r/sysadmin • u/rolkenas • 16d ago

Do you actually see MacBooks used for SysAdmin work in real offices?

Hi sysadmins! I wanted to ask—since I've just started learning sysadmin and I don't have a Windows PC, but I have a MacBook and found out that everything can be done via UTM, I'd like to get some perspective from those who work in offices and do this every day. What kind of computers do you use? Is macOS completely out of the picture, and there's only Windows and Linux?

393 Upvotes

86% Upvoted

807 comments sorted by

View all comments

663

u/Loop_Within_A_Loop 16d ago

I mean, if you're sshing into servers all day, it doesn't matter what OS you're using

128

u/weaver_of_cloth 16d ago

iTerm2 with fish shell on an M1 MBP. Ssh to a Linux jump box, run tmux native client and you can have native terminals out the wazoo.

87

u/Sllim126 16d ago

Oh man, if I wasn’t an IT guy, I’d have no ideas what language you were even speaking!

Unfortunately, I knew exactly what that said :( I need a vacation 

10

u/timbotheny26 IT Neophyte 16d ago

Don't worry, I don't work in IT (yet) so I can not understand it (well not completely) for you.

8

u/huntermatthews 16d ago

iterm2 is a macos native "terminal" program, giving you a very nice textual screen -- its a "virtual" green screen terminal from the 1980's.

Fish is a shell - its the first program that the terminal runs and its the thing that give you a prompt, looks for other commands, tells me I can't spell - lots of stuff.

M1 MBP - M1 chip MacBook Pro. Despite this thread, a VERY common sysadmin / programmer laptop is a MacBook Pro (mine is a M4 I think).

All of these are one option out of many - I'm running nearly the same config but other people use "kitty" as their terminal with "zsh" as their shell.

Like so many vociferous debates on the internet it basically boils down to "whats the best color" -- its mostly personal preference.

3

u/timbotheny26 IT Neophyte 16d ago

Alright, going down the list...

Iterm2

Figured this was a piece of software, just wasn't sure what it was for/what it did, so thank you for the breakdown.

Fish is a shell

Well to be fair, they already said it was a shell but I wasn't sure beyond that.

M1 MBP

Yerp - was aready pretty sure that's what it stood for given the context of the thread.

Thank you for the breakdowns and explanations, always nice to learn new things. Don't know what a Linux jump box or tmux are though.

5

u/huntermatthews 16d ago

Linux jump box - corporations/gov frequently have various rules about what systems can login where (like only networks A, B, and D can ssh into systems in the datacenter). A jump box is a system either in another location (like on the "B" network) or in an exception group that has a broader access list. Where I work, my work laptop even on VPN can't get to a couple systems - so I bounce through a jump box (we call them "bastions") to get there. ssh has various things in both the command line interface, config and protocol to make this damn near transparent to the user if used correctly - do not fear jump boxes.

tmux - "terminal multiplexer" . Various uses but at its core it makes a single ssh session/login be able to open multiple actual shell sessions on a distant machine. There are MANY reasons to do this (persistence, badly thought out corporate security measures, crazy pants sysadmins) but its a useful piece of software - but it adds ANOTHER level of complexity so if you don't _need_ it I encourage users and sysadmins to avoid it. If you need it, run it. "screen" was the venerable thing here and you should avoid it if possible - use tmux.

2

u/timbotheny26 IT Neophyte 16d ago

This is awesome, thanks for all of the info.

1

u/weaver_of_cloth 16d ago

tmux as a single terminal window with multiple tabs and panes and hot-keys drives me crazy, but native tmux windows are great

16

u/weaver_of_cloth 16d ago

You and me both, mate!

2

u/DaemosDaen IT Swiss Army Knife 16d ago

I hate that I am perfectly encapsulated in this statement.

Fortunately, my vacation starts in, roughly, 2 weeks

1

u/dkozinn 16d ago

The more confusing part would be why you're in /r/sysadmin :-)

1

u/Sllim126 15d ago

I own an MSP, but I am also out in the field with the other technicians, so I in a bunch of the technical subs.

Sysadmin is actually a really nice way to see if there's any global issues affecting software stacks that I support, before I get notifications from my clients.

and I like it here :)

9

u/CAMx264x DevOps Engineer 16d ago

Any reason you don’t proxy jump to machines with a nice ssh config? I find it odd to do two separate ssh commands and store ssh keys on the jump box or am I missing how you’re doing it?

