Forgotten password lion server

I forgotten password Lion server

Boot into the Recovery HD. Next launch Terminal. At the prompt, type resetpassword. It will launch the Password Reset Utility.

Similar Messages

I am trying to allow guests on windows to connect to shares on my Lion server but it keeps asking for a password for guest. I have allow guest users to access this share enabled but it still does not work.

I am trying to allow guests on windows to connect to shares on my Lion server but it keeps asking for a password for guest. I have allow guest users to access this share enabled but it still does not work.

Ditto. Guest accounts shouldn't have a password. No way to enter one in System Prefs...

How can I reset my password via Lion Server web front-end?

I'm trying to enable my users to be able to change their passwords from the default value I've given them. This can be done from the user's profile page but when with the new Lion Server web interface, I select the "Change Password" at the bottom of the page and I get the following result:
Changing passwords is turned off.
You can turn it on by using the Server app on the server.
I'm assuming I cannot use the Server app on my client computer (a MacBook Pro) so I use the Server app on the server. I cannot find out how to enable this feature. I've been all over the Lion Server help documentation but can't find out how.
I've selected my server in the Hardware section on the left-hand side of the Server app and gone to the Settings tab and checked the "Enable screen sharing and remote management" box but I still get the message above.
Thanks in advance...

You will have to enabled "Profile Manager" tab.
Inside this tab, enable also the "Device Management", which will start a network directory.
This make sense for a centralized user mgmt.
But a bit not user-friendly enough.
After setting above two,
go back to the "Web" tab, and click the pencil to see the grayed-out activated.

Can't log in to Lion Server. Open Directory Log Message says: unable to connect to password server

I am setting up Lion Server. I can't log in to Lion Server from client.
Checking the Open Directory Log: says: "unable to connect to password server" or
"3394.14268, Node: /LDAPv3/127.0.0.1, Module: AppleODClient - unable to read Password Server response - connection to Password Server was closed, socket fd 18 (5205)"
Thanks for help with this.

I never discovered the problem, and instead rebuilt the server from the ground up. I followed instructions at this discussion thread. Very helpful.
How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.
I have had some log-in problems with users. I have found that restarting the server helps. If this doesn't work, I rebuild permissions on the server, followed by opening up Workgroup Manager, go to the user's password, click on options and require that the user change password on the next log-in. For some reason, this will usually fix the problem. I then log in as the user, and "change" the password to the original one. Also note, that if you import a user, the password is not brought in. You must enter it for each user that you imported. Even so, I have often had to resort to the re-set password procedure to enable a log-in.

Mountain lion server won't take my password for install

I have never run a server version of apple software. I am wanting web sharing to host a small website. This option was removed from sharing preferences in mountain lion.
I purchased server to avoid the need to use the command line interface. It was requiring a password and I don't use a password on my system and it wouldn't take a null. I am finding a similar problem with attempting to install server on mountain lion.
When I run the mountain lion server installer it prompts for an administrator password. I hit return as I set up the system without an administrator password. This fails, but works with all other admin password requests for software installation.
Any assistance would be appreciated.
Best Regards,
David Finell

I just decided to setup passwords. I just wanted to avoid the pain. It worked. Now to figure out how to share folders over the web in server.

Reset diradmin password on server lion

Dear All,
I forgot my (diradmin) password in server lion 10.7.8. When try the folloing command to reset the password, it is still the same
mkpassdb -dump (I get the slot-ID and use it in the folloing command)
sudo mkpassdb -setpassword [slot-ID] Then I a message to type new password: I type a new password
The password doesnt change.
I googled it alot but I couldn't find any good solution.
I appreciate if any one can help me please.
Thank
Tiger07

Look through, or post in, this discussion forum dedicated to OS X Lion Server. Chances are greater to find help there.

