# Presentation: 906043

## Managing Macs in an Enterprise

**National Laboratories Information Technology Summit**
**June 2007**
**Brian Wallace**
- Technical Specialist

## History of Mac Management at Oak Ridge National Laboratory

**Self managed**
**Security Requirements**
**Passwords**
**Login Banners**
**Screen Savers**
**Virus Software**
**Backups**

## Defense in Depth (DiD) Project 2006

- Defense in Depth (DiD) Project 2006

**Initial Tools**
**Apple Remote Desktop (ARD)**
**Virex and ePolicy Orchestrator (ePO)**
**Active Directory (A/D)**
**XServe Servers**
**Early Problems**
**ARD Performance**
**A/D Authentication**
**Reporting**

## Defense in Depth (DiD) Project 2007

- Defense in Depth (DiD) Project 2007

**Deployment of LANrev**
**Apple Remote Desktop and LANrev Comparison**
**LANrev Server/Admin/Agent Components**
**Agent Deployment**
**Reporting with LANrev**
**Builtin Reports**
**Custom Reports**

## Defense in Depth (DiD) Project 2007

**Cyber Security Report (CSR) System**
**General Overview of System**
**How LANrev Feeds Data to CSR**

**CSR**

**Network **
**Registration**

**Microsoft’s**
** ****SMS**

**RedHat**
**Patch Server**

**Active**
**Directory**

**ePolicy**
**Orchestrator**

**LanRev**

**Apple Remote**
**Desktop**

**Virex**

**Pointsec**

**Syslog**

**Password**
**Management**

**SSH Access**
**By Core IT**

## Future Work

**New Intel XServer Servers**
**Patch Updating**
**Disk Imaging**
**Good/Bad Software Reporting**

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Admin Program

## LANrev Networking

- LANrev Server

- LANrev Server
- Software Distribution Server
- Staging Server

- Internal Ethernet Network
- LANrev Agent

- Internal Wireless Network
- LANrev Agent

- External Network
- LANrev Agent

- LANrev Admin

- LANrev Admin

## LANrev Database

**LANrev 4.0.4 Sqlite Databases**
**ServerCommandDatabase.db**
**ServerDatabase.db**
**Tables Used for Reporting**
**agent_info**
**agent_processes**
**commandqueue_history**
**hardware_info**
**heartbeat**
**installed_software_info**
**network_adapter_info**
**software-info**

## LANrev Reporting

**Cron Job Runs on LANrev Server Daily**
**Scripts Access the LANrev Database**
**Extracted Data is Formatted and Copied to a Central Server for the Cyber Security Report (CSR) System****	**
**Software Tools**
**Sqlite Command Line Tool**
**Shell Scripts**
**Perl Scripts**
**Format of the Report Data**
**MAC Address**
**Date**
**Report Specific Data****	**

## LANrev Reporting

- Mac
- Admin Account
- Scripts

**lanrev_report**

**mac_admin**

**mac_admin1**

**mac_admin2**

**mac_admin3**

**mac_admin4**

**sqlite3**
**sql_admin**

- (run nightly by cron)

- (1 of 7 report scripts)

## lanrev_report

- #!/bin/sh
- #
- # lanrev_report - Report Mac DiD data
- #
- #       mac_admin.txt     Mac admin account data.
- #       mac_ard1.txt      Mac ARD data based on software inventory.
- #       mac_ard2.txt      Mac ARD data based on processes.
- #       mac_filevault.txt Mac FileVault account data.
- #       mac_lanrev1.txt   Mac LANrev data based on software inventory.
- #       mac_lanrev2.txt   Mac LANrev data based on processes.
- #       mac_notebook.txt  Mac notebook data.
- #       mac_os.txt        Mac OS version data.
- #       mac_virus1.txt    Mac virus data based on software inventory.
- #       mac_virus2.txt    Mac virus data based on processes.
- #
- # Written by: Brian Wallace, Oak Ridge National Laboratory
- #
- # History: 02/09/2007 - Created file.
- #          02/22/2007 - Added admin account data.
- #          02/27/2007 - Added FileValut account data.
- #          03/14/2007 - Added OS version data.
- #          03/28/2007 - Added notebook data.
- #
- #
- # Variables
- #
- HOME=/Users/admin/Documents/LANrev
- SCP=/usr/bin/scp
- #
- # Create Mac admin account data
- #
- $HOME/mac_admin
- #
- # Create Mac ARD data
- #
- $HOME/mac_ard1
- $HOME/mac_ard2