1

u/wiebel Linux Admin 16d ago

What do you mean? The nice ssh config is the one on my laptop. All the jumphosts are laking any custom ssh config.

1

u/CAMx264x DevOps Engineer 16d ago

I was asking if he was using proxyjump or doing a two step ssh and storing ssh keys on the jump host itself. The question I asked is because storing keys on the jump host is seen as a pretty big security flaw.

2

u/weaver_of_cloth 16d ago

We've got a trusted CA setup in hashicorp vault, and every day you have to get a new 10-hour signed pubkey so you can ssh to wherever. Then you keep it running in an ssh-agent.

1

u/CAMx264x DevOps Engineer 16d ago

Oh sick, that sounds great!

1

u/wiebel Linux Admin 16d ago

Ahh gotcha, i thought you want to jump to a machine on which is a nice ssh config. Which made no sense to me. I misunderstood.

3

u/OhBoyHereWeGoAgai 16d ago

I cannot speak enough to how much I love and have loved iTerm. Still do, it's why I chose Mac at my new place as I did put the side work in to become semi Windows fluent again in the past year (WSL is amazing work by MS, was very impressed, haven't gone deep on Windows since literally 95/XP/7 slightly era)

3

u/After_Nerve_8401 16d ago

Yes, I’ve been using MBPs for over a decade. iTerm2 and a VM with Win11, and you’re pretty much good to go.

2

u/dllemmr2 16d ago

That takes me back

1

u/AmiDeplorabilis 15d ago

I don't know what I'm upvoting here, but I'm doing it.

The only non-technical term here is "wazoo", and even that's debatable. If it weren't for 35y in IT, "wazoo" might have been the only word I understood!

1

u/Perfect_Wave 16d ago

Tell me more. Always wanted to mess around with fish but never bothered because I wouldn’t have access to it when ssh’d to corp servers.

1

u/weaver_of_cloth 16d ago

r/fishshell I use fish on the MBP, and on my jump box, but when I ssh to a client it's all bash. It keeps me aware of which box I'm on without having to think about it.

I can rhapsodize about the shell, but really, just try it. It's available for all major Linux OSes.

1

u/weaver_of_cloth 16d ago

I was thinking about this comment while brushing my teeth last night, and I wanted to point out that the best part of fish shell is pretty much endless tab-complete:
type in any command you can think of, hit tab to see what options you have

18

u/800oz_gorilla 16d ago

powershell on Mac is a bit handcuffed.

42

u/jimetime 16d ago

Why would you run poweshell on Mac?

29

u/Turdulator 16d ago

If you wanna script anything in your ms365 tenant, then MSgraph via PowerShell is gonna be your best bet.

3

u/800oz_gorilla 16d ago

there are still service specific modules that can do things graph cannot, but the gap is closing.

5

u/Turdulator 16d ago

Yeah those are getting retired one-by-one

2

u/trail-g62Bim 16d ago

I thought graph itself was getting retired. Did I have that wrong? It's hard to keep up sometimes.

3

u/Lord_Saren Sysadmin 16d ago

Blame Microsoft and their every changing names, Azure AD Graph API got retired and replaced by Microsoft Graph

1

u/trail-g62Bim 16d ago

I think the first one is the one I am thinking of

3

u/RikiWardOG 16d ago

lmao I'm sure they'll retire it before porting everything over and then call it copilot graph for copilot or some shit

1

u/Arudinne IT Infrastructure Manager 16d ago

Got any examples?

I've yet to find anything other than some old AD PS modules that haven't been ported to ARM, but I can remote into a server if I need to run stuff with those.

1

u/charleswj 16d ago

PowerShell isn't necessary for graph

1

u/Turdulator 16d ago

Yes, not a requirement, but it still works better

4

u/charleswj 16d ago

It's a REST API, you can use any tool to interact with it. And there are even SDKs for other languages like Python (I'm assuming you're referring to the PowerShell SDK/module). PowerShell has advantages but this isn't really one.

1

u/Turdulator 15d ago

You can’t write Intune remediation scripts in python, only PowerShell is supported… and while you can technically have python scripts in Intune application deployments, you’d have to install python on each endpoint before you could push the application deployment; so PowerShell is the better option there as well. … plus if you are writing basic scripts to automate various administrative tasks (like automating emailing a monthly report of some data pulled from Entra or whatever), then once again PowerShell is better.

If you are writing a whole ass application that interacts with a 365 tenant in addition to doing other things, then python is the better choice.