Lion server corrupted sudo: 3 incorrect password attempts

A couple of weeks ago I noticed that I was having a problem with sudo on my Lion Server, I went back as far as I could in Time Capsule and restored the entire OS, but the problem seems to have been there since the original install a few months ago. Sudo works fine on my MacBook Pro with Lion 10.7.4 Client.
I have been using sudo for years, and I've never had this happen.'
$ sudo echo
Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
Sorry, try again.
sudo: 3 incorrect password attempts
( 0 ) I can log out as system admin, and log in as root with no problems, but sudo at the Terminal always fails
( 1 ) I have turned off access to root, restarted, turned it back on umpteen times
( 2 ) downloaded an re-installed Lion Server Combo 10.7.4
( 3 ) ran Norton Anti Virus, found no problems
( 4 ) looked at /etc/sudoers using visudo and it looks normal
( 5 ) I am the sys-admin for the server and $id shows that I am in the admin group
( 7 ) Server.app -> Menubar -> Tools -> Directory Utility -> Edit -> Disable Root User
( 8 ) Re-Boot
( 9 ) Server.app -> Menubar -> Tools -> Directory Utility -> Edit -> Enable Root User
( 10 ) Server.app -> Menubar -> Tools -> Directory Utility -> Select my shortname on the left scrolling area, delete Authentication Authority from right side display of my record, then save, quit, and re-boot.
( 11 ) Enter the requested old and new passwords when booting to restore the Authentication Authority
Any ideas other than the http://support.apple.com/kb/HT1528 notes on how to turn it on/off
Most everything I have done on the lion server has not required me to use sudo, but I use it frequently on osx lion client with no problems.
Something is either corrupted, or somebody forgot to turn it on ?
I hope I can get this fixed, I sure don't want to have to re-install the server software.
Thanks for any insights,
Bill Hernandez
Plano, Texas
I can su to root, but not sudo...
$ sudo echo
Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
Sorry, try again.
sudo: 3 incorrect password attempts
myHost:~ usershortname$ su root -c 'tail -30 /var/log/secure.log'
Password:
May 28 21:36:44 myHost su[1426]: in od_record_check_pwpolicy(): retval: 0
May 28 21:36:44 myHost su[1426]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:36:44 myHost su[1430]: usershortname to root on /dev/ttys000
May 28 21:37:41 myHost su[1442]: in pam_sm_authenticate(): authentication failed
May 28 21:37:46 myHost su[1442]: in pam_sm_acct_mgmt(): The group check succeeded.
May 28 21:37:46 myHost su[1442]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:37:46 myHost su[1442]: in od_record_check_pwpolicy(): retval: 0
May 28 21:37:46 myHost su[1442]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:37:46 myHost su[1446]: usershortname to root on /dev/ttys000
May 28 21:37:57 myHost login[1454]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:37:57 myHost login[1454]: in od_record_check_pwpolicy(): retval: 0
May 28 21:37:57 myHost login[1454]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:38:04 myHost com.apple.SecurityServer[44]: Succeeded authorizing right 'system.services.directory.configure' by client '/System/Library/CoreServices/Directory Utility.app' [1003] for authorization created by '/System/Library/CoreServices/Directory Utility.app' [1003]
May 28 21:38:04 myHost com.apple.SecurityServer[44]: Succeeded authorizing right 'system.preferences' by client '/System/Library/CoreServices/Directory Utility.app' [1003] for authorization created by '/System/Library/CoreServices/Directory Utility.app' [1003]
May 28 21:38:09 myHost sudo[1485]: usershortname : 3 incorrect password attempts ; TTY=ttys000 ; PWD=/Users/usershortname ; USER=root ; COMMAND=/bin/echo
May 28 21:38:19 myHost su[1491]: in pam_sm_authenticate(): authentication failed
May 28 21:38:23 myHost su[1491]: in pam_sm_acct_mgmt(): The group check succeeded.
May 28 21:38:23 myHost su[1491]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:38:23 myHost su[1491]: in od_record_check_pwpolicy(): retval: 0
May 28 21:38:23 myHost su[1491]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:38:23 myHost su[1494]: usershortname to root on /dev/ttys000
May 28 21:38:39 myHost login[1502]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:38:39 myHost login[1502]: in od_record_check_pwpolicy(): retval: 0
May 28 21:38:39 myHost login[1502]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:38:48 myHost sudo[1533]: usershortname : 3 incorrect password attempts ; TTY=ttys000 ; PWD=/Users/usershortname ; USER=root ; COMMAND=/bin/echo
May 28 21:38:58 myHost su[1537]: in pam_sm_authenticate(): authentication failed
May 28 21:39:03 myHost su[1537]: in pam_sm_acct_mgmt(): The group check succeeded.
May 28 21:39:03 myHost su[1537]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
May 28 21:39:03 myHost su[1537]: in od_record_check_pwpolicy(): retval: 0
May 28 21:39:03 myHost su[1537]: in od_record_attribute_create_cfstring(): returned 2 attributes for dsAttrTypeStandard:AuthenticationAuthority
May 28 21:39:03 myHost su[1540]: usershortname to root on /dev/ttys000
myHost:~ usershortname$

Did you mean that support document?
Open Terminal.app (Applications > Utilities) and paste the two lines to the Terminal. Hit ENTER and insert your admin password (it dond't show any output to the Terminal, so just type blind and hit ENTER. AND you also have to had set a password, it won't work with a blank password).
If the first command was successfull it would print "not loaded" and return to a new line, ending on $. Then enter the second command, and hit enter.
If the first command fails, copy and paste the output here to the discussions.

