Lion Server without a Static IP - Worth it?

I'm running a small video production company, and I'm considering setting up my iMac with Lion Server for use in organizing productions.  I love the idea of having calendars that multiple people can update and expand upon, a wiki or custom website for sharing progress and updates, shared contacts for keeping track of cast and crew, distributing files like scripts and footage, and eventually setting it up to host my website and company email.
My problem is that I don't have a static IP, and from what I've found, I can't afford one right now.  That being said, I'm fine holding off on the webhosting and email for now, and I imagine I'll lose the ability to do push notifications as well, but I'm still interested in the system.  Having the calendars and contacts update whenever the employee logs into the local network at the office would work for us.  But I wanted to check: is that how it would go down?  It would sync the info when each device logged onto our network and then they could go about their merry way, or is it more complicated than that?
I'm fairly technically savvy, (I work part-time as a web designer, and I actually work at an Apple store as well), so I imagine I can handle the setup and such.  I'm just curious as to how much of my desired functionality will even work with the "update whenever you enter the network" pattern.  Is that how it would go down, or is it more dependant on a static IP, even for local-network use?
-Nerrolken

Linc is right, but I'd add a little clarification.
Lion Server does want a static IP address. It's perfectly happy if that address is on your LAN. Make sure it's on the same subnet as the LAN (Ethernet) side of your Internet router/gateway/access point. Configure the router to reserve a static IP for your server--so that a DHCP query will give your iMac the same IP every time--or narrow the range of IPs the router doles out to exclude the static address you assign your iMac.
If the day comes when you do want to publish some services to the Internet, configure port forwarding for those services in your Internet router and, as Wittless said, sign up for DynDNS or a similar service so your users can find you. Lion Server handles all of this automatically if you use AirPort Extreme or Time Capsule, but it's almost as easy to manage with non-Apple network gear.
Best of luck.

Similar Messages

  • I am running OXS Lion.  I cannot puchase OSX Lion Server without buying OSX Lion again in the App Store?

    I am currently using OSX Lion.  I went to the App Store to buy OSX Lion Server.  It informs me I have to buy OSX LIon as a package with the Server.  Why do I need to buy Lion twice to get the server?

    Have you bought Lion with the same account you're trying to install Lion Server?
    Normally you didn't have to pay Lion twice. You only have to had installed Lion with the newst update to load and install Lion server

  • How to install yosemite on lion server without server application

    I have osx 10.7.5  (that's all it says when I click about this app, but I know the computer was installed with lion with server app originally).  I don't need nor want the server app, and am happy to remove it one way or another.  Server is currently disabled.  I want to know how to upgrade to mavericks or yosemite without any server aspect at all.  Can it be done?  I have googled until my head has exploded and am none the wiser.  Most people seem to be unsuccessful.  I did previously try to install mavericks when it came out but it came up with some random scary message and I cancelled it. 
    Both my mac mini 2011 disks are in use  for different reasons - one tends to be more operational such as the operating system and apps, the other to save all my photos, videos and files mainly.   I have a separate ext hard drive for time machine back ups.
    I have no tech skills whatsoever, so baby language please.  Be specific.  Outline EVERY step in simple language.  Or I will cry! 
    Thanks!
    Jodi

    There's nothing special you have to do. Just upgrade. The Server app won't come back.

