For many companies it is important that their laptop users can access external networks for email and Internet access (e.g. at home, in the hotel or at a customer’s site) or because they need to access your customer’s server while they are on-site.

This means that most likely you let your users add network settings on their own.

Yet, in many companies you find both public Wi-Fi networks with internet access but limited access to a company’s internal network and an ethernet network with full access to the internal network but limited access to the outside world.

Due to security restrictions in these environments it is not allowed to build a bridge between the public Wi-Fi and the internal ethernet network.
But if you let your users change network settings on their own, how do you make sure, that they don’t build that bridge, either on purpose or by accident?

One way to do this is to use a free tool like crankd, which allows you to monitor your network devices and to trigger scripts whenever something changes. crankd has become part of the PyMacAdmin tools, so don’t get confused by the name PyMacAdmin.

In this little tutorial, we use crankd to monitor the ethernet and the Wi-Fi device in a MacBook Pro running Mac OS X 10.6.x. As soon as we get a working Wi-Fi connection, we deactivate our ethernet connection.

First, download and extract crankd.
Cd into the extracted folder and invoke
sudo ./install-crankd.sh
to install crankd on you machine.

Now, create the folder /usr/local/bin:
sudo mkdir -p /usr/local/bin

Create the file /usr/local/bin/toggleEthernet.sh:
sudo nano /usr/local/bin/toggleEthernet.sh

and copy the following code into it:

#!/bin/bash
AirPortStatus="$(/usr/sbin/networksetup -getairportnetwork en1)"
# echo "${AirPortStatus}"
if [[ "${AirPortStatus}" =~ "AirPort power is currently off." ]]; then
echo "AirPort not running. Activating Ethernet interface."
/usr/sbin/networksetup -setnetworkserviceenabled Ethernet on
elif [[ "${AirPortStatus}" =~ "Current AirPort Network:" ]] || [[ "${AirPortStatus}" =~ "You are not associated with an AirPort network." ]]; then
echo "AirPort is running. Deactivating Ethernet interface."
/usr/sbin/networksetup -setnetworkserviceenabled Ethernet off
fi
echo "========================="
(You can instead load the file from here.)

Save this script by typing Control-W, and close nano by typing Control-X.
Connect your test machine to working ethernet and Wi-Fi networks and run the script to see if it works.

If it works as expected, copy this file (after unzipping it, of course) into /Library/Preferences/.

The interesting part in this crankd preference file is:

SystemConfiguration
State:/Network/Interface/en1/AirPort
command: /usr/local/bin/toggleEthernet.sh

which means, that crankd listens to our AirPort interface and runs the script /usr/local/bin/toggleEthernet.sh whenever something changes.

To start the crankd daemon during system startup, please download this file, unzip it and copy it into /Library/LaunchDaemons.

Set the correct permissions:
sudo chmod 644 /Library/LaunchDaemons/de.andre-aulich.runcrankd.plist
sudo chown root:wheel de.andre-aulich.runcrankd.plist

and load the job:

sudo launchctl load -w de.andre-aulich.runcrankd.plist

Now AirPort should be turned off automatically as soon as you activate your ethernet connection.

Note: if someone connects a USB ethernet interface to your laptop, this will not be watched by our example crankd configuration. If you need to monitor multiple ethernet interfaces, you need to customize the configuration files described here.

Using the tools mentioned here, you can allow your laptop users to manage their network settings on their own without building a bridge between internal ethernet network and public Wi-Fi connection.

Maybe you already know fiprecon, my little middleware between Final Cut Server and Archiware PresSTORE, which allows Final Cut Server to archive media on tape.
In this article I’ll explain how to install an extended version of fiprecon, which adds the following features to the basic version:

• recursive archiving and restoring of productions and FCP projects
• stores id, label and barcode of the tape on which an asset has been archived in the asset’s FCSvr metadata
• sends a mail to an administrator, if a tape needed for a restore process is not available. Includes a list of missing tapes, supports authorized mail sending

Please make sure you try this in your lab first, to make sure everything works as expected.

Please download this zip file, copy it to your computer and extract it.

Login to the Terminal using the same user credentials you used to install Final Cut Server.
Now create /usr/local/fiprecon:
mkdir -p /usr/local/fiprecon
Copy the contents of the fiprecon folder into it.

