February 2009 - Darwin-dev - lists.apple.com

Re: PAM and the loginwindow.app
by Nigel Kersten 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Sat, Feb 14, 2009 at 1:49 PM, Patrice Matthias Brend'amour <patrice.brendamour(a)uni-konstanz.de> wrote: > hmm... > I wan't shure either. > But it is a problem concerning loginwindow and PAM which are in the Darwin > Source Tree. So I think I am right here. Well you know the whole LDAP client plugin is in that source tree too, but I still wouldn't come here to ask LDAP integration questions :) > autofs won't work because I can't login without password to the ssh server. > Inserting a preshared key for the ssh login into every single home directory > isn't an option. Kerberized SSH isn't an option? Configure /etc/authorization to get Kerberos credentials (assuming you can't do GSSAPI auth to your LDAP server) and do kerberized sshfs ? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: PAM and the loginwindow.app
by Patrice Matthias Brend'amour 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Best regards Patrice --- Patrice Matthias Brend'amour patrice.brendamour(a)uni-konstanz.de Universität Konstanz --- Am 14.02.2009 um 21:57 schrieb Nigel Kersten: On Sat, Feb 14, 2009 at 7:55 AM, Ben Greenfield <ben(a)cogs.com> wrote: No matter what the auth mech is. Loginwindow.app will pass approved auth credentials to keychain for management. I really don't think this is going to help the issue of the loginwindow not consulting PAM. The problem essentially is just wanting to have sshfs mounted home directories. Have you tried to do this with autofs/sshfs Patrice? I've done this under Linux but not under OS X since autofs appeared. I'm also not really sure this is a darwin-dev list topic? You might have more luck at client-management, macosx-interop or macenterprise ? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/patrice.brendamour%40uni-… _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com hmm... I wan't shure either. But it is a problem concerning loginwindow and PAM which are in the Darwin Source Tree. So I think I am right here. autofs won't work because I can't login without password to the ssh server. Inserting a preshared key for the ssh login into every single home directory isn't an option. I could be wrong but I think if you configure a service to use pam then the gui's keychain manages the password for you. This email sent to patrice.brendamour(a)uni-konstanz.de smime.p7s PGP.sig

1 0

Re: PAM and the loginwindow.app
by Nigel Kersten 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Sat, Feb 14, 2009 at 7:55 AM, Ben Greenfield <ben(a)cogs.com> wrote: > I could be wrong but I think if you configure a service to use pam then the > gui's keychain manages the password for you. > > No matter what the auth mech is. > Loginwindow.app will pass approved auth credentials to keychain for > management. I really don't think this is going to help the issue of the loginwindow not consulting PAM. The problem essentially is just wanting to have sshfs mounted home directories. Have you tried to do this with autofs/sshfs Patrice? I've done this under Linux but not under OS X since autofs appeared. I'm also not really sure this is a darwin-dev list topic? You might have more luck at client-management, macosx-interop or macenterprise ? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: PAM and the loginwindow.app
by Ben Greenfield 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Feb 14, 2009, at 10:26 AM, Patrice Matthias Brend'amour wrote: PAM is not the Problem... But the Loginwindow.app is.. So maybe we should take it off list if you think I might be helpful. Thanks, Ben --- Patrice Matthias Brend'amour patrice.brendamour(a)uni-konstanz.de University of Konstanz, Germany --- Am 14.02.2009 um 16:20 schrieb Ben Greenfield: Long story short. Here is the man page for pam on OS X. Ben On Feb 14, 2009, at 9:39 AM, Finlay Dobbie wrote: On Fri, Feb 13, 2009 at 8:06 PM, Patrice Matthias Brend'amour <patrice.brendamour(a)uni-konstanz.de> wrote: You may want to take a look at http://developer.apple.com/technotes/tn2008/tn2228.html -- Finlay _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/ben%40cogs.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… It seems it doesn't use PAM at all. Otherwise i would see debug output from my module in the syslog. Or am I missing something? I could be wrong but I think if you configure a service to use pam then the gui's keychain manages the password for you. No matter what the auth mech is. Loginwindow.app will pass approved auth credentials to keychain for management. In your case it seems that everyone has an identity on an ldap server. Those same users have access to the sshfs share with same identities. I think you may need to get the os x client machines to trust sshfs server and sshfs server to trust the clients. I think changes may be needed to /etc/pam.conf then make the sshfs run with pam in the /etc/pam.d services. It is quite possible that this isn't the right list for my answer and maybe even your question. I may be missing the obvious... this may not be relevant at all to your situation In the past I was able to get an Open Directory server to act as the auth mechnism for linux and os x machines. The Linux machines were using pam to auth against the OD server and the OS X used the OD for auth as well. I used the dscl to set the homedir path The home directories were on a 3rd Linux machine, I used the dscl to set the homedir path for the os x and the linux machines. I was then able to use pam auth for SVN, ssh, webdav,.... for all the clients. It should be straight forward. Get pam auth working for the OS X clients and map the appropriate path for home dirs in the ldap server. http://developer.apple.com/documentation/Darwin/Reference/ManPages/ man8/pam.8.html Hi. I'm currently integrating 10 iMacs in an existing Linux computer pool for our students at the University of Konstanz. There we have an LDAP Server for authentication, no AD, no NFS/AFP. Authentication on OS X with LDAP works fine but I have a little problem with the homedirectories. Our sysadmins want me to mount the users home dir via sshfs to the mac. So far, no problem. Sshfs works on OS X. But we need to mount the homedir at login time (with the password). This email sent to ben(a)cogs.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/ patrice.brendamour%40uni-konstanz.de This email sent to patrice.brendamour(a)uni-konstanz.de This email sent to site_archiver(a)lists.apple.com