  • Lion Server not handing out DHCP addresses to Snow Leopard client

    I have been pulling my hair out over this.
    Here is the layout
    Lion Server running on the newest Mac Mini and doing mail, DNS, DHCP, Software update and has a valid, not self assigned, certificate
    3 clients running Lion Desktop (2 iMACs and a MBP pro (all no more that a year old and all woth the current updates)
    1 client running Snow Leopard Desktop (last years 13 inch MBA)
    The 3 Lion clients can get dhcp fro mthe Lion server without any issue
    The SL client cannot get a DHCP address from the Lion server
    A tcpdump shows the DHCP request coming from the MAC address of the SL client but no response from the Lion Server and nothing showing a deny in the logs for the DHCP server or any other system/kernel logs. The Lion clients all show the request and reply for them. All 4 clients currently have a static assignment in DHCP but even if I remove them all and do auto-assign for everything or even each one individually, the SL client will not get an address both on the Wifi and Ethernet (I have the USB ethernet adapter).
    I also have an Aiport Extreme and if I use that for the DHCP server then all clients get the addresses. I know the DHCP server in the extreme cannot be shut down but if you give the extreme a static address then assign dhcp on the extreme to only give out one address and that is the same one that is statically assigned then it "thinks" it is out of addresses and no longer tries to assign addresses
    At first I thought there was a conflict between the extreme and the Lion server but as I mentioned above, tcpdump clearly shows the requests going right to the Lion server
    I'm usually pretty good at this kind of thing but this one has me stumped. I'm thinking bug, anyone else run into this yet?

    Ryan jones,
    > Having trouble with our dhcp server handing out IP addresses through the
    > Wireless Lan Controller.
    Has it ever worked? Is the Wireless controller configured to forward DHCP
    requests to your DHCP server?
    Anders Gustafsson (NKP)
    The Aaland Islands (N60 E20)
    Have an idea for a product enhancement? Please visit:
    http://www.novell.com/rms

  • Lion Server Vs MobileMe

    Hi All,
    Im after a bit of advice. Im currently using MobileMe for Mail, Cal and up until recently Back To Mac (which has stopped working for some reason). Its great from the point of view that I have access to the same information everywhere. Though recently I have been thinking about getting Lion Server to control the file system in the office and as I have a couple of freelance staff which we are currently using dropbox to collaborate on projects. Im thinking I may be growing out of it so to speak. I would much prefer more control inhouse with files stored on my hardware and server.
    Couple of questions Im a little unsure of is and Im hoping I can get some tips from the community.
    Can Lion Server replace my current set up of MobileMe? ie can I access my mail, cal and file system from each of my devices?
    Does Lion Server require a static IP for email to work? For email I would be looking at hosting my own domain.
    Can I connect back to the server's file system when Im out and about. Im a consultant so Im on site alot. This would be great if was available.
    As I said Im after any advice, so past experience, tips and testimonial will be great.
    Cheers,
    Phil

    You won't lose anything from a desktop or client standpoint - any app you can run in Lion (client) you can run on Lion Server. The major difference is the addition of the server-based apps, some networking tweaks, and a minimal performance hit if you have clients fedeing off your Mac at the same time you're trying to use it (the same issue when running any background task, really).

  • Migrating wiki from Leopard Server (10.5) to Lion Server

    Is there any way to migrate Wiki Server data from Leopard Server (i.e. 10.5 not 10.6) to Lion Server without upgrading to Snow Leopard first. I'm happy to set up everything else afresh but I've migrated wiki data before and it was a nightmare.
    The situation we'll soon be in is needing to migrate wiki data on a PowerPC mac running Leopard Server to a new Power Mac pre-installed with Lion Server.

    From: http://images.apple.com/macosx/server/docs/Upgrading_and_Migrating_v10.7.pdf
    Need to set up Lion Server first, then:
    Copy the wiki data located in /Library/Collaboration/ by default or in the location specified in Server Admin on the v10.5.8 or later server to a local volume Lion Server can access.
    Use the following steps to manually migrate your Mac OS X v10.5.8 or later server’s Wiki data to Lion Server.
    If you are migrating a v10.5.8 wiki server’s data, make sure Lion Server is bound to the same Open Directory master as the v10.5.8 server, so the ACLs for wikis can convert. If not, wikis are only readable or writeable by admins, and ACLs must be reset.
    To migrate wiki data:
    1 Start Wiki service in the Server app.
    2 Enter the following command.
    sudo wikiadmin migrate -r /path/to/collaboration/folder

  • I have Lion 10.7.3 can i install lion server

    I have Lion 10.7.3 installed on my iMac can I install Lion Server without having to do a clean install?

    Yes from what I read Lion server is just an Application that run on, ,and changes certain things, in the normal Lion OS.

  • Archiving Mail on Mountain Lion Server with MailSteward or Other?

