DNS + do I need a diradmin account?

Question

I have a 10.5.8 server currently being used as a file server for 8 Macs. It is behind a NAT router so is not accessible from the Internet, and doesn't need to be. E-mail and website is handled by a hosting company. All computers have manually-set IP addresses.
I want to eventually set up portable home directories (PHD) so people can work from any computer.
I have set up a clean server and client to duplicate the work system. I've read lots of Apple's documents, and while they are not too bad, there are lots of ifs and buts for much more advanced configurations than mine. So I am a little confused over some things and would be grateful for advice from more expert people than me.
Question 1
Most of the information I have seen about setting up OS X Server seems to assume the machine is accessible from the internet. This one isn't.
During the install, I set the Primary DNS Name to "ueserver.private". The IP address was set manually to 192.168.200.99.
According to checkip -checkhostname, this is fine with name and IP addresses consistent. And I have been able to get PHD to work.
Is this an acceptable way to set the DNS up for this situation, or is there a better way?
Question 2
During the install, I set the server configuration to be "Standard". This seems to have already set OD to be "Open Directory Master", and AFP is active. Guest access is already enabled as required for PHDs.
Documentation I have seen suggests that I should create a diradmin account to administer OD. This is mainly from people who set their machines up as Advanced configurations.
The overall administrator account seems to be able to do anything the diradmin account could do.
Is there any reason to create a separate diradmin account?
Thanks
David

Answer 1

Camelot wrote:
Do you mean/want Portable home directories, or do you really want/mean network home directories?
Portable home directories are designed for systems that split their time between in the office and remote. They have all their home directory data locally and sync with the master whenever they're in the network.
By comparison, Network home directories are designed for systems that are always local to the server, and no user data is saved on the local machine. It's this feature that allows any user to log on from any workstation, which is what it sounds like you're after.
Hello Camelot
I did consider this. What swung me to PHD was a comment in the Apple docs that with PHD, performance was better as it went to the local disk rather than over the network. And there was the advantage that they could still keep working if the server was down for any reason.
Is this an acceptable way to set the DNS up for this situation, or is there a better way?
It's OK, but generally I'd look for another level of hostname. For example, I'd expect something like company.private for the main domain, with this server being ueserver.company.private. This makes it easy to name the workstations things like station1.company.private, station2.company.private, etc.
Thanks for the advice. It's something I had not thought about. OTOH, I'm not sure I'll need to give names to the workstations. (For that matter, drafting1.local will always work.)
Is there any reason to create a separate diradmin account?
Mainly for reasons of delegation. In large organizations its common to delegate user administration to individual(s) that are different from the network admins. Having a separate directory administrator role makes that easier to do.
Ok, well I do it all, so having a separate diradmin account seems unnecessary.
There are some other under-the-hood elements such as directory replication. You don't say how you're handling replication...?
No replication. It's too small an operation to have more than one server, and I believe another OS X Server is required for a replica.
And one more small question:
I used Directory Utility on the client to set up the directory server. It seems to ask for the directory admin (or in my case, the server admin) username and password. This is not something I would usually give out to people setting up a new computer.
Is this what it is really asking for? If so, I would mean that the admin would have to bind the client to the server. This is no big deal in my case, but would be for a site with hundreds of computers to set up. Is there any other way to do this?
Thanks
David