Getting started with Chrome OS Device Policy

One of the nice things about getting a Chrome OS device as part of ChromeBooks for Business is the policy control options.

After the device is enrolled in the domain, you have two device policies:

- allow / disallow guest

- restrict logins to specified accounts.

The latter takes wildcards so you specify *@domain.com so only members of your domain can log on.

To get device policies you need to enroll the device.

1. Start the Chromebook.
   Power up your Chromebook by pressing the power button on the top-right corner of the keyboard.
2. Select your language.
   On the "Let's get started" screen that appears, select the interface language to use by default. If prompted, select a keyboard input method too.
3. Connect to a network.
   Select a Wi-Fi network from the network menu.
4. Accept the terms of service.
   The Chromebook downloads any available system updates.
5. Before signing in to the Chromebook, press the key combination Ctrl-Alt-E.
   The enrollment screen appears. 
6. Enter the user name and password you received in your welcome letter from Google, or the user name and password for your existing Google Apps account if you have one.
7. Click Enroll device.
   The Chromebook is now enrolled and will follow the organizational policies you define.

If the device has already been setup either for another domain, or already has users configured, then you need to wipe the device and start again. For the Samsung Series 5:

1. Turn off the Chromebook.
2. Locate the black cover with a SIM card icon, on the right side of the device next to the USB port.
3. Open the black cover and gently move the switch underneath it to the right (toward the USB port) using a paper clip or a pen tip.
   Moving the switch to this position puts the Chromebook into Developer mode.
4. Start the Chromebook.
   The screen displays a sad face icon rather starting up immediately.
5. Press Ctrl-D to begin the wiping process.
   If you don't press Ctrl-D, the process starts automatically after 20 seconds. The Chromebook begins returning to its initial internal state. The process takes about 5 minutes. Do not turn off the Chromebook during the wiping process.
   The sad face icon appears again when the process is complete.
6. Press Ctrl-D again, or wait for 20 seconds.
   The initial sign on screen appears.
7. Turn off the Chromebook.
8. Return the switch from step 3 to its original position (away from the USB port, which is normal mode) and close the black cover.
9. Start the Chromebook.
10. Enroll the Chromebook before signing in to it.

There are a heap loads of user settings, of which the most interesting is likely the ability to control extensions.

Policy	Description
Extension IDs to allow	By default, the user can install any extension that does not appear in the list of Extension IDs to block. You only need to list an extension to this text box if the extension has an Extension ID that falls within the Extension IDs to block but you want to allow it.For example, if the Extension IDs to block is set to the wildcard *, all extensions are blocked except for the specific ones listed in the Extension IDs to allow text box.
Extension IDs to block	Specifies extensions that users are not allowed to install. Identify the extension by its Extension ID, with extensions separated by commas. The user can run any extension that does not appear in the list of Extension IDs to block.A value of * means all extensions are blocked unless they are explicitly listed in theExtension IDs to allow text box.
Extension to preinstall	Specifies extensions to install automatically. Users cannot uninstall these extensions.You must supply both the Extension ID and the URL where the extension is posted, separated by a semi-colon. For gallery extensions, the URL ishttps://clients2.google.com/service/update2/crx. For example, to install the Gmail Checker Extension, enter this string in the Extension to preinstall text box: mihcahmgecmbnbcchbopgniflfhgnkff;https://clients2.google.com/service/update2/crx  You can't preinstall any extension whose ID appears among the Extension IDs to block.

I wasn't able to find an easy way to get the ExtensionID and URL. Still working on that.

Moving email from one Google Apps account to another

As part of my digital clean up, I needed to move email from an account on one domain, to an account on another domain.

Google Apps used to have a good tool for this, it ran from the cpanel over IMAP, and was in essence a server-server tool, but this got deprecated. Now, you need to download the email locally from the source account / domain, and then upload to the destination account / domain.

On a Mac there are two ways how to do this: use MailFetcher and the Google Email Uploader.

