How to backup profile manager?

Is there a way to backup the database in the profile manger?

Thought I should update this info for Mavericks (10.9) and Server 3 because Apple changed things again, just slightly.
Apple removed /user/bin/psql and associated apps so now you only have one psql to deal with and it’s in your environment path. Running ‘which psql’ will show you /Applications/Server.app/Contents/ServerRoot/usr/bin/psql
That has simplified things a little.
The socket has moved also and is now in:
/Library/Server/ProfileManager/Config/var/PostgreSQL/
So to get into the database run this command.
sudo psql -U _devicemgr -d device_management -h /Library/Server/ProfileManager/Config/var/PostgreSQL/
Use \d to see the tables \h to get help \q to exit. See the man page or the postgresql documentation online for more if you are new to this, like me.
The basic backup/dump command is:
pg_dump -U _devicemgr -h /Library/Server/ProfileManager/Config/var/PostgreSQL/ -c device_management > $HOME/device_management.sql
If you use the above psql command to create the backup it will be in a text format. Apparently that means you need to also use psql to restore. I’m sure there are better ways to do the backup and restore. Having a full TimeMachine backup of your server works well.
For the restore I modified the previously posted commands just a bit.
sudo serveradmin stop devicemgr
sudo serveradmin start postgres
sudo dropdb -h /Library/Server/ProfileManager/Config/var/PostgreSQL/ -U _devicemgr device_management
sudo createdb -h /Library/Server/ProfileManager/Config/var/PostgreSQL/ -U _devicemgr device_management
sudo psql -U _devicemgr -d device_management -h /Library/Server/ProfileManager/Config/var/PostgreSQL/
sudo serveradmin start devicemgr
I rand all this on a test server and it appears to work.

Similar Messages

  • How do I backup profile manager database on OS X Yosemite?

    Hello guys,
    I'm struggling to find an answer on how to backup profile manager database(devices, groups etc.) on Yosemite(server 4), so far I only found a few threads for Mavericks (10.9) & Server 3 saying to type the following command via terminal: "sudo pg_dump -U _postgres -c device_management > $HOME/device_management.sql"
    Although this command applies to Mavericks(server 3) I decided to give it a shot but as expected I got this error message:
    "pg_dump: [archiver (db)] connection to database "device_management" failed: could not connect to server: No such file or directory
    Is the server running locally and accepting
    connections on Unix domain socket "/var/pgsql_socket/.s.PGSQL.5432"?"
    I also tried to backup & restore profile manager's database with TimeMachine but unfortunately it didn't worked..
    It seems that TimeMachine misses the profile manager's data folders(see thread: Profile Manager not being backed up in Time Machine?)
    and I saw that other people also complained about this problem.
    As we're a company who holds thousands of devices & integrates them on daily basis to profile manager, I would be very pleased to know how to backup our Profile manager's database.
    Please see this question as HIGH importance, I really hope to get an answer ASAP..
    Thanks in advance for all the repliers!
    Yours sincerely,
    Daniel Adler.

    Hi Strontium90,
    Thanks for your reply!!
    I tried your command, but unfortunately i got the following error msg:
    "too many command-line arguments (first is "devicemgr_v2m0")
    Try "pg_dump --help" for more information."
    Please correct me if I'm wrong: assuming command was successful, I should've seen 'profileManager.sql' file at my desktop(output path = ~/Desktop/) which is the Profile Manager's database file I guess, right? and where is the restoration path located? in case I want to restore Profile Manager's database with the created backup file('profileManager.sql').
    Also you mentioned: "Automate to perform daily", how can I automate this command?
    Thanks a lot for your support!
    Have a nice day.
    Yours sincerely,
    Daniel Adler.

  • How to configure profile manager in Maverics when DNS is externally managed?

