Configure Lion Server as iCal Server
We have a small business with two email systems in use. Google Apps is used by 60%, IMAP is used by 60% (yes, 40% use both). How can Lion Server be used as a single calendar server. How is iCal configured on the client Macs? Do all the Macs need to run Lion?
In Server Admin, select your server, click on Settings, then go to the General tab. You will see an option to enable the Network Time Server.
Similar Messages
-
I have what I believe to be a unique need;
I have a MacPro (1,1) running Lion with Server app.
I require that this particular machine be connected as a client to a VPN server, while at the same time acting as a VPN server for my network.
The PPTP connection configuration is such that "Send all traffic over VPN connection" is checked.
If PPTP client is NOT connected, I can connect to Lion as VPN server. As soon as I make the connection from Lion as a client, I can no longer
connect to Lion VPN server.
I understand this is because I am forcing all traffic out the virtual interface (tun0) and eth0 is no longer listening on the local network.
1. Is it possible to bind the VPN client (on Lion Server) to a particular interface? If I could tell the PPTP client to only use eth1 as the interface of choice, my assumption would be that eth0 would then be free to accept incoming connections.
2. Is it possible to bind the VPN service (on Lion Server) to a particular interface? if I could tell the vpn serviec to only listen on eth1, and in turn tell the PPTP client to NOT communicate on eth1 but only eth0 then perhaps I could separate the communications?
In my head, it seems as though both of the above options would be required in order to use Lion as both a VPN server and VPN client
Any and all help appreciated.This is a standard facet of most VPNs - the problem lies in your NAT router since both clients appear to come from the same IP address as far as the VPN server is concerned, and the router can't separate out the traffic.
There are a couple of solutions.
First, the built-in VPN server supports L2TP and PPTP protocols. You should be able to connect one system under each protocol, so that gets your two machines connected.
Second, you can replace your NAT router with one that supports multiple VPN clients (often termed 'VPN passthrough').
Third, setup a site-to-site tunnel so that your entire LAN is connected to the VPN (this saves you from having to run a separate VPN client on each machine, but is typically only worth it when you have more machines). -
How do I RE-Configure Lion Server?
So, i was playing with Lion Server, and had managed to Mail to recieve, but not send messages, and webmail sems to be all messed up.
How do i Re-run the Configuration for Lion server? It's a remote Mac Mini, so i am not able to be physically at the machine and wipe/rebuild it. I would like to do it all remotely if possible. Is there a way to wipe all the settings except network, IP, and remote acces, and reset it all up?
I could have sworn there was a configure utility in 10.5 that you could re-run to input the serial, set admin accounts and so forth.
The server is socialgraphics.com if it matters. I think i got DNS set up right, but the server is wonky, and i'd like to just reconfigure if possible
Thanks!Hi Paul
You can still download Lion (and the Server App for Lion) from the App Store by calling Apple Sales (in the US this would be 1-800-692-7753) and paying for a redemption code. I think it's $20? I'm not sure what number you call outside of the US? Apple's Service & Support page may help?
http://support.apple.com/kb/HE57?viewlocale=en_US&locale=en_US
If I've understood your post correctly you may not have to do any of the above?
"I wish to put 10.7 on another device that does not support 10.8 but don't know how to do it?"
Assuming your existing 10.7 Server is still active why can't you target disk mode (over firewire) the device that does not support 10.8 and either use CarbonCopyCloner or use Disk Utility to restore? When you're happy migrate to 10.8.
HTH?
Tony -
How to configure Lion Server as network time server?
I have Lion Server at the top of a small network of Windows 2K, Windows XP and Windows 7 machines.
I need each of those computers to synch their time to that of the Mac Server because this network operates without internet access.
I have tried various protocols from those machines to synch on the server's IP but they all fail.
It has led me to belive I need to enable a service to allow time synch to the managed computers.
But I can't find information on this. I keep getting directed to how to synch the mac to a time server or time machine configuration tips.
Thanks in advanceIn Server Admin, select your server, click on Settings, then go to the General tab. You will see an option to enable the Network Time Server.
-
I have been trying for two weeks now to publish from the iWeb program to the Lion Server both of which are installed on the same computer. I've gotten all the required info from my isp - in this case my workplace (DNS, directory path,ect). I was told I don't need to configure the router for port mapping as I am using my workplace's server as the 'parent'. Publishing from the iWeb to the lion server ISN'T easy by any means. I've had hundreds of 'could not establish a connection to the server...' messages. Somehow or other, after putting in all the required info into the iWeb program, I 'lucked' onto putting up two test pages but I had to try literally dozens of combinations of the settings even just to do that. Five minutes later the same settigns don't work when trying to add another page. Is there a 'dummies' guide to configuring both the iWeb program and the lion server so I can publish??