    Anyone here successfully archiving mail for multiple user accounts on Mountain Lion Server without spending a bunch of dough?
    From poking around a bit I guess mail is in /Library/Server/Mail/Data, but I don't think MailSteward can pull from there, dovecot daemon stuff that is over my head.
    Interested in solutions short of going to Kerio Connect, which looks to provide the archiving functionality I need (and maybe also lets users change their own passwords, which would also be nice).
    Thanks!

    Eustace - Thanks for taking a crack at it!  I saw this same post as well but it doesn't answer my question about how to create and launch an Out of Office Reply for Apple Mail on the new Mountain Lion Server?
    I'm not looking to create an out of office rule on my computer but on our Mountain Lion Server like we used to be able to do on Lion Server.

  • Lion Server VPN: Static IPs to Clients?

    Does anyone have any thoughts as to whether it might be possible to have the
    Lion L2TP server hand out static IPs to clients when they connect, based on the
    username they use to log in?
    Looking at this snippet from /Library/Preferences/SystemConfiguration/com.apple.RemoteAccessServers.plist:
                                            <key>ConfigMethod</key>
                                            <string>Manual</string>
                                            <key>DestAddressRanges</key>
                                            <array>
                                                      <string>10.50.0.100</string>
                                                      <string>10.50.0.149</string>
                                            </array>
    ConfigMethod gives me a little hope that other methods may be available, and I
    might be able to do this, but am reaching out to see if anyone here has
    experience or insight on this topic.

    Yup... all UDP.  I'll mess with getting it outside the firewall. 
    I'm thinking now that it might be a domain/certificate name issue - seeing that all the new certificate trust requirements have already broken other things for me (like web-based stuff, calendars and profile management)
    Is it required by the VPN server that the certificate hostname matches the external hostname?

  • I need a mail server without SMTP authentification. Which is the right one? Or how to configure OSX Lions Mailserver?

    Hello folks,
    our HP Scanner with email delivery is one the most used pieces of hardware in our office. Just scan and get delivered to your inbox. That works easy and perfect.
    Unfortunately we had to change our standard mail server and now a prerequsisite is the smtp authentification. But the HP admin interface on the scanner does not allow to enter smtp auth credentials. It only supports smtp delivery without username/password. Now I have a serious problem. I cannot find any external provider that supports smtp mail delivery without smtp authentification (against spam of course, I understand that).
    I have a OSX Lion Server running as a file server in our network. But I have no clue if there's a way to use it's mailserver without smtp auth.
    Is there anyone who can help me out?
    Cheers,
    Joo-Chen

    I have a OSX Lion Server running as a file server in our network. But I have no clue if there's a way to use it's mailserver without smtp auth.
    Sure. Turn it on.
    The default mode is to not require authentication. You have to turn on authentication if you want it.
    Changing authentication on/off is a matter of clicking a radio button.

  • How can I creat a 802.1x Profile without Lion Server? I miss the plus-button in Lion to creat a 802.1x Profile.

    How can I creat a 802.1x Profile without Lion Server? I miss the plus-button in the Network Configuration (OS X Lion) to creat a 802.1x Profile.

    Tried this?
    http://blog.affien.com/archives/2011/03/16/802-1x-configuration-profile-on-lion- mac-os-x-10-7/

  • Worth upgrading to Lion Server?

    Not trying to be snarky, geniunly curious.
    Currently have a Snow Leopard server for a small business office. It's being used as an Open Directory master, network share, web server, and Time Machine backup. No mail/calendar/wiki (use Kerio for that). In reading about Lion server I'm not sure if any of the new features are worth the upgrade for me. We went from 10.5 to 10.6 server mostly for the speed boosts and Spotlight searching, but I can't seem to find any "must have" Lion features for my use case.
    Anyone care to share their decisions over why they are planning an upgrade, and why?