    Are there any guides to configuring Profile Manager as a MDM?
    Here is my story.
    Recently installed  Mac mini at a school where the DNS is externally managed by the Education departments IT group.  Upgraded to Maverics and installed Server app.  Configured profile manager to the point where we could generate a trust profile and enrolment profile.  Doesn't work because there is no DNS entry for Mac mini server.   Create entry but need to change host name and computer name and local machine name to match entry.  Suddenly profile manager not working at all.  Delete server app and it's configuration file in ~/Library/.  Reinstall.  Now Profile manager won't even activate.  Speak to Apple on phone, run various commands to reinitialise Open Directory and reset profile manager.  To no avail.  Apple say to reinstall Mavericks, Server and try again.
    Funny thing is I got profile manager to work as an MDM in a test environment, but changing DNS after doing so much configuration seems to have made a real mess of things.  Vowing to make a time machine backup as soon as Mavericks re-installs.
    Anyone know of any guides other than the one on krypted.com, which appears to be for the previous version of Profile Manager.
    Stom

    In general, either your OS X Server box has a DNS translation for its address, or it doesn't. 
    If you don't have valid DNS, you will have problems with various services, as DNS is fundamental to distributed authentication and encryption, among other uses. 
    OS X Server doesn't recover well from installations that start off with DNS errors, and the wipe and reinstallation suggested by Apple is usually easier than resolving the various issues that tend to arise within the configurations of the various services.
    If your server doesn't have a valid DNS translation, then either add the DNS translation into your organization's local DNS environment, or work to retrain or replace the folks that are unwilling or unable to administer and to properly maintain local DNS services, or (far less desirably) configure and start your own parallel DNS services.  There are other options, of course. 
    I'd escalate this discussion to management, and let them sort this out — at its core, this very likely isn't a technical issue.

  • How to restrict profile manager to SSL?

    I have just setup Profile Manager 3.0.2 on OS X 10.9.1 (Mavericks). The setup works fine, but I noticed that I can access profile manager over SSL and regular HTTP. I would like to restrict access to using SSL, but I don't know. Can someone please direct me to how I restrict access to profile manager to only allowing secure connection. Please be clear as I am new to OS X. Thanks.

    Authentication and everything after the login page should be SSL (https://).
    If you login via the page at http:// does it not redirect to https:// ?

  • How to get Profile Manager working over the internet?

    I've set up profile manager at home and it work great on my local network. Now I wanted to make it work over the internet but I can't figure out how to do so. I've already opened the required ports. When I try accessing the User Portal trought my <external ip>/mydevices it asks me whether I trust a certificate or not, but when I choose "ok" it keeps requesting the URL forever until it times out. Am I required to have a registered domain name to access my server or I can just use my external IP ? Is there anything else I should do in order to have it working?

    First off, you say you've opened 'the required ports', but which ones are they, in your opinion?
    That may sound like a dumb question, but it isn't meant to be. You'll need port 443 to support HTTPS connections, and 1640 for the Certificate Enrollment server.
    Additionally, you WILL need a valid domain for this - at least if you don't want authentication errors. SSL certificates rely on the hostname (amongst other things) to provide validation and if you access the site via IP address that validation is doomed to failure. That shoudkn't lead to the problem you're experiencing, which is no response at all, but it's still an issue to resolve.

  • How to reset profile manager on mountain lion?

    I never manager to get profile manager working on Lion Server.
    I was expecting to do a clean install on my mac mini server, I couldn't.
    Before reformating the partition any simpler tip?
    May be I messed up the certificate as well.
    When I try to enroll a compter (e.g. the mac mini server itself) via the web interface, I get the error message:
    profile installation failed
    could not download the identity profile from the encrypted profile service. The credentials within the device enrollment profile may have expired.
    For resetting, I tried in Terminal
    cd "Server HD"
    sudo sh /usr/share/devicemgr/backend/wipeDB.sh
    and I get :
    No such file or directory
    Thanks in advance

    I'm having this same issue.
    I can install the Trust Profile
    but when I go to Enroll Device, I get:
    profile installation failed
    could not download the identity profile from the encrypted profile service. The credentials within the device enrollment profile may have expired.
    what I've done:
    backed up my Device Manager database
    wiped the database
    re-setup Device Manager
    replaced the database
    tried to Enroll Device and failed (same error)
    wiped the database
    re-setup the Device Manager
    tried to Enroll Device and failed (same error)
    I've tried recreating my ssl certs
    Ive tried running it without code signing certs
    I refuse to wipe my entire Open Directory
    is there any to get this working or am I going to need to go third party to manage my Mac-only shop?

  • How to open Profile Manager on OS X Lion

    Trying to create a new profile and cannot open Profile Manager by using "/Applications/Firefox.app/Contents/MacOS/firefox-bin -profilemanager" or any of several variations. Thought there might be another way to do it in Lion. Thanks.

