Lion Server vs NAS

I'm out of space on my primary machines trying to decide which solution is better: FW 800 drives attached to a Lion Server or a NAS.
1. Is there a NAS that reliably works as a Time Machine device? Read about the Synology and QNAP boxes. Is using them as Time Machine supported?
2. Likewise with iTunes, does the iTunes server feature vendors advertise work?
Thanks for any insights.
Jeff

I am using a 3 terabyte NAS, the 'My Book Live' from Western Digital.
The MBL supports Time Machine. I am currently backing up two of my Macs
Via Time Machine and have had no problems.
Jerry

Similar Messages

Lion Server vs NAS System

Hello all,
I have a long and interesting question that i hope can be answered.
I currently have an imac running lion server and am starting to have problems with it getting slow and stuck. As i was going to fix the issue, i started to think about various nas drives that could replace the server and be much more effeciant then constantly trying to solve these problems. All i use my server for is file sharing, and with the release of ios 5, i was going to use the webdav so i could access my files away from home. but nas drives such as netgear can also do this right through a website, and various applications. I also pointed my editing mac to a external drive on the server for 1920x1080 video scratch
First, do i stick with the server, or go to the nas system, and will the nas be able to work as a scratch drive.
Second, if i get a nas, which do i get. ive seen some from netgear which so far im leaning towards, and lacie and western digital.
Third, with a nas, does it show up on my mac just like any external hard drive? and is it complicated to set it up to be accessed anywhere in the world.
Lastly, Is it possible to have multiple nas in one house?
As you can probably tell, im new to this stuff.
thanks for the help!

I am using a 3 terabyte NAS, the 'My Book Live' from Western Digital.
The MBL supports Time Machine. I am currently backing up two of my Macs
Via Time Machine and have had no problems.
Jerry

Share NAS directories on LION Server

I want to share directories on a Synology NAS via LION Server.
Currently I have LION setup as Opendirectory server, Synology as LDAP client.
Synology is connected to LDAP server on Lion, I can see the LDAP users in the Synology LDAP user base, however I can't seem to be able to setup shares residing on the NAS via the server.
I am sharing a sharepont on synology, can mount it in finder of the server, but then I am unable to publish the mount as a shared directory in either server.app or in system settings for sharing.
any thoughts?
best
-Harald

Hi Jonathan,
probably my descripotion is not accurate should, I want to manage the network shares via the server (WGM).
in principle its like this:
OD user logs in, gets his network home folder (on NAS) that synchronizes with the local home folder (all this managed and configured via mobility in WGM).
OD user also gets access to group shares on the NAS, also managed via WGM.
The storage of data should occur on the NAS.
I am starting to think that iSCSI may be th eway to go for simplicity.
best
-H

Lion server file sharing issue with windows API read/write ini file (GetPrivateProfileString)

Hello,
I try to config lion server as file server for a windows application we use at work. All other computers are windows 7 or XP, lion server is the only mac. I choose lion server because it's size, quality and personal love of apple products.
10.7.2 lion server's samba file sharing works almost perfectly with all my windows machines, I can copy, delete, modify any text files or office files without any issue, but the most important windows application for my business doesn't work with samba file sharing. After some digging, I found it is because windows program can't read or write INI file stored on lion share. Windows API GetPrivateProfileString always returns empty if the INI file is store on lion share.
You can download a small application for read/write windows INI file from codeproject.com to test this problem:
http://www.codeproject.com/KB/files/ini.aspx
I can open/edit the in file using any text editor without any problem. The only problem is with those windows APIs. ACL is turned on for my lion share and assigned "delete" rights to samba users.
I install samba3 on the same server; it works perfectly with windows API. My windows program also works. Looks like there is something wrong with lion server's sambax.
I'd prefer to use built-in samba even I have samba3 working. Built-in samba is very immature right now, but considered how young it is, I will give apple some time to make it mature.
Does anyone have same issue or knows how to fix it?
Thanks,
Michael.

