are ‘managed’ in one way or another. This allows an IT team to centrally control configuration and security and ensure compliance with IT policy. Unmanaged mobile devices present potential threats to this carefully managed environment, so need to be deployed in a way that brings them in line with the ‘managed’ approach to IT.

AirWatch is a leading enterprise MDM product. It is also pebble.it’s preferred solution and its many tools and features, correctly configured, will fulfil requirements for managing the current and future fleet of iPhones and iPads (and Android devices, if required).

Deployment

In order to efficiently deploy large numbers of new iOS devices,Apple Configurator is used to consistently prepare and configure iPads and iPhones via a central ‘image’ (pre-built with settings and policies as desired).

The device is enrolled into AirWatch during deployment by installing the MDM profile. Subsequently, management and policy is handled by AirWatch ‘over-the-air’.

Enrollment

End-users enroll existing iOS devices into AirWatch via a one-time process; either by web portal, email, SMS or App Storeapplication.

With iOS devices under AirWatch control, settings, policies and apps can be configured by the IT department and updated over-the-air from the web-based console.

The management policies (a.k.a. Profiles) that can be applied is defined in a specification (see table below) set by Apple. As such, the possibilities do not vary greatly from one MDM solution to another. However AirWatch does excel by allowing policies to be enforced by device, user, group, time-schedule or location (geofencing).

To ensure consistent access to business tools, AirWatch can manage iOS device applications by installing, upgrading and removing apps remotely. These can be internal (custom) apps or from the App Store (free or purchased). A customised, branded App Catalog can be provided to users to view, install and update company-wide recommended apps.

Lastly, enrolling and managing iOS devices with AirWatch allows for centralised inventory, monitoring and reporting, device querying, and user messaging.

Integration

It is important iOS devices be integrated with existing infrastructure to reduce costs, complexity and duplication.

AirWatch can integrate with Active Directory (AD), meaning users enroll devices using corporate credentials, devices are registered to corporate identities and AD groups are leveraged for applying MDM policies.

When using Exchange for corporate email, calendars and contacts. iOS natively supports Exchange via the ActiveSync protocol. ActiveSync can be used to apply device policies (enforce passcode, restrictions, remote wipe, etc.) however, MDM is more powerful and therefore should be handled by AirWatch. AirWatch can correctly and consistently configure devices without user intervention.

AirWatch also offers Secure Email Gateway. Acting as a proxy between the corporate infrastructure and mobile devices, the SEG simplifies device configuration and offers additional access controls, enhancing security.

To simplify iOS device integration within the corporate network, AirWatch can install Wi-Fi and VPN profiles to ensure reliable connectivity to company resources.

Security

iOS devices have many native security features. By establishing a passcode, current iOS devices protect all data using AES 256-bit hardware encryption. iOS also offers additional software encryption at the OS, application (sandboxing) and file levels.

To ensure these encryption safeguards are enabled on devices, AirWatch can enforce Passcode Policy profiles. Restriction profiles can disable device features, if desired. AirWatch’s compliance features can monitor the status of policies and perform automated actions on non-compliant devices.

In the event of a lost of stolen device, its location can be tracked and remote lock or wipe commands can be sent from the AirWatch web console.

For sensitive or confidential email, iOS offers support for S/MIME encrypted email.

To prevent corporate data leakage via external cloud syncing services, it is possible to make use of the AirWatch Mobile Content Management module. MCM allows for Dropbox-like functionality to users requiring access to company data from iPads or iPhones, whilst ensuring security. Content can be synchronised with corporate repositories such as SharePoint and network file servers, and use existing Access Control Lists for permissions to integrate with current workflows.

Managing Macs with Puppet

pebble-it — Wed, 05 Jun 2013 15:22:00 +0100

Recent presentation at the Penn State University Mac Admin conference, from pebble’s Lead Engineer Graham Gilbert.

Recent presentation by pebble.it’s Lead Engineer Graham...

pebble-it — Wed, 05 Jun 2013 15:20:11 +0100

Recent presentation by pebble.it’s Lead Engineer Graham Gilbert at the Penn State University Mac Admin Conference.

Such advances in computer storage in 34 years…

sebbo-blog — Tue, 16 Apr 2013 10:30:31 +0100

Such advances in computer storage in 34 years…

Moving homebrew installs to a new Mac

sebbo-blog — Mon, 15 Apr 2013 10:30:26 +0100

Our siblings pebblecode posted a good article last week that’s relevant here too.

Moving homebrew installs to a new Mac by George Ornbo:

You are a homebrew user and you have a new Mac. If you don’t want to use Apple’s migration tool to copy over everything you might be faced with running brew install [formula] for everything you have installed.

