Lion Server unreachable over IPv6?

My Lion Server is perfectly reachable over IPv4 and as it is housed in a datacenter the DNS must not be an issue either. Does anyone think it's fun to help me sort this question out? If I find the answer before you do, I'll post it here

I've see this Apple post already:
To manually set up your computer to use IPv6
You should only do this if your network administrator or Internet service provider has specifically told you to manually configure IPv6.
Choose Apple menu > System Preferences, and then click Network.
If the Network Preference is locked, click on the lock icon and enter your Admin password to make further changes.
Choose the network service you want to use with IPv6, such as Ethernet or AirPort.
Click Advanced, and then click TCP/IP.
Click on the Configure IPv6 pop-up menu (typically set to Automatically) and select Manually.
Enter the IPv6 address, router address, and prefix length you received from your network administrator or Internet service provider. Your router address may be referred to as your gateway address by some ISPs.
(source: http://support.apple.com/kb/HT4667)

Similar Messages

I downloaded OS X Lion Server using my apple developer account? Will it stay after my enrolment is over?

The title says it all. I downloaded OS X Lion Server using my apple developer account? Will it stay after my 1 year enrolment is over? I basicaly signed in and redeemed a code to download OS X Lion Server. It is now in my purchased list in the Mac App Store. But I got it by redeeming a code that I got through being an Apple Mac Developer. I wanted to know if I decided not to pay $99 next year to renew my enrolment, will I still be able to keep OS X Lion Server in my purchased list in the Mac App Store. When I click on More Apps by Apple in the Mac App Store, it takes me to the page with all their apps. OS X Lion Server says it is installed. But I want to know if it will still be in the purchased menu after the enrolment is finished and not renewed.

I am a new Mac Developer. I checked the page you gave me and I think it's more to do with topics about programming and using the developer tools and pre-release software. I don't think my question relates to any of the topics there. OS X Lion Server has already been released and is available for the public. I was planning on buying it. But before I did that I wanted to become a developer. So I enrolled in the Mac Developer program and I went to download OS X Mountain Lion Developer Preview 2 when I realized that I could also download the already released OS X Lion Server which was available for $50. So instead of buying it from the Mac App Store, I just got the redemption code from the Mac Developer Center and downloaded it free of charge (I did pay the $99 to be a Mac Developer though). Now it has been added to the purchased list in the Mac App Store and when I click the More Apps by Apple button in the Mac App Store, it takes me to the page with all Apple apps. And now on that page it says that OS X Lion Server has been installed. I am just wandering if once my enrollment is over next year April, and I decide not to renew my enrolment, will I still be able to have the OS X Lion Server in my list of purchased apps and still be able to re-download it? Sorry if this is too long, but I am trying to be as clear as possible. Sometimes when I ask questions, I wait a whole day and go back there, only to find out that they didn't understand what I meant. Thank you .

How do I share a folder over the internet with Mountain Lion server?

I am new to using formal servers. In Snow Leopard I was able to use web sharing to serve a small website and if I wanted to share a folder with someone I would just provide the person I wanted to share a file with the path to the file inside the sites directory. With Mountain Lion this functionality was removed from the sharing section of system preferences.
I purchased mountain lion server and was able to restore the website serving ability, but I haven't been able to figure out how to share a folder. I am still looking over what documentation I can find, but for the most part it just tells me to set up the services without telling me how. Any assistance would be helpful. Networking is not my area of expertise.
Best Regards,
David Finell

I purchased server to assist with this as I am unfamiliar with the command line protocols for using apache. Because of the UNIX architechture of OSX and I presume apache, I am uncomfortable using the command line for fear of causing serious problems.
Unfortunately, the documentation that I have seen for mountain lion server is wanting in either its completeness or layout/functionability. To summarize the server instructions as I understand them. It just says to configure it and my system to meet my requirements without telling me how.
I am confident that both the apache command line and server are capable of accomplishing what I was able to do before under snow leopard. I just haven't figured out how.
I was able to provide a link to family and clients like http://ipaddress/~user/folder
This no longer works.