All the memory is fine. The server rarely if ever goes down when there are only around 10-12 users connected. When there are 20+ users connected and working heavily it goes down often. When I say working heavily, I mean they are transferring huge files to the SAN (100GB+), sometimes 5 at a time per user, and there are a bunch of others who are reading large video files at a minimum of 220MB/sec from the SAN.
Though this worked on Snow Leopard without any issues, Lion just doesn't seem to be able to handle it. The odd thing is, on Snow Leopard there was only a single 1GB ethernet connection to a NAS system, whereas with Lion we have a much more powerful machine with a 6-port 10GB ethernet card and a 4 lane 8GB fiber card to a true SAN. You would think that the newer scenario with Lion would handle far more users with ease.
So far, very disappointing with regards to Lion's file serving performance.

Using Lion Server Radius for authenticating "other" clients

Hi I've been trying to get the Radius service in Lion Server to authenticate users of my SQUID web proxy. I have followed the squid wiki's instructions to configure the squid server as a radius client and pass authentication requests to the Lion Server Radius (I hope). However I'm trying to configure and test the Lion Server Radius. As Lions Server Admin GUI for radius only lets to add Airport Basestations, I've been trying to dig around for what underlying config files to edit. I have tried 2 methods of adding the client details to radius:
1. By editing the /etc/raddb/client.conf, and adding/changing (for example):
client localhost {
     secret     = mysecretpassphrase
client 192.168.0.0/24 {
     secret              = mysecretpassphrase
     shortname       = local-lan-clients
and restarting squid. Nothing seems to get mentioned in the radius log file! So I'm not completely convinced that the Lion Radius took any notice of this!
2. Instead of above, added the same client info using radiusconfig:
$ sudo radiusconfig -addclient 192.168.0.0/24 local-lan-clients other <return>
- then it prompts for the secret. With this command I notice the entry/event is recognised in the radius log file, and also looks like some SQL activity. If I dont specify "other" for the nas-type, it defaults to "Aiport Base Station" or similar.
OK, so forgetting about SQUID for a minute, I can't even get that far as I'm just trying to test the config using the "radclient" utility from the Lion Server and the squid server:
$ sudo radclient localhost auth mysecretpassphrase <return>
and... no response, just hangs, nothing in radius log either.
The Lion Firewall allows TCP and UDP requests into the Radius authentication port.
Any ideas what else I need to do? Scratching my head, I'm wondering if it is anything to do with SSL? e.g. do I need to make the authentication using the self-signed certificate that Open Directory has? I presume any Airport Base Stations added to radius will use this certificate to establish a secure connection for authentication.

The RADIUS server in OS X Server is a standard FreeRADIUS implementation with Apple's own custom GUI frontend for configuring it and which only allows adding AirPort base-stations. In Mountain Lion Server it is even limited to a specific configuration for the AirPort base-station.
However if you follow the normal command-line instructions and steps for configuring FreeRADIUS then it will be possible to add any type of RADIUS client.
While as far as I can see by manually configuring the FreeRADIUS server in OS X Server should enable you to do what you want, most people chose to configure Squid to use either a PAM or the LDAP modules for Squid to in this case authenticate directly to Open Directory (which is of course based on LDAP).
I myself have used a PAM in the past with Squid to successfully configure Squid to authenticate users via Open Directory. I was even able to specific an Open Directory group and only allow members of that group access via the Squid Proxy Server. I then went a bit OTT and set up another open-source tool (which was discontinued and I had to fix to get working) to process the Squid logs and store them in MySQL, and then setup FileMaker Pro to connect to the MySQL database via ODBC to allow producing reports.
Unfortunately the AFP458 website had a major redesign a while ago and many previous technical articles on it are now hard to find. I had used two articles on that site to guide me through setting up Squid and the PAM on a Mac server. I believe the two articles I used are the ones listed below.
http://afp548.com/2004/09/08/using-os-x-open-directory-to-authenticate-squid-pro xy-server/
http://afp548.com/2004/12/13/squid-server-using-ldap-authentication/