HT4798 I cannot get the Apple ID option of resetting my -forgotten password- up. MacBookPro. OS X LION. Christian

I cannot get the Apple ID option of resetting my -forgotten password- up. MacBookPro. OS X LION.
How to proceed?
Christian.dk

Use Disk Utility whihc is in the Utilities Folder.
Select your Boot Disk on the left.
Select Verify Permissions
If any errors the do Reapir permissions.
You might have to repeat the process.
see this:
Steve

Lion Server Won't Accept Password After New Motherboard Installed

We got a mac mini with Lion Server installed on it. The motherboard went bad so we took it back, and they put in the new motherboard. We couldn't log into the computer after that for some reason so we reinstalled it using the Time Machine backup we had (running from the other drive). Then we were able to log in using our admin password. Now the connecct to server won't work, even though we're trying to connect to ourselves, which should us the admin password. We deleted all the keychain passwords but to no avail.
Thoughts?

We had to reinstall the software (using cmd-r when booting up) and then reload everything. That fixed it.

How to use Lion Server Profile Manager to require password after screensaver

Our Company is upgrading to Lion server. One of our requirments for network security is to require a password to wake the computer from sleep or screensaver. In SL Server you would add a key to the com.apple.screensaver entery in workgroup manager.
In Profile Manager in Lion server there is a custom setting section and I have tried adding a key there but it does not seem to work. Can anyone offer some help on how to put the require password to wake from sleep or screensaver in Profile Manager so the setting gets pushed out?

Hi CodyCodes,
Just discovered the same issue today as well. Further complicating things, the screensaver timeout setting in Login Window doesn't apply to Profile Manager clients no matter what the setting. This was reproduced and confirmed by the Apple Tech I was working with. He's submitted the bug to their engineering staff. I requested that he ask them why there is no setting for password on sleep or screensaver. Hopefully this is resolved soon, as this feature is 99% of the reason we're implementing Profile Manager to begin with.
Cheers

Password problem after migrating to Mountain Lion Server

Hello everyone,
Yesterday, I migrated our Lion Server to Mountain Lion Server. Everything seemed to work fine. Except since this morning, none of the network user cannot connect to their calendar, reminders, and wiki. They can connect to their account and to their mails. The following line appears multiple times in ApplePasswordServer.Error.log:
Aug 16 2012 16:52:50 700250us client response doesn't match what we generated
It seems that only web services are concerned (vpn, mobile accounts, and mails are working). My initial guess is that the hash computed on the basis of the user password is not computed on the same way on the client machine (which is running Mountain Lion by the way) and on the server. On the other hand, this would be very surprising, since all this stuff is based on standards and unlikely to have changed since Lion.
I tried to create a new "Test" user. Even this new user, created after the migration, cannot connect to its calendar, etc. I also tried to reset my user password using the Server App. It makes no difference, the same lines appear in the logs.
Is anyone experiencing a similar problem ? Does anyone have a clue of what to try next ?
Thanks a lot !

I found out the following:
After looking at the contents of the password server database using the slot numbers of several user accounts, it seems that all users where WEBDAV-DIGEST authentication is failing, have two entries for the digest method "*cmusaslsecretDIGEST". This is obviously wrong. All users who can authenticate successfully have only one such entry.
Deleting and recreating the user account has no effect. In fact, updating the password server with a new entry may actually trigger this error. It could be that all users where this is failing have changed their passwords after the server was updated to Mountain Lion.
It would be interesting to know if you also see duplicate entries for "*cmusaslsecretDIGEST" in the database. You can display a password server record via the user account's slot number (in your example, the 0xd6ace...) using the command
sudo mkpassdb -dump <slot-number>
At the end of the record dump, you should see 10 digest entries with their method identifiers.

Is there a way to reset keychain passwords from server.app?

We have a Lion server and a number of Macs that authenticate with the server through open directory. On occasion users have forgotten passwords, and so I've reset them from server.app. I've tried both getting them to enter their password on the server, or setting their password to "password" with reset at next login set, but both methods result in an issue whenever the user logs in where they're prompted to create a new keychain or use their old one (which is not possible because they have forgotten the password to unlock it). This is frustrating for me and users.
Am I doing something wrong, or is this how it is supposed to work? It'd be a real pity if the latter was true, and would go against the idea that "it just works" on the Mac.

