Issues with LDAP, NFS, and VNC

I guess this question is rather meta, because I'm at least as interested in knowing how to get help as in some actual help.

Anyway, we use LDAP and NFS to provide shared home directories for folk across machines, and enable screen sharing (maybe Remote Admin? I sometimes get these slightly confused) on networked Macs.

Apparently, since Catalina, we have had issues where VNC logins from LDAP users hang (I think pretty reliably, but I'd have the check the notes from sysadmin). Afterwards, random things start to hang for other users (whether connected via VNC or SSH), until you have to reboot to do anything useful with the machine.

If only local accounts use VNC while LDAP users use SSH, things are fine, except that a terminal it is not necessarily the best way to develop.

This has become an issue as were setting up M1 Macs to expand the effort beyond the initial core team that worked on the DTK (which had local accounts only, obviously).

So, first question, do these symptoms sound familiar to anyone? Any troubleshooting suggestions?

Second, where could we get some actual support? Is this something we can use DTS ticket on? It's not really related to our development as such, but it sure is blocking our development work. And given the currently level of "Geniuses" (unlike 15 years ago, when you really could find someone to talk to at a store), I don't think asking one of them this question would be helpful. I'm not sure what other avenues there are. Any help would be appreciated.

Replies

Regarding:

So, first question, do these symptoms sound familiar to anyone? Any troubleshooting suggestions?

I have ran into a similar issue with SSH / VNC when either the host or remote machine contains a NEFilterDataProvider and / or a NETransparentProxyProvider. If this is the case then please let me know and I can dig into my test case notes for more info.


Regarding:

Second, where could we get some actual support? Is this something we can use DTS ticket on? It's not really related to our development as such, but it sure is blocking our development work.

Right, if you are using any sort of Apple APIs here in this workflow, please do open a DTS incident and we can try to research this item further for you. A general DTS rules of thumb is that we provide API level support, and that is why I mentioned Apple APIs here.

Either way, I would still suggest that you open a bug report on this as anytime you are experiencing issues it's always good to get that recorded as a bug report. For a topic like this, you will be asked to add a sysdiagnose to your bug report, so I will ask this of you right away. Please add the following debug profiles and take a sysdiagnose and attach it to your bug report. Please make sure to identify the time and date your issue was created.
  • Accounts/AuthKit

  • mDNSResponder

  • Net-diagnose

  • Network Diagnostics

Please respond back with the Feedback ID.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Thanks for you answer. I did my best to follow your advice in filing FB8968653.

I did my best to follow your advice in filing FB8968653.

Thanks!

As Matt mentioned, DTS’s focus is on code-level support [1], so we can only help you if Apple APIs are involved. Reading through your original post it seems like that’s not the case, in which case you should contact Apple Support. Note the following:
  • Enterprise-y stuff like this isn’t supported by your local Apple Store. I’m not particularly up-to-speed on their policies, but a good place to start would be AppleCare Professional Support.

  • Make sure you can reproduce the problem solely with production hardware, lest the presence of a DTK muddy the waters.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

[1] Also support for Apple tools, accessory development, and certain Apple services, like notarisation.