Lion Server File Sharing Crashes

We have a brand new Mac Pro (12 core with 64GB of RAM) running OS X Lion Server in a corporate environment. The server is running only file sharing and software update servers, and we have around 40 users who need to be connected over AFP at all times. This company runs 24/7 and we have an XSan environment using an ATTO Celerity 8GB 4 channel fiber card (84EN) along with a 6 port 10GB Ethernet card. The Ethernet card is configured in a link aggregation bond using ports 1-4. The idea is that clients who do not have fiber cards installed on their machines can still connect to the SAN via Ethernet and this file server. They AFP connect to the share, and of course the share is the SAN. It's a single mount point and everyone has read/write access.
The issue is that this machine keeps crashing (multiple times per day) and I cannot find any reason why. Syslog shows nothing of value and I've called into Apple Enterprise Support who also brought nothing to the table.
We initially had SMB and AFP file sharing activated but as soon as a Windows 7 client connected the machine was brought down. So, I disabled SMB via terminal (sudo serveradmin stop smb) and deactivated it via the Server app for the share point). That at least allows the machine to be up for 4-6 hours before crashing again.
This is seemingly the simplest of setups for file sharing and I would've thought that this beast of a machine would be able to handle being a file server without issue for far more than 40 clients. I'm seeing high CPU usage, which Apple support told me was perfectly normal (around 60% on the kernel_task process and around 55% on the AppleFileServer process). It also seems to consume all 64GB of memory, though it shows 60GB as inactive, but at the same time it's paging in and out.
Virtually all of the clients are running Lion (10.7.4), the server itself is running 10.7.4. There are a few ethernet connected clients running 10.6 along with two running 10.5. As I mentioned I disabled SMB so there are no Windows computers connecting to this machine at this time (though it would be nice to get that functionality back if AFP can be stabilized).
None of this makes any sense to me and I'm hoping someone can shed some light on this issue. This company simply cannot be down, especially not multiple times per day. The only way to bring things back and running from a crash is to hard boot the machine via the power button as you cannot perform a restart or a shutdown. Once the machine comes back up everything is back to working order for a few more hours until it happens again.

All the memory is fine. The server rarely if ever goes down when there are only around 10-12 users connected. When there are 20+ users connected and working heavily it goes down often. When I say working heavily, I mean they are transferring huge files to the SAN (100GB+), sometimes 5 at a time per user, and there are a bunch of others who are reading large video files at a minimum of 220MB/sec from the SAN.
Though this worked on Snow Leopard without any issues, Lion just doesn't seem to be able to handle it. The odd thing is, on Snow Leopard there was only a single 1GB ethernet connection to a NAS system, whereas with Lion we have a much more powerful machine with a 6-port 10GB ethernet card and a 4 lane 8GB fiber card to a true SAN. You would think that the newer scenario with Lion would handle far more users with ease.
So far, very disappointing with regards to Lion's file serving performance.

Can I install FFmpeg, FLVTool2, Mp4Box, and PHP CLI on Lion server?

I've been trying to find an answer to this question every where but no answer even at the apple store phone support or business support.
I would really appreciate if this question could be answered here.
I also have a qnap nas TS-459 Pro II and was wondering if I could use it as a storage for my website kinda expand the capacity of the Mac Mini.
Thanks

Just about any package you can install on the client version of Lion can be installed on the server. If you want to compile your own versions then download the developer tools from apple and install fink or macports.
What do you want to use the packages for?
As for the nas, you could use it in two ways:
1. Connect via nfs and use root mapping so that Lion server can handle all permissions
2. Dedicate a share on the nas for your webserver files and mount it on the Lion server.
If you could give more details of what you want to achieve then I'm sure the community will be able to help.

