The problem exists when you use a script to create the folders and apply the permissions using the cacls.exe command on a Windows 2003 R2 server. A user on a Mac OS X client with not be able to drag files into the folder on a Windows 2003 R2 server share or perform a copy procedure and will result in the error: “You may need to enter the name and password for an administrator on this computer to change the item name “item-name”.”. You may also see the exclamation error if the file has a preview fork attached of “Couldn’t open the file. It may be corrupt or a file format that Preview doesn’t recognize.”. After much reading on this problem I was almost convinced that it was an OS X bug, but I realize now it is actually a flaw in the cacls command. We use a script similar to the snippet of code below to create the directories.

mkdir \\server\share\userdir
cacls \\server\share\userdir /e /t /g userdir:c

explanation:

cacls {file or folder} /e {edits} /t {changes on all sub directories} /g {grants} userdir:c {user:permission of change}

The problem was solved using the command that was introduced in Vista and Server 2003 R2 called icacls.exe. The icacls tool is now included in Windows Server Service Pack 2 and is standard in Vista. This command allows you to set inheritance, which is the root cause of the problem. The inheritance properties were first introduced in NTFS 5.0 with Windows 2000, however something has changed recently in the OS X 10.5 software or Windows Server 2003 R2. The problem also exists in Windows Server 2008 and Windows Server 2008 R2 so the problem is not going away and I am guessing it is OSX at fault.

When setting a directory with the code above, if you use the icacls command to export the permissions structure out to a file you can see the problem. This will export the security into Microsoft’s SDDL language which is documented here http://msdn.microsoft.com/en-us/library/aa379567(VS.85).aspx.

icacls.exe \\server\share\userdir /save aclfile.txt

notepad.exe aclfile.txt

D:(A;OICI;0x1301bf;;;S-1-5-21-123456789-123456789-123456789-12345) (A;OICIID;FA;;;DA)(A;OICIID;FA;;;SY)
(user:chage) (domain admin:full) (system:full)

The problem is not is not evident until we set the permission properly with the icacls.exe command.

icacls \\server\share\userdir /t /c /grant userdir:(OI)(CI)M

explanation:

icacls {file or folder} /t {changes on all sub directories} /grant {grants} userdir:(OI)(CI) {see below}M { change/modify }

CI CONTAINER INHERIT
OI OBJECT INHERIT
NP NO PROPAGATE INHERIT
IO INHERIT ONLY
ID INHERITED
SA SUCCESSFUL ACCESS FLAG
FA FAILED ACCESS FLAG

Complete list http://msdn.microsoft.com/en-us/library/aa374928(VS.85).aspx

D:AI(A;OICI;0x1301bf;;;S-1-5-21-123456789-123456789-123456789-12345) (A;OICIID;FA;;;DA)(A;OICIID;FA;;;SY)

Explanation:

D: - Defines the DACL
AI - is the MISSING Auto Inheritance Flag
(A;OICI;0x1301bf;;;S-1-5-21-123456789-123456789-123456789-12345) - is the user’s SID and permissions
(A;OICIID;FA;;;DA) - is the “Domain Admin” permissions identified by the trailing DA
(A;OICIID;FA;;;SY) - is the “System” permissions identified by the trailing SY

The AI in the DACL or Discretionary Access Control List is missing when using the cacls command. My guess is that the client when using Windows is responsible for the completion and writing of the DACL. When a Mac OS X client copies a file they utilize SAMBA which does not carry the DACL and consequentially fails. This would explain the empty file that gets created when an OS X client drags and drops the file. The file entry gets created, but is inherited with only the original permissions that have inheritance from above. This same problem could also exist on Linux or UNIX using SAMBA since it is SAMBA that drops the ball.

The Fix:

Use ‘icacls \\server\share\userdir /t /c /grant username:(OI)(CI)M’ to grant access to NTFS folders and replace all entries in scripts using the cacls command.

1. Download the latest current build from the Debian website http://www.debian.org/distrib/. You’ll only need to download and burn the first ISO for CD1, since all the other CDs contain packages that can be downloaded via the ‘apt-get’ command.
2. Insert the CD and set your BIOS or ‘first boot’ menu to boot from CD. As the CD spins up you will be brought to a prompt with the Debian logo. Debian Etch defaults to install the Linux 2.6 kernel so just hit enter.

3. The ‘Choose language’ screen will appear, select ‘English’ or your preferred language.

4. The ‘Choose country or region’ screen will appear, select ‘United States’ or your preferred country.

5. The ‘Select a keyboard layout’ screen will appear, select ‘American English’ or your preferred layout.

6. The pre-installer will start to scan your hardware, scan the packages available on the CDROM, load the components of the Debian installer, then detect and configure the network with DHCP if detected.

7. You be prompted at the ‘Configure the network’ screen, were you will be asked to select a hostname for your system.

8. Then you’ll be prompted with the ‘Domain name’ prompt, were you will select your domain name for your system.

9. The installer will detect all disks and start the partition utility. It is preferable to select the ‘Erase entire disk’.

10. The next prompt will ask you for a partitioning scheme, again it is preferable to select the default of ‘All files in one partition’.

