Lion Server Vs MobileMe

Hi All,
Im after a bit of advice. Im currently using MobileMe for Mail, Cal and up until recently Back To Mac (which has stopped working for some reason). Its great from the point of view that I have access to the same information everywhere. Though recently I have been thinking about getting Lion Server to control the file system in the office and as I have a couple of freelance staff which we are currently using dropbox to collaborate on projects. Im thinking I may be growing out of it so to speak. I would much prefer more control inhouse with files stored on my hardware and server.
Couple of questions Im a little unsure of is and Im hoping I can get some tips from the community.
Can Lion Server replace my current set up of MobileMe? ie can I access my mail, cal and file system from each of my devices?
Does Lion Server require a static IP for email to work? For email I would be looking at hosting my own domain.
Can I connect back to the server's file system when Im out and about. Im a consultant so Im on site alot. This would be great if was available.
As I said Im after any advice, so past experience, tips and testimonial will be great.
Cheers,
Phil

You won't lose anything from a desktop or client standpoint - any app you can run in Lion (client) you can run on Lion Server. The major difference is the addition of the server-based apps, some networking tweaks, and a minimal performance hit if you have clients fedeing off your Mac at the same time you're trying to use it (the same issue when running any background task, really).

Similar Messages

Lion server - is it right for me?

We are currently using a Mac Mini in our small office for file serviing. It is running 10.6 (NOT server). I have some software running on it that allows me to set up "mount points" for different user groups. I run the mini headless, and am able to "screen share" via the local network or through my MobileMe account using "back to my mac."
The setup works fairly well, but can be difficult to administrate.
I am considering the jump to Lion server. Looking past the marketing department descriptions I want to make sure it is the right choice for me. Here are some of the things I am doing and would like to do:
- I would like to continue sharing files. We have about 5 users. I would like to be able to set varying levels of access for each person. I can do this on an individual basis but would also like "workgroup" permissions/access.
- Right now we only have local access (except for my admin login). Ideally I would like to have the same file access (with restrictions and permissions) extended to sharing files via internet. Even better if I could limit which files or folders are available over the net for all except me.
-Looking beyond file sharing, I am interested in the WebDAV features discussed on the promo page. The short description of these features seems like I can basically run an iDisk on my mini. I can then let workers upload and download pages/keynote/number documents. We can also use this to coordinate calendars locally and across the internet. Plus it will sync with our iPads and iPhones. Am I understanding this correctly?
-Along the same lines, there is also iCal Server 3. The way I understand it, this can basically act as a replacement for the old MobileMe calendar, right? I see how calendars can be shared and understand how that works. But can these calendars also be administered, with permissions, from the server? In other words, can I (as admin) create calendars for Bob, Tom and Doris - let's say a personal and business calendar for each. Then set it up so that Doris can see Tom's business and personal calendars but only Bob's business calendar?
-Web server: I have played with the Apache server on previous non-server OS X versions. Can Lion server be easily set up to run as an INTERNAL web server? (Web pages viewable on the local network). If we wanted to make those web pages viewable outside the local network, is the process very difficult? We have a company to host our regular web and email services. I am only looking for some simple "company news" type information and maybe a small Filemaker database for a handful of employees.
We don't currently have a static IP, which I guess would be necessary for making some of these features accessible from outside the office. Do I need to get a static IP from my ISP, are there features in Lion Server that eliminate the need for that (e.g. back to my mac) or are there other options that provide a workaround for this?
Based on the above, is Lion Server what I need? Is there another product/application better suited for the above tasks?
Thanks in advance for any ideas, help or suggestions.

Do you think the monitor on the new Imac is good?
Yes, I use mine for both digital photography and working with video. The extra screen real estate is extremely handy.
If you need portability, I would keep the iBook also.

Lion server VPN not working away from network

Hey everyone,
So I have a mac mini setup with lion server, and setup a VPN, however after I setup the profile and installed it on my iphone and ipad, it worked great wile I was connected to the same network, but once I connect to either 3G or to a different network (than the server is based) it says,
"The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your administrator."
I have check the port mapping settings, as I have a airport extreme and have the VPN setting checked for the extreme from the server app. I have also disabled mobileme "back to my mac" on the computer, and also on the airport extreme just to make sure that wasn't causing the issue. I'm out of ideas, I know it has to do with the incoming connection, and I have setup a dyndns for the ip address. Any ideas would be really appriciated.

I also had the same issues but managed to fix it.
My airport extreme DHCP settings were conflicting with the VPN servers assigned addresses.
For example, the DHCP on the extreme was set to the range 10.0.1.200 - 10.0.1.254
And the VPN was set to the same range of 10.0.1.200 - 10.0.1.254
I then changed the DHCP range on the extreme to 10.0.1.100 - 10.0.1.229
and i set the VPN to give out IP addresses between 10.0.1.230 - 10.0.1.254
Reset both the extreme and VPN server, then boom. It started working, internally and externally.