Install the launchd plist files into /Library/LaunchDaemons and set the permissions to
-rw-r--r-- 1 root wheel 429 May 4 2010 de.andre-aulich.aw2fcsvr.plist
-rw-r--r-- 1 root wheel 429 May 4 2010 de.andre-aulich.fcsvr2aw.plist
Launch them:
sudo launchctl load -w /Library/LaunchDaemons/de.andre-aulich.*
Now run the config tool:
sudo /usr/local/fiprecon/bin/config.command

Add this line to your /etc/sudoers file:
ALL ALL = NOPASSWD: /Library/Application\ Support/Final\ Cut\ Server/Final\ Cut\ Server.bundle/Contents/MacOS/fcsvr_client

Add this line to your /etc/newsyslog.conf file:
/usr/local/fiprecon/logs/activity.log 777 10 100000 * J

Now open your FCSvr admin panel and create these items:
Metadata fields:
Unicode Strings:

Boolean:

Category is always “None”.

Metadata groups:





Please add the fields “Send FCP Project To Archive” and “Restore FCP project from Archive” to the Asset Filter MD group:

Please add the fields “Send Production To Archive” and “Restore Production from Archive” to the Production Filter MD group:

Responses:

Command path is /usr/local/fiprecon/bin/archivefcpproject.command
Command Parameter is [Asset ID]

Command path is /usr/local/fiprecon/bin/archiveproduction.command
Command Parameter is [Production ID]

Command path is /usr/local/fiprecon/bin/restorefcpproject.command
Command Parameter is [Asset ID]

Command path is /usr/local/fiprecon/bin/restoreproduction.command
Command Parameter is [Production ID]

Subscriptions:





Devices:
Add /usr/local/fiprecon/bin/postarchive.command as a post-archive command to your archive device.
Add /usr/local/fiprecon/bin/prerestore.command as pre-restore command.

Now fiprecon should work like this:
1. You can still select one or more assets in the FCSvr client interface and send them to the archive.
2. Instead, you can also select an FCP project asset and archive/restore entire FCP projects:

3. The same works with productions:

4. After PresSTORE wrote a file to tape, fiprecon will write the tape id back to the item’s FCSvr metadata:

If you archive and restore the same asset multiple times, fiprecon pro will only store the tape ID of the latest archive process, as a normal restore process will always access the latest version only.
I added some functionality to send authenticated emails if tapes needed for a restore process are missing. You will get the idea when you run the config tool.

Enjoy!

If e.g. a media file has the file path /Volumes/MyBigStorage/MigratedFiles/cars/german/bmw/Z4_in_summer_with_blue_sky.jpg, then both the file path elements and the file name hold valuable asset metadata which you might want to use in your FCSvr DB.
If your FCSvr device has the file path /Volumes/MyBigStorage/MigratedFiles, then the relative path (called Location) stored in the asset’s metadata will be /cars/german/bmw, while the file name will be Z4_in_summer_with_blue_sky.jpg.

If now you search for

cars bmw

FCSvr won’t find this asset. You need to search for cars/german/bmw to find this asset, as FCSvr doesn’t support finding a single string when you search for multiple parts of it.

Your users expect to find the asset using the search string “cars bmw”, so we need to fix this. This article explains how to do this.

PLEASE NOTE: If you want to mirror your filesystem within Final Cut Server to help your users find their content using the same folder structure they are used to from the filesystem, please get in touch with me. I’ve got scripts which scan the filesystem and tell FCSvr to create folders and subfolders as productions and subproductions to do exactly this.

So what are we going to do?
Whenever a file is added to the FCSvr database, we want FCSvr to take the location and the filename, extract all valuable metadata as individual strings and add them to the metadata field “Keywords”. In our example, we would translate “/Volumes/MyBigStorage/MigratedFiles/cars/german/bmw/Z4_in_summer_with_blue_sky.jpg” into “cars german bmw Z4 in summer with blue sky jpg” and add this string to the Keywords field. We need to make sure that we don’t overwrite existing keywords.

To do this, please follow these steps:

1. On the FCSvr machine, open the Terminal and get root permissions. Now type:
   mkdir -p /usr/local/path2key/bin
mkdir -p /usr/local/path2key/logs
cd /usr/local/path2key/bin
touch path2key
chmod +x path2key
touch ../logs/path2key.log
chmod 777 ../logs/path2key.log
2. Now copy this text into /usr/local/path2key/bin/path:
   #!/bin/bash
   #
   ###################################################
   # path2key, copyright 2011 by www.andre-aulich.de #
   # This script accepts the asset id of a FCSvr #
   # asset as its only parameter. It then extracts #
   # the file path and adds all parts of the path as #
   # keywords to the asset's FCSvr metadata. #
   ###################################################

