Lion Server install fail

I'm trying to install Lion Server on a Lion system.
When trying to install Lion Server the server app installer wants to download additional things.
When it tries, the Server app says ":Can't install Server Essentials because you are not connected to the Internet."
My internet is up and running - that's how I bought the Server app and made this post to the Apple Support Community.
Does anyone have any ideas on how to get the Server app to see this?
Thank you.

Hi Wozzar. Check out the following thread from iblueracoon. I had exactly the same issue as you and this solved my problem. All the best:
Correct Answer by iblueracoon on Jul 21, 2011 1:16 AM
Hi! I've been having this same issue and I had been busting my head about it for a couple of hours. Whenever I went to create a partition to install windows and download the support software, it would pop up that message. The same for whenever I tried running a java application. An easy fix to this would be to go into system preferences > Network, next, create a new location and delete the old one(transfer your connections ofcourse). Then, connect to your current network. Now, just go into "advanced">"Proxies" and disable auto proxy discovery! It seemed to do the trick for me

Similar Messages

Lion Server install failed - yet still labelled as installed in MAS

On my lion test machine, I decided to test Lion Server, so I of course got the redemption code, popped it all in. When the actual "download" started - it instantly said it was complete - I never saw the download icon in the dock for it. Under MAS Purchases tab, I see Lion Server as "installed" - but of course, there is no way it could be, especially not without a reboot.
I rebooted. Still only Lion Client.
I've tried pkgutil --forgetpkg com.apple.Server, but its still listed as "installed" in MAS. I don't see anything /Applications, or / that could be a "Lion Server Installer".
Any ideas how to flip the "install" switch, so I can try re-installing in MAS?

Please use your Developer account login at the confidential Mac Dev forums when discussing unreleased versions of OS X, thanks.
https://developer.apple.com/

What I wish I'd Known Before My Lion Server Install

The truth is that I am on my FIFTH Lion Server install on the same box this week. While I was working on #4, I went ahead and submitted a ticket with Apple and arranged a timeslot for this morning to work with them to help me past my struggles with Lion Server. This post is the result of that experience. Big props to Apple support techs Chuck and Don - you know who you are!
What I Wish I'd Known Before My Lion Server Install
1. Do NOT migrate user accounts, apps, and files, until AFTER you have the Server set up and working correctly.
- This one tip, which is brilliantly simple, would have saved me four very long days of head bashing.
2. Server Admin Tools are mandatory.
- The first time around I used the Server App to configure the system (after an upgrade install, and subsequently after a clean install + migration).
- Server Admin allows you to set up the foundation of your server - which it NEEDS!
- DNS - configure a local, pseudo domain for your server if you're doing this at home. Something like "mynet.private" - if you don't, your SSL certificates can get all jacked up, your clients will not trust your certs. This breaks a lot of stuff.
3. Do NOT accept the mDNS .local domain suffix for your Server
- At each step, if something auto-fills your server name as name.local reject it, and use the fully qualified domain name that you set up above (server.mynet.private).
- If you do not do this, anything that requires certificates could/will have big problems.
4. Enable services one at a time. Reboot after EACH major phase past the core Lion install.
- Base install ... Server install. REBOOT
- DNS configuration. REBOOT
- validate your host name - I needed to force a 'changeip' command because there was a problem with the HOSTNAME retaining the mdns .local domain name.
- OD Master config. REBOOT
- Set up Podcast Producer (which will also setup your Xgrid). REBOOT
5. Take images of your hard drive as you go.
- Once I got the core server installed, the basic services above, I rebooted and held the option key, then restarted on the Recovery HD image.
- Use Disk Utility to take a snapshot image of your hard disk so you can get back to this wonderful place of everything working! It's cheap insurance, and adds a bit of extra time, but is well worth it. If you leave the default settings alone (the 'compressed' one in particular) it will use as little space as possible. My server at this stage of configuration created a 4GB disk image.
6. Use the Migration Assistant After the above
- Now you can migrate your apps
- Migrate your users
- etc.
If you use the Migration option while you're installing the server, or if you upgrade on top of your Snow Leopard (or whatever), I can almost guarantee you that you are in for a world of hurt.
I struggled through all kinds of issues with files having embedded information, scattered throughout all the various subsystems, that gummed up my installation and would case all manner of the flakey Lion Server behavior that you read about ("Error Reading Configuration").
If you want to use Podcast Producer, or any of the Profile Manager features, the above methodology was the only way that I could get them to work. Often times I'd have everything working, then reboot and it would break. After I did the above, the system is as solid as a rock.
Today, I love Lion Server. Yesterday I was cursing it.
Best of luck!!