Lion server and virus

hello i was wondering how can i find out if my macbook pro has ox s lion server ? and if it doesn't have is it necessary to get ? ??? thanks x
and my other qustion is how can i find out if my poor baby mac has got virus ??? becouse i have installed a program called macbook cleaner by mistake and then i founf out that is not an apple app so i thought maybe that was a virus?"??? :-(

Please read this whole message before doing anything.
This procedure is a diagnostic test. It won’t solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.
Third-party system modifications are a common cause of usability problems. By a “system modification,” I mean software that affects the operation of other software -- potentially for the worse. The following procedure will help identify which such modifications you've installed. Don’t be alarmed by the complexity of these instructions -- they’re easy to carry out and won’t change anything on your Mac.
These steps are to be taken while booted in “normal” mode, not in safe mode. If you’re now running in safe mode, reboot as usual before continuing.
Below are four lines of text in monospaced type, which are UNIX shell commands. They’re harmless, but they must be entered exactly as given in order to work. If you have doubts about the safety of running these commands, search this site for other discussions in which they’ve been used without any report of ill effects.
Some of the commands will line-wrap in your browser, but each one is really just a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, and you can then either copy or drag it. The headings “Step 1” and so on are not part of the commands.
Note: If you have more than one user account, Step 2 must be taken as an administrator. Ordinarily that would be the user created automatically when you booted the system for the first time. The other steps should be taken as the user who has the problem, if different. Most personal Macs have only one user, and in that case this paragraph doesn’t apply.
To begin, launch the Terminal application; e.g., by entering the first few letters of its name in a Spotlight search.
Step 1
Copy or drag -- do not type -- the line below into the Terminal window, then press return:
kextstat -kl | awk ' !/apple/ { print $6 $7 } '
Post the lines of output (if any) that appear below what you just entered (the text, please, not a screenshot.)
Step 2
Repeat with this line:
sudo launchctl list | sed 1d | awk ' !/0x|apple|com\.vix|edu\.|org\./ { print $3 } '
This time, you'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning not to screw up. You don't need to post the warning.
Step 3
launchctl list | sed 1d | awk ' !/0x|apple|edu\.|org\./ { print $3 } '
Step 4
ls -1A {,/}Library/{Ad,Compon,Ex,Fram,In,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Sta}* 2> /dev/null
Important: If you synchronize with a MobileMe account, your me.com email address may appear in the output of the above command. If so, change it to something like “[email protected]” before posting.
Remember, this is all drag-and-drop or copy-and-paste, whichever you prefer -- no typing, except your password.
You can then quit Terminal.

Are there some simple start up instructions for a first time user of Lion Server?

Our small office has been using MobileMe to share one central calendar on a mac mini with 4 users MBPro users. We were also using a 3rd party application (Address Book Server (ABS)) to share a central Address Book contact database with the same 4 users. It was all working fine. Then we upgraded all our systems to Lion and iCloud. Calendar sharing works fine, but it broke our contact sharing. ABS used the old sync capability. Now all our contacts are on iCloud, and they won't sync anymore.
Does anyone know if there is a way to share contacts among several users in iCloud? (I haven't found one.)
We are now considering Lion Server, but all we need it for is sharing contacts (shared calendars under iCloud works fine).
Can we install Lion Server for just contacts and continue to use iCloud for calendar sharing?
Is there some simple Start up documentation available for Lion Server that I can read before I jump into it?
How much time is it really going to take to install and manage a server system?
We are not IT professionals. Just a small office of professionals, who want the conveninece of shared calendars and shared contacts. We all have our own calendars and contacts as well, and we want to be able to see them on all our devices: MBPros, iPhones, iPads etc.
Thanks so much for your help.

You can use Lion Server in place of the MobileMe/iCloud account. That would be your best bet. Lion Server has built into it an address book server and a calendar server which would take the place of what you are currently using.
Lion Server is designed to be quite easy to setup and run. It is pitched as being meant for people who "don't have an IT Department." Honestly, most of it is just on/off switches. If you have a Mac Mini and all of your users are on their MacBook Pros, you pretty much have the hardware necessary. Assuming all of your machines can run Lion, you should be good to go.
The most technical you might have to get is to get a domain name from some place like godaddy.com. The Server App actually walks ou through the whole setup process step-by-step. Not to mention that there is a vibrant community of users to be help out. And once it is up and running, there is very little you should have to do to it.
There are a lot of technical components to any server platform, and Apple is no exception, however they do a good job at hiding it. And at $49, you do not have much to lose. Plus, you only really need to use the components you want. If all you want in address book server and ical server, then just use those. You find you want to start sharing documents, turn on file sharing. It is up to you. Don't feel pressured to have to use every component.
Apple has posted they "Advanced Administration Guide" which has a lot of good information in it, and it is searchable. Check it out: https://help.apple.com/advancedserveradmin/mac/10.7/