I want to be able to remotely access my lion server over the internet how do I do this after installing lion server

i have a mac mini with lion server, I just want to be able to access it over the internet and upload and download files to it like my windows server, but I dont have a clue how to go about even starting this process

Im guessing you simply want to know what tool to use to access it. Meaning you access with your windows box with remote desktop - the mac equivalent of that is "screen sharing"
step 1: enable screen sharing on the mac server: system pref -> sharing -> screen sharing
step 2: forward needed ports if behind a router (off the top of my head I believe its port 5900)
step 3: depending on what type of machine you're trying to access from... if from a mac, finder -> go -> connect to server -> vnc://ip_address_or_domain_name ------ if from a windows or linux box you'll need to get a VNC client (see google for those)
good luck and hope this helps

How to turn off IPV6 on Lion Server

I did a clean install of Lion Server on my Mac Mini. I need to enable the firewall on that machine.
My Mini is only connected via WiFi to the network.
Due to firewall / Networksoftware issues i would like to disable IPV6 on the Lion Server completely.
The menu however only shows entries for "Automatic, Manual or Link-Local". On a Lion install (no Server) there is also the "Off".
Is there any reason i cannot switch off IPV6? If i cannot switch it off how do i configure my firewall so my software no longer
tries to connect using IPv6. I assume IPV6 is chosen in the first place due to a mDNS running with IPV6 enabled as i only configure ipv4 stuff and have eliminated all ipv6 completely from all other os's.
thanks & regards
udo

I found a fix for this issue and applied it to several different MacBooks, iMac's, PowerMac's in the last couple of weeks. It works quite well and will now show or unlock the option of "Off" in the IPv6 section of GUI once these process is completed.
Click some place on the desktop
Click on the Go menu at the top of your screen
Click on Utilities
Inside the Utilities menu you will find the utility called Terminal
Open up Terminal
Depending if your account has admin privileges or the following will be different.
In the terminal window type in the following:
networksetup –listallnetworkservices (precede this command with su or sudo if you are not logged in as an admin of the MAC)
You will see a list of network services such as Wi-Fi, Ethernet, Bluetooth, Firewire etc etc.
The next couple of commands will enable a new option in the GUI that will say Off under your Wi-Fi and Ethernet etc.
networksetup -setv6off Ethernet
networksetup –setv6off Wi-Fi
networksetup –setv6off FireWire
networksetup –setv6off 'Bluetooth PAN' (if you have this)
networksetup –setv6off 'VPN (PPTP)' (if you have this)
Close the terminal window and reboot your MAC
You will be all set and all IPV6 stuff will be disabled for your networking and you will also have the new option in the GUI to change it if you so choose to in the future.

VPN Lion Server over Time Capsule

Hi,
well i have a small office of four iMacs and some MBooks, and one mac mini runing os x lion server, all connected with a linksys router. The point is we want to start runing VPN to get access to the intranet website when out of the office. As we checked on apple´s airport reviews it is easy to configure the vpn using a time capsule.
Any one has tried it?

You may have issues.. due to BTMM using ipsec which is hidden into the firmware of the TC and AEBS some people have issues.. PPTP should be ok.
It seems like Apple ignore things like vpn in their testing.. some firmware work and some don't.
But if you are using the Linksys router.. how does the TC come into the picture??

Is it possible to install Lion Server over regular Lion?

I am considering buying Lion Server, so that I can get a feel for administering it (my background is in Windows Server and Warp Server for eBusiness). I have a 2010 21.5" iMac, which I upgraded to Lion a couple of weeks ago. I also have a MacBook Air with Lion.
I am wondering if I can just purchase Lion Server from the App Store and install it on my iMac, using the MBA as a client machine.
(1) Is this possible?
(2) Will I still be able to use the iMac as a regular machine, running (principally) Aperture and later on Final Cut Pro X as local programs
(3) What likely pitfalls am I going to encounter, and what (other than the client services) will I gain? I'm thinking that hosting Podcasts might be useful, but I don't know much about it
and finally,
(4) What resources are there to help me migrate my skills from Windows Server?
TIA,
Thomas

The other option is boot from your restore partition use diskutility to add third partition then use the reinstall lion option to install lion on 3rd partition, this will then download lion for you and reinstall it!
When this is done you can set it up properly (static ip etc) and then download the server app and install it!
Depending on what you want to do running it as your machine is not a big problem it works fine just keep in mind you might need to restart a few times and if you using it as a server that could be an issue!
in order to boot from your restore partition just reboot and hold down <alt>