1 0

Re: PAM and the loginwindow.app
by Patrice Matthias Brend'amour 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com PAM is not the Problem... But the Loginwindow.app is.. --- Patrice Matthias Brend'amour patrice.brendamour(a)uni-konstanz.de University of Konstanz, Germany --- Am 14.02.2009 um 16:20 schrieb Ben Greenfield: Long story short. Here is the man page for pam on OS X. http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/pam… Ben On Feb 14, 2009, at 9:39 AM, Finlay Dobbie wrote: On Fri, Feb 13, 2009 at 8:06 PM, Patrice Matthias Brend'amour <patrice.brendamour(a)uni-konstanz.de> wrote: You may want to take a look at http://developer.apple.com/technotes/tn2008/tn2228.html -- Finlay _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/ben%40cogs.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/patrice.brendamour%40uni-… _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com It seems it doesn't use PAM at all. Otherwise i would see debug output from my module in the syslog. Or am I missing something? I may be missing the obvious... this may not be relevant at all to your situation In the past I was able to get an Open Directory server to act as the auth mechnism for linux and os x machines. The Linux machines were using pam to auth against the OD server and the OS X used the OD for auth as well. I used the dscl to set the homedir path The home directories were on a 3rd Linux machine, I used the dscl to set the homedir path for the os x and the linux machines. I was then able to use pam auth for SVN, ssh, webdav,.... for all the clients. It should be straight forward. Get pam auth working for the OS X clients and map the appropriate path for home dirs in the ldap server. Hi. I'm currently integrating 10 iMacs in an existing Linux computer pool for our students at the University of Konstanz. There we have an LDAP Server for authentication, no AD, no NFS/AFP. Authentication on OS X with LDAP works fine but I have a little problem with the homedirectories. Our sysadmins want me to mount the users home dir via sshfs to the mac. So far, no problem. Sshfs works on OS X. But we need to mount the homedir at login time (with the password). This email sent to ben(a)cogs.com This email sent to patrice.brendamour(a)uni-konstanz.de smime.p7s PGP.sig