Trouble connecting to Lion server AFP shares after changing server's hostname

Hello everyone,
I recently changed hostname of my Lion server box (via Server application) and now my clients are having a problem when trying to connect to its AFP shares via aliases. It takes 160 seconds of "resolving alias to <sharename>" before it finally works. Aliases were created by navigating to the server, connecting with "Connect As", providing valid credentials, then navigating one level up and dragging the share icon (blue disk with three white people outlines) to the Desktop with Option-Command.
What is interesting, if I create a new account on a client machine, create an alias, and click on it - it works without any delay, as it was for the clients that are having problems now; so I'm assuming some details about the previous server name got cached somewhere.
The clients with long delay problems can access the shares quickly if they click on the server in the Finder window drawer, then "Connect As" and provide their login credentials - it works instantly then.
I've been digging around quite a bit (deleting Keychain saved Network passwords for any and all references to the server I could find), and also by looking at kerberos logs on the server. What is interesting, the newly created clients I mention above who don't have delay with connecting, don't leave any records in the kerberos log file; but the ones that have 160 second delay do - there's nothing for 160 seconds, and then there is a flurry of activity, as the connection is finally established.
When a client who has trouble connecting uses the "Connect As" method described above, entries in the Kerberos log are created instantly when client clicks connect.
Probably also worth noting that renaming of the server was related to me setting up Open Directory on it.
Any pointers would be greatly apprecited.

I experienced almost exactly the problems you described. I also found that connecting via command line using mount_afp worked right away... and once the connection is established, mounting via finder was super fast.
Tried all kinds of craziness on the client, even a full Time Machine restore.
Tried fixing Open Directory.
I was absolutely stumped by what was happening, but then thought, Hmm. I'm wondering if it's related to MobileMe going down? I noticed it started to happen after July 31...
Success! That was it! Signing out of MobileMe in System Preferences made everything work the way it should!
CDPlayer2: check if the clients are signed in to MobileMe, and if signing out fixes things - I'd appreciate it if you could post your results. Thanks.

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

How do I best share an iPhoto library to several users on a Lion Server?

I am considering setting up a Lion Server to use for our family of five. The one thing I struggle to understand from searching for information here, and throughout the Internet is: Can I set up a Lion server to have shared libraries for iTunes and iPhoto, and what is the best way to set it up? I would also like to understand if such a shared setup would create any issues with reduced functionality and/or performance?
Today we share libraries across several accounts on one computer, and that works mostly fine, although with some restrictions (only one account can have iPhoto open at a time, which is not much of an issue if on same computer; iTunes can share music but not Apps, ...)

I followed Apple's support team's instruction to create iPhoto on the new external hard drive (My Passport) - and then drag and drop the existing iPhoto library onto it from the Master file.
Don't know who told you that but it would be difficult to be more wrong.
Make sure the drive is formatted Mac OS Extended (Journaled)
1. Quit iPhoto
2. Copy the iPhoto Library from your Pictures Folder to the External Disk.
3. Hold down the option (or alt) key while launching iPhoto. From the resulting menu select 'Choose Library' and navigate to the new location. From that point on this will be the default location of your library.
4. Test the library and when you're sure all is well, trash the one on your internal HD to free up space.
Regards
TD

I'm trying to use Mountain Lion Server so my family can have separate logins via Screen Share to their iTunes.

Using Mountain Lion Server so my family can have separate logins and connect via Screen Share.
Works great, each has their own home directory and permissions are perfect.
Now setting up iTunes for each with their own Library (not shared), thus keeping multiple Libraries.
I get this;
This Computer is already associated with an Apple ID.
If you download past purchases with your Apple ID, you
cannot auto-download past purchases with a different
Apple ID for 90 days.
What!
So what it is on the same computer, they are completely separate Libraries never to be mixed.
If this works, I only need to keep one computer up and running, instead of three.
Each can do their syncing/backup and connect to the various Airplay/AppleTVs I have around the house.
How do I fix this.
Thanks

Bottom line is you can't - easily.
You need to make sure that you log out of the server each time otherwise the ID is running. To explain, if you had a laptop with different people using it, your solution works fine. Each time someone logs in, the iTunes ID is different so it works as you can only have one person using the laptop at any one time.
Now, turning your problem inside-out, you want people to be able to log into iTunes concurrently to use their own version of the program with their own library. This does not seem to work and you get the conflicted ID error message. Even though iTunes is running under their own login ident, I have never been able to get this working reliably and was told that iTunes is NOT a network-aware application as it is designed to be single user.
The way I got around this was to login as XYZ and to make sure that the ID was changed in iTunes accordingly. However, it did not always work so I gave up with the whole thing.