There are 2 distinct apps in Lion Server.... Podcast (in Server app) and Podcast Producer (Server admin which is deemed legacy from SNS). Podcast uses Podcast Publisher instead of Podcast Capture to produce, edit and submit to Podcast app. Podcast doesn't requre Xgrid where PCP did. The two don't mix.
It's as clear as mud in all the documentation about this.
We're finding that Podcast Publisher has much more flexibility that Podcast Capture (edit, episodes & more), can use existing workflow from PCP, doesn't require xgrid, and podcasts can easily be managed by non-IT people via the Podcast wiki as opposed to the CLI pcast commands to edit & modify PCP feeds.
Hope this helps.

[link] What I Wish I'd Known Before My Lion Server Install

All-
A couple people suggested that I post a link to this article from another forum... a few things that I needed to do to get a good Lion Server installation up and running solidly.
What I wish I'd Known Before My Lion Server Install
Cheers!

There are 2 distinct apps in Lion Server.... Podcast (in Server app) and Podcast Producer (Server admin which is deemed legacy from SNS). Podcast uses Podcast Publisher instead of Podcast Capture to produce, edit and submit to Podcast app. Podcast doesn't requre Xgrid where PCP did. The two don't mix.
It's as clear as mud in all the documentation about this.
We're finding that Podcast Publisher has much more flexibility that Podcast Capture (edit, episodes & more), can use existing workflow from PCP, doesn't require xgrid, and podcasts can easily be managed by non-IT people via the Podcast wiki as opposed to the CLI pcast commands to edit & modify PCP feeds.
Hope this helps.

Can Mac OS X Lion Server Installed on Non-Mac machines

Hello,
I have a server with Windows 2008 standard. I want to format the machine and install Mac OS X Lion. Will the Lion server work on the hardware whcih is a pentium 4 Processor?
Do I need to change the clients to Mac OS or let it remain as windows (XP/Vista). Can I smoothly operate the Service Client network in this way or change everything to Mac OS?
Thanks

No, it won't work. The clients can use Windows, but the server must be a Mac.
Kappy: Your statement doesn't apply to all Apple software; iTunes and Safari have official Windows versions, along with a few other Apple products.
(59706)

OS X Lion Server upgrade *failed*, now what?

The installation process got as far as registering a message like, "Upgrading Services, failed". The only option was to click the Lion icon for reboot. That, I did, then I couldn't find the 10.7 Server Admin Tools, which I had to download separately. The "Open Directory" part of the Server Admin UI does not have the *expected* start/stop button and the service is stopped.
It would be nice to have a post-upgrade program to checklist what went well, what needs fixing with pointers to resources. It's possible none of my services programs got upgraded.
I got an email receipt with a link to "Report a Problem" which turns out to be mostly a hole for getting lost, but at least it got me here to present feedback.

goeres wrote:
But do we need all the blows and wristles?
Yes. Lion Server out of the box does not allow for complex custom configurations short of manually editing text configuration files, which is an ironic step backwards from SL Server considering Apple's commitment to ease-of-use GUIs.
Instead of improving the admin tools that were available with SL Server, they simply removed too many of them. That would suggest that they've given up on the market for business servers to focus on the market for toy servers for home use, which is a bit disconserting considering that Lion Server's security is also woefully lacking out of the box. It's hard to figure how any IT professional could take it seriously.
The Internet is a dangerous place to play with a server. Apple's quest to simplify OS X Server with Lion has resulted in a server package that is dangerously simplistic. If Lion Server becomes popular for home use, I expect to see a rapid expansion of botnets.

