sudo odutil show all
Author: Ed
Changing OD password by command line
Login to the server running Open Directory and run the following to be prompted to change snoopdog’s password
sudo passwd -i OpenDirectory -l /LDAPv3/127.0.0.1 -u diradmin snoopdog
found here: https://discussions.apple.com/thread/1509269
NAME
passwd — modify a user’s password
SYNOPSIS
passwd [-i infosystem [-l location]] [-u authname] [user]
DESCRIPTION
The passwd utility changes the user’s password. If the user is not the super-user, passwd first prompts for the current password and will not continue unless the correct password is entered.
When entering the new password, the characters entered do not echo, in order to avoid the password being seen by a passer-by. The passwd utility
prompts for the new password twice in order to detect typing errors.
The new password should be at least six characters long and not purely alphabetic. Its total length should be less than _PASSWORD_LEN (currently 128
characters), although some directory systems allow longer passwords. Numbers, upper case letters, and meta characters are encouraged.
Once the password has been verified, passwd communicates the new password to the directory system.
-i infosystem
This option specifies where the password update should be applied. Under Mac OS X 10.5 and later, supported directory systems are:
PAM (default) Pluggable Authentication Modules.
opendirectory
A system conforming to Open Directory APIs and supporting updates (including LDAP, etc). If no -l option is specified, the search node is used.
file The local flat-files (included for legacy configurations).
nis A remote NIS server containing the user’s password.
-l location
This option causes the password to be updated in the given location of the chosen directory system.
for file,
location may be a file name (/etc/master.passwd is the default)
for nis,
location may be a NIS domainname
for opendirectory,
location may be a directory node name
for PAM,
location is not used
-u authname
This option specifies the user name to use when authenticating to the directory node.
user This optional argument specifies the user account whose password will be changed. This account’s current password may be required, even when
run as the super-user, depending on the directory system.
FILES
/etc/master.passwd The user database
/etc/passwd A Version 7 format password file
/etc/passwd.XXXXXX Temporary copy of the password file
SEE ALSO
chpass(1), login(1), dscl(1), passwd(5), pwd_mkdb(8), vipw(8)
Robert Morris and Ken Thompson, UNIX password security.
HISTORY
A passwd command appeared in Version 6 AT&T UNIX.
Mac OS X August 18, 2008 Mac OS X
DSCL and scripting mentioned here: https://technology.siprep.org/terminal-command-to-change-a-user-password-on-a-mac/
Open Directory audit log data into Splunk
illustrated Splunk server configuration steps
I put Splunk server scripts for dispersing here
Splunk >> bin >> scripts
sudo nano /Applications/Splunk/bin/scripts/Example_OD.sh
Script input:
#!/bin/bash
sudo log stream –level info –style syslog
# trying json
sudo log stream –level info –style syslog
Forwarder Management:
Settings >> Forwarder management
Settings >> Forwarder management >> Clients
Settings >> Forwarder management >> Server Classes
New Server Class
Data >> Data Inputs
Data >> Data Inputs >> Forwarded Inputs >> Scripts
Change the sourcetype to json
Once everything is in place you should be able to search and find information in this example I created am account “teddyboy” in OPen Directory, the following shows a query from the script which stream the slapd, and opendirectoryd data
Change/check the local inputs.conf files from the scripts running on the Open Directory server.
sudo nano /Applications/SplunkForwarder/etc/apps/_server_app_OD_Servers/local/inputs.conf
reads:
GNU nano 2.0.6 File: …ps/_server_app_OD_Servers/local/inputs.conf
[script://$SPLUNK_HOME/etc/apps/_server_app_OD_Servers/bin/ScriptName_OD.sh]
disabled = 0
index = default
interval = 60.0
sourcetype = linux_messages_syslog
Trying this
sourcetype = oracle:audit:xml
or this
sourcetype = _json
Change/check the local inputs.conf files from the forwarder running on the Open Directory server.
sudo nano /Applications/SplunkForwarder/etc/system/local/inputs.conf
reads:
[monitor:///var/audit/]
[default]
host = ClientMachineHostName.local
Change/check the local output.conf files from the forwarder running on the Open Directory server.