## lanrev_report

- #
- # Create Mac FileValut account data
- #
- $HOME/mac_filevault
- #
- # Create Mac LANrev data
- #
- $HOME/mac_lanrev1
- $HOME/mac_lanrev2
- #
- # Create Mac notebook data
- #
- $HOME/mac_notebook
- #
- # Create Mac OS version data
- #
- $HOME/mac_os
- #
- # Create Mac virus data
- #
- $HOME/mac_virus1
- $HOME/mac_virus2
- #
- # Copy data to home1.ornl.gov
- #
- # Note: Uncomment mac_*1 for software inventory data and mac_*2 for process data
- #
- $SCP -p $HOME/mac_admin.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_admin.txt
- #$SCP -p $HOME/mac_ard1.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_ard.txt
- $SCP -p $HOME/mac_ard2.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_ard.txt
- $SCP -p $HOME/mac_filevault.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_filevault.txt
- #$SCP -p $HOM_[Word](file:///../../../Application%20Data/Microsoft/Internet%20Explorer/Quick%20Launch/Word.lnk)_E/mac_lanrev1.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_lanrev.txt
- $SCP -p $HOME/mac_lanrev2.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_lanrev.txt
- $SCP -p $HOME/mac_notebook.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_notebook.txt
- $SCP -p $HOME/mac_os.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_os.txt
- #$SCP -p $HOME/mac_virus1.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_virus.txt
- $SCP -p $HOME/mac_virus2.txt didit@home1.ornl.gov:/usr/local/adm/macdid/mac_virus.txt

## mac_admin

- #!/bin/sh
- #
- # mac_admin - Dump Mac admin account data from LANrev database.
- #
- # Written by: Brian Wallace - Oak Ridge National Laboratory
- #
- # History: 02/27/2007 - Created file.
- #          03/29/2007 - Added uniq command.
- #          04/12/2007 - Added reverse sort and mac_admin4.
- #
- #
- # Variables
- #
- HOME="/Users/admin/Documents/LANrev"
- SQLITE="/Users/admin/Documents/LANrev/sqlite3"
- LANREVDB="/Library/Application Support/LANrev Server/ServerDatabase.db"
- SORT=/usr/bin/sort
- UNIQ=/usr/bin/uniq
- RM=/bin/rm
- #
- # Get admin account data
- #
- $SQLITE "$LANREVDB" < $HOME/sql_admin > $HOME/mac_admin1.dat
- #
- # Split admin account data
- #
- $HOME/mac_admin1
- #
- # Edit admin account data
- #
- $HOME/mac_admin2
- #
- # Format admin account data
- #
- $HOME/mac_admin3

- #
- # Reverse sort admin account data
- #
- $SORT -r $HOME/mac_admin4.dat > $HOME/mac_admin5.dat
- #
- # Remove old admin account data
- #
- $HOME/mac_admin4
- #
- # Sort admin account data
- #
- $SORT $HOME/mac_admin6.dat > $HOME/mac_admin7.dat
- #
- # Remove duplicate admin account data
- #
- $UNIQ $HOME/mac_admin7.dat $HOME/mac_admin.txt
- #
- # Remove work files
- #
- $RM $HOME/mac_admin?.dat

## sql_admin

- .separator "\t"
- attach "/Library/Application Support/LANrev Server/ServerCommandDatabase.db" as main2;
- select a.PrimaryMACAddress,
-        substr(b.last_modified,1,10),
-        quote(b.CommandResultParameters)
- from main.heartbeat a,
-      main2.commandqueue_history b
- where a.AgentSerial=b.AgentSerial
- union all
- select b.MACAddress,
-        substr(c.last_modified,1,10),
-        quote(c.CommandResultParameters)
- from main.agent_info a,
-      main.network_adapter_info b,
-      main2.commandqueue_history c
- where a.id=b.agent_info_record_id and
-       a.AgentSerial=c.AgentSerial and
-       b.AdapterName not like "%Parallels%" and
-       b.MACAddress<>"";
- .exit

