OS X: sshd/sftp jail

A while ago I enabled a jail for an useraccount on my server.
Last week, I had to add another user.

The difference between priviliged useraccount and a “jailed” useraccount is a dot in the path of the home directory, for example: “/Users/./username”.

Being a little bit under stress and having not very much time, I couldn’t recall how to do that with OS X serveradmin.
Very frustrating. Googling and digging through the manuals didn’t give the answer where I was looking for.
Am I the only one who prefers the plain old /etc/passwd above netinfo?

But…today I recalled how I did it before.
And it’s so simple….(after mucking around with obscure CLI commands like nicl and serversetup)

MyFirstWidget™

Having an ADC-select account, I have access to the latest release builds of Tiger.
On Easter-Sunday, I decided to do something usefull with my tiger-seed and downloaded the Dashboard SDK.

Being used to PHP, it took some frustrating tries with javascript, but some hours later I was looking at my first widget.
It basically uses Curl to fetch PHP generated content over a HTTPS connection.
Shown are the last five lines of a access-log from a webapplication.
It works like a charm and refreshes every time dashboard shows up, or with the command+r keycombo.

If Tiger is released and the NDA is lifted, I’ll probably post the widget for download…untill then, some screenshots:

the front, some content blurred for privacy reasons

and the backside, i simply love the animation :)

Upgrading mysql on OS X 10.3 Server

With the latest discovery of some remote vulnerabilities in mysql and PHP, I had to upgrade my production server.
And to be clear, I don’t like updates.
Esp. not on mission critical apps. Updates tend to break things, you see:)

But running php 4.3.6 and mysql 4.0.20 was getting…unwise.

Upgrading PHP is easy, with the (imho) great installer of entropy.ch.

installer -verboseR -pkg ~/php-4.3.10.pkg -target /

Don’t forget afterwards to restore your httpd.conf and to edit /usr/local/php/httpd.conf.php to add:

AddType application/x-httpd-php .php
AddType application/x-httpd-php .html
AddType application/x-httpd-php-source .phps


MySQL is somewhat more tricky.
The version supplied by Apple is well…historic.
I like to compile MySQL from source (esp. because that takes 8,5 minute on my Xserve :) and install it to /usr/local/mysql-(version).
After that I create a symlink from /usr/local/mysql-(version) to /usr/local/mysql.
Take some care replacing the apple supplied mysql-binaries with symlinks to the up2date /usr/local/mysql/bin/ counterparts.
After this, upgrading mysql from source is painless.

The most recent upgrade:

# cd /usr/local/src
# gnutar -xzvf mysql-4.1.10a.tar.gz
# cd mysql-4.1.10a
# ./configure --with-openssl \
--prefix=/usr/local/mysql-4.1.10_a \
--localstatedir=/usr/local/mysql-4.1.10_a/data\
--mandir=/usr/local/share/man/\
--with-mysqld-user=mysql
# make
# make install
# cd /usr/local/
# mysqladmin -u root -p shutdown
# cp -R mysql/data mysql-4.1.10_a/data
# chown -r mysql:wheel mysql-4.1.10_a/data
# ln -s /usr/local/mysql-4.1.10_a /usr/local/mysql
# mysqld_safe &


That’s all. If something goes wrong, just restore the symlink to the “old” mysql-(version) and you’re safe.
Be aware of the new password hashing mysql uses from 4.1.1 of. I used the –old-password switch untill I’ve upgraded all my clients.

Localizing wordpress with OS X Panther

Quick and dirty:

download the .po file
edit in bbedit
save

get the gettext tools from:
http://download.videolan.org/pub/videolan/devtools/gettext-macosx.tar.gz

mkdir -p /usr/local/lib
cp gettext* /usr/local/lib/
ln -s /usr/local/lib/msgfmt /usr/sbin/msgfmt
/usr/local/lib/libintl.a

msgfmt --statistics -o nl_NL_merlijn.mo /Users/merlijn/Desktop/NL_nl.po

upload the mo file, edit wp-config.inc
done

Upgrade day

pfeeuw.

Transmit 3
Pix OS 7 (well, announced at least)
Wordpress 1.5

Transmit 3 have I bought today.
PIXos 7 will be a free upgrade (SMARTnet to the rescue)
Wordpress…2 out of 3 blogs already updated, gargleblaster will follow this weekend.

Transmit 3 kicks ass. Still clicking through the different new options. I know I’m going to love the “DockSend” option.
A year ago I thought that a graphical (s)FTP client was for lusers, but since my colo I couldn’t live without Transmit.