The Cool-ade Blog: Mac-Windows, Information Security and Technology. » Mac-Windows

Major Exchange Support Improvements for Office 2011 for Mac

admin — Fri, 21 May 2010 08:00:54 +0000

Microsoft are getting their act together with Office 2011 for Mac. There are major improvements which include improved support for Exchange and the reincorporation of support for Visual Basic for Applications. See the latest info at: http://www.appleinsider.com/articles/10/05/06/road_to_office_2011_new_looks_support_for_exchange_vba.html.

The Exchange improvements are well overdue as the current Entourage is a disaster with slow synchronisation, corrupting databases, inability to save custom distribution group, etc… Bringing back Visual Basic for Applications will also resolve the headache of not being able to use macro enabled Excel spreadsheets in a mixed Mac/PC workgroup.

Snow Leopard Ditched Resource Forks

admin — Mon, 01 Mar 2010 11:00:40 +0000

Yes, the dot underscore (DS_Store and ._ AppleDouble files) are gone. They have been replaced using SMB Alternative Data Streams (ADS) also known as NTFS Streams. See http://www.symantec.com/connect/articles/windows-ntfs-alternate-data-streams for detailed information on ADS.

As a network administrator, I welcome this but it may have repercussions. For example, you have a bunch of Quark files without extension names on an SMB share in the AppleDouble format created by a 10.4 client. By default a 10.6 client wouldn’t be able to read the Quark files because it doesn’t read the AppleDouble dot underscore file and there are no extension names. Therefore, Apple have made it easy to re-enable the feature. This is possible be editing the nsmb.conf file.

To disable named streams as a default for your Mac OS X client user account

Execute these two commands in Terminal:

echo "[default]" >>  ~/Library/Preferences/nsmb.conf
echo "streams=no" >> ~/Library/Preferences/nsmb.conf

To disable named streams as a default for all Mac OS X client user accounts on a Mac

Log in to Mac OS X with an admin user account if you aren’t already logged in as an admin, then execute these two commands in Terminal:

echo "[default]" | sudo tee -a /etc/nsmb.conf
echo "streams=no" | sudo tee -a /etc/nsmb.conf

See the man page on nsmb.conf for more details about how to configure it.

To re-enable streams on 10.6 or to enable it on 10.5 change streams=no to streams=yes

Mac Leopard not saving resource forks on Isilon OneFS

admin — Sat, 02 Jan 2010 09:00:27 +0000

MacOS X Leopard (10.5) doesn’t save resource fork information (._ hidden files) on the Isilon by default. Leopard uses the Isilon SMB Alternate Data Streams (ADS) feature which allows metadata such as resource fork data to be stored. However, MacOS X Tiger (10.4) cannot use ADS. Therefore, files (without extensions) written to the Isilon from Leopard(10.5) cannot be identified by Tiger (10.4) unless ADS is disabled.

To disable support for ADS for all shares in a cluster, edit the file /etc/mcp/override/smbd.xml and add the following text to the file immediately after any line that begins :

This has to be done via the command line so you will need to SSH into the isilon cluster. Once you have made this change, wait 60 seconds for it to propagate to all nodes in your cluster, then run following command to restart all SMB connections to the cluster, in order to take advantage of this change:

isi_for_array -q ‘killall smbd’

If the change made to the global smbd.xml file doesn’t work, edit the file /etc/mcp/override/smbd_shares.xml and add the following entry into the individual share. See the example below: -

Once again when you have made this change, wait 60 seconds for it to propagate to all nodes in your cluster, then run following command to restart all SMB connections to the cluster, in order to take advantage of this change:

isi_for_array -q ‘killall smbd’

Please DO NOT atempt this if you are not familar with the command line environment.

Firefox and Windows Integrated Authentication

admin — Fri, 01 Jan 2010 09:00:46 +0000

Firefox can authenticate with Active Directory using Kerberos single sign-on. It works on both Macs and PCs. This allows automatic authentication to intranets or specific internal company websites.

See http://www.mozilla.org/projects/netlib/integrated-auth.html for the specifics on how it works.

Launch Firefox. In the URL Field type about:config

Look for the following three preference names:

network.automatic-ntlm-auth.trusted-uris
network.negotiate-auth.delegation-uris
network.negotiate-auth.trusted-uris.

Double click on each preference name and add ‘http://yourwebsite-1, http://yourwebsite-2, yourActiveDirectoryDomainName’ to its value field. You can add more sites as required.

Close the about:config windows and the following entries will be written into your prefs.js file which resides in the the Firefox User Profile directory:

user_pref(”network.automatic-ntlm-auth.trusted-uris”, “http://yourwebsite-1, http://yourwebsite-2, yourADdomain”);
user_pref(”network.negotiate-auth.delegation-uris”, “http://yourwebsite-1, http://yourwebsite-2, yourADdomain.com”);
user_pref(”network.negotiate-auth.trusted-uris”, “http://yourwebsite-1, http://yourwebsite-2, yourADdomain.com”

You have now configured Firefox to use Integrated Authentication on your network.