The answer to your question depends on some information you haven't provided. I use GoDaddy to manage my domains, though, so I can tell you how I have managed this.
If you have static-IP on your internet service, than you can do the same. Using the domain manager at GoDaddy:
1. You need to set an A name to point to your mail service - for example, add the following to your A-name records.
mail xxx.xxx.xxx.xxx (your fixed IP address)
If you do this, then if you were to use the NetUtillities, the address mail.yourdomain.com would resolve to your IP address
2. You need to set the highest priority (lowest number) MX record to point to mail.yourdomain.com. 0 is the lowest so you can change the MX record with a value of zero to:
0 mail.yourdomain.com
If you've turned on mail service using the Lion Server application, you will be be able to receive mail
Cheers,
Gregory -
How can I configure Lion server or mail.app to show IMAP subfolders with mailboxes?
I'm sure we've all seen the weird IMAP glitch where mail subfolders appear down lower on the mail.app pane instead of nested neatly under the mailbox itself. Usually you can get around this by changing the Inbox IMAP prefix to "" or "INBOX" or "/" or some such path that the server recognizes as the root path to your IMAP folder. Unfortunately, this sometimes means you are unable to work with those folders or introduce other problems.
Since I am running Lion (Client) and Lion Server as my mail host, I would think that there is an appropriate answer to this either on the mail.app client settings, or perhaps with a Lion Server configuration through DOVECOT. I don't mind if the solution is a command-line one, but I need to be able to easily set up my mailboxes so that mail subfolders appear properly under each mailbox, instead of being hidden away lower on the page where it is very inconvenient to find, especially when you are using multiple email accounts.
Client Machine Lion 10.7.3
Server Machine Lion Server 10.7.3
Please Help!!!!I've tried editing /etc/dovecot/conf.d/10-mail.conf on Lion Server to add the following:
namespace private {
type = private
separator = /
prefix = INBOX/
inbox = yes
This puts me in a catch-22:
If I leave the "IMAP Path Prefix" setting in the account Advanced tab empty, I can see the subfolders and move messages in and out of them, but can't add or edit the folders or heirarchy.
If I set the "IMAP Path Prefix" to "INBOX" I can add and edit subfolders, but they don't appear nested under my inbox.
Please help! -
Configuring Lion server as time machine target?
I've got a mac mini (2009) that I'm considering upgrading to Lion. Can I use this soon to be lion server as a remote (wireless) time machine target for my laptop? Is there any tutorials on how to do this? I'd prefer to not have to go about the older methods of running NFS mounting scripts and such.
ThanksI had the same problem.
Time machine on my server, updated from Lion to Mountain Lion.
Fixed it by:
(To be completely safe, always start by backing up to a extra external hard drive, if you can.)
On the Machine that is your Server
I went to (Server>Services>Time Machine). My Time Mahine backup folder was there.
Open a Finder window and follow the path to your backup folder
When I checked on the backup drive folder it didn't exist.
In Finder use "New folder" and recreate the directory folder as shown in (Server>Services>Time Machine) eg. Volumes/TM folder/Shared Items/Backups.
Go to the Server>Services>File Sharing. Check that the Master folder (ie. TM folder)you are using for your time machine is shared. Double click on it and check that the account you use to connect to the server has "Read & Write" access.
Open the Server Panel, under Services >go to "Time Machine" and turn off the Time Machine. (Server>Services>Time Machine)
Select the current folder and remove "-" the folder currently showing.
Then add "+" the newly recreated folder
Go back to Server>Services>Time Machine
Then turn on the Time Machine
Then try to connect your macbook to the Time Machine server again
If you get to step 3 and find the folder is there then just skip step 4 and do the rest to reset it.
It may not connect your machine to it's previous TM folder so before continuing on to step 5, mark that by ctrl+click>Label> any colour. You can then go back later when you have a couple of up to date backups in the new folder and delete the old on for more space. -
I've installed and configured Lion Server on an old iMac that suddenly became available when I upgraded to a new iMac. I've got a share point on there. It was easy. Love it.
My bookkeeper comes into my office once a week and works on that iMac. He already has a regular user account set up there. He needs to access the sharepoint that is on that iMac he's using, and which is now running Lion Server. But I can't see the server from his account, and I can't manually connect to it - I get an error to connect locally on the Mac instead.
But I can't navigate to the point in the user account that I'm using as a file serving account to get him access to the directory I'm sharing.