1 0

Re: PAM and the loginwindow.app
by Ben Greenfield 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Long story short. Here is the man page for pam on OS X. http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/pam… Ben On Feb 14, 2009, at 9:39 AM, Finlay Dobbie wrote: On Fri, Feb 13, 2009 at 8:06 PM, Patrice Matthias Brend'amour <patrice.brendamour(a)uni-konstanz.de> wrote: You may want to take a look at http://developer.apple.com/technotes/tn2008/tn2228.html -- Finlay _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/ben%40cogs.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I may be missing the obvious... this may not be relevant at all to your situation In the past I was able to get an Open Directory server to act as the auth mechnism for linux and os x machines. The Linux machines were using pam to auth against the OD server and the OS X used the OD for auth as well. I used the dscl to set the homedir path The home directories were on a 3rd Linux machine, I used the dscl to set the homedir path for the os x and the linux machines. I was then able to use pam auth for SVN, ssh, webdav,.... for all the clients. It should be straight forward. Get pam auth working for the OS X clients and map the appropriate path for home dirs in the ldap server. Hi. I'm currently integrating 10 iMacs in an existing Linux computer pool for our students at the University of Konstanz. There we have an LDAP Server for authentication, no AD, no NFS/AFP. Authentication on OS X with LDAP works fine but I have a little problem with the homedirectories. Our sysadmins want me to mount the users home dir via sshfs to the mac. So far, no problem. Sshfs works on OS X. But we need to mount the homedir at login time (with the password). This email sent to ben(a)cogs.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: Waking up a network server: 2 threads + semaphore vs 1 thread + pipe
by Joel Reymont 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:references:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:mime-version :subject:date:cc:x-mailer; bh=CEcXG7kIZq/KU4VAVC5RyA1eRPwsViQUQxfZ8TEk23E=; b=lzetXVkdcdhPxSBdbCog2UYbjSFKnOWTzZmZ0E/6zLZffXX+rBiCOJn53HG7Ue9FNy K290l3IeCaUYcXz/0jJGaaqNw22byVrZQUFIzh6S059Vf65FJ66wDTxVXrl9xv+9lQao bMyAStDOti0TGL8Pch2VaifWrU1kkahNNYsug= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:message-id:from:to:in-reply-to:content-type :content-transfer-encoding:mime-version:subject:date:cc:x-mailer; b=JC2THptaEkmzP+NMjlus4ZFhCQjG73VGNF62r925zzYnDu2I77Cv6fdvPg7eTvge4q XPkV0+6Ay7mz7CEG9/LURNlJqciyMh9bseMKiUtvJ59yXDWy7KBaaYEJFmTZxFmy5jzu 8lh2T3DV/RuS6Exc3cyrUNY2ECceAdHqBmimc= Terry, On Feb 14, 2009, at 2:19 PM, Terry Lambert wrote: My apologies. Certain experts are not on every list... like you. Which is the best design and how efficient? Thanks, Joel --- http://tinyco.de --- Mac & iPhone _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Please do not crosspost, especially to subscription-required-to- reply lists. You've actually said almost nothing about your problem space, other than implying that the packets are network MTU sized or smaller by discounting UDP vs. TCP and therefore packet reassembly after fragmentation doesn't come into play.. I tried to give just enough background to make it suitable for the lists I was posting to. The problem space is real-time audio generation on the iPhone (VoIP or synthesized music) and the broadcast of said audio. The application is supposed to send, receive, mix microphone with generated audio and do it without stuttering. Imagine that the iPhone is an instrument and you are trying to put together a distributed orchestra. CoreAudio triggers a callback every few milliseconds to both ask for audio and to supply it. I'm using ring buffers to store generated audio and packets received from the network. I will need to invoke sendto (or CFSocketSendData) in a loop to deliver audio to clients but I don't think it's proper to do it from within the CoreAudio callback. I can wrap CFSockets around my native sockets and add them to the run loop but it seems from reading the source code that CFSocket may run a thread per socket. The "you can read" notification will be handled then and I'll just need to run a thread to iterate through my sockets and send the audio. I figure can wake up this thread from the CoreAudio callback by using a semaphore. Alternatively, I can track my sockets with select or kevent/kqueue and use the same mechanism to track a pipe and wake the sending thread. This will only require one thread since it will be woken up on both sends (byte put into a pipe) and receives. How efficient is it to put a byte into a pipe in a callback that gets triggered every few milliseconds? Would there be a significant gain since an extra thread is not required to wait on a semaphore? Would it even out since (intuitively) a pipe is slower? This email sent to site_archiver(a)lists.apple.com

