How to repair SACL from single-user boot with 'serveradmin settings' (CLI)?

Question

Hello!
Could anyone explain me in a step-by-step guide to repair/reset service access for local users (and group Administrators) because I can't login to the server when at the login window (GUI). Now I have only access to the OS using single-user mode at boot time (Cmd+S) or with “Mac OS X Server Install Disc” and the Terminal app inside.
I know that CLI ‘serveradmin settings info:????’ should help, but not sure how the proper syntax is typed so that I can login without the login window graphically bouncing when typing in the correct credentials.
Anyone care to help ?

Answer 1

If I understand right, the reason you can't log in anymore is that the Administrators group has been removed from the service access control list for the "Login Window" service (i.e. the ability to log into the desktop on the server itself). If I'm wrong about this, please clarify; these instructions may be irrelevant (and the second option I'll give may be actively destructive).
Anyway, the repair method I'd recommend is to install the server admin tools on another Mac (that you can log into). There's a copy of the installer on the Server Install DVD, or you can download the latest version from [http://support.apple.com/downloads] (the 10.6.5 version is [here|http://support.apple.com/kb/DL1071]). Note that the admin tools can't be installed on older OS versions (e.g. if the Mac is running 10.6.4, you could install anything from the 10.6.0 to 10.6.4 tools, but not 10.6.5).
Once that's installed, run Server Admin, connect to the server, then select the server in the sidebar -> Access in the toolbar -> Services tab under that -> Login Window in the service list on the left, and either edit the allowed user&group list, or simply select "Allow all users and groups".
The other option is to use single-user mode. You cannot use serveradmin in this mode, because servermgrd isn't running (in fact, pretty much nothing is running); you'll have to do it "by hand".
1. Since you probably didn't shut the server down cleanly, the first task is to make sure the file structure on the boot volume is ok. Run the command "fsck -fy" to check (and repair) the volume. If it says "FILE SYSTEM WAS MODIFIED", run it again as it may not have found & fixed all problems on the first pass. Keep running it until it says "The volume suchandso appears to be OK", or reports errors it can't fix (in which case you have more serious problems, and should deal with those first).
2. Once the file structure is verified, you need to enable write access to it to make changes. Run the command "mount -uw /". If it prints anything (other than another command prompt), something went wrong (make sure you included the final "/", and that it had a space before it).
3. Now, remove the access control group that's disabling access to the login window. This command is pretty long, and if you make any typos it may do something completely unfortunate, so type carefully and use tab completion: type part of a filename (get the capitalization right), then press tab and it'll try to fill in the rest for you; if it doesn't work, you either haven't typed enough of the filename for it to figure out what you mean, or you've made a typo. Anyway, the command is: "mv /var/db/dslocal/nodes/Default/groups/com.apple.access_loginwindow.plist /var/db".
4. At this point the access control should be gone. Use the command "exit" to get out of single-user mode, and bring up the full OS.