11. You will then have a chance to confirm your selection and ‘Finish partitioning and write the changes to disk’.

12. You’ll be prompted again to write the changes, select ‘Yes’ the default is ‘No’.

13. The installer will ask for your time zone, enter the desired time zone.

14. The installer will ask for the root’s password (privileged user account).

15. You will need to type the password again for confirmation.

16. You will also be required to create an initial user (non-privileged user account) account.

17. You will need to supply a login name for the account.

18. Set the password for this user and confirm it like the previous account.

19. The system installer will begin installing the entire system now.

20. The package manager will now require configuration, select ‘Yes’ for a mirror.

21. Choose ‘United States’ for the mirror’s country or your country.

22. Choose ‘ftp.us.debian.org’ or the first mirror that appears for you prior selection.

23. Select ‘Enter’ if you are not using a proxy.

24. The developers ask that you participate in a feedback survey, for this how-to we will answer ‘No’.

25. Unselect all software using the spacebar and arrow keys and select ‘Continue’.

26. Answer ‘Yes’ to the Grub loader screen, this will install the boot manager of Grub on the system; this is used for emergency purposes.

27. Finish the install by selecting ’Continue’.

28. You will reboot and see the Grub boot loader.

29. You can now login as ‘root’ with the password you supplied for ‘root’.


Now that we have an installed and running system we need to tweak a few settings. The network was installed and DHCP had been automatically configured, however since this will be a server DHCP is not the right choice; we will need to manually configure an IP address.

30. Edit ‘/etc/network/interfaces’ by typing:
    nano -w /etc/network/interfaces# This file describes the network interfaces available on your system
    # and how to activate them. For more information, see interfaces(5).

    # The loopback network interface
    auto lo
    iface lo inet loopback

    # The primary network interface
    #auto eth0
    #iface eth0 inet dhcp

    auto eth0
    iface eth0 inet static
    address 192.168.1.2
    netmask 255.255.255.0
    network 192.168.1.0
    broadcast 192.168.1.255
    gateway 192.168.1.1

31. Set the resolver for proper DNS servers.
    nano -w /etc/resolv.confsearch foo.com
    nameserver 192.168.1.3
    nameserver 192.168.1.4
32. Next you will need to restart the network component.
    /etc/init.d/networking restart
33. Add your new static IP to the hosts table.
    nano -w /etc/hosts

    127.0.0.1 localhost.localdomain localhost debian

    192.168.1.2 debian.foo.com debian

    # The following lines are desirable for IPv6 capable hosts
    ::1 ip6-localhost ip6-loopback
    fe00::0 ip6-localnet
    ff00::0 ip6-mcastprefix
    ff02::1 ip6-allnodes
    ff02::2 ip6-allrouters
    ff02::3 ip6-allhosts

34. Set the system’s hostname.echo server1.example.com > /etc/hostname
    /bin/hostname -F /etc/hostname
35. Install some needed software packages and services.apt-get install wget bzip2 rdate unzip zip ncftp nmap lynx fileutils dnsutils
    apt-get install tcpdump less make tftp rdate file gcc g++ ssh
36. Sync the time with an atomic clock.crontab -e

    # update time with time.nist.gov
    0 3,9,15,21 * * * /usr/sbin/rdate time.nist.gov | logger -t NTP

37. Set up the ‘bashrc’ file.nano -w /root/.bashrc

    # ~/.bashrc: executed by bash(1) for non-login shells.

    export PS1=’\h:\w\$ ‘
    umask 022

    # You may uncomment the following lines if you want `ls’ to be colorized:
    export LS_OPTIONS=’–color=auto -h’
    eval “`dircolors`”
    alias ls=’ls $LS_OPTIONS’
    alias ll=’ls $LS_OPTIONS -l’
    alias l=’ls $LS_OPTIONS -lA’

    # Some more alias to avoid making mistakes:
    alias rm=’rm -i’
    alias cp=’cp -i’
    alias mv=’mv -i’

    # Bohack’s stuff
    alias nano=’nano -w -K’
    alias pico=’nano -w -K’
    alias ptree=’ps axf’

    PS1=’\[\033[36;1m\w \[\033[35;1m\h \[\033[0m\$ ‘
    export PS1
    export GREP_OPTIONS=”–color=auto”
    TERM=xterm-color
    export TERM
    cd /

Done! You now have a minimal install of Debian as a clean install. Don’t forget to do an ‘apt-get update’ and an ‘apt-get upgrade’, to install any major/minor updates.

The ‘grep’ command will support ANSI colorization and this can be done a number of ways. The first way is to specify the –color or –colour option on the command line. The second way is to export a variable that ‘grep’ looks at when executed. You will most likey want to add the export lines to your .profile or .bashrc file.

cat {somelogfile} | grep  --color {matching text}

or

tail -f {somerollinglog} | grep --color {matching text}
export GREP_OPTIONS="--color=auto"
export GREP_COLOR='1;31'

Grep colorization is good, but sometimes you need to see all the lines from the log file and focus on just what you are looking for. In this case we need to take a different approach; grep will filter and show just the lines that contain the information matching the regular expression we’ve feed it. In order to see all the lines and only highlight the specific pieces we want to see, we will need to run the information thru a mechanism that will highlight just the matching piece. I originally came across this poorly written piece of PERL script that I adapted and refined over many iterations.

#!/usr/bin/perl
### Bohack 2006i
### Usage: hilite <ansi_command> <target_string>
### Purpose: Will read text from standard input and perform specified highlighting
### command before displaying text to standard output.
### License: GNU GPL
$|=1; # don't buffer i/o
$target = "$ARGV[0]";
$color = "\e[31m";
$end = "\e[0m";while(<STDIN>) {
s/($target)/$color$1$end/i;
print $_;
}

Remeber to chmod the file for execute permissions and put it in the path. (i.e. chmod 0777 hilite)

cat {somelogfile} | hilite {matching text}
or
tail -f {somerollinglog} | hilite {matching text}