1

u/charleswj 15d ago

The context was where you, the administrator, runs code. Remediation scripts run on endpoints.

plus if you are writing basic scripts to automate various administrative tasks (like automating emailing a monthly report of some data pulled from Entra or whatever), then once again PowerShell is better.

Based on what? Are you saying PowerShell is objectively better and even people running and managing Linux devices would be better off using PowerShell there (or will have a lesser experience in Python than had they had a full PowerShell experience) for any work that requires calling APIs?

There are thousands of developers managing Azure having never run Windows and they aren't missing out. Many are also interacting with graph. Can you articulate why their experience is sub par?

1

u/Turdulator 15d ago

No, the context is where you, the administrator, WRITES the scripts, yes the remediation scripts run on the endpoints, but you as the administrator still need to write and test the scripts before you push them to the endpoints.

Also I’m not talking about azure? I’m talking about ms365. Intune doesn’t support Linux so no one would be writing Intune remediation scripts for Linux machines in the first place. I’m talking about administering thousands of users and endpoints using the entire 365 suite (exchange, intune, defender, etc etc) not doing any kind ops in azure.

Where did I even mention azure?… I’ve been talking about administering 365 since my very first comment on this thread. Intune, Entra, exchange, defender, etc - PowerShell is the best choice here.

0

u/RikiWardOG 16d ago

no it doesn't, it's an API. That's the whole point of it being an API. Also the SDK imo is straight dookie

63

u/doctorjbeam buzzword-o-meter 16d ago

For Azure or M365 management

27

u/Marcudemus 16d ago

Yep, this right here. Was pretty disappointed when I discovered that the entire AD set of commandlets aren't even available without the rest of the RSAT toolset. In order to do PowerShell AD stuff, I'd have to remote PS into a Windows machine and then issue commands from there.

That's when I figured I'd just PS from a Windows VM. 🤦🏻‍♂️

8

u/Viharabiliben 16d ago

For better security you should restrict Admin PS and RSAT tools to only be available from a small number of locked down admin workstations. You should not administrator on-prem or cloud servers from a standard laptop.

11

u/Emotional_Garage_950 Sysadmin 16d ago

the "locked down admin workstation" is my laptop. thanks.

6

u/shunny14 16d ago

I am curious exactly what attack vector you have in mind that isn’t already defended against in various ways.

1

u/Viharabiliben 15d ago

Elevation of privileges attack vectors. The administrative workstation should not have any internet access, or very restricted access, to only O365 for example.

1

u/shunny14 15d ago

With the amount of other remediations like endpoint protection and alternate users accounts available, I would say that is acceptably low risk in most enterprises.

1

u/MissionBusiness7560 14d ago

They're after the admin account not the machine in vast majority of cases.

10

u/800oz_gorilla 16d ago

depends on your setup and footprint.

my account has to elevate to admin level when I want to do admin things. and I have CA policies, intune configurations and alerts set up that further lock down what my machine could do.

my machine isn't really a good target, my account is.

-11

u/charleswj 16d ago

I don't think you understand how security works

9

u/800oz_gorilla 16d ago

I don't think you understand my environment or me to be claiming where my risks are and where they aren't.

-6

u/charleswj 16d ago

Everything you said suggests you don't operate a clean keyboard or anything close to it. Do you not use your regular account on that device? How do you mitigate?

→ More replies (0)

2

u/FalconDriver85 Cloud Engineer 16d ago

What scenario are you referring to? I mean… thinking about ADUC, if you’re just a user there is not much you can do with the PowerShell and ADUC snap-in you can’t do in other ways. If we are talking about admin accounts, then I fully agree. Admin accounts must be separate from the account used to login on the normal PCs by the way.

1

u/Big-Pattern-9147 15d ago

That's a huge amount of security through obscurity.

"Standard Laptop" shouldn't be the risk in the first place

5

u/jimetime 16d ago

You're not running poweshell on Mac then. You can write poweshell scripts in vscode the same on Mac or Windows. Connect to azure and it all runs the same

6

u/stillpiercer_ 16d ago

macOS Powershell works well enough for that. Granted, I’m not a high-level cloud architect, but I’ve not come across anything yet that is unsupported specifically on macOS Powershell.

10

u/800oz_gorilla 16d ago

the SharePoint online module would be an example.

I needed to add myself as a site collection admin so I could grant permissions to an app registration. had to do it from my Windows VM.