1 0

Re: PAM and the loginwindow.app
by Finlay Dobbie 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:reply-to:in-reply-to :references:date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=jVbWxYmz7NvSRKYjEZ3TjHrxpIgVAPfG9LTL/RVtOWM=; b=WJtyvey0vQMSbGV5TLifU8spbx7GosRnTC9/OUGKnnTRLHltMYIE+SkFI1CZvsqa+q 6OanhAAXNNFtbRMNtwHgLK7UkU+1Q0nZfqgURYUtau9H6+SMjl4+4qOK8mins73YkivB 79fI/xw7ge54PTk+tREqt0nhEBo3AvwnlL+gU= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:content-transfer-encoding; b=OQuztx7TOuW1OEjbnAK0kvK1FqZs59wbb5Qg91zSDjx44o3AYFLsl7eBTYyM0v8Cr5 hR3Js9KkC/gO7im3wzkRmila+XRjB4/0sANsLNjqxt56Pztjs6k4FLpN8/5OF7FCNeHF laI1Blmp+RPcY79jTm8w8wvPd7T/HJVHpNrRI= On Fri, Feb 13, 2009 at 8:06 PM, Patrice Matthias Brend'amour <patrice.brendamour(a)uni-konstanz.de> wrote: > Hi. > I'm currently integrating 10 iMacs in an existing Linux computer pool for > our students at the University of Konstanz. > There we have an LDAP Server for authentication, no AD, no NFS/AFP. > Authentication on OS X with LDAP works fine but I have a little problem with > the homedirectories. > Our sysadmins want me to mount the users home dir via sshfs to the mac. So > far, no problem. Sshfs works on OS X. But we need to mount the homedir at > login time (with the password). You may want to take a look at http://developer.apple.com/technotes/tn2008/tn2228.html -- Finlay _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Waking up a network server: 2 threads + semaphore vs 1 thread + pipe
by Terry Lambert 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Feb 14, 2009, at 12:16 AM, Joel Reymont <joelr1(a)gmail.com> wrote: Which is the best design and how efficient? Thanks in advance, Joel --- http://tinyco.de --- Mac & iPhone _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/tlambert%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Please do not crosspost, especially to subscription-required-to-reply lists. You've actually said almost nothing about your problem space, other than implying that the packets are network MTU sized or smaller by discounting UDP vs. TCP and therefore packet reassembly after fragmentation doesn't come into play.. Suppose I'm trying to create a very efficient network server. I define efficiency as low latency and low CPU usage. The server is to run on the iPhone. The server will use one ring buffer each for sending and receiving data. I don't think it matters whether it's TCP or UDP for the purpose of this discussion. A producer is pumping out packets at high speed and there a main GUI thread with a run loop. One design would involve adding a CFSocket per connection to the run loop and using a separate thread and a semaphore to notify the network server that there's data to be broadcast to clients. I'm not sure if each CFSocket creates a separate thread or there's a thread managing all of them together. Not sure if it matters. There are at least two threads in this design and separate threads for network sending and receiving. Another design could use a pipe to wake up the network server and add it to the list of native sockets monitored by the server. This design could use either select or kqueue/kevent and may not need CFSocket. Sending and receiving here would run in a single thread since the pipe is just another descriptor to be monitored. How efficient is it to put a byte into a pipe in a callback that gets triggered every few milliseconds? Would there be a significant gain since an extra thread is not required to wait on a semaphore? Would it even out since (intuitively) a pipe is slower? This email sent to tlambert(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Problem with SampleD Daemon
by Susan Granger 14 Feb '09

14 Feb '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=7t2L18NAmZFuM/tGzXOhdInWxEiPd270v4CZnNX3aGY=; b=qkk4oGEyBsBbochzMBQ1esDtbB60XuOWSY5drf6EBCkJuu6wy5El0qahmFMB4y2Xns D0iJOjK6gQXM1zSjgpfecsdVrqIyOtjSEuSVT8+4XoBij5AA6+jxK3Yo+YClCyd35C2D PG1K2PSPLQEdp0rHVdrYrTbqA64UBKhkSLRRg= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=BDsBPrUJ6GjUaVWSIeZn+2q2F4fxiu62RrJ9JeO8O67fRD2TsdptG1Yg2Q54L9JpKk lZ9v+rExIFZnudEq1YxxgTVNZylVXkdiIpL+ofwV//esAK/Uk7+oofr24cF8+yEUdZtJ LPoJikrOCLYiUxK0u0FSvMJxDsjvzm3NkMcgA= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0