    I don't know what that's all about. Still looking for a solution.

  • Firefox won't open, error msg = can't find profile; deleted all app.data to rid new Win 7 Total Security virus - tried both v 4.0 & v 3.6 (now no error msg either). Can't open profile manager, can't open safe mode. pls help

    My mother's computer was infected with the new "Win 7 Total Security" virus (apparently a fake antivirus program) - corrupted real av. To remove, we followed online advice to delete everything in AppData, for all programs, plus some other stuff. We moved it all to a flashdrive for safety, but after successfully removing virus, likewise cleaned & reformatted flashdrive. This apparently deleted Firefox profile(s), and after uninstalling & reinstalling, Firefox still won't open - I can't create a new profile. With v 4.0, I get an error message about not being able to find the profile. Found advice on how to open profile manager, but it won't open. Found reference to version 4 dispensing with profile manager, so tried installing version 3.6 again; still won't open, still can't open profile manager, but now no error message at all.

    THANX for the reply cor-el. I've never had a problem using just "firefox -p", but i did use the full path like you advised after i read the profile manager article here before i posted my question. Unfortunately it didn't work. I've backed up all 3 profiles from the "%appdata% profile" file, and also from my remaining main profile that i'm on right now. I decided i'm going to uninstall ff3.6.28 & upgrade to "firefox 11" this weekend and hopefully create the other 2 profiles along with my main one. I do like in the newer versions of FF the tabs on top like googles chrome because it gives you more room on the page. I also like some other features too, but the main reason i kept my old version both times is because the newer versions didn't seem to load pages any faster than version 3.6.28. I'm not going to worry about some themes/personas not being compatible with ff11. I'll find some new ones. I think when i tried "ff9" awhile back along with my current version, i just deleted the shortcut that the article said to create on the desktop and still had all 3 profiles & no problems like i have now. In case your curious, the article on how to create more than one version of firefox at the same time was on the site "Dottech.org>[How To] Tip: Install multiple versions of Firefox to test before upgrading to latest release". It works but i obviously did something different this time that caused this problem. THANX again for your time/help, i do appreciate it.

  • How can I disable backup for managed app with profile manager?

    I use Server App 3.1.2 to manage iOS devices with profile manager.
    Is it possible to exclude managed app's backup from users iCloud or iTunes backup?
    thanks
    Paolo

    Hi,
    Please use the following link (under "Manage Print Apps" to cancel/remove it:
      http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02940901&cc=us&dlc=en&lc=en&product=5058336&tmp...
    Regards.
    BH
    **Click the KUDOS thumb up on the left to say 'Thanks'**
    Make it easier for other people to find solutions by marking a Reply 'Accept as Solution' if it solves your problem.

