Changing password for "local items" keychain in OS X

Again, note time.

I changed the login password in my Mac. At first I did it through the Users & Groups panel from System Preferences, but it didn't seem to have taken any effect, or maybe there had been some errors in the process and I just neglected it. Anyway, I tried again through web and succeeded.

But after a reboot, quite a lot of applications started to ask for password to unlock the Local Items keychain, which I assume was because the password for Local Items keychain was not synchronised with the login password. To make things worse, if you right click the Local Items keychain, there is nothing available to change the password from the menu.

Before long I found this one - https://discussions.apple.com/thread/5473260, and it helped solve the issue. It turns out that the iCloud keychain is either called "Local Items" if you don't have syncing enabled or "iCloud" if you enabled iCloud keychain sync. Lock the login keychain then unlock it again would trigger a dialogue where the password for Local Items keychain could be changed.

Proxy network traffic for vagrant VMs

Thanks to the shitty network condition here people have to fight their way to the INTERNET whenever they are looking for something cool.

It has come to vagrant this time. Have been trying https://github.com/UtahDave/salt-vagrant-demo for a simple salt setup. It's already got functional code incorporated. But guess what, it needs free INTERNET access from within vagrant VMs. Luckily a bit of digging led me to https://github.com/tmatilai/vagrant-proxyconf. Nice piece of work that just works!

Getting rid of BES and JAMF

I'm not familiar with any of these. So don't try and ask me what they stand for. I don't know, or care. But I do know they both have something to do with endpoint management, which in layman's terms, is watching and controlling your computer remotely (my Mac in this case), banning you from doing anything they don't approve of. Don't get me wrong here. I'm not totally against the idea of endpoint management. It's crucial to enterprise IT. Just that some of the management policies really piss me off.

So I decided to stop them. After some trial and error I finally came up with the following.

Stopping BES:
--- Library_LaunchDaemons/BESAgentDaemon.plist 2015-07-15 01:00:15.000000000 +0800
+++ /Library/LaunchDaemons/BESAgentDaemon.plist 2015-07-15 01:00:21.000000000 +0800
@@ -5,7 +5,7 @@
  <key>Label</key>
  <string>com.bigfix.BESAgent</string>
  <key>OnDemand</key>
- <false/>
+ <true/>
  <key>ProgramArguments</key>
  <array>
  <string>/Library/BESAgent/BESAgent.app/Contents/MacOS/BESAgent</string>

Stopping JAMF:
diff -ruN Library_Application_Support_JAMF_ManagementFrameworkScripts/StartupScript.sh /Library/Application Support/JAMF/ManagementFrameworkScripts/StartupScript.sh
--- Library_Application_Support_JAMF_ManagementFrameworkScripts/StartupScript.sh 2015-08-05 21:12:03.000000000 +0800
+++ /Library/Application Support/JAMF/ManagementFrameworkScripts/StartupScript.sh 2015-08-05 21:23:04.000000000 +0800
@@ -1,15 +1,15 @@
 #!/bin/sh

-## Ensure the JSS is available
-/usr/sbin/jamf checkJSSConnection
-
-## Log the event to the JSS
-/usr/sbin/jamf log -action startup
-
-## Check for policies on the JSS
-/usr/sbin/jamf policy -action startup
-
-## Start SSH
-/usr/sbin/jamf startSSH
+### Ensure the JSS is available
+#/usr/sbin/jamf checkJSSConnection
+#
+### Log the event to the JSS
+#/usr/sbin/jamf log -action startup
+#
+### Check for policies on the JSS
+#/usr/sbin/jamf policy -action startup
+#
+### Start SSH
+#/usr/sbin/jamf startSSH

 exit 0
diff -ruN Library_Application_Support_JAMF_ManagementFrameworkScripts/loginhook.sh /Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh
--- Library_Application_Support_JAMF_ManagementFrameworkScripts/loginhook.sh 2015-08-05 21:12:03.000000000 +0800
+++ /Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh 2015-08-05 21:23:21.000000000 +0800
@@ -1,25 +1,25 @@
 #!/bin/sh