That's the way it works. Due to the nature of a Keychain, and what is potentially stored in it, once a password is forgotten you need to use a new Keychain and all data within is "lost". If there were a way to reset the Keychain password then you can grab anyone's Keychain, insert it into another account and then use the reset password to get all of the data out of it… at which point there's little point to password protecting it at all.

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

Unable to add/remove users in Mountain Lion Server (Options are greyed out)

For some reason, im unable to add/remove users in Mountain Lion server. The + and - are greyed out. It seems like something is wrong with the permissons because it looks like it cant write the the Ldav3 file (although that may be speculation). Does anyone have any advice for me? I URGENTLY need to add users.
Maybe theres a way to restore default permssions for the boot drive (if that in fact is the issue). Hopefully there is a way that I can fix this while leaving all users, groups, their permissions and shares intact.

Anything interesting and relevent in the server logs?
Anything interesting in the server alerts?
Since it's far and away the most common cause of problems with OS X Server and with distributed authentication (Open Directory is entirely based on network encryption and digital certificates and on responses from your local DNS server(s)), verify your local DNS configuration is working and requires no changes with the following Terminal.app (Applications > Utilities) harmless, diagnostic command:
sudo changeip -checkhostname
sudo requires an administrative password. You might get a one-time warning about the sudo, and that can safely be ignored. The command will display some details, and indicate whether the local configuration appears valid and no changes are required, or further diagnostics for (most) common errors that can arise.

Many Lion Server Problems

I think I have run into most of the Lion Server issues mentioned so far and perhaps a few self inflicted new ones.
1) Upgrade from Snow Leopard worked except the migration failed. Naturally I did not have a backup of the server configuration.
2) Manual configuration has many problems related to the machine name. I was using a linux box for DNS and a private LAN DNS name space. My router is configured to forward many services to my OSX Server box. Somehow I could not configure Lion Mail to operate. The machine name, Internet name, local internet name, etc. are very confusing and different things happen depending upon using Server or Server Admin. In Snow Leopard I could use a command line utility to set the return mail address to my MX record but under Lion I had to eliminate the private LAN name space, configure Lion to be the DNS before I could get e-mail to operate correctly from both IMAP and WEB mail.
3) Once you attempt to use Open Directory the only way to correct a failed configuration is to re-install from scratch.
4) If LDAP and the Password process fail to launch then they ping on/off every 10 seconds forever. Only a re-install from scratch is the fix. When this happens it appears that the permissions on the boot drive are hopelessly broken. I do not mess with the permissions but now I am pondering a nightly permissions repair script.
5) Using self signed certificates seems to cause many problems. If I use them for the mail server everything is OK. If I use them for Open Directory I cannot seem to get the other systems to connect.
6) Under Snow Leopard I could see all users and their pictures on the remote Mac's. I can't find this on Lion.
7) Open Directory quit after a week of operation requiring a clean install from my backup. I turned off Reserve Server Resources. I hope this helps.
8) Timeouts on Lion seem to be infinite. Once one application falls into a timeout you eventually must power cycle the whole machine.
9) The first time a user users mail I have to force kill it and restart before it performs the initial configuration. This has happened 3 times so far.
10) Manually editing user permissions from Finder within the Admin account (i.e. correcting my old user directories to match my new user ID's) is an exercise in futility. Using the command line seems to be the only reliable way.
11) I still cannot get profiles to work but I am afraid to try because the server seems to fragile.
12) Carbon Copy Cloner is a required tool with Lion. As soon as you have something working, make a fresh backup so you do not have to redownload everything. I now make a nightly backup of the boot drive with CCC and cron.
13) Some settings only take affect on a reboot, when you are making/testing changes this causes an interesting phase delay between making a change and observing an effect.
My system is a Mac Mini with 8GB and 24TB of RAID storage on Firewire.
It hosts home directories, e-mail, wiki's, etc for my wife & kids. All data is on the Mini so the other macs at home are bare except for OS and Apps.
This upgrade has caused more trouble than all other system upgrades I have ever done. It is making me think seriously about making another stab at LDAP/OD on Linux for my home server.

You might want to take a look at the much more functional AirPort Utility 5.6 for Mac OS X Lion on a "test" Mac to see if that works better for you. Oddly, 5.6 was released on the same day as AirPort Utility 6.0.
You can keep both 5.6 and 6.0 on a Mac (You cannot delete 6.0).

Forgotten password lion server

Similar Messages

Maybe you are looking for