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.1.2.3:9997
[tcpout-server://10.1.2.3:9997]
To search and find OD account creation success, I query from the json sourcetype
ODNodeCreateRecord request
—–
This records barbie account record getting created: dsAttrTypeStandard:RecordName\” = (\n barbie\n
____
Delete a record, “eventMessage” : “Delete a record“, “processImagePath” : “\/Applications\/Server.app\/Contents\/MacOS\/Server“,
{ “processImageUUID” : “388D1B12-E930-3D81-AB34-6EFAA44E12EF“, “processUniqueID” : 28164, “threadID” : 1386945, “timestamp” : “2019-09-22 06:32:34.581205-0400“, “traceID” : 1181143700349387010, “eventType” : “OSActivityCreateEvent“, “activityID” : 857809, “processID” : 28164, “machTimestamp” : 395240545174841, “timezoneName” : “”, “senderProgramCounter” : 56111, “eventMessage” : “Delete a record“, “senderImageUUID” : “29F55F7B-379F-3053-8FF3-5C6675A3DD4D“, “processImagePath” : “\/Applications\/Server.app\/Contents\/MacOS\/Server“, “senderImagePath” : “\/System\/Library\/Frameworks\/OpenDirectory.framework\/Versions\/A\/Frameworks\/CFOpenDirectory.framework\/Versions\/A\/CFOpenDirectory” }
JAMF Pro Configuration Settings commands
jamf-pro config list
sudo jamf-pro server restart
Link to MySQL setup https://www.jamf.com/jamf-nation/articles/631/creating-the-jamf-pro-database-using-the-jamf-pro-server-tools-command-line-interface
UDP Syslog data into Splunk Enterprise
How I poll Cisco switch syslog data at home
Settings >>Data>> Data Inputs >> UDP
Splunk server log(s) location
My mini is freezing and I am having to reboot every 12 hours, since I installed Aplunk server I want to look at those logs
cd /Applications/Splunk/var/log/splunk
and I am looking for splunkd.log here:
/Applications/Splunk/var/log/splunk/splunkd.log
Change the admin user password on Splunk forwarder
Lately when I install the client forwarder on MacOS the password gets corrupted and I have to inexplicably reset the password following this method
rename the $SPLUNKHOME/etc/passswd and restart splunkforwarder to rest it to default “changeme”.
Start Apple Remote Desktop
Sample commands
The commands in this article work with Apple Remote Desktop 3.2 and later.
Here are commands that you can use:
Restart the ARD Agent and helper:
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent
Turn on Remote Desktop Sharing, allow access for all users, and enable the menu extra:
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -clientopts -setmenuextra -menuextra yes
Turn on Remote Desktop Sharing, allow access for specified users:
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers
You must use the -configure, -access, and -privs options in a separate command to specify the set of users and their access privileges. For example, this command is for users with the short names “teacher” and “student.” It gives them access to observe (but not control) the computer, and to send text messages:
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users teacher,student -access -on -privs -ControlObserve -ObserveOnly -TextMessages
Unlike other kickstart options, you can’t combine the allowAccessFor options with other kickstart options. You must use it as in the last two samples above. You might have to call kickstart more than once to finish a computer’s setup.
Remove access privileges for specified users (“student” in this example):
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users student -access -off
Disable ARD Agent and remove access privileges for all users:
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off
Published Date: October 15, 2018
Adobe Photoshop legacy versions
ON THIS PAGE: https://helpx.adobe.com/photoshop/kb/legacy-version-updates.html
What was the latest update for legacy versions?
How do I check for and install the updates?
How do I verify what update I have installed for Photoshop?
How do I verify which update I have installed for the Camera Raw plug-in?
What if I update Adobe Camera Raw and Photoshop still doesn’t recognize my camera?
Photoshop prior version updates
Camera Raw prior version installers and updates