So, in short, how does a local user on an iMac running Lion Server connect to the server's sharepoints?All drives are now listed under volumes both local and remote.
I would try the fullpath using /Volumes/....
or post the file paths your trying
are you trying the goto menu? -
Hey world!
I have five Macs of various types and ages spread throughout my house.
I've set up Lion server on a 21' iMac to manage the five apple computers on the home network. I must say that although I read some bad publicity, the iMac is absolutely steaming along! (I also increased to 6Gb RAM).
The way it's all configured (remember I'm a home user and not that IT literate) is that the ADSL modem feeds into the WAN port on my Time Capsule; I have an ethernet connection to the computer with Lion Server software, and WiFi feeds to the computers and four iPhones. I had an IT savvy buddy come over and set up the IP addresses for the ADSL and the server - all works well but he is actually anti Mac (refusing to know the intricacies) which makes the Mac nuances difficult to explain (again remember I'm not IT literate apart from the basics).
Instead of having to download software and firmware updates five times, I'd like to do it just once.
Can I configure Lion Server so that for software upgrades, it only downloads once to the server and then I can either distribute it or store it for use?
All I'm doing is trying to set up a secure and efficient home network. if anyone else has more tips on using a server in a home environment I'd appreciate your input.
Kind regards,
NamphGo to Server Admin (installing it via Server Admin Tools if you need to) > select the server > Settings > Services and enable the Software Update service and go from there.
-
How do I perform a clean install of Lion Server?
There seem to be many sites documenting how to pull out the ESD image and burn a bootable copy of Lion.
What I'd like to know is how do I perform a clean installation of Lion Server?
Is it possible to just install Lion and then open the App Store and install from Purchase without being charged again?Okay....so Apple does have a guide related to Mass deployment which includes a rough way to do a clean OS X Server clean install. You need to use a NetBoot Lion Server as a boot, but it works.
http://support.apple.com/kb/HT4746
Use these steps to create a NetRestore image of an un-configured Lion Server:
Install OS X Lion, and then Lion Server. This server will be used to create the NetRestore image.
On the server, install the app named "Install Mac OS X Lion" from the Mac App Store (a network connection is required for this process).
Install the Server Admin Tools from http://support.apple.com/downloads/ on the server.
Open the "Install Mac OS X Lion" application, and install to an empty volume. This volume can be a spare partition or external hard drive. Be sure to click the Customize button and to select the Lion Server software.
Once installation is complete, the server will restart from the newly installed volume. Instead of completing the setup assistant, press Command-Q to quit the assistant.
Select the option to shut the server down.
Restart the server and hold the Option key.
When the Startup Manager appears, select the volume which you've already configured Lion Server on.
Open System Image Utility and create a NetRestore image from the newly installed (and still un-configured) volume. If you'd prefer to image the volume after it has already been configured, you can proceed with the setup assistant before booting back to the original installation created in step 1. -
I launch Server.app, click 'Continue', accept licence, 'Continue', it asks for my admin user/pass which I give then click again on 'Continue'.
Then, it stops forever at 'Configuring services'.
In console, I have 7 lines like
authorizationhost : SFBuiltinEntitled: Server.app is not entitled for com.apple.ServiceManagement.daemons.modify
(the 7 only differs after 'for') then one with
com.apple.SecurityServer : Failed to authorize right 'system.install.app-store-software' by client '/System/Library/PrivateFrameWorks/PackageKit.framework/Versions/A/Resources/in stalld' [481] for authorization created by '/Applications/Server.app' [460]
But, I entered my regular user/pass, the same account I used to buy Lion Server; the same I use to update software. So, why my admin account is not enough to configure Lion Server services?
Any ideas are welcome!+1 same issue for me too.
I have a wireless connection though, wondering if it is a wired connection that is being asked for here? -
Setting up Push Notification in Lion Server
Dear all,
I am setting up a Lion Server which allows users to enroll their ipad, and want to send out push notification.
After I got a SSL cert, enroll the ipad.However, I could not see any way to push my notification to application in my ipad. So here is my question:
1. Does the APNs set up in the Lion Server Connecting to the gateway.apple.com:2195 or directly connect to the ipad? Because my target environment will be a private network.