## mac_admin1

- #!/usr/bin/perl
- #
- # mac_admin1 - Split LANrev Unix Shell Script database records
- #
- # Written by: Brian Wallace, Oak Ridge National Laboratory
- #
- # History: 03/14/2007, Created file.
- #
- $file_in  = "/Users/admin/Documents/LANrev/mac_admin1.dat";
- $file_out = "/Users/admin/Documents/LANrev/mac_admin2.dat";
- open(IN_FILE,  "<$file_in")  or die "Error opening input file: $file_in\n";
- open(OUT_FILE, ">$file_out") or die "Error opening output file: $file_out\n";
- #
- # Process results from LANrev Unix script command
- #
- foreach $line (<IN_FILE>)
- {
-     chomp($line);
-     #
-     # Split LANrev database records
-     #
-     if ($line =~ /^(.*?)\t(.*?)\t(.*?)$/)
-     {
-         $mac    = $1;
-         $date   = $2;
-         $result = $3;
-         printf(OUT_FILE "%s\n", $mac);
-         printf(OUT_FILE "%s\n", $date);
-         if ($result =~ /^X'(.*?)'$/)
-         {
-             $hex = $1;
-             $plist = $hex) =~ s/([a-fA-F0-9]{2})/chr(hex($1))/eg;
-             printf(OUT_FILE "%s", $plist);
-         }
-         else
-         {
-             printf(OUT_FILE "\n");
-         }

-     }
- }
- close(OUT_FILE);
- close(IN_FILE);
- exit;

## mac_admin2

- #!/usr/bin/perl
- #
- # mac_admin2 - Edit LANrev Unix Shell Script database records
- #
- # Written by: Brian Wallace, Oak Ridge National Laboratory
- #
- # History: 02/27/2007, Created file.
- #          04/09/2007, Added check for result header.
- #
- $file_in  = "/Users/admin/Documents/LANrev/mac_admin2.dat";
- $file_out = "/Users/admin/Documents/LANrev/mac_admin3.dat";
- open(IN_FILE,  "<$file_in")  or die "Error opening input file: $file_in\n";
- open(OUT_FILE, ">$file_out") or die "Error opening output file: $file_out\n";
- #
- # Process results from LANrev Unix script command
- #
- $mac    = "";
- $date   = "";
- $result = "";
- $eor    = 1;
- foreach $line (<IN_FILE>)
- {
-     chomp($line);
-     #
-     # MAC address
-     #
-     if ($line =~ /^..:..:..:..:..:..$/)
-     {
-         $mac = $line;
-         next;
-     }
-     #
-     # Date
-     #
-     if ($line =~ /^....-..-..$/)
-     {

-         $date = $line;
-         next;
-     }
-     #
-     # Start of result
-     #
-     if ($line =~ /^(.*?)<string>(.*?)$/)
-     {
-         $result = $2;
-         if ($result eq "Mac Admin Accounts")
-         {
-             $eor = 0;
-         }
-         next;
-     }
-     #
-     # Next result or end of result
-     #
-     if ($eor == 0)
-     {
-         if ($line =~ /^(.*?)<\/string>(.*?)$/)
-         {
-             $mac    = "";
-             $date   = "";
-             $result = "";
-             $eor    = 1;
-         }
-         else
-         {
-             $result = $line;
-             printf(OUT_FILE "%s\t%s\t%s\n", $mac, $date, $result);
-         }
-     }
- }
- close(OUT_FILE);
- close(IN_FILE);
- exit;

## mac_admin3

- #!/usr/bin/perl
- #
- # mac_admin3 - Create data file of Mac admin accounts
- #
- # Written by: Brian Wallace, Oak Ridge National Laboratory
- #
- # History: 03/14/2007, Created file.
- #
- $file_in  = "/Users/admin/Documents/LANrev/mac_admin3.dat";
- $file_out = "/Users/admin/Documents/LANrev/mac_admin4.dat";
- $mac    = "";
- $date   = "";
- $admins = "";
- $admin  = "";
- $uid    = "";
- $flag   = 0;
- open(IN_FILE,  "<$file_in")  or die "Error opening input file: $file_in\n";
- open(OUT_FILE, ">$file_out") or die "Error opening output file: $file_out\n";
- #
- # Process the Mac admin accounts
- #
- foreach $line (<IN_FILE>)
- {
-     chomp($line);
-     #
-     # Get MAC address, date and admins
-     #
-     if ($line =~ /^(.*?)\t(.*?)\tadmin:\*:80:(.*?)$/)
-     {
-         $mac    = $1;
-         $date   = $2;
-         $admins = $3;
-         $flag   = 1;
-         #
-         # Get admin names
-         #