Mount Lion Server Install of Mavericks Client

I was wondering whether you need to have Mavericks Server running in order to install Mavericks Clients as a Netinstall or Netbook image using System Image Image Utility. I have tried to perform the install from Mountain Lion server but no luck. I followed the same proceddure for installing Mountain Lion using System Image Utility but cannot locate the install. dmg file without have to 'unhide" it. Do I need to install Mavericks Client by doing so from Mavericks Server?
Thanks,
David

The rule of thumb is this:
To create 10.9 Mavericks nbis you will need OS 10.9 (server or client) System Image Utility
To create 10.8 Mountain Lion nbis you will need OS 10.8 (server of client) System Image Utility
To create 10.7 Lion nbis you will need OS 10.7 (server or client) System Image Utility
Once you've created the nbis with the appropriate OS version of SIU you can 'serve' all of them regardless of version from OS X Server versions 10.9, 10.8 or 10.7.

Lion Server Install Failure/Incomplete

Hi,
I just purchased and tried to install Lion Server. After a few hours of being stuck at "Configuring System", and the progress bar being "stuck" for over 45 minutes, it just crashed. Now launching the app just brings the server menu but none of the services can be accessed (almost all menu entries are grayed out).
So I can't re-install (because it thinks it's already installed) and the install is incomplete and thus wont work! This is very annoying.
Apple, I love you guys but for those of us who are playing with server, don't give us the one button for dummies UI. Maybe some of us are techs who aren't afraid of the command line or "advanced" menus (an option like --force-reinstall would be nice right now!!!).
Any suggestions???
Thanks,
PS: What's with the install UI window with a cropped progress bar and icons? The window can't be resized nor scrolled ???

Since Lion Server is essentially an app, you can throw it in the trash and re-download it. I believe that what that application does is give you front-end access to tools that are already on your system, and adds a few command-line tools such as slapconfig.
I would try this: trash the application, you can even try using something like AppCleaner, which finds associated plists. Then, go to /Library/Receipts. There is a plist in there that contains the install history. find and remove any entries associated with install. Don't worry if you accidentally delete something that isn't associated, as it is ust a receipt list, but it is alway a good idea to make a backup of the original, just in case.
Once you do that, reboot the machine into single user mode and run "fsck -fy" from the command line. once that completes, reboot and run repair permissions from disk utility. Finally, re-download the app from the App Store and re run the installer. You might need to hold down the option key to re-download, but either way, it should come back down and run again.
If none of that work, I would go with the backup, wipe, and install suggestiosn from above. Grab youself an extneral hard drive (a good investment anyway), clone the machine with Carbon Copy Cloner, and then wipe and re-install.

Mail relay issue since lion server install

I upgraded (or not) my Mac Mini Server with Snow Leopard, to Lion Server.
I'm now getting mail relay errors when sending email to an account on my server from gmail.
"Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 554 554 5.7.1 <[email protected]>: Relay access denied (state 14)."
I'll post postconf -n if required.
voigtstr.com has an A name at the domain name registrar
mail.voigtstr.com has an mx record.
dig +short MX voigtstr.com returns
1 mail.voigtstr.com.
voigtstr.com and mail.voigtstr.com both point to my external ip address
any pointers?

LincNesh,
Seems the problem has been solved by Peter Rauen.
See this discussion: Mail relay SASL problem / postconf -n
I checked on my server and Peter is right. Although there are configs in /etc/postfix there is another path with postfix conf files: /Library/Server/Mail/Config/postfix
I actually only had to insert this line to main.cf there: smtp_sasl_security_options =
After a postfix reload my mails are being delivered via dyndns again.
Cheers!