  • How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

    I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
    Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
    Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
    Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
    DVD>Disk Utility>Erase Disk  [or Recovery Partition>Disk Utility>Erase Partition]
    DVD>Install Lion
    Reboot, hopefully Lion install kicks in
    Update, update, update Lion (NOT Lion Server yet) until no more updates
    System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
    Terminal>$ sudo scutil --set HostName server.domain.com
    App Store>Install Lion Server and run through the Setup
    Download install Server Admin Tools, then update, update, update until no more updates
    Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
    System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
    A few DNS set-up steps and these most important steps:
    A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
    B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
    C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
    D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
    E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
    F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
    G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
    H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
    I. Test from web browser server.domain.com/mydevices: Lock Device to test
    J. ??? Profit
    12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
    You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
    Firewall
    Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
    SSH
    Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
    PermitRootLogin no
    PasswordAuthentication no
    ChallengeResponseAuthentication no
    I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
    Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
    client$ ssh-keygen -t rsa -b 2048 -C client_name
    [Securely copy ~/.ssh/id_rsa.pub from client to server.]
    server$ cat id_rsa.pub > ~/.ssh/known_hosts
    I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
    $ diff denyhosts.cfg-dist denyhosts.cfg
    12c12
    < SECURE_LOG = /var/log/secure
    > #SECURE_LOG = /var/log/secure
    22a23
    > SECURE_LOG = /var/log/secure.log
    34c35
    < HOSTS_DENY = /etc/hosts.deny
    > #HOSTS_DENY = /etc/hosts.deny
    40a42,44
    > #
    > # Mac OS X Lion Server
    > HOSTS_DENY = /private/etc/hosts.deny
    195c199
    < LOCK_FILE = /var/lock/subsys/denyhosts
    > #LOCK_FILE = /var/lock/subsys/denyhosts
    202a207,208
    > LOCK_FILE = /var/denyhosts/denyhosts.pid
    > #
    219c225
    < ADMIN_EMAIL =
    > ADMIN_EMAIL = [email protected]
    286c292
    < #SYSLOG_REPORT=YES
    > SYSLOG_REPORT=YES
    Network Accounts
    User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
    2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
         User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
    Oh well.
    Email
    Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
    root:           myname
    admin:          myname
    sysadmin:       myname
    certadmin:      myname
    webmaster:      myname
    my_alternate:   myname
    Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
    cd /etc/postfix
    sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
    sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
    sudo serveradmin stop mail
    sudo serveradmin start mail
    Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
    If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
    iCal Server
    Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
    Web
    The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
    $ diff httpd.conf.default httpd.conf
    95c95
    < #LoadModule ssl_module libexec/apache2/mod_ssl.so
    > LoadModule ssl_module libexec/apache2/mod_ssl.so
    111c111
    < #LoadModule php5_module libexec/apache2/libphp5.so
    > LoadModule php5_module libexec/apache2/libphp5.so
    139,140c139,140
    < #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
    < #LoadModule encoding_module libexec/apache2/mod_encoding.so
    > LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
    > LoadModule encoding_module libexec/apache2/mod_encoding.so
    146c146
    < #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
    > LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
    177c177
    < ServerAdmin [email protected]
    > ServerAdmin [email protected]
    186c186
    < #ServerName www.example.com:80
    > ServerName domain.com:443
    677a678,680
    > # Server-specific configuration
    > # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
    > Include /etc/apache2/mydomain/*.conf
    I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
    Alias /eyetv /Users/uname/Sites/EyeTV
    <Directory "/Users/uname/Sites/EyeTV">
        AuthType Digest
        AuthName "EyeTV"
        AuthUserFile /Users/uname/.htdigest
        AuthGroupFile /dev/null
        Require user uname
        Options Indexes MultiViews
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
    <Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
        AuthType Digest
        AuthName "EyeTV"
        AuthUserFile /Users/uname/.htdigest
        AuthGroupFile /dev/null
        Require user uname
        Options Indexes MultiViews
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
    Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
    One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
    Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
    User-agent: *
    Disallow: /
    Misc
    VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

    Privacy Enhancing Filtering Proxy and SSH Tunnel
    Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
    If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
    $ ./ssht 8080:[email protected]:3128
    $ ./ssht 8080:alice@:
    $ ./ssht 8080:
    $ ./ssht 8018::8123
    $ ./ssht 5901::5900  [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
    $ vi ./ssht
    #!/bin/sh
    # SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
    USERNAME_DEFAULT=username
    HOSTNAME_DEFAULT=domain.com
    SSHPORT_DEFAULT=22
    # SSH port forwarding specs, e.g. 8080:localhost:3128
    LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
    REMOTEHOST_DEFAULT=localhost    # Default is localhost
    REMOTEPORT_DEFAULT=3128         # Default is Squid port
    # Parse ssh port and tunnel details if specified
    SSHPORT=$SSHPORT_DEFAULT
    TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
    while [ "$1" != "" ]
    do
      case $1
      in
        -p) shift;                  # -p option
            SSHPORT=$1;
            shift;;
         *) TUNNEL_DETAILS=$1;      # 1st argument option
            shift;;
      esac
    done
    # Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
    shopt -s extglob                        # needed for +(pattern) syntax; man sh
    LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
    USERNAME=$USERNAME_DEFAULT
    HOSTNAME=$HOSTNAME_DEFAULT
    REMOTEHOST=$REMOTEHOST_DEFAULT
    REMOTEPORT=$REMOTEPORT_DEFAULT
    # LOCALHOSTPORT
    CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
    CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR%:}                            # delete :
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        LOCALHOSTPORT=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # REMOTEPORT
    CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
    CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR#:}                            # delete :
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        REMOTEPORT=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # REMOTEHOST
    CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
    CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR#:}                            # delete :
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        REMOTEHOST=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # USERNAME
    CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
    CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR%@}                            # delete @
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        USERNAME=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # HOSTNAME
    HOSTNAME=$TUNNEL_DETAILS
    if [ "$HOSTNAME" == "" ]                # no hostname given
    then
        HOSTNAME=$HOSTNAME_DEFAULT
    fi
    ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
        && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
        || echo "SSH tunnel FAIL."

