Useful Commands for OSX Administration
Over the years I have stored a file that has many of the day to day commands that I use to administer the computers at my workplace. After 4 years of saving these commands I am giving back and creating the ultimate post to aid all new sys admins out there.
The Adaptive Firewall
The most basic task you can do with the firewall is to disable all of the existing rules. To do so, simply run afctl (all afctl options require sudo) with a -d option:
When run, the adaptive firewall’s rules are disabled. To re-enable them, use the -e option:
To remove a specific IP address that has been blacklisted, use the -r option followed by the IP address (rules are enforced by IP)
To add an IP to the blacklist, use the -a option, also followed by the IP
To permanently add a machine to the whitelist, use -w with the IP
Recover a corrupt open directory
10.5, 10.6, and 10.7 have a recover tool that will help you recover a damaged or corrupt ldap directory.
Reset a corrupt open directory
Note, this should only be done in the event that there is no possible way to recover or restore the OD. This will completely destroy your servers open directory.
Change computer name
Change the computer name over ARD or SSH.
Cleanup files from users computers
We do not allow .torrent files on users computers, so I run this via ARD every morning on the entire network. I later adapted these commands to a script that runs on login.
Establish Jailed SSH
This command will allow you to establish a secure connection over ssh with an encrypted key pair.
Unison
Unison is an amazing utility that runs as a service on OSX that will do two way file syncing over ssh or locally. When setting up Unison you must copy it to /usr/bin/ and then create this directory for it to run.
For more information on Unison you should check out this site.
Running A Unison Batch
You can run this command with Unison to start a file syncronization.
Check a user record
Often times its easier to lookup an account and see its attributes in the terminal rather than using Workroup Manager.
Sync MYSQL between servers
If you need to do a backup from one MYSQL database to another you can use this command to do so. You can also use this as a way to dump a database to a different server.
RSYNC to remote server
Sometimes you need to backup files across a network to a different computer this method allows you to do that over a secure ssh connection.
Force remove a broken OD replica
OD Replicas can be tricky, over time they can fail and sometimes when a replica fails, and you decommission it, it does not get fully removed on the OD Master. Here is how to update the Master to remove that stubborn old replica record.
Fix broken Mobile Account run on the local machine
Mobile accounts sometimes need to be removed from the local computer locally. Here is a simple terminal command to remove a mobile account from a local machine.
Change local password with ARD
This is the easiest way to change user passwords on remote computers with ARD. You can also use secure SSH but ARD is much easier.
Enable ARD remotely
How can you enable ARD on a computer system that you have SSH access to? Hers how!
Fix SSL on servers
Sometimes SSL on an OSX Server can break, here is how to get it back up and running for your server and all of the ssl sites.
- Put the bundle package “gd_bundle.crt” in the /etc/apache2/ directory
- Enter this line in the SSL block
Fix Apple SUS
This sometimes happens, where the symlinks on the server will break, instead of changing all the clients to point to the other catalog that you mentioned, I changed the symbolic link at the server to point to it instead. In Teminal at the server:
Enable Screen Share (VNC) from Terminal
Remotely Set Volume level on a computer
Manually Set SUS in OSX
Remove Microsoft License
If your not fortunate enough to be using a site license for Microsoft Office then you can remove or revoke a license in the terminal like this.
Search and replace in SQL
Change Mailman Password
How to quickly change the mailman password on an OSX Server installation.
- Change password
Export Mailman Lists
How to export Mailman Lists to text files on an OSX Server installation.
Reset the localKDC
This is important to do, if you do not do this, you will not be able to bind your computer after an ASR restore to an OSX Directory. Tools like Deploy Studio Server and Casper run these commands for you.
- Delete all 3 com.apple.kerberos.kdc in the login keychain
Restart the Wiki Service
List out the size of folders on the file system
Change the way the dock behaves
Use Suck instead of Scale
Report on all activity from a specific user
Good for seeing exactly what users are doing on the server or on their computers.
Export a list of contacts from MailMan OSX Server
Restart the Mail Service Remotely
Start the SSH service on a server remotely
Enable universal access remotely
Change email from html to plain text only
Change the scrollbars in OSX
This will change how the scrollbar works there will be an up and down arrow, this only works in 10.5, 10.6.
Show hidden files in OSX
Eject a stubborn or stuck disk remotely
Change the text in the login window
Change the dock size
Change the icon size
Change the desktop tile size
Remove Spotlight from OSX
This will destroy spotlight until you run repair permissions.
Restart the ethernet port
Copy a file remotely
See the Serial Number of your 10.6 Server
You can obtain the Mac OS X Server serial number (for Snow Leopard) via the command line. At the Terminal on the server itself (or via ssh if you wish), type: