In short, I would say, that

• Apple opens up its pro software like FCP X and Mac OS X Server to the consumer, by making it easier to learn than ever before. A great strategy to sell more boxes and devices, which surely leads to greater turnover, and probably to more profit, too, as consumers buy easy tools and need support on a very low level only (if at all), which Apple can provide for cheap.
• Apple dumps all network products, which’s sole purpose was to help sell more client boxes to professionals in the enterprise or workgroup, like Xserves, Xserve RAIDS, Final Cut Server, and probably -on the long run- other products like Xsan metadata controllers and Mac OS X Server. In fact, I don’t think there is a big need for any of these products anymore, since Apple clients integrate just fine with Active Directory environments, most file servers, and many storage devices.
• I don’t think that this necessarily means Apple doesn’t care for the pros anymore. I think that FCP X is already quite powerful, and multicam support, FCP X APIs/XML interfaces, SDI connectivity and the like are going to be added to FCP sooner or later. Yet, I think Apple’s main market for FCP X is the single user or small workgroup. If you look at FCP X’s media import options, you’ll see the option “Create proxy media”: If you also look at the Sharing options: you’ll see that FCP X includes an option to export files and probably metadata to CNN iReport. I bet that FCP X’s powerful metadata management capabilities and the option to generate proxies during media import, are a very good basis to add iCloud support to FCP X. I guess that for many very small workgroups it would be great to simply send a proxy version of a project to the iCloud, so that another team member can edit a sequence and send it back to the original FCP X machine which has access to hires files to render the final output. This might be a very good Final Cut Server replacement for very small teams.

Making tools like FCP simpler than before doesn’t necessarily mean, that it’s not suited for pros anymore. Okay, right now it is not, but I am sure, it will soon be.

Yes, Apple has dumped Final Cut Server, which is the base for many postpro environments, now. But FCSvr meant to most of its customers, that you needed Xsan in place (most resellers and consultants were simply not able to design these systems right), that Open or Active Directory needed to work fine and that your Mac and Windows clients needed to be integrated into this directory infrastructure (and again, most service providers could not do these things properly).

This means it was very difficult to get a Final Cut Server infrastructure working, especially as so few people know how to make storage, asset management, Open or Active Directory, filesystem permissions, portable home directories and video editing clients work together smoothly.

In my opinion for many small shops it would be a great step to cut out all this overhead and move FCSvr into the cloud by adding an option to FCP X.

On the other hand, FCSvr leaves a big gap in the market, which tools like CatDV might fill: many shops do not want to publish their data into the cloud.
Especially in Europe people don’t like to store their business data on servers hosted either in the US or anywhere else by a US company, which might sooner or later grant access to these data to any kind of secret service.
This leaves a need for a local DAM in enterprise environments.

Personally, I would like to have a much easier DAM tool than anything on the market, something that can be set up without needing a consultant, at least for small environments. For bigger environments, I would say that if you work with FCSvr, you will be able to keep your current infrastructure and just replace either the FCSvr server software or probably the whole FCSvr machine to get something else up and running.

As FCSvr is so open, it is totally easy to export media and metadata to any other system.

I had a look at the new FCP X project files and the way FCP X stores files on a central storage. Even without the Apple API I think that there is a way to extract data easily and build them into your own asset management.

Being a consultant, my approach to Apple’s latest announcements is this:

• I recommend people to use Windows servers for directory management.
• Don’t know if Xsan will really be free in Lion. Still Xsan is a great tool, but I might recommend people to use StorNext metadata controllers at least if people need rack-mountable hardware.
• Apple builds wonderful standalone machines, which can be integrated into enterprise environments. In fact, now that Apple focuses on its core business – building great machines which are easy to use – and doesn’t care much about the enterprise network stuff around it, there’s more money in the game for third party developers who build DAM systems. I bet we’ll see great third party solutions soon and overall Apple kit will better fit into enterprise environments than today.

I feel that Apple’s approach on the pro market might leave us all with better tools in the end.
Let’s see.

Since Apple has discontinued the Apple Xserve in January 2011, there seems to be a growing need for rack mountable server hardware in the Apple world, which is more powerful than the Mac mini Server and takes less rack space and consumes less power than the Mac Pro.

If you want to run file services, directory services, software update services, and other services for Macs, Windows, and Linux clients, you’ll find both Linux and Windows based solutions to do just that. On the other hand, the Mac Pro and the Mac mini Server seem to be great systems to serve many of these things, too.

Yet, if you read the announcement of ActiveSAN, it seems as if there was a high demand for a 1U rack mountable metadata controller for Xsan environments.
What the guys at ActiveStorage seem to do is build great server hardware incl. nice monitoring and setup tools, which make it easy to set up a Quantum StorNext metadata controller to handle your Mac-based Xsan clients.

If you are an Xsan or StorNext pro anyway and work in the command line most of the day, you can even replace your existing Apple Xserve MDC with a Linux-based StorNext MDC with a minimal downtime of your Xsan volume. This is what you need:

• Server hardware which is able to run a recent Linux version. Make sure you add enough RAM, redundant drives for the boot disk, a nice and OS supported FC card, dual Gigabit Ethernet. Note: You can also use a Windows OS instead, which is nice if you integrate with Active Directory, but whatever you do, make sure, the OS of choice supports the LUN size you use in your Xsan setup. The ActiveSAN hardware looks like a very nice solution to this.
• I would go for CentOS as the MDC’s OS, as it’s officially supported by Quantum and doesn’t cost you money. If you need support, I would go for RedHat. See http://downloads.quantum.com/SNMS/4.1/StorNext%204.1%20Supported%20Platforms_V2.pdf for a list of supported MDC platforms.
• Make sure to integrate your MDC into your directory environment. Both Active Directory and Open Directory are supported. You will need this to use ACLs (the only way to properly deal with permissions in most Xsan environments).

Before you start buying the hardware to build the new MDC, you need to make sure, that you don’t have named streams enabled in your existing Xsan environment.

To actually migrate the volume from the Xsan MDC to the SNFS MDC, roughly follow these steps:

• Make sure to use matching filesystem versions in the Xsan environment and on your StorNext controllers.
• Run cvfsck -w on the Xsan volumes.
• On the primary Xsan metadata controller, save the folder /Library/Filesystems/Xsan/config to a place we can access easily later on, like a USB stick, e.g.
• Shut down the Xsan metadata controllers.
• Set up the StorNext controllers. The easiest way is to use the same IP addresses as for the Xsan metadata controllers.
• After installing the StorNext filesystem and -optionally- the Storage Manager, copy our Xsan volume’s config file into the StorNext controller’s config folder.
• Open the config file and delete the lines with the options “NamedStreams”, “EnableSpotlight”, and “SpotlightSearchLevel”.
• Optionally, make the volume managed by adding the appropriate option to its config file.
• Make sure to run chown www:adic on the config file as well as chmod 664
• Run cvfsck on the volume.
• Start the volume and mount it.
• You are done.

If you want to add Xsan clients to your StorNext controller, you find a nice article at http://krypted.com/xsan/adding-xsan-clients-to-stornext-environments/.

While this migration is something that can be done very easily, you need to consider, that StorNext currently doesn’t support Spotlight searches, so you can’t easily use the Finder to search for content. If your users navigate through the filesystem or use a DAM like Final Cut Server, this is not an issue at all. (On the other hand, the StorNext MDC catches all filesystem events, so I guess it should be possible to write a client, which collects these events and tells a dedicated Mac machine to add new files to the filesystem’s central Spotlight DB).

Another caveat is that the automatic HSM process in Storage Manager, which moves data to tape and restores them to disk as needed, restores data whenever a file gets invoked by a client. You either need to turn off previews in Finder to prevent constant restores, or you better hide the filesystem from the Finder and let your users access the filesystem through FCSvr and its edit-in-place option only.

One of the best things that come with the migration from Xsan to StorNext is that you can add additional functions (part of SNFS and/or SNSM) like filesystem replication, Distributed Data Mover, HSM functionality, writing to tape, etc.

In addition, SNFS has documented optimization settings for image sequences, which is very interesting for film production.

On the other hand, if you already own an Xserve which runs your Xsan, I would say that this is a great hardware to do just that.

Although I have done the migration described here in the lab, and found it reasonably easy, I am curious to see ActiveSAN as soon as it’s there, because it looks like they made the process of building a new Xsan/StorNext environment so much easier.

Both Rumpus and Kerio come with their own builtin webserver, so you can’t run all three services on the default port 80.

Your website should probably run on port 80 to make sure, everyone can access it without firewalls blocking access to it.

Rumpus and Kerio on the other hand, should better provide their web interfaces through an SSL secured connection, as people need to enter their passwords on these sites.

One thing you can do now, is to let Apache run on port 80 and serve your website only, while the Rumpus web interface runs on port 443 (the default SSL website), and the Kerio web interface on a non-default port.

Yet, if you want to make sure that both Rumpus and Kerio don’t get blocked by a firewall, you can use Apache as a reverse proxy, meaning, that Apache answers any port 80 and port 443 web requests, and then either answers requests itself (if someone asks for your website), or forwards requests to Rumpus or Kerio.

To do that, you can e.g. configure Kerio to serve its plain http web interface on port 81, while Rumpus serves its SSL web interface on port 8181.
We are going to serve Rumpus using the URL https://rumpus.example.com, while Kerio will reply to https://kerio.example.com.
We can’t use the same name for both services, as they use the same port, 443. Either the port or the site name need to be different.

Now create the SSL certificates for rumpus.example.com and kerio.example.com. Make sure, that your internal and external DNS resolve these names and point them to your server.

Write down the paths to the SSL keys. In my setup they look something like this:

webserver:~ root# cd /etc/certificates/
webserver:certificates root# ls -al
-rw-r--r-- 1 root wheel 1196 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.cert.pem
-rw-r--r-- 1 root wheel 1196 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.chain.pem
-rw-r----- 1 root certusers 2939 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.concat.pem
-rw-r----- 1 root certusers 1743 Jan 18 11:32 rumpus.example.com.1BA4694BA149ABABE6991681AEA863B9980D6CCD.key.pem
-rw-r--r-- 1 root wheel 977 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.cert.pem
-rw-r--r-- 1 root wheel 977 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.chain.pem
-rw-r----- 1 root certusers 1940 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.concat.pem
-rw-r----- 1 root certusers 963 Jan 17 22:37 kerio.example.com.A62BDDC503EC429F48F6AD7DA83BDE4584D9DF35.key.pem


Now create two empty websites in Server Admin => Web named kerio.example.com and rumpus.example.com. Make sure they use port 443 and the SSL certificates we just created.

On Mac OS X Server 10.6 change to /etc/apache2/sites and open the file 0002_any_443_rumpus.example.com.conf. Instead of 0002 you might find another number, but the rest of the file name should match.

Change the content to match 0002_any_443_rumpus.example.com.

Make sure you use the correct paths to your SSL certificate files. If you run Rumpus on any other port than 8181, make sure to reflect that in this config file.

Please notice, that this way Apache maintains an SSL connection to your web client, and it talks to Rumpus using SSL, too.

Now open the file 0003_any_443_kerio.example.com.conf. Again, instead of 0003 you might find another number. Change the content to match 0003_any_443_kerio.example.com.

Now Apache accepts SSL secured connections from the outside world and forwards them to Kerio using plain http.

Now type

sudo serveradmin stop web
sudo serveradmin start web

and try to connect.

If you got questions setting this up, please feel free to hire my services

If you are looking for iPad printing solutions, you might have come across funny approaches like this one, but this article is about a serious solution.

Credits: to use Mac OS X Server’s mail services to provide printing features for the iPad was Armin Briegel’s idea. You can follow him on Twitter. I was just the guy to write the few lines of code.

The idea is very easy: iPad’s iWork applications as well as other iPad apps can export PDF files, which you can send to an email address of choice.

If now you use a Mac OS X Server machine (can be a Mac mini server, e.g.) which runs mail services to print all PDF files sent to a specific address, you have an easy solution to the iPad printing “challenge”.

I guess you know how to set up Mac OS X Server 10.6 to run basic mail services, if not, read my wonderful O’Reilly book on it The book comes in german only, so see it as a chance to improve your german , or get in touch with O’Reilly, that you want it translated into english.

So this is how it works:

1. List available printers and test them

First open the Terminal on your Mac OS X Server 10.6 and type the following line to see which printers are available for our mail printer.
mothership:iPadPrint root# lpstat -a
EPSON_Perfection_2480_2580 accepting requests since Mon Aug 31 18:33:07 2009
Fax accepting requests since Tue May 11 21:25:40 2010
hp_deskjet_5550 accepting requests since Tue May 11 21:55:46 2010
In this example you see that there are three printers available on my machine, where the EPSON device actually is a scanner, and there is a Fax available, too, but imagine that there are multiple printers you might want to use.

Now try if you can print PDF files to one of your printers:
lp -d "hp_deskjet_5550" 1.pdf
In the line above replace “hp_deskjet_5550″ with the name of your printer. Replace “1.pdf” with the absolute file path of a pdf file.
If this works fine, go to the next step.

2. Set up printing mail accounts on Mac OS X Server

I assume that your Mac OS X Server runs as an Open Directory Master. Now open the Workgroup Manager and create a new mail account for your printer. In my case the user will be called “hp_deskjet_5550″, the domain is “andre-aulich.de”, so the complete email address will be “hp_deskjet_5550@andre-aulich.de”.

Note: If you don’t want some Internet folks printing thousands of pages on your machines, make sure that this machine can not be reached from the internet. If this is not possible, create a dedicated internal domain which can not be reached from outside.

This is how the new account looks like in Workgroup Manager:


Save theses settings, send an email without any attachements, and a second one with a PDF file as attachment to this account, and then open the Terminal and change into your dovecot’s mail directory:
mothership:mail root# cd /var/spool/imap/dovecot/mail
mothership:mail root# ls -al
total 0
drwxrwxr-x 10 _dovecot mail 340 Mar 25 09:56 .
drwxr-xr-x 4 root wheel 136 Aug 31 2009 ..
drwx------ 15 valerie mail 510 Nov 10 2009 14167B4C-211D-4AA9-A2B4-4641AD5C508B
drwx------ 25 andre mail 850 May 12 11:38 22D9FA73-A1CA-4981-AD37-3E06D7E4F457
drwx------ 13 public mail 442 Nov 10 2009 2AF362D6-E665-48D7-98AF-E347B055135A
drwx------ 11 ab mail 374 Mar 12 10:48 2EF9F9D2-69FD-4670-B1FE-2C8FC55D3675
drwx------ 16 ical mail 544 Jan 15 16:32 A1BB97FC-5E6D-491C-AAED-F8B9212FE3D3
drwx------ 10 hp_deskjet_5550 mail 340 Mar 25 09:56 B806EEC7-9C41-49B7-8D7C-DF507DFE21DF
drwx------ 16 sadmin mail 544 Nov 18 12:15 E8043686-DCCC-432F-BD96-85C400288357
drwxrwxrwx 7 andre mail 238 Nov 10 2009 Public
mothership:mail root# cd B806EEC7-9C41-49B7-8D7C-DF507DFE21DF/
mothership:B806EEC7-9C41-49B7-8D7C-DF507DFE21DF root# ls -al
total 32
drwx------ 10 hp_deskjet_5550 mail 340 Mar 25 09:56 .
drwxrwxr-x 10 _dovecot mail 340 Mar 25 09:56 ..
drwx------ 2 hp_deskjet_5550 mail 68 Mar 25 09:56 cur
-rw------- 1 hp_deskjet_5550 mail 84 Mar 25 09:56 dovecot-uidlist
-rw------- 1 hp_deskjet_5550 mail 8 Mar 25 09:56 dovecot-uidvalidity
-rw------- 1 hp_deskjet_5550 mail 0 Mar 25 09:56 dovecot-uidvalidity.4bab2555
-rw------- 1 hp_deskjet_5550 mail 220 Mar 25 09:56 dovecot.index.log
-rw------- 1 hp_deskjet_5550 mail 11 Mar 25 09:56 maildirsize
drwx------ 3 hp_deskjet_5550 mail 102 Mar 25 09:56 new
drwx------ 2 hp_deskjet_5550 mail 68 Mar 25 09:56 tmp
mothership:B806EEC7-9C41-49B7-8D7C-DF507DFE21DF root# cd new
mothership:cur root# ls -al
total 0
drwx------ 2 hp_deskjet_5550 mail 68 Mar 25 09:56 .
drwx------ 10 hp_deskjet_5550 mail 340 Mar 25 09:56 ..
-rw------- 1 hp_deskjet_5550 mail 1.3K May 12 12:02 1273658576.M795669P68535.mothership.intern,S=1327,W=1364:2,
-rw------- 1 hp_deskjet_5550 mail 1.3K May 12 12:03 1273658602.M6558P68554.mothership.intern,S=1325,W=1362:2,
-rw------- 1 hp_deskjet_5550 mail 77K May 12 12:05 1273658717.M385494P68662.mothership.intern,S=78367,W=79416:2,
-rw------- 1 hp_deskjet_5550 mail 77K May 12 12:05 1273658742.M267533P68676.mothership.intern,S=78365,W=79414:2,
What have we done here? Dovecot stores emails in /var/spool/imap/dovecot/mail. We list the content of the folder and see that each user has its own folder, named like the UUID of the user. If you don’t know how to look up the UUID of a user, or if you just don’t want to spend the time doing it, just look for the folder which is owned by our new printer user.
If you need to look up the UUID of our newly created user, you can also type
dscl /LDAPv3/127.0.0.1 -read /Users/hp_deskjet_5550 | grep apple-generateduid
in Terminal to get an output like this:
dsAttrTypeNative:apple-generateduid: C784550D-B2A6-4881-8DAF-0FC96D4BE8ED
Now you can search for the mail folder of our freshly created mail user.
In the code above we see that the folder B806EEC7-9C41-49B7-8D7C-DF507DFE21DF is owned by hp_deskjet_5550, so we change into this directory and list its contents. New mails will always be copied into the “new” folder, so we change into this directory and list its content, which already holds 4 emails in my case.

3. Extract attachments from emails and print them

First, make sure you have MacPorts installed, then install ripmime:
bash-3.2# port install ripmime
---> Computing dependencies for ripmime
---> Fetching ripmime
---> Attempting to fetch ripmime-1.4.0.6.tar.gz from http://lil.fr.distfiles.macports.org/ripmime
---> Verifying checksum(s) for ripmime
---> Extracting ripmime
---> Configuring ripmime
---> Building ripmime
---> Staging ripmime into destroot
---> Installing ripmime @1.4.0.6_0
---> Activating ripmime @1.4.0.6_0
---> Cleaning ripmime

Now, create a new directory and a bash script which we are going to use for further automation:
mkdir -p /usr/local/iPadPrint/
cd /usr/local/iPadPrint/
touch printpdfs
chmod +x printpdfs
Open the script using nano and insert the following code:
#!/bin/bash
TMPDIR="/usr/local/iPadPrint/tmp/"
mkdir -p /usr/local/iPadPrint/tmp/
for i in /var/spool/imap/dovecot/mail/C784550D-B2A6-4881-8DAF-0FC96D4BE8ED/new/*; do
if [[ "$(grep "Content-Type: application/pdf;" "$i")" == "" ]]; then
echo "Deleting file $i as it holds no pdf files."
rm "$i"
else
echo "Printing pdf attachment(s) of file $i"
/opt/local/bin/ripmime -i "$i" -d "$TMPDIR"
rm "$i"
fi
done
for i in "$TMPDIR"*; do
if [[ "$i" != *.pdf ]]; then
echo "$i deleted. No pdf file"
rm -r "$i"
else
echo "$i will be printed."
lp -d "hp_deskjet_5550" "$i"
rm "$i"
fi
done

You can also download the script from here. Just extract it, copy it into /usr/local/iPadPrint and make it executable.
Change /var/spool/imap/dovecot/mail/C784550D-B2A6-4881-8DAF-0FC96D4BE8ED/new/* to match your environment.
Now invoke the script.

It will extract all attachments out of your emails. If an email doesn’t contain a pdf file, it will be deleted without printing.
The tool will print all contained pdf files and delete everything after printing.

4. Automate it

To run this whenever a new email arrives in the account of our printer mail account, download this file, copy it into /Library/LaunchDaeomons, and make sure, its permissions look like this:
-rw-r--r-- 1 root wheel 458 May 12 13:38 de.andre-aulich.ipadprinter.plist
Change the line /var/spool/imap/dovecot/mail/C784550D-B2A6-4881-8DAF-0FC96D4BE8ED/new/ to match your environment.
Then load the job:
launchctl load -w /Library/LaunchDaemons/de.andre-aulich.ipadprinter.plist

Now Mac OS X Server 10.6 automatically discovers new print jobs you send via email and prints all included pdf files to the selected printer.

You can use this solution to work with multiple printers by simply creating more scripts and launchd jobs.

Hope this helps!

P.S.: Most cli commands need to be invoked as root user or with sudo.

Many of us would like to use Final Cut Server (FCSvr) as an archive solution to write high res media files to tape (or disks).
By default, FCSvr can write archives onto various file systems, but it can’t directly access tape drives.

Now download my little middleware tool fiprecon to connect Final Cut Server to Archiware PresSTORE in a way which can look like this:

Make sure to install fiprecon on your Final Cut Server system. The PresSTORE server can be a separate machine which fiprecon controls over the network, but fiprecon supports running FCSvr and PresSTORE on the same machine, too.

After the installation, run the config tool using

sudo /usr/local/fiprecon/bin/config.command

and enter the paths /usr/local/fiprecon/bin/postarchive.command and /usr/local/fiprecon/bin/prerestore.command as postarchive and prerestore script paths of your archive volume in FCSvr.

I recommend to set the retry count in FCSvr to 10 and the timeout setting to 300 seconds.

I wrote a detailed documentation about “Backup and Archive setups with Final Cut Server, Xsan, and PresSTORE”, which can be downloaded here and describes fiprecon in detail.

It also explains these topics:

• Archiving FCSvr assets on tape.
• Automatic archiving after x days
• Automatic archiving right after asset creation (great for moving video tape based archives into the digital world)

Please feel free to use both the tools and the documentation – they come for free.
If you need any customization, or any other kind of Final Cut Server consulting, please get in touch with me.

Looking forward for your feedback!

I will follow the setup guide described in my new book published by O’Reilly (in german). Everything will be done using a live demo system.

More information regarding entry fee, location, etc. can be found at http://www.lob.de/pics/BK04_Veranstaltung02032010.jpg.

I am looking forward to seeing you there!

It’s available in german and explains you how to set up your own mail, calendar, addressbook, and webserver based on Mac OS X Server 10.6 within no time.

You find more details about it at O’Reilly. The focus of the book is to use Mac OS X Server as the communication central for your Mac OS X, Windows, Linux, and iPhone users.

I’d appreciate your feedback!

If you want to change this behavior, you just need to open the file /etc/postfix/main.cf and change the line

header_checks = pcre:/etc/postfix/custom_header_checks

to

# header_checks = pcre:/etc/postfix/custom_header_checks

Afterwards, type

sudo postfix reload

to activate the new setting.

You could also change the rule set in /etc/postfix/custom_header_checks to do the same thing, yet, as currently the only rule in this file is to reject incoming mails with an empty subject, we can easily ignore the whole file like described above.

I will answer my emails before that, though…

By default Mac OS X Server lists all available group wikis at http://yoururl.com/groups, which you can easily change by editing (or renaming, deleting) the file /usr/share/wikid/lib/apple_templates/group_listing.xsl which generates the default group listing.