  • Profile manager backup

    Dear all,
    Can profile manager backup by time machine?
    if it can't then how to backup and restore profile manager correctly
    i tried to use time machine to restore the profile manager but i try to use profile manger to reset ipad password ,update ipad profile doesn't.
    any methods fix it ?
    Thanks

    The files are created by PostGreSQL and contain WAL (write-ahead-logging) data. It's still not clear why these files should be growing at more than 33 MB a day.
    Why is there no snapshot of the database taken, past WAL files deleted and new ones started every day/week/month? Can I do this myself? I'm now wasting 16GB of storage as an inefficient backup for PostgreSQL.

  • How do I use the Profile Manager to run multiple PHP sessions?

    I have a website that tracks the session and state of users as they traverse through the site. Several users can "work together" simultaneously. To test this cooperative functionality, I ran multiple Firefox profiles simultaneously on my computer, using Firefox's Profile Manager. After logging in as two users (one on each separate running Firefox instance), one of my Firefox instances still works, while the other one does not seem to track the session.
    How do I create and run multiple Firefox instances to allow me to test the functionality of such sites? I believe this worked a few months ago. Perhaps this is a new bug?
    I even tried running normal Firefox and Firefox Extended Support Release simultaneously, but I ran into the same error.

    Disregard the question. The solution has nothing to do with any "Firefox bug". Turns out that my session wasn't being managed properly. Or rather, I was accidentally deleting other users' information when new users logged in. So if I had user 1 and user 2, and user 2 logged in after user 1, some of user 1's information would be deleted, resulting in the errors.
    Oops; sorry about the false alarm. :)
    (Was hoping to retract the question, but it looks like others have a similar problem.)

  • How do I push VPP managed apps to devices using Profile Manager silently?

    Here is my setup.
    100 to 150 Ipads in carts used by their departments in classrooms.
    OSX Mavericks Server running Profile manager
    I use Apple Configurator to push a wifi payload to the ipads as well as an auto enrollment profile to connect to Profile Manager.
    That part works like a dream.
    Now that I have that working. I am having a problem pushing apps to the Ipads. I downloaded some free apps, GDrive for example, using the managed distribution.
    But I cannot figure out how to push the apps to the iPads without having the iPads asking for an Apple ID and password.
    I just want to push VPP apps to the iPads silently.
    Thanks for any help.

    Sorry. Added this to the wrong section.

  • How do i add more than one pdf at a time to profile manager books

    How do I add more than one pdf at a time to profile manager books? When I browse to my pdf folder I can only select one pdf at a time. I have 500+ pdf files I need to add. Any help would be greatly appreciated.

    Bucknut wrote:
    I want to add more than one email address to my address book from an email I received. They were in the CC of the email I received. is there anyway to drag them all into an address book group all at once. I hate having to add and address and then having to find the address and then add it to a group. thanks
    no, there is no way to do that, sorry. you need to control-click on every email address one at a time and select "add to address book". if an email is in the address book already that option will not be there.

  • How do I remove unwanted entries in the Profile Manager window?

    Can anyone please explain how do you remove irrelevant entries in the Profile Manager dialog? Since I have both 4.0 and 3.6 installed,each with two profiles,I use to launch secondary profiles with the Profile Manager via a command line instead of a specific shortcut,and the dialog window always shows all four options,regardless of what path I enter : is it possible to clean up the dialog window,so that only the 4.0 profiles are displayed when entering the path to 4.0 profiles,and so on for 3.6,without actually risking to delete any profiles? BTW,4.0 profile folders are stored in a different directory than 3.6,and the 3.6 profiles were accessed with the Profile Manager window (no shortcuts to specific profiles at the time) before installing 4.0

    The Profile Manager is for all versions of Firefox you have installed - every Profile that is listed in the '''profiles.ini''' file will appear there. The location of the Profile folders has no effect on what the Profile Manager dialog window shows. There is no way to set it up relative to one program installation.
    Best thing to do is to have separate desktop shortcuts for each Profile / Firefox-version you want to use.
    http://kb.mozillazine.org/Shortcut_to_a_specific_profile

Maybe you are looking for