-## Ignore the casperscreensharing user
-if [ "$1" == "casperscreensharing" ];
-then
- exit 0;
-fi
-
-## Verify that the JSS is available
-if /usr/sbin/jamf checkJSSConnection -retry 0 ;
-then
-
- ## Log the event to the JSS
- /usr/sbin/jamf log -action login -username "$1" &
-
- ## Check for policies on the JSS
- /usr/sbin/jamf policy -action login -username "$1" &
-
-else
-
- /usr/sbin/jamf policy -action login -username "$1" -offline &
-
-fi
+### Ignore the casperscreensharing user
+#if [ "$1" == "casperscreensharing" ];
+#then
+# exit 0;
+#fi
+#
+### Verify that the JSS is available
+#if /usr/sbin/jamf checkJSSConnection -retry 0 ;
+#then
+#
+# ## Log the event to the JSS
+# /usr/sbin/jamf log -action login -username "$1" &
+#
+# ## Check for policies on the JSS
+# /usr/sbin/jamf policy -action login -username "$1" &
+#
+#else
+#
+# /usr/sbin/jamf policy -action login -username "$1" -offline &
+#
+#fi

 exit 0
diff -ruN Library_Application_Support_JAMF_ManagementFrameworkScripts/logouthook.sh /Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh
--- Library_Application_Support_JAMF_ManagementFrameworkScripts/logouthook.sh 2015-08-05 21:12:03.000000000 +0800
+++ /Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh 2015-08-05 21:23:30.000000000 +0800
@@ -1,26 +1,26 @@
 #!/bin/sh

-## Ignore the casperscreensharing user
-if [ "$1" == "casperscreensharing" ];
-then
- exit 0;
-fi
-
-## Verify that the JSS is available
-if /usr/sbin/jamf checkJSSConnection -retry 1 ;
-then
-
- ## Log the event to the JSS
- /usr/sbin/jamf log -action logout -username "$1"
-
- ## Check for policies on the JSS
- /usr/sbin/jamf policy -action logout -username "$1"
-
-else
-
- ## Check for policies on the JSS
- /usr/sbin/jamf policy -action logout -username "$1" -offline
-
-fi
+### Ignore the casperscreensharing user
+#if [ "$1" == "casperscreensharing" ];
+#then
+# exit 0;
+#fi
+#
+### Verify that the JSS is available
+#if /usr/sbin/jamf checkJSSConnection -retry 1 ;
+#then
+#
+# ## Log the event to the JSS
+# /usr/sbin/jamf log -action logout -username "$1"
+#
+# ## Check for policies on the JSS
+# /usr/sbin/jamf policy -action logout -username "$1"
+#
+#else
+#
+# ## Check for policies on the JSS
+# /usr/sbin/jamf policy -action logout -username "$1" -offline
+#
+#fi

 exit 0

--- Library_LaunchDaemons/com.jamfsoftware.jamf.daemon.plist 2015-08-05 18:57:41.000000000 +0800
+++ /Library/LaunchDaemons/com.jamfsoftware.jamf.daemon.plist 2015-08-05 19:03:07.000000000 +0800
@@ -7,7 +7,7 @@
  <key>GroupName</key>
  <string>wheel</string>
  <key>KeepAlive</key>
- <true/>
+ <false/>
  <key>Label</key>
  <string>com.jamfsoftware.jamf.daemon</string>
  <key>Nice</key>
@@ -20,7 +20,7 @@
  <string>-monitorNetworkStateChanges</string>
  </array>
  <key>RunAtLoad</key>
- <true/>
+ <false/>
  <key>UserName</key>
  <string>root</string>
  <key>WorkingDirectory</key>

--- Library_LaunchDaemons/com.jamfsoftware.startupItem.plist 2015-08-05 18:57:41.000000000 +0800
+++ /Library/LaunchDaemons/com.jamfsoftware.startupItem.plist 2015-08-05 19:03:24.000000000 +0800
@@ -7,7 +7,7 @@
  <key>LaunchOnlyOnce</key>
  <true/>
  <key>RunAtLoad</key>
- <true/>
+ <false/>
  <key>ProgramArguments</key>
  <array>
  <string>/Library/Application Support/JAMF/ManagementFrameworkScripts/StartupScript.sh</string>