Mac Mini 2011 - 2.3Ghz - 2GB Ram running Lion Server

Hi guys.
I’m in a processof deciding whether to buy or not a mac mini.
Since the$599 version comes with Lion, 2.3 GHz i5 and 2GB of ram, is there any problemto upgrade from Lion to Lion Server? Or the server is reserved to the Mac MiniServer.
Since Ialready own one Apple Time Capsule, do you see any inconvenience to put’ it ontop.
What shouldbe best?
The Timecapsule on top on mac mini or the mac mini on top of time capsule.
Currentlythe time capsule is only a NAS/Switch which means that the radio if off as wellas other components. Bridge Mode. I guess that with the radio off he will warmbut not that high.

Hello, see how many of these you can answer...
See if the Disk is issuing any S.M.A.R.T errors in Disk Utility...
http://support.apple.com/kb/PH7029
Open Activity Monitor in Applications>Utilities, select All Processes & sort on CPU%, any indications there?
How much RAM & free space do you have also, click on the Memory & Disk Usage Tabs.
Open Console in Utilities & see if there are any clues or repeating messages when this happens.
In the Memory tab of Activity Monitor, are there a lot of Pageouts?
Safe Boot , (holding Shift key down at bootup), use Disk Utility from there to Repair Permissions, test if things work OK in Safe Mode.
Then move these files to the Desktop for now...
/Users/YourUserName/Library/Preferences/com.apple.finder.plist
/Users/YourUserName/Library/Preferences/com.apple.systempreferences.plist
/Users/YourUserName/Library/Preferences/com.apple.desktop.plist
/Users/YourUserName/Library/Preferences/com.apple.recentitems.plist
Reboot & test.
PS. Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive.

Sharing a Calendar from Mountain Lion server with Snow Leopard users on local network

Hello.
I have a new Mac Mini Server running Mountain Lion Server and I want to create a shared calender for a mix of Lion, Mountain Lion and Snow Leopard users on our local network. Does anyone have any info on how to do this? I have tried using the Server App and Calender Help within the applications, but the content isn't available. I have managed to create a Shared Calender from the Mini's Calendar App where I've added users and I can see a 'wireless' transmit icon to the right of the Calendar name - but I cant get any of the users' iCal or Calendar apps to recognise the Calendar on the local network. I've also created a Location in the Server App under Calendar and still can't see anything on the local network. Am I missing something really obvious?
Thanks in advance!

Sorry, I hadn't explained everything fully. I don't want to open up my VPN to friends and family. I do have the router assigning the NAS a fixed IP, so that when I connect over the VPN I can use the local IP address to connect, as you have mentioned.
What I would like is for my friends or family to connect to my server over AFP or SMB using the public IP of my network, which my router then forwards onto my server, and display the available sharepoints configured using Mountain Lion server. However, the NAS drive is not an available option this way as it has a separate IP to the server.
As the NAS alllows guest access, I also don't want to configure the router to forward a specific port to it, as this way it will be open to the internet. I wanted to try and use my server as an authentication point, with profiles set using Mountain Lion server, and limited to file sharing services only.
Hope this makes sense.

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

How do I best share an iPhoto library to several users on a Lion Server?

I am considering setting up a Lion Server to use for our family of five. The one thing I struggle to understand from searching for information here, and throughout the Internet is: Can I set up a Lion server to have shared libraries for iTunes and iPhoto, and what is the best way to set it up? I would also like to understand if such a shared setup would create any issues with reduced functionality and/or performance?
Today we share libraries across several accounts on one computer, and that works mostly fine, although with some restrictions (only one account can have iPhoto open at a time, which is not much of an issue if on same computer; iTunes can share music but not Apps, ...)