Sharing pst (outlook) files over OSX lion server

Hi,
I can share every type of files via osx lion server. But if I try to share .pst files (Outlook) files and try to connect from a Windows 7 pc to the share. It doesn't work.
Any idea?
Best Regards,
Christian

I found out that I can open the Access db but only if I choose "open exclusively" in the office file dialog box, meaning that other users on the network won't be able to open the db when I have it open.
So it seems a file lock issue. Anybody having an idea what I could try to change the SMB file lock behaviour on OSX Lion would help me allot.
Thanks
Roger

Taking over a Lion Server

I have just accepted a position in a company that is running Lion Server. A consultant preceded me, and a quick look at the server suggests that the server was not set up correctly. For instance, when looking for users on the server to see their permissions etc, I find that the users have not been set up correctly, and you have no access to permissions or checkboxes of any description.
I suspect the consultant (a PC guy) somehow imported users home directories into the server from their local hard disks, and the screens you get when you access a user are not what you expect to be getting. The file server appears to be running, but they have issues with permissions which are not easily rectified.
So here's my question. It appears that the server should be rebuilt properly to get the most out of it. What would the best approach be? To change things on an item by item basis, or set up a new server from scratch, and get everything correct, and then put that in place. Or am I seriously confused??
Les

First off, I'm not a heavy command line guy, I know enough to get around and not get into trouble, but that's it. On the pane issue. If you "Add User" you get a pane that shows the user name along with a screen that has various checkboxes. In the server currently in place, the username that seems to be in play appears to be "the short name" from a users local home directory and not the long name that would be displayed had you chosen that fron the list of network users. For example, if John Smith was a network user, and I chose him in an "Add User" function, he would show up as "John Smith" in my Edit Permissions screen. If I click on John Smith, I would then get a screen that allowed me to control the read, write etc permissions for that user via checkboxes.
However, what shows up in the list is not "John Smith", but "jsmith" and if I try to do an Edit Permissions on "jsmith" I do not get that pane with the checkboxes, I get something else, a single line of no use whatsoever. I suspect that somehow the "jsmith" was the home account in a users local home directory and that has been shoe-horned into Lion Server. I could be wrong, but all sorts of weird permissions errors and things keep arising.
My gut feel is I think we should "start again", and set up Lion Server correctly, but I'm wondering if then putting that in place later is not more problematic than just going in on a user by user basis and trying to replace the bad stuff and get it working properly. Additionally I have a concern that the piecemeal process would not leave other legacy issues that I'm currently unaware of in place, only to rear their head later.
Any perspective you can add would be greatly appreciated.
Les

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

Photoshop CS6 can't save to server after upgrading to Mac OS Yosemite Server from Mac Lion Server

We recently upgraded our server from a Mac Pro 2008 with OS X Lion Server to a Mac Mini 2014 with LaCie 20TB 5Big Thunderbolt 2 RAID drive. Everything is working fine with the exception of Photoshop. It does it intermittently but once it happens it will continue to do so. We get message like "Can't save to disk because of disk error" and "Can't save file because of program error" . Sometime we are able to do a "save as" and save over it. Most of the time we have to "save as" with a different file name and then rename and recopy the file. We have check permission on all the file as well as the server HD has ignore ownership checked. Again only three things changed. 1) Sever hardware change from Mac Pro to Mac Mini. 2) Server software upgraded from 10.7 Lion to 10.10 Yosemite(both have the latest update). 3) Drive when from internal on Mac Pro to External Thunderbolt 2 LaCie drive. We have no problem with Illustrator or Indesign. Only Photoshop. Anyone with any suggestion is greatly appreciated.

Unfortunately you seem to be using Photoshop in a way that Adobe discourages, so you may not be getting a lot of helpful advice.
Networks, removable media | Photoshop | CS4 and later

How can I configure Lion server to accept inbound VPN (L2TP) connections while connected as client to another vpn service?