   # Define our variables and set up logging.
   PATH="/Library/Application Support/Final Cut Server/Final Cut Server.bundle/Contents/MacOS/":$PATH
   LOGFILE="/usr/local/path2key/logs/path2key.log"
   ASSETID="$1"
   echo "$(date)" >> "${LOGFILE}"
   if [[ "$1" == "" ]]; then
   echo "No asset ID given. Stopping." >> "${LOGFILE}"
   echo "---------------------------------------------------------" >> "${LOGFILE}"
   exit 0
   fi

   echo "Processing file path of asset ${ASSETID}." >> "${LOGFILE}"

   PATHKEYWORDS="$(fcsvr_client getmd /asset/${ASSETID} | grep "PA_MD_CUST_FILENAME:\|CUST_LOCATION:" | sed -e 's/CUST_LOCATION://' -e 's/PA_MD_CUST_FILENAME://' -e 's/^[ \t]*//' -e 's/^\///' -e 's/[\.\\\/-]/ /g' -e 's/_/ /g' | awk '{printf("%s", $0 (NR==1 ? " " : " "))}')"

   echo "Keywords extracted from file path are:" >> "${LOGFILE}"
   echo "${PATHKEYWORDS}" >> "${LOGFILE}"

   FCSVRKEYWORDS="$(fcsvr_client getmd /asset/${ASSETID} | grep "CUST_KEYWORDS" | sed -e 's/CUST_KEYWORDS://' -e 's/^[ \t]*//')"

   echo "Keywords extracted from FCSvr are:" >> "${LOGFILE}"
   echo "${FCSVRKEYWORDS}" >> "${LOGFILE}"

   COMPLETEKEYWORDS="$(echo ${FCSVRKEYWORDS} ${PATHKEYWORDS})"

   echo "Complete keywords are:" >> "${LOGFILE}"
   echo "${COMPLETEKEYWORDS}" >> "${LOGFILE}"
   sudo fcsvr_client setmd /asset/"${ASSETID}" CUST_KEYWORDS="${COMPLETEKEYWORDS}" >> "${LOGFILE}"

   echo "---------------------------------------------------------" >> "${LOGFILE}"

   
   or download this file instead and extract it. This script will later extract the metadata from the file path and the filename. It replaces . / \ – _ – against whitespaces.

3. Now open the FCSvr Administration window and create a new response using these data:
   • Response Action: Run an external script or command
   • Name: path2key
   • Command path: /usr/local/path2key/bin/path2key
   • Command Parameters: [Asset ID]
4. Create a Subscription using these data:
   • Subscribe to: Asset
   • Name: path2key
   • Enabled: needs to be activated
   • Event Type Filter: Created
   • Response List: path2key
5. To make sure our script can write to the FCSvr database, we need to add this line to /etc/sudoers/:
   ALL ALL = NOPASSWD: /Library/Application\ Support/Final\ Cut\ Server/Final\ Cut\ Server.bundle/Contents/MacOS/fcsvr_client
6. You might need to restart the FCSvr client interface, and probably the FCSvr server, too.

If now you upload some files to FCSvr, please look at their Keywords metadata field. The file path and file name elements should be added to the list of keywords, and now your users will be able to search for

bmw cars

to find your asset.

Hope this helps.

If you need more customization like this, I’d be happy to provide my services and help you develop your environment.

This version includes the following changes:

• Better handling of files with file names including double spaces (thanks for the hint, Matt Geller)
• Automatically deals with non default PresSTORE Archive Indices (thanks to Lars Petter Ommundsen at Video 4)
• Better config tool handling
• updated manual to reflect fsevents support of PresSTORE 4

You can pick it up at http://www.andre-aulich.de/en/perm/connecting-final-cut-server-to-archiware-presstore.

I thought about adding these features, too:

• Preventing duplicates in the archive
• Writing tape ID back into an asset’s metadata in FCSvr
• Automatic creation of temporary Archive folder, responses, and metadata fields in FCSvr during config process

Yet, right now I think that these features need to be customized for each installation, so I decided not to add it to a standard tool like fiprecon.

If you need one of these features, please feel free to get in touch with me.

Both Rumpus and Kerio come with their own builtin webserver, so you can’t run all three services on the default port 80.

Your website should probably run on port 80 to make sure, everyone can access it without firewalls blocking access to it.

Rumpus and Kerio on the other hand, should better provide their web interfaces through an SSL secured connection, as people need to enter their passwords on these sites.

One thing you can do now, is to let Apache run on port 80 and serve your website only, while the Rumpus web interface runs on port 443 (the default SSL website), and the Kerio web interface on a non-default port.

Yet, if you want to make sure that both Rumpus and Kerio don’t get blocked by a firewall, you can use Apache as a reverse proxy, meaning, that Apache answers any port 80 and port 443 web requests, and then either answers requests itself (if someone asks for your website), or forwards requests to Rumpus or Kerio.