--- Library_LaunchDaemons/com.jamfsoftware.task.1.plist 2015-08-06 00:58:20.000000000 +0800
+++ /Library/LaunchDaemons/com.jamfsoftware.task.1.plist 2015-08-06 00:59:31.000000000 +0800
@@ -12,7 +12,7 @@
  <string>300</string>
  </array>
  <key>StartInterval</key>
- <integer>900</integer>
+ <integer>0</integer>
  <key>UserName</key>
  <string>root</string>
 </dict>

--- Library_LaunchAgents/com.jamfsoftware.jamf.agent.plist 2015-08-05 19:04:52.000000000 +0800
+++ /Library/LaunchAgents/com.jamfsoftware.jamf.agent.plist 2015-08-05 19:05:36.000000000 +0800
@@ -5,7 +5,7 @@
  <key>AbandonProcessGroup</key>
  <true/>
  <key>KeepAlive</key>
- <true/>
+ <false/>
  <key>Label</key>
  <string>com.jamfsoftware.jamf.agent</string>
  <key>Nice</key>
@@ -15,7 +15,7 @@
  <string>/usr/sbin/jamfAgent</string>
  </array>
  <key>RunAtLoad</key>
- <true/>
+ <false/>
  <key>WorkingDirectory</key>
  <string>/usr/sbin</string>
 </dict>

Update: recent JAMF versions seem to have updated their code layout. So the diffs should read:
--- +Library+Application_Support+JAMF+ManagementFrameworkScripts/loginhook.sh 2015-10-22 15:54:56.000000000 +0800
+++ /Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh 2015-10-22 15:56:30.000000000 +0800
@@ -1,25 +1,25 @@
 #!/bin/sh

-## Ignore the casperscreensharing user
-if [ "$1" == "casperscreensharing" ];
-then
- exit 0;
-fi
-
-## Verify that the JSS is available
-if /usr/local/jamf/bin/jamf checkJSSConnection -retry 0 ;
-then
-
- ## Log the event to the JSS
- /usr/local/jamf/bin/jamf log -action login -username "$1" &
-
- ## Check for policies on the JSS
- /usr/local/jamf/bin/jamf policy -action login -username "$1" &
-
-else
-
- /usr/local/jamf/bin/jamf policy -action login -username "$1" -offline &
-
-fi
+### Ignore the casperscreensharing user
+#if [ "$1" == "casperscreensharing" ];
+#then
+# exit 0;
+#fi
+#
+### Verify that the JSS is available
+#if /usr/local/jamf/bin/jamf checkJSSConnection -retry 0 ;
+#then
+#
+# ## Log the event to the JSS
+# /usr/local/jamf/bin/jamf log -action login -username "$1" &
+#
+# ## Check for policies on the JSS
+# /usr/local/jamf/bin/jamf policy -action login -username "$1" &
+#
+#else
+#
+# /usr/local/jamf/bin/jamf policy -action login -username "$1" -offline &
+#
+#fi

 exit 0
--- +Library+Application_Support+JAMF+ManagementFrameworkScripts/logouthook.sh 2015-10-22 15:55:04.000000000 +0800
+++ /Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh 2015-10-22 15:56:51.000000000 +0800
@@ -1,26 +1,26 @@
 #!/bin/sh

-## Ignore the casperscreensharing user
-if [ "$1" == "casperscreensharing" ];
-then
- exit 0;
-fi
-
-## Verify that the JSS is available
-if /usr/local/jamf/bin/jamf checkJSSConnection -retry 1 ;
-then
-
- ## Log the event to the JSS
- /usr/local/jamf/bin/jamf log -action logout -username "$1"
-
- ## Check for policies on the JSS
- /usr/local/jamf/bin/jamf policy -action logout -username "$1"
-
-else
-
- ## Check for policies on the JSS
- /usr/local/jamf/bin/jamf policy -action logout -username "$1" -offline
-
-fi
+### Ignore the casperscreensharing user
+#if [ "$1" == "casperscreensharing" ];
+#then
+# exit 0;
+#fi
+#
+### Verify that the JSS is available
+#if /usr/local/jamf/bin/jamf checkJSSConnection -retry 1 ;
+#then
+#
+# ## Log the event to the JSS
+# /usr/local/jamf/bin/jamf log -action logout -username "$1"
+#
+# ## Check for policies on the JSS
+# /usr/local/jamf/bin/jamf policy -action logout -username "$1"
+#
+#else
+#
+# ## Check for policies on the JSS
+# /usr/local/jamf/bin/jamf policy -action logout -username "$1" -offline
+#
+#fi