-         while ($flag)
-         {
-             if ($admins =~ /^(.*?),(.*?)$/)
-             {
-                 #
-                 # Next admin account
-                 #
-                 $admin  = $1;
-                 $admins = $2;
-             }
-             else
-             {
-                 #
-                 # Last admin account
-                 #
-                 $admin = $admins;
-                 $flag  = 0;
-             }
-             #
-             # Check for possible UCAMS account
-             #
-             if (length($admin) == 3)
-             {
-                 $uid = $admin;
-             }
-             else
-             {
-                 $uid = "";
-             }
-             #
-             # Write record for admin account
-             #
-             printf(OUT_FILE "%s|%s|%s|%s\n", $mac, $date, $admin, $uid);
-         }
-     }
- }
- close(OUT_FILE);
- close(IN_FILE);
- exit;

## mac_admin4

- #!/usr/bin/perl
- #
- # mac_admin4 - Remove old Mac admin account data
- #
- # Written by: Brian Wallace, Oak Ridge National Laboratory
- #
- # History: 04/12/2007, Created file.
- #
- $file_in  = "/Users/admin/Documents/LANrev/mac_admin5.dat";
- $file_out = "/Users/admin/Documents/LANrev/mac_admin6.dat";
- open(IN_FILE,  "<$file_in")  or die "Error opening input file: $file_in\n";
- open(OUT_FILE, ">$file_out") or die "Error opening output file: $file_out\n";
- #
- # Process the Mac admin accounts
- #
- $last_mac     = "";
- $last_date    = "";
- $last_account = "";
- $old_data     = 1;
- foreach $line (<IN_FILE>)
- {
-     chomp($line);
-     #
-     # Get MAC address, date and account
-     #
-     if ($line =~ /^(.*?)\|(.*?)\|(.*?)$/)
-     {
-         $mac     = $1;
-         $date    = $2;
-         $account = $3;
-         if (!$old_data)
-         {
-             printf(OUT_FILE "%s|%s|%s\n", $last_mac, $last_date, $last_account);
-         }

-         if ($mac ne $last_mac)
-         {
-             #
-             # Start of new data
-             #
-             $old_data = 0;
-         }
-         else
-         {
-             if ($date ne $last_date)
-             {
-                 #
-                 # Start of old data
-                 #
-                 $old_data = 1;
-             }
-         }
-         $last_mac     = $mac;
-         $last_date    = $date;
-         $last_account = $account;
-     }
- }
- if (!$old_data)
- {
-     printf(OUT_FILE "%s|%s|%s\n", $last_mac, $last_date, $last_account);
- }
- close(OUT_FILE);
- close(IN_FILE);
- exit;

## LANrev Reporting

- Active Directory

- Mac Virus Software

- ARD Client

- FileVault on Notebooks

- LANrev Client

- Mac OS Version

- Mac Notebooks

- Admin Accounts

**Notes:**
Review the various constituencies/stakeholders to whom you answer — you have already mentioned the “bosses” (UT-Battelle, Battelle, DOE, Congress) in Part I, so you can remind your audience of that and add in the community, then go on to the “UT-Battelle in 2000 and Today” piece (which was developed for ETEC and Friends of ORNL) and the CEO report (which we’ll use for future reports to staff and the community). 
WHO HAS BEEN HERE:
June: Zach Wamp (S&T Park announcement, Tennessee Valley Summit), Clay Sell
July: Chinese Academy of Sciences, meeting with Mentor-Protege companies, visitors from RIKEN (Japan), visitors from Tennessee Eastman, Coach Phil Fulmer
August: UT-Battelle Board of Governors, UT strategic planning meeting, Vanderbilt “Roads Scholars,” dedication of Iran Thomas Auditorium at SNS/Oak Ridge Schools event, visitors from AECL (Canada), Admiral Kirkland Donald from DOE Naval Reactors, Congresswoman Marsha Blackburn
September: State Senator Ron Ramsey, U.S. Ambassador Christina Rocca, ITER Lehman Review, Dr. Tom Cruse from Air Force Research Laboratory, DHS Under Secretary Robert Zitz
October: LCF Lehman Review, Kirk Levedahl from DOE-NE
November: Visitors from KAERI (Korea)
December: Traveling to India

## More In-Depth Presentations related to ORNL’s Defense in Depth Project

**Network Enhancements for Defense in Depth at ORNL***Clark Piercy*
**Managing Unix/Linux at ORNL** *Brett Ellis*
**Defense in Depth Reporting at ORNL** *Steve Parham*
**Managing Macs in an Enterprise** *Brian Wallace*
**Quarantine:  Controlling Network Access Using DHCP***James Calloway*
**Network Access Control at ORNL***Paige Stafford*

## Questions

**Brian Wallace**
**Oak Ridge National Laboratory**
_**[wallacebs@ornl.gov](mailto:wallacebs@ornl.gov)**_