To do that, you can e.g. configure Kerio to serve its plain http web interface on port 81, while Rumpus serves its SSL web interface on port 8181.
We are going to serve Rumpus using the URL https://rumpus.example.com, while Kerio will reply to https://kerio.example.com.
We can’t use the same name for both services, as they use the same port, 443. Either the port or the site name need to be different.

Now create the SSL certificates for rumpus.example.com and kerio.example.com. Make sure, that your internal and external DNS resolve these names and point them to your server.

Write down the paths to the SSL keys. In my setup they look something like this:

webserver:~ root# cd /etc/certificates/
webserver:certificates root# ls -al
-rw-r--r-- 1 root wheel 1196 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.cert.pem
-rw-r--r-- 1 root wheel 1196 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.chain.pem
-rw-r----- 1 root certusers 2939 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.concat.pem
-rw-r----- 1 root certusers 1743 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.key.pem
-rw-r--r-- 1 root wheel 977 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.cert.pem
-rw-r--r-- 1 root wheel 977 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.chain.pem
-rw-r----- 1 root certusers 1940 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.concat.pem
-rw-r----- 1 root certusers 963 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.key.pem


Now create two empty websites in Server Admin => Web named kerio.example.com and rumpus.example.com. Make sure they use port 443 and the SSL certificates we just created.

On Mac OS X Server 10.6 change to /etc/apache2/sites and open the file 0002_any_443_rumpus.example.com.conf. Instead of 0002 you might find another number, but the rest of the file name should match.

Change the content to match 0002_any_443_rumpus.example.com.

Make sure you use the correct paths to your SSL certificate files. If you run Rumpus on any other port than 8181, make sure to reflect that in this config file.

Please notice, that this way Apache maintains an SSL connection to your web client, and it talks to Rumpus using SSL, too.

Now open the file 0003_any_443_kerio.example.com.conf. Again, instead of 0003 you might find another number. Change the content to match 0003_any_443_kerio.example.com.

Now Apache accepts SSL secured connections from the outside world and forwards them to Kerio using plain http.

Now type

sudo serveradmin stop web
sudo serveradmin start web

and try to connect.

If you got questions setting this up, please feel free to hire my services

Many of us would like to use Final Cut Server (FCSvr) as an archive solution to write high res media files to tape (or disks).
By default, FCSvr can write archives onto various file systems, but it can’t directly access tape drives.

Now download my little middleware tool fiprecon to connect Final Cut Server to Archiware PresSTORE in a way which can look like this:

Make sure to install fiprecon on your Final Cut Server system. The PresSTORE server can be a separate machine which fiprecon controls over the network, but fiprecon supports running FCSvr and PresSTORE on the same machine, too.

After the installation, run the config tool using

sudo /usr/local/fiprecon/bin/config.command

and enter the paths /usr/local/fiprecon/bin/postarchive.command and /usr/local/fiprecon/bin/prerestore.command as postarchive and prerestore script paths of your archive volume in FCSvr.

I recommend to set the retry count in FCSvr to 10 and the timeout setting to 300 seconds.

I wrote a detailed documentation about “Backup and Archive setups with Final Cut Server, Xsan, and PresSTORE”, which can be downloaded here and describes fiprecon in detail.

It also explains these topics:

• Archiving FCSvr assets on tape.
• Automatic archiving after x days
• Automatic archiving right after asset creation (great for moving video tape based archives into the digital world)

Please feel free to use both the tools and the documentation – they come for free.
If you need any customization, or any other kind of Final Cut Server consulting, please get in touch with me.

Looking forward for your feedback!

Besides other topics the presentation deals with

• Rough Cut Editing
• FCSvr CLI
• XML and data exchange with other MAMs
• Automatic fetching of news feeds incl. XML metadata
• Working with growing clips
• Automatic XDCAM ingest
• FCSvr Archiving to tape

The presentation contains a great deal of demo parts, so not every topic will be explained in detail in the linked PDF file.

If you got any questions regarding the topics dealt with in the presentation, or if you’d like to hire me for one of these things, please use my feedback form to get in touch with me.

One of the big challenges is to discover issues before they become problems.

For this we use Nagios, an open source monitoring solution, which monitors our customers’ systems and informs us immediately if anything goes wrong.

Unluckily, in 2006 there were no appropriate Nagios plugins available which allowed for decent Xsan and Xserve monitoring, so ConSol* had to develop their own plugins, which we have been using at our client’s sites since then.