    I will add to what was said above. Do not under any circumstances upgrade.
    I recently setup a clean Lion server, pre-installed on an iMac, with the lion server add-on from the App Store. So, totally clean machine, starting from scratch, Lion pre-installed.
    It's been a nightmare. The Server tool is unusable. It is buggy as ****. User and Group assignments just up and dissapear. They are still present, but you can't see them from the Server Tool. The only way to manage them is to use the Users and Groups Preference Pane, which is a pain also, but at least it works.
    The UI for setting permissions (yes, the standard Command-I interface), is screwed up also. It cannot handle simple tasks whithout failing. You never know what it its going to do. You add a group. But it doesn't take. You add it again. It might work. Hevean forbid you want to add a group, assign it read-write, and then apply to all subfolders. LOOKS like it works, but it doesn't. I confirmed this using the command line tools.
    I finally gave up trying to use the UI for permissions, and now I am doing everything from the command line using "chmod" commands. These always work. As soon as I can figure out how to manage users and groups from the command line, that's what I'm going to do.
    Windows SMB/CIFS sharing is a nightmare. It mostly works. Except when it doesn't. And it doesn't a whole lot of time. You think it's fine. But for no apparent reason, the Mac starts dropping the connection if it idles for too long. You can have a document open on a Windows machine, and go back to save it or work further, and the connection has dropped. Repeatedly you will work on a file, and for no apparent reason, when you try to save it, you are told that the file is already open by another user. But it's not. You are the only user, and in fact you are only using one single application to edit the file.
    I could not get our Debian-Linux based RIPs (for our large format printers) to connect using SMB at all. I finally gave up after numerous attempts trying every possible combination, and switched to using NFS exports. Thankfully, NFS still works in Lion, and the NFS Manager app (google for it) has been updated to manage them if you are uncomfortable doing it from the command line / text editor.
    We are hobbling along. It ain't pretty. I wish we had another option at this point.
    FYI: We didn't have a choice but to make this move now. Our old fileserver, a linux box, could no longer keep up with our growing user base and our very large file systems (we are a medium-sized printing company). Linux is great as a Mac server for smaller networks, but it can't handle either Samba or AFP connections once the filesystem grows too large. It bogs down horribly due to the inherent limitations of Samba and Netatalk. So our only options were a Mac Server or Windows+Extreme-Z IP. We chose to roll the dice on an iMac + Promise Pegasus disk array on Thunderbolt + Lion Server.
    I wish I had the option to install Snow Leopard. But you can't install it on this iMac. The only machines that support Thunderbolt AND Snow Leopard are laptops. Unless we spent gobs of money on a Mac Pro + Fiber Channel (which would have been almost triple the price), our only choices were the new Mac Mini Server, or the new iMac, either of which supports Thunderbolt, but neither of which supports Snow Leopard.

  • Mac Mini Server with Lion (without Lion Server) ?

    I intend to buy a new Mac Mini and obviously the Server Hardware version is the best option with a i7 Quad Core and 2x HDDs (the option to 2x 750 is $100 whereas the option for 1x750 is $150 !!! for the standard Mac Mini) ... well lets make it shor, I would like the Mac Mini Server hardware but I don't want the Server components in the OS, I don't need them, I don't want to configure them. Does anybody know for sure if I can deinstall the Server components easily ?
    Thx

    Hi RajPad,
    i have not yet found a commandline tool to remove pages. If you're familiar with SQL you can use a tool to connect to the postgresql database where the pages are stored.
    I won't try to write a "howto connect to pgsql on lion" here because i know this has been answered already.
    If youre connected to the database collabd and you have a page url like:
    http://my.lion.server/wiki/pages/P9c196z/somepage.html
    Then your SQL to find the entity is:
    SELECT * FROM entity where tiny_id='P9c196z';
    Note the uid from that result and find and remove all related entries in other tables there after removing this entity.
    I have not excercised that myself because i don't have a system to screw
    Make a Database dump prior to your actions and hope nobody is editing pages while you're at work.
    If you have a plain SQL dump you could pick individual datasets from there to rebuild if something goes wrong. You'll only have to note what you changed to be able to revert.
    Just an idea ....
    Make a copy of your page and compare both pages in database. If one is working and the other aint you should be able to find the difference.
    Good Luck
    Andreas