SCOM Reporting Server install fails

Hi there,
I have successfully installed System Center OpsMgr 2012 R2, but my attempts to install the Reporting Services component have failed. Systems are on the same subnet and firewalls are presently turned off.
The main error I'm receiving seems to be this one:
[15:46:45]: Warn:
:Message:SRSPolicySetter SoapException Exception: System.Web.Services.Protocols.SoapException: An error occurred when invoking the authorization extension. ---> Microsoft.ReportingServices.Diagnostics.Utilities.AuthorizationExtensionException: An
error occurred when invoking the authorization extension. ---> System.ServiceModel.FaultException`1[[System.ServiceModel.ExceptionDetail, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]: Access is denied. (Exception
from HRESULT: 0x80070005 (E_ACCESSDENIED))
at Microsoft.ReportingServices.Library.ReportingService2005Impl.GetRoleProperties(String Name, Task[]& Tasks, String& Description)
at Microsoft.ReportingServices.WebServer.ReportingService2005.GetRoleProperties(String Name, Task[]& Tasks, String& Description). Will retry..
[15:46:45]: Warn:
:Extra data:<detail><ErrorCode xmlns="http://www.microsoft.com/sql/reportingservices">rsAuthorizationExtensionError</ErrorCode><HttpStatus xmlns="http://www.microsoft.com/sql/reportingservices">400</HttpStatus><Message
xmlns="http://www.microsoft.com/sql/reportingservices">An error occurred when invoking the authorization extension.</Message><HelpLink xmlns="http://www.microsoft.com/sql/reportingservices">http://go.microsoft.com/fwlink/?LinkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsAuthorizationExtensionError&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.2100.60</HelpLink><ProductName
xmlns="http://www.microsoft.com/sql/reportingservices">Microsoft SQL Server Reporting Services</ProductName><ProductVersion xmlns="http://www.microsoft.com/sql/reportingservices">11.0.2100.60</ProductVersion><ProductLocaleId
xmlns="http://www.microsoft.com/sql/reportingservices">127</ProductLocaleId><OperatingSystem xmlns="http://www.microsoft.com/sql/reportingservices">OsIndependent</OperatingSystem><CountryLocaleId xmlns="http://www.microsoft.com/sql/reportingservices">1033</CountryLocaleId><MoreInformation
xmlns="http://www.microsoft.com/sql/reportingservices"><Source>Microsoft.ReportingServices.Diagnostics</Source><Message msrs:ErrorCode="rsAuthorizationExtensionError" msrs:HelpLink="http://go.microsoft.com/fwlink/?LinkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsAuthorizationExtensionError&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.2100.60"
xmlns:msrs="http://www.microsoft.com/sql/reportingservices">An error occurred when invoking the authorization extension.</Message><MoreInformation><Source>mscorlib</Source><Message>Access is denied. (Exception from
HRESULT: 0x80070005 (E_ACCESSDENIED))</Message></MoreInformation></MoreInformation><Warnings xmlns="http://www.microsoft.com/sql/reportingservices" /></detail>
Interestingly, even thought I've registered the SPN's for mt SQL and OpsMgr service accounts this still comes up in the System logs:
A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 22:39:13.0000 4/4/2014 Z
Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
Extended Error: 0xc0000035 KLIN(0)
Client Realm:
Client Name:
Server Realm: DOMAIN.COM
Server Name: MSOMSdkSvc/SASCM.DOMAIN.COM
Target Name: MSOMSdkSvc/[email protected]
Error Text:
File: 9
Line: f09
Error Data is in record data.
Kind of hit a wall here, looking forward to your suggestions. Thanks in advance,
Riki