I have what I believe to be a unique need;
I have a MacPro (1,1) running Lion with Server app.
I require that this particular machine be connected as a client to a VPN server, while at the same time acting as a VPN server for my network.
The PPTP connection configuration is such that "Send all traffic over VPN connection" is checked.
If PPTP client is NOT connected, I can connect to Lion as VPN server. As soon as I make the connection from Lion as a client, I can no longer
connect to Lion VPN server.
I understand this is because I am forcing all traffic out the virtual interface (tun0) and eth0 is no longer listening on the local network.
1. Is it possible to bind the VPN client (on Lion Server) to a particular interface? If I could tell the PPTP client to only use eth1 as the interface of choice, my assumption would be that eth0 would then be free to accept incoming connections.
2. Is it possible to bind the VPN service (on Lion Server) to a particular interface? if I could tell the vpn serviec to only listen on eth1, and in turn tell the PPTP client to NOT communicate on eth1 but only eth0 then perhaps I could separate the communications?
In my head, it seems as though both of the above options would be required in order to use Lion as both a VPN server and VPN client
Any and all help appreciated.

This is a standard facet of most VPNs - the problem lies in your NAT router since both clients appear to come from the same IP address as far as the VPN server is concerned, and the router can't separate out the traffic.
There are a couple of solutions.
First, the built-in VPN server supports L2TP and PPTP protocols. You should be able to connect one system under each protocol, so that gets your two machines connected.
Second, you can replace your NAT router with one that supports multiple VPN clients (often termed 'VPN passthrough').
Third, setup a site-to-site tunnel so that your entire LAN is connected to the VPN (this saves you from having to run a separate VPN client on each machine, but is typically only worth it when you have more machines).

How can I use LDAP searching from OSX Lion Server to Mozilla Thunderbird?

How can I use LDAP searching from OSX Lion Server to Mozilla Thunderbird? We have a super awesome contacts server that works great for our Mac users. About 30% of our company are on PCs, and I would like to use the Mozilla Thunderbird mail client for them. I see that in Thunderbird I can set up LDAP searching, and would like to have this feature point to our contacts server. I've tried several different settings, and looked all over the web, but could not find the proper way to configure this. Does anyone know if this can be done, or if not, would have a better suggestion? Thank you for your time!!

try double clicking keychain acces should launch and ask if you want to install login, system, System roots
A dialog box will launch asking where to install the cert since your configuring a vpn I would put the certificate it in system.

What to do when SLS - Lion Server Upgrade & Migration Fail

Hi everyone,
I've had a tough time over the past week trying to updating my SLS to LS. (It was a slow week at the office so despite the warnings in these discussions I wasn't disturbing anyone, so I thought I'd try...) Both an upgrade to the current running system and a clean install on a wipe of that hard drive stall at the "Configuring Services" "Upgrading services" screen of the set up process. The migration path eventually fails, and as far as I can tell, it seems that the upgrade path just stays there forever.
Don't worry - I'm doing this all on a Super Duper! clone of my primary drive, so I can go back to SLS whenever I need to.
BUT, I can tell that the server's status is at least partially okay, even in this stalled setup state - iChat seems to work on various clients, and I can use Server Admin to see stats and services, etc.
So despite the discomfort of a failed install, part of me feels like I'll be fine with the LS if I can just figure out how to move my old data into the right places for the new system to use it. But I can't find any guidance for that. I'm looking to migrate OD (seems to have migrated fine), iCal, iChat, Address Book, Wikis, Time Machine, and File Sharing (which should be trivial to set up, I reckon).
Can anyone point me in the right direction?
Thanks very much,
Willhaus