  • How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

    I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
    Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
    Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
    Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
    DVD>Disk Utility>Erase Disk  [or Recovery Partition>Disk Utility>Erase Partition]
    DVD>Install Lion
    Reboot, hopefully Lion install kicks in
    Update, update, update Lion (NOT Lion Server yet) until no more updates
    System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
    Terminal>$ sudo scutil --set HostName server.domain.com
    App Store>Install Lion Server and run through the Setup
    Download install Server Admin Tools, then update, update, update until no more updates
    Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
    System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
    A few DNS set-up steps and these most important steps:
    A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
    B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
    C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
    D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
    E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
    F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
    G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
    H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
    I. Test from web browser server.domain.com/mydevices: Lock Device to test
    J. ??? Profit
    12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
    You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
    Firewall
    Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
    SSH
    Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
    PermitRootLogin no
    PasswordAuthentication no
    ChallengeResponseAuthentication no
    I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
    Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
    client$ ssh-keygen -t rsa -b 2048 -C client_name
    [Securely copy ~/.ssh/id_rsa.pub from client to server.]
    server$ cat id_rsa.pub > ~/.ssh/known_hosts
    I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
    $ diff denyhosts.cfg-dist denyhosts.cfg
    12c12
    < SECURE_LOG = /var/log/secure
    > #SECURE_LOG = /var/log/secure
    22a23
    > SECURE_LOG = /var/log/secure.log
    34c35
    < HOSTS_DENY = /etc/hosts.deny
    > #HOSTS_DENY = /etc/hosts.deny
    40a42,44
    > #
    > # Mac OS X Lion Server
    > HOSTS_DENY = /private/etc/hosts.deny
    195c199
    < LOCK_FILE = /var/lock/subsys/denyhosts
    > #LOCK_FILE = /var/lock/subsys/denyhosts
    202a207,208
    > LOCK_FILE = /var/denyhosts/denyhosts.pid
    > #
    219c225
    < ADMIN_EMAIL =
    > ADMIN_EMAIL = [email protected]
    286c292
    < #SYSLOG_REPORT=YES
    > SYSLOG_REPORT=YES
    Network Accounts
    User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
    2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
         User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
    Oh well.
    Email
    Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
    root:           myname
    admin:          myname
    sysadmin:       myname
    certadmin:      myname
    webmaster:      myname
    my_alternate:   myname
    Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
    cd /etc/postfix
    sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
    sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
    sudo serveradmin stop mail
    sudo serveradmin start mail
    Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
    If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
    iCal Server
    Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
    Web
    The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
    $ diff httpd.conf.default httpd.conf
    95c95
    < #LoadModule ssl_module libexec/apache2/mod_ssl.so
    > LoadModule ssl_module libexec/apache2/mod_ssl.so
    111c111
    < #LoadModule php5_module libexec/apache2/libphp5.so
    > LoadModule php5_module libexec/apache2/libphp5.so
    139,140c139,140
    < #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
    < #LoadModule encoding_module libexec/apache2/mod_encoding.so
    > LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
    > LoadModule encoding_module libexec/apache2/mod_encoding.so
    146c146
    < #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
    > LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
    177c177
    < ServerAdmin [email protected]
    > ServerAdmin [email protected]
    186c186
    < #ServerName www.example.com:80
    > ServerName domain.com:443
    677a678,680
    > # Server-specific configuration
    > # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
    > Include /etc/apache2/mydomain/*.conf
    I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
    Alias /eyetv /Users/uname/Sites/EyeTV
    <Directory "/Users/uname/Sites/EyeTV">
        AuthType Digest
        AuthName "EyeTV"
        AuthUserFile /Users/uname/.htdigest
        AuthGroupFile /dev/null
        Require user uname
        Options Indexes MultiViews
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
    <Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
        AuthType Digest
        AuthName "EyeTV"
        AuthUserFile /Users/uname/.htdigest
        AuthGroupFile /dev/null
        Require user uname
        Options Indexes MultiViews
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
    Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
    One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
    Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
    User-agent: *
    Disallow: /
    Misc
    VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