Unless you have a spare afternoon to do this you can achieve the same things with a few commands and be done in minutes, leaving you to get on with something more interesting.

On your old mac you can output a list of installed software from homebrew.
brew list
By piping this into a file you can create a text file containing all of your installed software.
brew list > homebrew.txt
Now you can copy this to your new Mac by Airdrop if you are on the same network, scp or using a cloud service.

Once you have the file on your new Mac and assuming you have homebrew setup you can install all of the software with a single command
cat homebrew.txt | xargs brew install
You might find that homebrew has removed some formulae since you installed it. If this is the case just edit the file and remove the formula that is no longer available.

If you have your dotfiles in git repository you’ve suddenly got a pretty portable setup.

Quick tip: Google Drive download links

sebbo-blog — Wed, 10 Apr 2013 13:13:00 +0100

If your company uses Google Apps or your just a fan of Google services, then you’re probably using Drive as your cloud file syncing tool.

When you want to share those files with others, you can specify who has access and grab a link via Sharing Settings. However, click that link and you’ll find that for many file types, instead of the browser downloading the file, the Google Drive viewer is displayed. For example, a .ZIP archive:

One can click File \> Download (⌘S) on this page but it becomes a 2-step operation. In order to directly download a file, we have to tweak the link.

The Link to share for my file is:

https://docs.google.com/a/pebbleit.com/file/d/0B05UA09uJtEDNjRPNURtbEk3MWM/edit?usp=sharing

The penultimate part of the URL, 0B05UA09uJtEDNjRPNURtbEk3MWM, is the file’s ID. Add it to the end of https://drive.google.com/uc?export=download&id= to create a link that will directly download the file:

https://drive.google.com/uc?export=download&id=0B05UA09uJtEDNjRPNURtbEk3MWM

Hopefully Google will add this feature soon so this manual tinkering will no longer be required.

Quick Tip: ImageOptim

sebbo-blog — Tue, 02 Apr 2013 10:30:00 +0100

If you share images on the web, via email or any other means, help yourself and your audience out by running PNG, JPEG or GIF files through ImageOptim first.

ImageOptim, as the name implies, optimises images by processing them with a number of open source tools. I’ve often seen file size reductions of 20-30%. A saving not to be sniffed at when in comes to disk space and load times.

As well as single files, the application can batch process multiple files or whole folders of images. And you can also install the system service to run directly from Finder’s contextual menu or invoke via keyboard shortcut.

Flushing your DNS cache

sebbo-blog — Thu, 28 Mar 2013 13:28:00 +0000

Last time, we gave you an introduction to DNS, what it is and a little bit of how it does it. Today we’re going to discuss a common pitfall of DNS and how to correct it.

Recall there is a hierarchy of DNS servers on the internet, each with its own cache of previously looked-up domain name to IP address records. You might be curious to know how all these copies kept up-to-date? If a website ‘moves house’ (changes host or IP address), who ‘forwards its mail’?

All DNS records have an expiry date. A record’s time to live value (TTL) describes, in seconds, how long it is valid for. Once that time is up, that local copy is discarded and the computer will revert to querying the DNS server. To return to our icanhascheezburger.com example, its TTL is 3600, or 1 hour.¹

So, if you change your web host, or move your domain’s email service provider,² there is a period where the old DNS record copies are still out there, and while technically valid, they’re not pointing to that shinny new something you want to show off. It is a time of uncertainty…

Soon enough, the TTL rule comes into effect, and the updated information trickles down through the hierarchy. We call this DNS propagation. The ‘resolution’ roughly comes down to patience but you can speed things at the local level: tear up your DNS cache and start over. Otherwise known as, flushing the DNS cache.

Apple have a support article on how to do this on OS X. For Lion or Mountain Lion, open up Terminal³ and type at the prompt:

sudo killall -HUP mDNSResponder

Press Enter. This being a sudo command, you must have administrator privileges and will be asked for your password. There will be no output or response returned, just a new prompt. This is the command line after all, and here ‘no news is good news’.

If you’re not comfortable in CLI-land, don’t worry. We’ve made an AppleScript application that will do the job for you:

> Download FlushDNS.zip

And for those power-users who like Alfred to do everything for them, there’s a Workflow for them:

> Download FlushDNS.alfredworkflow

These versions are for Lion and Mountain Lion. If anyone requires the Snow Leopard version, let us know in the comments below.

Happy flushing!

This is quite a low figure, it’s more common to see TTL values in the range of 24-48 hours. ↩︎
A staple of ours has been moving clients from in-house Microsoft Exchange servers to Google Apps for some time now. ↩︎
Found in Applications > Utilities. ↩︎