2. How can I configure Lion Server so that it could send out push notification? ( either from apple or direcly push )
ThanksThanks for your reply,
However,
http://support.apple.com/kb/HT3947
Referring to the above documents,
" Additionally, the service can be configured to provide Push Notifications to third-party applications which use the ServerNotification "
This really confuse me -
I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root: myname
admin: myname
sysadmin: myname
certadmin: myname
webmaster: myname
my_alternate: myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080 # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost # Default is localhost
REMOTEPORT_DEFAULT=3128 # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
-p) shift; # -p option
SSHPORT=$1;
shift;;
*) TUNNEL_DETAILS=$1; # 1st argument option
shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])} # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*} # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%@} # delete @
if [ "$CAR" != "" ] # leading or trailing port specified
then
USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ] # no hostname given
then
HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
&& echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
|| echo "SSH tunnel FAIL." -
Lion Server Profile Manager Configuration
Hi Guys,
Currently have been testing Lion Server and Profile Manager Configuration.
So Far Have setup
Lion with Server App and Server Admin Tools
Configured Open Directory Master and enabled SSL on LDAP
Once Configured OD has created a CA Certificate can use for Profile Manager
Have Enabled in Server.app Web and Profile manager
In SSL Certificate Configuration have set CA Certificate for Web and Enabled Apple push notifications with my apple ID
In Profile Manager Enabled Device Management and Enabled Sign configuration profiles and selected CA Open Directory Certificate Created when setting up OD Master.
On Server Originally could install Trust Profile OK and Enroll Server OK with no issues, but on any other 10.7 Devices could install Trust Profile OK but would always say unsigned and Enroll would never work or just hang.
Now Since Played around with settings on 10.7 Server can no longer enroll but trust OK.
Questions have is
For SSL and Profile Manager to work properly as well as Certificates do you require to purchase a proper SSL Certificate or can we use the OD Master Certificate that gets created. All we are testing is on the Local LAN so don't want to get a SSL certificate from the internet.
Also why cannot 10.7 clients trust profile and enroll Devices Properly? How do I get this working properly?
Any ideas?
Regards,
Shanetaubmas wrote:
Not sure if its that as finally got Lion Server working on a VM setup so network shouldn't be an issue...
Had 1 OSX Lion Server VM and 1 OSX Lion Client VM and OSX Lion Server VM gets profile and enrolls device fine but again OSX client doesn't get enroll just sits again at installing..... even if set keychain to trust and make trust profile verified..
any other ideas? I think need to somehow get the server to trust trust profile by default instead of going to keychain all the time.
Shane
Did you get this to work in an ESXI envrionment? If so, which version are you running? -
How to setup iCal on a Lion server and its client machines?
I recently bought a new mini server (running Lion) in order to share our iCal calenders (like in the Apple presentations). I thought this would be an easy process but apparently it isn't. So what was I already able to achieve:
1) Set up 5 different clients (on the Lion server), with corresponding e-mailadresses and passwords.
2) Activated iCal on the server preference window (ical: on)
3) Tried to add the user a account on one of the five client machines => HERE it goes wrong.
My main issue is that I'm not able to add a user account on a client machine and have it connected to the server.
It would be really nice if someone could assist me with it.
Warm RegardsI posted additional information online using the newly created Launchpad login Service account.
I hope that explains my situation, if not I will add more detail here.
There is no problem, when ither of the two OS are used to enable printing with the HP Deskjet 2050 J510 series printer.
The problem begins when I try to print from the other OS , when connected to one of the Operating System.
I have tried without success to print from Windows 7 Ultimate 64-bit OS from an HP Deskjet 2050 J510 series connected to a Ubuntu 12.04 LTS server with Amahi (HDA), installed.
The same thing occurred when I tried to print from the Ubuntu server and the printer was connected to the Windows 7 Ultimate 64-bit running P.C.
Maybe you are looking for
-
How can I call a DLL from Borland C++Builder that was generated by LabVIEW?
In the linking phase, the linker of Borland C++Builder echoes the message shown below: [Linker Error] 'Test.LIB' contains invalid OMF record, type 0x21 (possibly COFF) 'Test.LIB' was generated by LabVIEW Application Builder and had been verified work
-
Hi all, I would like to know if there is any BAPI present to create purchase requisiton. The fileds that I would like to give are Item Category ,Material no, Quantity Delivery date Plant Storage Location Supplyin
-
Email sent successfully in foreground,but fails in background
Dear All, On Tcode FBL5N, i have an option to send the account statement to specific customers. the issue i am facing is happening only to ONE customer ABC when the program is scheduled to run as a batch, tONLY his customer ABC alone does not recieve
-
Watching CNN and Yahoo videos with mplayer-plugin [SOLVED]
I had a hell of a time trying to view CNN videos (http://www.cnn.com) and Yahoo videos with mplayer-plugin (firefox) and didn't seem to find any solutions in a forum search. The following worked for me: To get it working at all, I had to edit /etc/mp
-
TS1646 When I click "view my account" there is no option for "none."
When I click "view my account" there is no option for "none." Can anyone help?