To resolve this problem, add the SDK service account to the Windows Authorization Access group. To do this, follow these steps:
Click Start, point to Administrative Tools, and then click
Active Directory Users and Computers.
In Active Directory Users and Computers, click Builtin, and then double-click
Windows Authorization Access Group.
Click the Members tab, and then add the SDK service account to the members list.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"

Lion client OD bind to Lion server - Authentication Failed

Authenticated bind enabed via terminal command. Client and server are up to date. I've been able to bind Leopard, Snow Leopard, and Lion clients over the last few weeks before this MacBook Air but for some reason it keeps failing with an authentication error. I can log into WGM on the server using my Diradmin account without issue. This is the same account I'm attempting to bind with. I have a non-admin account that can bind clients and it too is failing on the client side. I've been Googling for hours and haven't identified a source or solution. Anyone have any thoughts? I'm just shy of demoting my OD master, promoting it, and re-importing my OD config. I don't want to though.

Hello michaelhoch,
could you find any solution?
I have the same setup: OS X Leopard Server 10.5.8, and Snow Leopard Clients. Everything worked fine. But now I get the first OS X Lion Client, and I can not use Mail, iChat, iCal and so on. I found the same errormessage in Console, and I think I also have a problem with the user directories on the server.
Tanhks
Michael

IS 6 Installation issue - web server install fails

Trying to install Identity Server 6.0 on a machine (Solaris 8) with no luck. The web server package (SUNWamws) installation fails about half way thorugh. We're installing as root using JDK 1.3.1_06. This same exact distribution was used to successfully install IS 6 about 10 times over the last month or so. Now we get this..........
Extracting Upgrade Files ...
[0mld.so.1: /usr1/is6/SUNWam/servers/bin/https/bin/install-jc: fatal: libplc4.so: open failed: No such file or directory
Killed
[0m[0mld.so.1: /usr1/is6/SUNWam/servers/bin/https/bin/install-java: fatal: libplc4.so: open failed: No such file or directory
Killed
[0m[0mld.so.1: /usr1/is6/SUNWam/servers/bin/https/bin/install-webpub: fatal: libplc4.so: open failed: No such file or directory
Killed
[0m[0mld.so.1: /usr1/is6/SUNWam/servers/bin/https/bin/install-snmp: fatal: libplc4.so: open failed: No such file or directory
Killed
[0m[0msh: /usr1/is6/SUNWam/servers/bin/https/bin/install-cleanup: not found
[0m

Same problem here. Installing on new Solaris 8 machine. Used to work before. That lib appreas to be part of the Mozilla distribution if that's any help.
Donie

Leopard Server Install Fails

I have been trying to take a Tiger server to Leopard server, but every time I begin the actual installation process, the installation fails due to an unknown error. I have tried doing a clean install and a standard install but both fail. I have also tried erasing the volume first but I get an error saying the volume would not unmount (using Disk Utility from the Leopard install dvd). I was able to erase the volume by booting the xserve up from an external hard drive and using disk utility. I have also tried different install dvds but same problem persists. I have tried repairing the disk but it says nothing needs to be repaired.
Is this a sign that I have a bad hard drive and need to replace it or am I missing something?
Any help would be great.

http://images.apple.com/server/macosx/docs/GettingStartedv10.5.pdf
Look at page 32

App Server Install fails - due to incompatible Message Queue

I had JES 2005 q1 installed in one of the test machines...now I am trying to set up JES 2005q4 on that. I cud install a Web Server on that ut when I tried to set up the App Server it throws up a msg stating that there is an incompatible version of Message Queue installed and hence installation cannot go ahead.
I am not able to find any instance of Message Queu setup....how do I detect and uninstall old versions of Message Queue??
thx
anand

I assume you are talking about appserver install on Solaris. Message Queue on Solaris is a package based install. The easiest way to uninstall the old version of MQ is: "pkginfo -i | grep Message" ---> "pkgrm all MQ packages".

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

Lion Server install fail

Similar Messages

Maybe you are looking for