Command-line tools via Python and Cocoa

This post is based on a column I wrote for MacTech magazine in 2012. MacTech used to make older columns available online, but they haven’t done that for the past several years for some reason.
I’m planning to go through my older columns and dust off and republish some that I think are still relevant or useful.

Cocoa-Python, also referred to as PyObjC, is a set of Python modules and glue code that allow Python programmers to access many of Apple’s Cocoa frameworks. This allows you to do many things from Python scripting that might otherwise require compiling code in C/Objective-C. To access the Cocoa frameworks, you import them by name, just as you might import a regular Python module.

A quick example: the CoreFoundation framework contains methods to work with user preferences, a bit like the /usr/bin/defaults tool. We can use the CFPreferencesCopyAppValue function in Python simply by importing CoreFoundation, and then calling it like we would a function from a “regular” Python module:


import CoreFoundation

print CoreFoundation.CFPreferencesCopyAppValue(
          "HomePage", "")

If you run the above code, it will print the current home page you have set in Safari. We’ve successfully used an OS X framework from Python!

Continue reading “Command-line tools via Python and Cocoa”

Command-line tools via Python and Cocoa

Gatekeeper Configuration Data and XProtectPlistConfigData and Munki and Reposado, oh my!

If you haven’t read this already, please do:

I’ll wait.

Done? OK. Concerned? No? Then you can skip the rest of this post.

If you are concerned, and would like to make sure your managed machines have these security updates, I have a solution for you — if it affects you (and you use Munki and Reposado; so what, about six people?)
Continue reading “Gatekeeper Configuration Data and XProtectPlistConfigData and Munki and Reposado, oh my!”

Gatekeeper Configuration Data and XProtectPlistConfigData and Munki and Reposado, oh my!

“unsetpassword” alternatives

Recently, prolific Mac admin documentation writer Rich Trouton blogged about a new tool available in Yosemite: unsetpassword. It’s a tool with a rather specific purpose: to clear the password for a local admin user account and set it to require a new password.

Rich’s post is here.

Rich’s suggested use-case for this tool is this: you create a local account for a user on a new machine. Instead of then handing the machine over with a password you now know (and the user may not change) or with an empty password (that the user may not replace with a better one), instead, you run unsetpassword before returning the machine to the user. The user now logs in with a blank password and is immediately prompted to change it.

You actually have to run sudo unsetpassword while logged into the account. This limits its functionality to admin accounts — you can’t use this tool to unset the account password if you’ve set up a standard account for a user. It’s pretty common to provide standard accounts — that is, accounts without admin rights — to users in many organizations, so this is a significant limitation.

The tool also leaves the login.keychain and Local Items keychains in place, but does not reset their passwords, leading to an almost certainly confusing prompt when the user logs in after the password is unset.

unsetpassword also forces a shutdown after running. This doesn’t seem strictly needed. Certainly a logout is needed, but it seems annoying to have to go through a restart cycle.

Finally, this tool is available only on Yosemite. If you are still supporting and even deploying machines running older versions of OS X, you can’t use it. But there is good news. You can accomplish the same basic task (“unsetting” a local user account password) with other tools that exist in Yosemite and older versions of OS X.

Here are the commands:

sudo dscl . passwd /Users/username ""
sudo pwpolicy -u username -setpolicy "newPasswordRequired=1"

Where “username” is the short username of the user for whom you wish to “unset” their password.

The dscl command sets the user’s password to an empty string.
The pwpolicy command marks the account as requiring a new password.

If the user account is an admin account capable of running commands with sudo, you can run these commands while logged in as that account. You should then immediately log out. (Shutting down as the unsetpassword command does isn’t required.)

If you have a different admin account available (either locally or via directory services), or you can SSH in as root, you can run these commands for a non-admin user account.

We can also eliminate the keychain prompts. Since the intention here is a new account setup, there shouldn’t be anything of value stored in the login keychain, so we could just delete the login.keychain and Local Items keychains. When the user logs back in, these keychains will be recreated without prompting the user.

sudo rm -r ~username/Library/Keychains/*

As always, you should test these commands on some test accounts to get a feel for how they work. While the unsetpassword command is much easier to remember, the techniques presented here are more flexible and usable in more contexts.

“unsetpassword” alternatives

Configuration Profiles and Identity payloads

In today’s MacTech deployment lab, the subject of using Identity payloads in configuration profiles came up.

Here: is a sample/demo configuration profile that contains both an Identity payload and an Email configuration payload.

When installed (by double-clicking the profile, after the normal warnings, the user is presented with a form for entering identification information:

Profiles identity

After entering the requested information and clicking Continue, gets a new Gmail account added with the information you entered.

Configuration Profiles and Identity payloads

MacTech Conference 2014: What’s New with Munki?

Here are links from my MacTech Conference 2014 presentation: “What’s New with Munki?”.

Munki itself:

GUI tools:

Web interfaces/Web reporting consoles:

Alternate Munki servers:

Update management:

Miscellaneous tools and add-ons:

Managed Software Center help page link:

Munki 2 documentation:

Munki discussion group:

Munki demonstration setup:

Removing Munki:

MacTech Conference 2014: What’s New with Munki?

MacTech Conference 2014: What’s New with Munki?

If you are attending my session on Thursday: “What’s new with Munki?” and want to follow along/participate in setting up your own Munki demo, don’t temp the WiFi gods. Download these things in advance:

MacTech Conference 2014: What’s New with Munki?