 exit 0
--- +Library+Application_Support+JAMF+ManagementFrameworkScripts/StartupScript.sh 2015-10-22 15:54:25.000000000 +0800
+++ /Library/Application Support/JAMF/ManagementFrameworkScripts/StartupScript.sh 2015-10-22 15:56:04.000000000 +0800
@@ -1,12 +1,12 @@
 #!/bin/sh

-## Ensure the JSS is available
-/usr/local/jamf/bin/jamf checkJSSConnection
-
-## Log the event to the JSS
-/usr/local/jamf/bin/jamf log -action startup
-
-## Check for policies on the JSS
-/usr/local/jamf/bin/jamf policy -action startup
+### Ensure the JSS is available
+#/usr/local/jamf/bin/jamf checkJSSConnection
+#
+### Log the event to the JSS
+#/usr/local/jamf/bin/jamf log -action startup
+#
+### Check for policies on the JSS
+#/usr/local/jamf/bin/jamf policy -action startup

 exit 0
--- +Library+LaunchAgents/com.jamfsoftware.jamf.agent.plist 2015-10-22 16:05:56.000000000 +0800
+++ /Library/LaunchAgents/com.jamfsoftware.jamf.agent.plist 2015-10-22 16:06:21.000000000 +0800
@@ -5,7 +5,7 @@
  <key>AbandonProcessGroup</key>
  <true/>
  <key>KeepAlive</key>
- <true/>
+ <false/>
  <key>Label</key>
  <string>com.jamfsoftware.jamf.agent</string>
  <key>Nice</key>
@@ -15,7 +15,7 @@
  <string>/usr/local/jamf/bin/jamfAgent</string>
  </array>
  <key>RunAtLoad</key>
- <true/>
+ <false/>
  <key>WorkingDirectory</key>
  <string>/usr/local/jamf/bin</string>
 </dict>
--- +Library+LaunchDaemons/com.jamfsoftware.jamf.daemon.plist 2015-10-22 16:00:15.000000000 +0800
+++ /Library/LaunchDaemons/com.jamfsoftware.jamf.daemon.plist 2015-10-22 16:02:09.000000000 +0800
@@ -7,7 +7,7 @@
  <key>GroupName</key>
  <string>wheel</string>
  <key>KeepAlive</key>
- <true/>
+ <false/>
  <key>Label</key>
  <string>com.jamfsoftware.jamf.daemon</string>
  <key>Nice</key>
@@ -20,7 +20,7 @@
  <string>-monitorNetworkStateChanges</string>
  </array>
  <key>RunAtLoad</key>
- <true/>
+ <false/>
  <key>UserName</key>
  <string>root</string>
  <key>WorkingDirectory</key>
--- +Library+LaunchDaemons/com.jamfsoftware.startupItem.plist 2015-10-22 16:00:21.000000000 +0800
+++ /Library/LaunchDaemons/com.jamfsoftware.startupItem.plist 2015-10-22 16:03:00.000000000 +0800
@@ -7,7 +7,7 @@
  <key>LaunchOnlyOnce</key>
  <true/>
  <key>RunAtLoad</key>
- <true/>
+ <false/>
  <key>ProgramArguments</key>
  <array>
  <string>/Library/Application Support/JAMF/ManagementFrameworkScripts/StartupScript.sh</string>
--- +Library+LaunchDaemons/com.jamfsoftware.task.1.plist 2015-10-22 16:00:28.000000000 +0800
+++ /Library/LaunchDaemons/com.jamfsoftware.task.1.plist 2015-10-22 16:03:40.000000000 +0800
@@ -12,7 +12,7 @@
  <string>300</string>
  </array>
  <key>StartInterval</key>
- <integer>900</integer>
+ <integer>0</integer>
  <key>UserName</key>
  <string>root</string>

 </dict>