Hi,

i want to port one of my Delphi applications to Mac OS X. Before I start (don't even have a Mac yet), I need to know if it's 's a client side part of a remote admin program. For this program, I need to control the system and get info about the system like:
- check if user has admin rights
- get a list of available screenresolutions and change it
- inject keypresses and stuff like that ...

I've asked in Mac-forums, but no one seems to be able to answer it. When I mentioned FreePascal, I've got no reply's at all anymore. Talking about closed communities ....

Does anyone knows where to get this information ?

TIA,

Paul

It is an UNIX env. So admin rights is nearly meaningless. However the `id` command should help you

- get a list of available screenresolutions and change it - inject keypresses and stuff like that ...

Instead of reinventing the wheel you should use the Apple Remote Desktop or a VNC client (I recommend you a SSH tunnel)

OS X Leopard provides a VNC Server
http://lifehacker.com/software/how-to/remote-control-leopard-with-tightvnc-319528.php

It is the *recommended* way

Indeed. Use Authorization Services to query the system about whether you currently have the rights to perform a particular action, and if you don't to request the user to authorise you to do so (e.g. by entering the login and password of an administrator user).

http://developer.apple.com/documentation/Security/Conceptual/authorization_concepts

Instead of reinventing the wheel you should use the Apple Remote Desktop or a VNC client (I recommend you a SSH tunnel)

And he can of course also look at the source code of existing VNC servers, e.g. http://sourceforge.net/projects/osxvnc/

But since it's such low level stuff, it's likely to require modifications for different OS versions and using an existing (and nowadays system-provided) protocol is indeed probably the best way to go.

Jonas

Shure this works, but we have a secure solution for Windows that's used by enterprise clients.
Unlike all other programs available, we don't use a P2P connection between the computers.
All data goes through a central server and both the contol-console and client-console are https-clients connecting to the server. This makes central management easy and is also very secure. A few of our clients also use Mac's and they are asking us for a solution. Also, a connection has to made possible immedialety by persons who don't even know what a computer exactly is..
So configuring a connection or setting up a VNC will be impossible: try asking it your grandma and you'll know why :-)

Paul

Jonas,

http://developer.apple.com/documentation/Security/Conceptual/authorization_concepts

thanks for these links, wonder why this site was not listed the mac developer forums ..

And he can of course also look at the source code of existing VNC servers, e.g. http://sourceforge.net/projects/osxvnc/

see my other reply

thanks,

Paul

Paul wrote

> http://developer.apple.com/documentation/Security/Conceptual/authorization_concepts thanks for these links, wonder why this site was not listed the mac developer forums ..

A lot depends on who, how and where you asked. And developer.apple.com is the very first site you get when googling for "mac programming" or "apple programming". To be honest, I also thought you already knew about that site, but simply did not know what exactly to look for there (e.g., "authorization" vs "administrator rights")..

> And he can of course also look at the source code of existing VNC > servers, e.g. http://sourceforge.net/projects/osxvnc/ see my other reply

It does not mean that your "client" can't simply enable a local VNC server, open a https tunnel to the server and simply tunnel VNC over this connection. Of course, no one can stop you from reimplementing everything, but it's probably going to be quite a bit of work (as such low level things are quite platform specific).

Jonas

Jonas,

I have to admit that I don't know much about nix, but I got an answer this morning: I can order a Mac :-)
what I want to know is what authorization the user has and what he can and can not do.

Tunnuling over our server is impossible and rules out central control/management, both sides must act as https clients It is indeed a lot of work: when I first started, I had completely written a P2P connection and running within 2 weeks.
Developing the same over a server took almost 3 years... The server was the hardest part though: i has to handle a lot of sessions and has to run 24/7 without failure.
It's only restarted every 6 months for maintenance, mainly for the Windows based servers.

Paul

Indeed

I was not suggesting to tunnel over your server, but to your server. Your server already contains a control infrastructure. If you'd go this route, your server would translate your proprietary protocol into VNC commands and back. Depending on the complexity of your protocol, this may be easier or harder than re-implementing and maintaining your entire client (which, as far as I understand, is mostly equivalent to a VNC server but using a different protocol) on the Mac side.

Jonas

That would be almost impossible: a session is running with 8 https clients communicating to the server.
The server has to have certificate that can be checked continuously at the certificate authority.
It's a complete different model than all existing software and is mainly used by large enterprise clients.
Some need a very high secutity level (banks) and we even need to write special servers for them.
Believe me: they won't take VNC for an answer.

Paul

I don't see the problem if you use a good and strong VPN. If was the case in my last job and we worked for a bank.

Paul

I don't see the problem if you use a good and strong VPN. If was the case in my last job and we worked for a bank.

Probably not if properly setup on both sides by IT personnel.

But what if you want a 100% save connection with someone that has never seen a computer in Zimbabwe, completely central managed for control within 10 seconds passing every firewall ?
Most of our clients came to us for the latter and never looked back. If needed, our enterprise clients can lock special features or instructions passing the server for particular sessions, automatically and centrally managed..
Actions can be limited per admin console.
Vnc will work in most cases, but not as secure and certainly not thru every firewall without user intervention.
Also, the features you can build in if you have complete control are unlimited.

Paul

Banks are very paranoia about security (and rightly so), and having a proprietary protocol which they can control is then to be preferred over a mash-up of open source components.

We made here a program for controlling FTP sessions to a mainframe, control which goes very far beyond anything that a regular FTP client or server does. It's used mainly by banks and insurance companies.

It's a special breed of client...

Michael.

It's a special breed of client... Michael.

No need to tell me, but they are not the only ones. Our largest client (car manufacturer) is even worse...

Paul

I really don't see the problem. Your client software would obviously be doing all the certificate checking and the customers don't have to know whether it's vnc or your proprietary protocol underneath. There are simply two separate things:
a) software to let a remote user control a local computer b) secure transmission and authentication of the commands etc between the server and the local computer

Now,
a) can be done with vnc
b) can be done by tunneling the vnc data stream over as many https connections as you want, which are authenticated as often and wherever you want, using your client software. I.e., the client software can simply be a secure proxy for a vnc data stream (breaking it up and sending different kinds of packets over different https connections or whatever).

Of course, if you need to be able to do things that the vnc protocol itself does not support, that would be another matter (but I haven't seen that being mentioned).

Jonas

However, as a bank, they only trust on themselves. And they like to reinvent a broken wheel :)

However, as a bank, they only trust on themselves. And they like to reinvent a broken wheel :)

exactly :-)

they also like many custom features ..

Paul

Just in case you really really want to remake the world, here is a link which may help you :
http://developer.apple.com/documentation/GraphicsImaging/Conceptual/QuartzDisplayServicesConceptual/Articles/MouseCursor.html#/ /apple_ref/doc/uid/TP40004269

http://developer.apple.com/documentation/GraphicsImaging/Reference/Quartz_Services_Ref/Reference/reference.html#/ /apple_ref/c/func/CGDisplayModelNumber

Wow, exactly the things I need.
I remember that there is a tool available to convert C-headers to pascal (I'm not a great C-fan)
Anyone knows what it is ?
(Sorry for asking all this questions, but I've been thinking to use FPC for a long time, but never came to do it.
I've been reading the messages on list for a while though. I need to install it on the Mac first, so probably, I'll be asking some more for the installation...)

thanks,

Paul

Paul wrote

Wow, exactly the things I need. I remember that there is a tool available to convert C-headers to pascal (I'm not a great C-fan) Anyone knows what it is ?

Most of these API's are already available in a unit called MacOSAll which is shipped with FPC. The tool you want is called h2pas, but note that it will still require manual intervention afterwards.

Jonas