Photoshop CS6 can't save to server after upgrading to Mac OS Yosemite Server from Mac Lion Server

We recently upgraded our server from a Mac Pro 2008 with OS X Lion Server to a Mac Mini 2014 with LaCie 20TB 5Big Thunderbolt 2 RAID drive. Everything is working fine with the exception of Photoshop. It does it intermittently but once it happens it will continue to do so. We get message like "Can't save to disk because of disk error" and "Can't save file because of program error" . Sometime we are able to do a "save as" and save over it. Most of the time we have to "save as" with a different file name and then rename and recopy the file. We have check permission on all the file as well as the server HD has ignore ownership checked. Again only three things changed. 1) Sever hardware change from Mac Pro to Mac Mini. 2) Server software upgraded from 10.7 Lion to 10.10 Yosemite(both have the latest update). 3) Drive when from internal on Mac Pro to External Thunderbolt 2 LaCie drive. We have no problem with Illustrator or Indesign. Only Photoshop. Anyone with any suggestion is greatly appreciated.

Unfortunately you seem to be using Photoshop in a way that Adobe discourages, so you may not be getting a lot of helpful advice.
Networks, removable media | Photoshop | CS4 and later

How do I add a wildcard domain to Additional Domains in Websites on Mac OS Mountain Lion Server?

I could do this in Lion Server, but I can't in Mountain Lion (when I try to type * it doesn't type anything). Is there a file I can change with emacs to get this working? I've added the wildcard domain to /var/named/db.mydomain.TLD (see the wildcard domain section) but I need it in the web server as well for this to work.

I found the answer here:
/Library/Server/Web/Config/apache2/sites/0000_any_<port>_example.com.conf
And just before </VirtualHost> put the line:
ServerAlias *.example.com

How do I get my airport extreme to show up under hardware in my Lion server app.

My airport extreme is not showing up in Hardware in my lion server app. How do i configure the settings on my airport extreme to work with the lion server app?

Hi there, it's pretty easy, see this link & check back if you have any problems...
http://email.about.com/od/macosxmailtips/qt/et_gmailosxmail.htm

Unable to add/remove users in Mountain Lion Server (Options are greyed out)

For some reason, im unable to add/remove users in Mountain Lion server. The + and - are greyed out. It seems like something is wrong with the permissons because it looks like it cant write the the Ldav3 file (although that may be speculation). Does anyone have any advice for me? I URGENTLY need to add users.
Maybe theres a way to restore default permssions for the boot drive (if that in fact is the issue). Hopefully there is a way that I can fix this while leaving all users, groups, their permissions and shares intact.

Anything interesting and relevent in the server logs?
Anything interesting in the server alerts?
Since it's far and away the most common cause of problems with OS X Server and with distributed authentication (Open Directory is entirely based on network encryption and digital certificates and on responses from your local DNS server(s)), verify your local DNS configuration is working and requires no changes with the following Terminal.app (Applications > Utilities) harmless, diagnostic command:
sudo changeip -checkhostname
sudo requires an administrative password. You might get a one-time warning about the sudo, and that can safely be ignored. The command will display some details, and indicate whether the local configuration appears valid and no changes are required, or further diagnostics for (most) common errors that can arise.

Running Lion Server on a FCP Machine?

Is it a sin to run Mac OS X Lion Server on a machine I purchased to do video editing with? If you don't want to address the normative question, can you tell me how much RAM it takes to run Lion Server? I have 16 GBs, purchased for motion graphics. I don't do a lot of motion graphics, but it's good to have the RAM and the processing power all together when you need it.
Thanks for your input!

>I assumed that Prem Pro and After Effects will run both 32 and 64 bit OS.
No, 64bit only... see below
Adobe's MINimums http://www.adobe.com/products/premiere/tech-specs.html
-Programs won't display if they will not install on your computer
-http://helpx.adobe.com/creative-cloud/kb/all-apps-displayed-aam.html

I am trying to allow guests on windows to connect to shares on my Lion server but it keeps asking for a password for guest. I have allow guest users to access this share enabled but it still does not work.

I am trying to allow guests on windows to connect to shares on my Lion server but it keeps asking for a password for guest. I have allow guest users to access this share enabled but it still does not work.

Ditto. Guest accounts shouldn't have a password. No way to enter one in System Prefs...

Lion Server Vs MobileMe

Similar Messages

Maybe you are looking for