The Email Uploader is very nice. It links to your Apple Mail or Thunderbird on your local machine, shows folders, and you can selective which folder to upload. You can also give the transferred folder a name so you can see it.

To get the email onto your local machine you need to use these instructions. You would need the domain admin to turn on IMAP first of course.

You may find that nor all messages can be moved across. The uploader won't move corrupt messages, messages that are not RFC 822 compliant, or messages with disallowed attachments eg .exe.

If the message is not RFC 822 compliant then you'll see "Invalid RFC 822 Message" in the window.

Message did not upload
   The operation couldn’t be completed. (Invalid RFC 822 Message: Date header "Sun, Dec 23 2001 13:26:12 +0000" is invalid.)
   /Users/user/Library/Mail/IMAP-user@domain.co.uk@imap.gmail.com/Email Saved.imapmbox/Messages/143660.emlx
  

I found that Mail did not see these messages either, so I couldn't use drag and drop, but since they are plain text you can view them using QuickLook in the finder, and decide if you really need them.



Also, if a folder / label has over 500 messages in it, you'll find progress quite slow after the 500. It gets to 500 really fast, maybe only a few minutes, depending on attachments. Thereafter you are limited to one message per second, so a folder with, say, 4000 message will take about an hour to upload. You might consider splitting a large folder up. You also likely parallelise things up, by running the uploader more than once, but I didn't try that. I know you can multiple GAMME uploads concurrently, to get around the ingestion limit.

Synology access to satashare over AFP

I use a Synology NAS with an eSATA HD for backup, and various Synology backup jobs to make sure my data is backed up.

And I wanted to check that the data is being backed up. But for some reason over AFP I couldn't see it. I could see it over SMB, and the Shared Folder control panel in DSM showed it as shared.

After some investigation I found that the user account must be enabled to see satashare over AFP.

Go into the 'user' control pane, select the user you want to have access to satashare and make sure the read/write box is ticked.

They should then be able to see satashare after connecting, either through the left hand side window onf the finder, or apple-k to connect.

Changing the email address of your Apple ID

As part of my clean up of my digital life, I decided to retire an email address, and my Apple ID was on that address so I needed to change it.

There's no doubt that changing the email address associated with things like your Apple ID can be scary. What if it goes wrong? Most folks have a lot of $$ / ££ / €€ invested in the iOS ecosystem.

BTW this doesn't solve the multiple Apple account problem. One day maybe Apple will solve this.

Here's the process (information gathered from Apple's help system, and personal experience).

1. sign out of your iOS devices:
   
   settings > store
   
   
   
   
   
2. sign out of itunes
   
   itunes > store > sign out
   
   
   
   
   
   
3. goto appleid.apple.com and follow instructions from support.apple.com/kb/HE40
   
   
   
   
4. login by selecting 'manage your account'. Use using existing (old) email address / password
    
5. in the section for "Primary Email Address", click edit
   
   put in new email address, click save, and it'll generate a verification email
   
6. If you try to run the verification too soon, you'll get an error saying something scary like the address is already in use.
   
   so, give it a few minutes, and re-login to iOS and iTunes, the try the verification again

OSX: Launching aplications as root

While looking for a solution to how to launch TrueCrypt as a root, when logged in as a plain user, I got the hang of a terminal command.

I thought I could also do it with an AppleScript. Turned out to be harder than I thought, but then I've never used ApleScript before.

First I got a copy of Pseudo, which was harder than I thought sice the author has disappeared. Eventually I found a copy here. NB these instructions WILL NOT work for Lion since Pseudo requires Rosetta, and Apple have done away with Rosetta.

1. Launch Pseudo and create a new launch document
   
   
   
   
   
   
2. Drag the TrueCrypt application icon onto that little window, and go to then Save
3. Create an AppleScript:
   
   tell application "Pseudo"
       open file "Mac:Users:user:documents:TC_Root.pseudo"
   end tell
   
   Fix the command to reflect the location of the .pseudo document.
   
   Save this an an application, put on the dock, and when you run the script it'll launch TrueCrypt for you, with a pop up for credentials.

