Troubleshooting Lab Macs

General Publications

http://www.cs.uwaterloo.ca/cscf/student/maclabs2006

Recovery of files: BackupMacs

Caution - Do NOT login concurrently to more than one machine!

The lab Macs use network home directories. The login / logout hooks provide some temporary links to the local disk to improve performance, and then remove them at logout. Any machine already logged on will be in an unstable state after you log out of another machine.

Login Problems

• authentication requires Student Active Directory (cs-teaching) credentials
• use only the first 8 characters of the username
• use entire password, even if it's longer than 8 characters, if the user set it in 2011 via https://www.student.cs.uwaterloo.ca/password/
  • if user set it before 2011, use only the first 8 characters of the password (and no funnies - use "aA1" character set)
• rejected passwords have to be re-set:
  • on the web, logged in with their WatIAM password, via https://www.student.cs.uwaterloo.ca/password/
  • with passwd on a student cpu host, such as cpu02.student.cs
• it is now very unlikely that other rejections will happen because a user is not in a group that has lab access;
  • anyone with an active account in the CS Student Active Directory Domain (CS-TEACHING) should be able to login to a lab Mac
  • any Math and specifically any CS student, or Instructor, or Tutor, or student in a CS course has access; any ISG or CSCF staff has access
  • the verification test - get the student to log in to the Mac in the Consultant's office; there are NO group restrictions, all that is required is a valid account and password in the Active Directory
    • if login still fails; then suspect a password change is required (see above)
• if no-one can log in:
  • suspect that the time is incorrect (AD and Kerberos allow only small differences in time between client and server); a reboot may fix it; otherwise, sometimes they "lose" the configuration and a local administrator login is required to change the System Preference, Date and Time, to "automatic" from ntp.student.cs.uwaterloo.ca
  • we have had a couple of instances where the Domain information cached on the Mac becomes corrupt; preventing user login; and preventing administrator ability to bind/unbind the machine to the Active Directory - see ST#70642 for local administrator actions to repair
• login / operation may be very slow if the student Fileserver is heavily loaded
• Several times student accounts have been accidentally orphaned - the symptom is that they can authenticate, but then not "do" anything, effectively they do not have permissions on their home directory after it is mounted. Support people have to un-orphan them, and make sure it doesn't happen again - could have been caused by bad Registrar data for example.
• If students have trouble logging in for a lab exam, we have had cases where it is their first attempt of the term. If they didn't attend the first lab and re-set their password, a process about a month later will re-set the password, effectively disabling the account until they go through a password re-set with the Consultants

• With OS X Lion v10.7.3 and later, an admin user can unlock another user's screen saver.
• Unlocking a non-admin user's screen saver
  • Press Option-Return, then enter an administrative user's name and password.

• Unlocking an admin user's screen saver as we have in some self managed machines.
  • To enable this feature, first use the following advanced steps:
  • As an admin user, edit the /etc/pam.d/screensaver file.
  • Locate and remove (or comment out) the following line:

          account    required       pam_group.so no_warn deny group=admin,wheel ruser fail_safe

• • Save the changes.
  • Log out and back in.
  • To unlock the screen saver, press Option-Return, then enter an administrative user's name and password.

Operational Problems

• First verify that the student has diskquota available; the Macs use network based profiles/home directories, and will exhibit strange behaviour if they cannot create working files; eg Firefox will refuse to start.
• Funny application behaviour in general can be observed when the fileserver is overloaded; eg, saving a Microsoft Office file will give a bogus permissions error, when the real underlying problem is a timeout communicating with the server. A possible workaround is to save the file temporarily in /tmp/username - that folder is local to the system, but will be deleted when you log out, so make sure to copy the file to your home directory space.
• Microsoft Excel error "Can't record macro" - log out and back in; the login hook deletes some Microsoft Office preference files that can become corrupted, then running Excel re-creates them.
• Occasionally other programs will get corrupted preference files (suspected because of concurrent logons sometimes). They can be removed, since they will be dynamically re-created in a default state. They are in the USER, not System, space ~/Library/Preferences and typically have a form like com.optima.PageSpinner.plist; some applications may have multiple plists. There may also be removable files in ~/Library/Application Support/ specific to the problem application

X11 Problems

this appears to have been solved with our Spring 2011 Snow Leopard image

• an error message such as:

     /software/ssh-openssh-4.3krb/private/xauth:  error in locking authority file /u5/iturner/.Xauthority
     Terminal type is xterm
     cpu02:~> xterm
      X11 connection rejected because of wrong authentication.
      X connection to cpu02.student.cs:10.0 broken (explicit kill or server shutdown)

• the cause is the existence of a file in the home directory, created by the X11 program on Leopard (Mac OSX 10.5.x); the existence will also cause X11 to not work properly on the older, Mac OSX 10.4 machines (none currently)
• the immediate requirement is "ctrl c" to exit the error condition;
• then, exit from all existing host sessions
• in either a local xterm, or in the local Terminal, enter:
  • rm .Xauthority-c
• then you should be able to start host sessions, eg xterm on cpu18 from the X11 "Applications" on the Menu bar, and, they should behave properly, even allowing "child" X sessions as you would expect

Printing Problems

• The paper size default for a new student account might show up as A4; once they select US Letter, it should "stick" (note: the A4 paper size will probably make the printer "hang" waiting for the correct paper to be loaded)

• If a student is having trouble printing from a lab mac, and gets an email back from lpquota saying their job was rejected because they don't have quota on imacxxx.local, the ".local" is the clue. Our lab macs get that name if they have seen a network problem, especially while booting. It can be "cured" by unplugging and re-plugging the network cable from the mac, or by rebooting. Of course, they can go to another Mac and try from there. One can observe the situation by starting a Terminal window, and typing hostname. The proper response is imacxxx.student.cs etc, the improper one is imacxxx.local.

• Double sided printing is not enabled by default. But it can be enabled on a per-machine/per-student basis; ie, the student would have to set it up on each different machine they want to use.

   System Preferences
   Print & Fax
   click the printer in the list
   click Options & Supplies
   click Driver
   "tick" Duplex Unit
   click OK 

Symptoms Which are NOT Problems

• "No Xauth data; using fake authentication data for X11 forwarding .....creating new authority" This is an artifact of the magic Jason invented for allowing single-signon from the lab Macs to student.cs cpu servers in the X11 program

Hardware Problems

• Machine will not boot - power light flashing
  • A Flashing power LED once per second - bad RAM, no RAM
  • Three flashes, a pause, and three more flashes (occurs continuously) - marginal RAM
  • The flashing LED light does indicate a problem with RAM, either the module(s) are bad or are not seated properly. Open the ejector clips and install the ram module(s) pushing real hard with both thumbs then close the ejectors and replace the cover. If you still have a problem install one module at a time or reinstall the original ram that came with your iMac.
• More generally, from Apple: Intel-based Mac: Startup sequence and error codes, symbols
  • http://docs.info.apple.com/article.html?artnum=303363

• Machine will not boot - beeping
  • As Ed researched in ST#66267

New World Macs (1999 onward) and Intel-based Macs

The beep codes were revised in October 1999,[2] and have been the same since. In
addition, on some models, the power LED would flash in cadence.

    * 1 beep = no RAM installed
    * 2 beeps = incompatible RAM types
    * 3 beeps = no good banks
    * 4 beeps = no good boot images in the boot ROM (and/or bad sys config block)
    * 5 beeps = processor is not usable

-- Main.iturner - 05 Jun 2008 - 03 Feb 2009