Today, you find an article at Xsanity, which describes how to install these plugins.

You can download the two plugins for free from the ConSol* Website.

Update: There’s also an article on the ConSol* site describing how to install and setup Nagios at http://www.consol.com/apple/tips-tricks/nagios-server-setup/.

After installing the Webalizer by copying the binary file webalizer to /usr/bin and creating the file /etc/webalizer.conf, you need to choose the appropriate settings. While this is documented on the webalizer site, it’s quite challenging to tell Webalizer how to deal with Apache’s rotating log files.

In Mac OS X Server, Apache regularly rotates its log files (depending on the settings you choose). This is good, because otherwise, with only one large log file, it could take hours for the webalizer to analyze this file. Yet, after each rotation, the log file has a new name.

There are basically three ways to deal with this: 1. you could change Apache’s behaviour of rotating log files. This isn’t as trivial as it sounds, so I decided not to go this way. 2. you can manually change the log file path in /etc/webalizer.conf. You need an ssh access to do this and it’s quite bothering me to do this regularly. Or, 3., you use the little script named webstat, I just wrote, to automize this.

Just download and unzip it, then copy it to /usr/bin and make sure, that you uncomment the line with the log file path in your /etc/webalizer.conf.
Now you can invoke the Webalizer by typing

/usr/bin/webstat

or by creating a cron or launchd job.

E.g., if you want to update your web statistic once an hour, a cron job that does this could look like this:

0 * * * * root /usr/bin/webstat

If instead you prefer to use launchd to invoke our script, download this plist file to your Desktop, unzip it, and copy it into

/Library/LaunchDaemons/

This file tells launchd to invoke our script every morning at 0:23 o’clock.
Change this time to fit your needs.

Now load it into launchd:

sudo launchctl load -w /Library/LaunchDaemons/de.andre-aulich.webalizer.plist

If at the end of this command’s output

sudo launchctl list

you see something like this

de.andre-aulich.webalizer.plist

everything’s fine.

Check

sudo tail -f /var/log/system.log

to see if our new launchd job causes some trouble.
If you don’t see any error messages, our script is running.

An example /etc/webalizer.conf file can look this this:


#
# Sample Webalizer configuration file
# Copyright 1997-2000 by Bradford L. Barrett (brad@mrunix.net)
#
# Distributed under the GNU General Public License. See the
# files "Copyright" and "COPYING" provided with the webalizer
# distribution for additional information.
#
# This is a sample configuration file for the Webalizer (ver 2.01)
# Lines starting with pound signs '#' are comment lines and are
# ignored. Blank lines are skipped as well. Other lines are considered
# as configuration lines, and have the form "ConfigOption Value" where
# ConfigOption is a valid configuration keyword, and Value is the value
# to assign that configuration option. Invalid keyword/values are
# ignored, with appropriate warnings being displayed. There must be
# at least one space or tab between the keyword and its value.
#
# As of version 0.98, The Webalizer will look for a 'default' configuration
# file named "webalizer.conf" in the current directory, and if not found
# there, will look for "/etc/webalizer.conf".

# HTMLHead defines HTML code to insert within the
# block, immediately after the

In this example the webalizer writes the stat pages into /Library/WebServer/Documents/stats, so Mac OS X Server’s default web directory needs a subdirectory calles ‘stats’.

Of course you can protect this subpage with a password using a realm in Server Admin.

Good luck!

While preserving as much information as possible is really useful, in some cases you might want to have an archive folder with write permissions for administrators and read-only permissions for users. I’ve seen prepress environments in which artists are supposed to copy files from a read-only volume to their local Desktop where they can then edit the copies. Yet, in a standard Mac OS X Server / Mac OS X environment they can not edit these files anymore.

To change this, we can set up an ACL entry for each user’s Desktop folder, that lets each user edit any file or folder on his or her own Desktop.

Download the following script, extract it, and run it on your server if you use server-based home directories or on your client machines if you use local home directories. If you work with portable home directories, I guess that invoking this script on your server only should be sufficient, too.

Here’s the script:
SetDesktopACLs.zip
After extracting it, open Terminal and type:

sudo -s

Enter your password, drag the extracted file into the Terminal application and press Enter.
If your home directories are not located in /Users, please change the path in the script.
In case ACLs are not activated on your client yet (they are turned off by default), the script automatically turns them on by invoking

fsaclctl -p / -e

If you have multiple clients, you can select them in ARD, choose “UNIX”, enter the code of the script, and let it run as root. This way you can enable ACLs remotely.

The script writes an ACL entry into each user’s Desktop folder that allows for writing and deleting.

Be careful and try this in a test environment first.