    Privacy Enhancing Filtering Proxy and SSH Tunnel
    Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
    If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
    $ ./ssht 8080:[email protected]:3128
    $ ./ssht 8080:alice@:
    $ ./ssht 8080:
    $ ./ssht 8018::8123
    $ ./ssht 5901::5900  [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
    $ vi ./ssht
    #!/bin/sh
    # SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
    USERNAME_DEFAULT=username
    HOSTNAME_DEFAULT=domain.com
    SSHPORT_DEFAULT=22
    # SSH port forwarding specs, e.g. 8080:localhost:3128
    LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
    REMOTEHOST_DEFAULT=localhost    # Default is localhost
    REMOTEPORT_DEFAULT=3128         # Default is Squid port
    # Parse ssh port and tunnel details if specified
    SSHPORT=$SSHPORT_DEFAULT
    TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
    while [ "$1" != "" ]
    do
      case $1
      in
        -p) shift;                  # -p option
            SSHPORT=$1;
            shift;;
         *) TUNNEL_DETAILS=$1;      # 1st argument option
            shift;;
      esac
    done
    # Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
    shopt -s extglob                        # needed for +(pattern) syntax; man sh
    LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
    USERNAME=$USERNAME_DEFAULT
    HOSTNAME=$HOSTNAME_DEFAULT
    REMOTEHOST=$REMOTEHOST_DEFAULT
    REMOTEPORT=$REMOTEPORT_DEFAULT
    # LOCALHOSTPORT
    CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
    CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR%:}                            # delete :
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        LOCALHOSTPORT=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # REMOTEPORT
    CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
    CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR#:}                            # delete :
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        REMOTEPORT=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # REMOTEHOST
    CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
    CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR#:}                            # delete :
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        REMOTEHOST=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # USERNAME
    CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
    CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
    CAR=${CAR%@}                            # delete @
    if [ "$CAR" != "" ]                     # leading or trailing port specified
    then
        USERNAME=$CAR
    fi
    TUNNEL_DETAILS=$CDR
    # HOSTNAME
    HOSTNAME=$TUNNEL_DETAILS
    if [ "$HOSTNAME" == "" ]                # no hostname given
    then
        HOSTNAME=$HOSTNAME_DEFAULT
    fi
    ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
        && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
        || echo "SSH tunnel FAIL."

  • How do I set up my Time Machine and Mac Mini with Lion Server so i have one wifi loop in the house?

    HELP!
    So I have had a Time Machine wifi loop at the house for approx. 6 years. I run two Macbooks, 2 iPhones, 2 iTouch and a Samsung Smart Blueray on the loop.
    I just bought a Mac Mini with Lion Server. When setting it up I'm not sure what or how I managed to do, but I now have 2 wifi loops, one doesn't lock and niether will support the Samsung BlueRay. Also, each time I want to go online with one of the other Mac devices i have to relog into the wifi loop.
    Can someone please walk me through the fix. The mac Mini is plugged straight into the Time Machine to recevie its internet connection.
    Thanks!
    John

    You often see this limit of 10 clients in wireless hotspots but I have yet to see it in an adsl modem.. most strange way to pay for a service that is really irrelevant how many clients you use.
    Have a go .. I recently setup a TC to help a guy run his Roku.. and this setup worked well.. I have no idea if it can work in your case.
    Lets say the IP you get is 192.168.2.1-10 .. doesn't matter what it really is. And the adsl modem is 192.168.2.254
    (Assuming they are private addresses.. if they are public IP you can just use the DHCP and NAT. )
    But go to the airport utility.. I think you need to run v5 at least to change DNS.. but you can do the same thing in v6 using static but no dns changes.
    Now you set the IP of the TC manually.. This address might need to be in the dhcp range of the modem to work. You can set the DNS to same IP as the router address.. ie home address of the modem. Or you can use another DNS.. whatever you like.
    Then set DHCP for clients that will join.. this can then expand the scope of addresses..
    It worked without a NAT error.. although I am not sure exactly how.. on paper it should not be able to work but did.. have a go.. otherwise there is perhaps another way.. but it is complicated.
    Give us an example from a computer plugged into the modem of what IP .. subnet mask .. Gateway and DNS you get. Then I can fine tune the values for it.

Maybe you are looking for