I followed Apple's support team's instruction to create iPhoto on the new external hard drive (My Passport) - and then drag and drop the existing iPhoto library onto it from the Master file.
Don't know who told you that but it would be difficult to be more wrong.
Make sure the drive is formatted Mac OS Extended (Journaled)
1. Quit iPhoto
2. Copy the iPhoto Library from your Pictures Folder to the External Disk.
3. Hold down the option (or alt) key while launching iPhoto. From the resulting menu select 'Choose Library' and navigate to the new location. From that point on this will be the default location of your library.
4. Test the library and when you're sure all is well, trash the one on your internal HD to free up space.
Regards
TD

I'm trying to use Mountain Lion Server so my family can have separate logins via Screen Share to their iTunes.

Using Mountain Lion Server so my family can have separate logins and connect via Screen Share.
Works great, each has their own home directory and permissions are perfect.
Now setting up iTunes for each with their own Library (not shared), thus keeping multiple Libraries.
I get this;
This Computer is already associated with an Apple ID.
If you download past purchases with your Apple ID, you
cannot auto-download past purchases with a different
Apple ID for 90 days.
What!
So what it is on the same computer, they are completely separate Libraries never to be mixed.
If this works, I only need to keep one computer up and running, instead of three.
Each can do their syncing/backup and connect to the various Airplay/AppleTVs I have around the house.
How do I fix this.
Thanks

Bottom line is you can't - easily.
You need to make sure that you log out of the server each time otherwise the ID is running. To explain, if you had a laptop with different people using it, your solution works fine. Each time someone logs in, the iTunes ID is different so it works as you can only have one person using the laptop at any one time.
Now, turning your problem inside-out, you want people to be able to log into iTunes concurrently to use their own version of the program with their own library. This does not seem to work and you get the conflicted ID error message. Even though iTunes is running under their own login ident, I have never been able to get this working reliably and was told that iTunes is NOT a network-aware application as it is designed to be single user.
The way I got around this was to login as XYZ and to make sure that the ID was changed in iTunes accordingly. However, it did not always work so I gave up with the whole thing.

Photoshop CS6 can't save to server after upgrading to Mac OS Yosemite Server from Mac Lion Server

We recently upgraded our server from a Mac Pro 2008 with OS X Lion Server to a Mac Mini 2014 with LaCie 20TB 5Big Thunderbolt 2 RAID drive. Everything is working fine with the exception of Photoshop. It does it intermittently but once it happens it will continue to do so. We get message like "Can't save to disk because of disk error" and "Can't save file because of program error" . Sometime we are able to do a "save as" and save over it. Most of the time we have to "save as" with a different file name and then rename and recopy the file. We have check permission on all the file as well as the server HD has ignore ownership checked. Again only three things changed. 1) Sever hardware change from Mac Pro to Mac Mini. 2) Server software upgraded from 10.7 Lion to 10.10 Yosemite(both have the latest update). 3) Drive when from internal on Mac Pro to External Thunderbolt 2 LaCie drive. We have no problem with Illustrator or Indesign. Only Photoshop. Anyone with any suggestion is greatly appreciated.

Unfortunately you seem to be using Photoshop in a way that Adobe discourages, so you may not be getting a lot of helpful advice.
Networks, removable media | Photoshop | CS4 and later

How do I add a wildcard domain to Additional Domains in Websites on Mac OS Mountain Lion Server?

I could do this in Lion Server, but I can't in Mountain Lion (when I try to type * it doesn't type anything). Is there a file I can change with emacs to get this working? I've added the wildcard domain to /var/named/db.mydomain.TLD (see the wildcard domain section) but I need it in the web server as well for this to work.

I found the answer here:
/Library/Server/Web/Config/apache2/sites/0000_any_<port>_example.com.conf
And just before </VirtualHost> put the line:
ServerAlias *.example.com

How do I get my airport extreme to show up under hardware in my Lion server app.

My airport extreme is not showing up in Hardware in my lion server app. How do i configure the settings on my airport extreme to work with the lion server app?

Hi there, it's pretty easy, see this link & check back if you have any problems...
http://email.about.com/od/macosxmailtips/qt/et_gmailosxmail.htm

Lion Server vs NAS

Similar Messages

Maybe you are looking for