Okay, so I've had some marginal success.
After leaving the hung install for a ridiculous amount of time (24+ hours), I realized that I could click the help button, and from the help window click the "further info about Lion Server" link to launch Safari. That gave me access to Software Update from the Apple menu, which then let me install the latest Safari update which conveniently enough requires a restart.
After restart, the Server Migration Assistant kicked in again, but failed quickly in the upgrading services stage. Another restart, and the sever finally booted more or less normally.
The strange thing was that although chat services worked fine during the hung install, all OD-related services stopped working after restarting. Turns out there were no users or groups in OD. Importing them from an OD archive, though, restored them.
So now iChat works great (even the old chat longs migrated successfully), and AFP is properly sharing our volumes across our studio's network. So our server is limping along.
The other services we need that aren't up yet are Wiki and iCal. Some info about those:
Wiki: administrators can log in and see all wikis just fine. That's awesome because it means the data migrated successfully. Any non-admin users can log in, but are then get a wiki-styled page that says simply "No wikis found". It's as if they don't have permissions to see the wikis, even though in Server.app they belong to the groups that the wikis are associated with. I've tried removing and re-adding users to groups, but that doesn't seem to do it. Any ideas how to fix this?
Calendar: While I can't get this to work, it's not like it's completely lifeless. An account in a client Lion iCal configured with the proper Lion settings returns an error that reads:
"The Server is Busy or Unavailable.
"The server at myserver.com is currently unable to handle the connection for account “ Calendars” due to a temporary overloading or maintenance of the server. If this continues you should contact the server administrator.
"You may try to connect to the server again or take the account offline."
As a logged in administrator, in a wiki clicking on Calendar in the nab bar goes to the calendar style page with an unending dialogue box that reads "Getting events from server". And clicking on Calendar from Home page footer takes me to the URL https://myserver.com/webcal with an error that says:
"Service Temporarily Unavailable
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.
Apache/2.2.20 (Unix) mod_ssl/2.2.20 OpenSSL/0.9.8r DAV/2 Server at myserver.com Port 443"
Again, at least I'm confident that the data migrated properly - I can find all the calendar data in it's proper new location - but either the service won't start or something's not configured correctly. I've tried chaining the hostname and restarting the service about a billion times. I've got no idea what to try next. Any ideas?
Thank you so much,
Willhaus

Lion Server for Home use reality check

Hi All,
as many others I had the best intentions buying Lion Server for my home network (5 Macs, 2 iPads, 2 iPhones) to manage everything.
It was destined to be a central server for user management, configuration management, home directories, file server, software update server, web server and Time Machine server and possible VPN gateway to my home network.
I did not intended to use as Address Book, iCal, Mail server as I use iCloud. I just don't see the point of iChat, Podcast, Wiki server for my home use.
Anyway the bits I had to abandon so far are:
configuration management - Profile Manager works only sometimes and is sluggish to say the least
home directories - the home sync just doesn't work for Mac libraries such as iPhoto and iTunes
software update server - worked, broke, fixed, worked, broke, fixed, ... going away with Mountain Lion.
What works for me is user management, file server, web server and Time Machine backup, haven't gotten around to test VPN yet.
Given that Mountain Lion is coming next month and presumably I'll have to buy new license for the Server version I am not sure if it's worth it.
As I see it using a plain vanilla Lion or Mountain Lion system I can still do file server, web server and Time Machine backup. What I'd lose is the user management and I am not sure about VPN on a non-Server system but not really important. User management is a one time task for 5 Macs that's it.
Would be interested to hear opinions from you folks about pros / cons of using a plain Lion or Mountain Lion OS X for server tasks vs Server version?
Anything I am missing here?
Thanks
Andy

iToaster wrote:
most osx server issues are usually DNS problems
if that is not correct practically nothing else will work correctly
That's probably true but also within that lies a major problem how this is positioned "The Server for Everyone". I am in IT and know what a DNS is. Most home users would NOT have a DNS running as it's not necessary not even talking about SSL certificates. I think this is a major problem here that it market incorrectly.
iToaster wrote:
if your trying to have portable home directories and having iphoto library sync'd
I don't recomend on wireless , even on a wired 1gb network it's slow
use WGM to skip iphoto or be prepaired for a long wait
It's not so much a network bandwidth problem but the fact that home sync doesn't work for package files such as iPhoto, etc. Many people have confirmed that that home sync actually corrupts those files.
iToaster wrote:
for the cost of ML server it's probibly cheaper in the long run then the time you'd spend
trying to get the same funtionallity via terminal. plus the posiblity of a OS update
that may blow all your finely crafted terminal work all away.
Don't intend to do terminal but for example take "File Sharing". It's an Server option but every Mac also has file sharing under the "Sharing Settings". As far as I can tell the server actuallty is just an overlay over the Mac sharing option because if I define a file share it's also updated in the sharing option.
Same thing goes for the Webserver. Hence I am thinking that Server really only is a central console for some basic services that can also be available by using standard OS X functionality.

Lion Server unreachable over IPv6?

Similar Messages

Maybe you are looking for