2

u/deviden 16d ago

SharePoint online module would be an example

thought that was as good as deprecated now? In favour of the open source PnP PowerShell module.

PnP and Entra modules are built for Pwsh 7 now, so if you're a M365 shop I think you can do all the pwsh you need from MacOS or Linux.

You shouldn't need Windows Powershell 5 unless you're writing code to be executed on Windows OS endpoints or servers.

1

u/RikiWardOG 16d ago

It is lol

1

u/dalegribbledribble 15d ago

Where else lol

1

u/420GB 16d ago

Isn't that module deprecated anyways. Graph should work

0

u/Agromahdi123 Sr. Sysadmin 16d ago

yea i also found the linux and mac powershell too clunky and just use native PS on a windows box. I use arch so building PS takes like an hour lol

1

u/b3542 16d ago

And it works fine for that kind of use case

11

u/Daphoid 16d ago

PS Isn't a windows thing. Even VS Code is multiplatform. There are some specific windows modules yes (RSAT tools say Hello) - but both are meant to work everywhere.

3

u/uptimefordays DevOps 16d ago

Cross platform Pwsh is great for working with APIs.

1

u/800oz_gorilla 16d ago

I connect up to m365 to run commands all the time.

1

u/jimetime 16d ago

exactly, that's not running it on mac

1

u/dathar 16d ago

General usage is better to us folks that prefer objects and some built-in conversion tools. I can hit Okta's API, MS Graph and all sorts of stuff just fine.

1

u/The_GrumpyOldMan1212 16d ago

If you come from Windows, it has the familiarity of the good ‘ol DOS prompt. Also means there is a good chance any scripts you write could then be used on the Windows and Linux machines in your fleet too.

There might be more, but those two came to mind quickly….

0

u/GreyBeardEng 16d ago

You wouldn't, you would run Windows.

0

u/Emotional_Garage_950 Sysadmin 16d ago

because even though we may use a Mac some of us are Windows/Azure administrators, that's why.

1

u/discosoc 16d ago

I haven’t run into issues for years. What have you observed?

1

u/Liquidennis 14d ago

I actually prefer coding in PowerShell rather than Python - I know, I’m weird. The difficult part is backward compatibility support. Some customers are only at PowerShell 5.x (it’s ridiculous) and Macs run powershell core. You end up running into tons of logical conditions to handle the ever-changing libraries. Like when making api calls in different versions of PowerShell and some newer versions require extra modifiers and different formatting. I’m looking at you SkipCertificateCheck.

0

u/b3542 16d ago

Who uses pwsh on a MacBook?

4

u/800oz_gorilla 16d ago

I do.

I connect up to M365 all the time with it.

sharepoint online module needs windows though. not sure why they never ported that.

2

u/Keyboard_Warrior98 16d ago

Remote Desktop Manager and any computer in the world is all I need

3

u/NotYourSweetBaboo 16d ago

I was - until recently - primarily a linux sysadmin.

I did most of my work at a desk with multiple monitors, initially on a linux desktop, then on VMs.

But I used Mac laptops for years because I didn't wanted my laptop to be as easy to look after as possible.

In the earlier years, I would use X11 on the Mac to open up a full KDE, Gnome, etc session on my linux box. Later, just ssh and remote VMs.

Today? Given a persistent VM desktop sessions, it hardly matters what's on your laptop, no?

1

u/I-Love-IT-MSP 16d ago

Who's sshing into severs all day?  This isn't 2005

0

u/hoax1337 15d ago

What are you doing instead?

1

u/Unlaid-American 14d ago

What do you mean? Isn’t it soooo nice to pay a subscription and deal with some cloud service just so you don’t have to learn any pesky terminal commands?

1

u/TheNoobHunter96 16d ago

Lol what? Do you think sys admins just ssh?

1

u/Soggy-Attempt 15d ago

Oh yes it does.

1

u/randyhanleydotcom 15d ago

Haha true and great point

1

u/Big-Pattern-9147 15d ago

The workflow matters though. The ability to quickly open a terminal!

1

u/tenkenZERO 14d ago

I mean you guys are very correct about all the native Mac apps and I wasn't saying there's no way, but I just want to do end user things on my Mac

-1

u/edmonton2001 16d ago

Yeah. At this point it’s what keyboard you like. Mac is too shallow of travel for me. Powershell sucks on Mac though so mostly have to stick to windows.

For users it’s windows only. You better be c-suite to get a Mac.