OSX QuickLook plugins

One moment my Mac can QL my camera raw files (NEF and CRW) and the next it cannot, just producing a grey area on the screen. Did a whole lot of googling to see whats going on. Didn't find anything other than suggestion to re-install the current update (10.6.8). A restart seemed a less time consuming option first, which happily fixed the problem.

While digging, I found that 3rd parties can write their own QL plugins, and there's even a site for them, www.quicklookplugins.com

Some plugins struck me as immediately useful such as:

whomwah.github.com/qlstephen to read the suffix-less README, INSTALL and CHANGELOG files you get with downloaded source code and some apps.

Here is it being used to QL the install instructions of itself. Your recursion dollars at work :-)

www.kainjow.com/?p=77 to QL AppleScripts

If you use InDesign, InCopy, ASE, PostScript, EPS, Illustrator & Quark then www.metadesignsolutions.com/products/mac-osx-quicklook-adoview.php will be useful, and the increase in productivity surely worth the $9.99

Photoshop brush viewer.

For GIS try people.oregonstate.edu/~jennyb/gislook/

For more free ones take a look here.

When you've installed the QL plugin, you may need to force a refresh of the QL databse.

In terminal you can run some QL related commands:

$ qlmanage -r

refreshes the QL databse

$ qlmanage -p file.crw 

generates a preview. Handy to see if QL has the right plugin.

$ qlmanage -h 

gives all its options

Usage: qlmanage [OPTIONS] path...
    -h        Display this help
    -r        Force reloading Generators list
    -r cache    Reset thumbnail disk cache
    -m [name ...]    Display statistics about quicklookd. Stats names:
            * plugins    Show the generators list
            * server    Show quicklookd life information
            * memory    Show quicklookd memory consumption
            * burst        Show statistics about the last burst
            * threads    Show concurrent accesses stats
            * other        Show other information about quicklookd
    -d debugLevel    Integer between 1-4
    -p        Compute previews of the documents
    -t        Compute thumbnails of the documents
    -x        Use quicklookd (remote computation)
    -i        Compute thumbnail in icon mode
    -s size        Size for the thumbnail
    -f factor    Scale factor for the thumbnail
    -z        Display generation performance info (don't display thumbnails)
    -o dir        Output result in dir (don't display thumbnails or previews)
    -c contentType    Force the content type used for the documents
    -g generator    Force the generator to use

or you can do

$man qlmanage

NAME
     qlmanage -- Quick Look Server debug and management tool

SYNOPSIS
     qlmanage -r

     qlmanage -m [name ...]

     qlmanage -t [-d debugLevel] [-x] [-i] [-s size] [-f factor] [-c contentTypeUTI [-g generator]] [file ...]

     qlmanage -p [-d debugLevel] [-x] [-c contentTypeUTI [-g generator]] [file ...]

     qlmanage -h

DESCRIPTION
     qlmanage allows you to test your Quick Look generators and manage Quick Look Server.

     The following usages are available:

     1.       qlmanage -r resets Quick Look Server and all Quick Look client's generator cache.

     2.       qlmanage -m gets all sort of information on Quick Look server including the list of detected generators.

     3.       qlmanage -t displays the Quick Look generated thumbnails (if available) for the specified files.

     4.       qlmanage -p displays the Quick Look generated previews for the specified files.

     5.       qlmanage -h displays extensive help.

Convert squid timestamps to readable time

Squid uses Unix time for its timestamps, which is not human readable eg

Here's a perl script convert unix timestamp in squid access.log to normal time. I found it here www.terrencemiao.com/Webmail/msg00333.html.

Here's how to use it.

First create a file called squidtimeconvert.pl and open it for editing

touch ~/squidtimeconvert.pl
nano squidtimeconvert.pl

add the following lines

#! /usr/bin/perl -p
s/^\d+\.\d+/localtime $&/e;

save and exit

allow it to execute

chmod o+x squidtimeconvert.pl

then run it on the log file of your choice

~/timeconvert.pl /squid-access.2009-03-09