Lion server wont kerberize to AD
I can get Lion server to connect to AD without issue, but even after I set the server permissions in AD proper delegation rights, I still can Kerberize. Any ideas what to try? I reinstalled Lion and lion Server fresh again.
Ok, I figured this out. Here's what I did:
1. Bind Lion server to the 2003 AD
2. Set up the server as an OD Master
3. Set OD to SSL (I believe this is optional, but better secure than not)
4. Bind client mac to AD.
5. Bind client mac to lion server OD (Ldap3)
6. Pull user from the AD on the Add User screen in Lion Server.
7. Make group for user, add user to said group.
Upon login with the AD user, it autheticated, and it added the user network folder to the dock.
It still isn't pulling dock permissions, but I think that's just me needing to understand Profile Manager configurations better.
The next step is to find a way to forward the local Documents folder to the network folder that's on the dock. That will be a different discussion.
So in a nutshell, if you want your mac clients to authenticate to your windows AD, and pull permissions from Lion Server, the above should do the trick. Don't worry about Kerberizing or any of that junk.
Similar Messages
-
Mountain Lion Server Profile Manager wont erase
I cant seem to get rig of these blank profiles in Moutain Lion Server. CAn anyone help? I have not been able to find a solution in the forum.
Thanks,
TomNelson -
Pretty much everything boiled down to DNS, firewalls and ports. Unfortunately, I was never able to acertain which of the three items were causing this problem because we have a separate group who manages the network and firewall (plus a separate security team). If I recall, once they focused on what it was I was trying to accomplish, most of the problems "magically" went away.
Is your reverse DNS working the way it's supposed to? Ex:
yourserver:~ login$ hostname
yourserver.yourdomainname
yourserver:~ login$ host yourserver.yourdomainname
yourserver.yourdomainname has address 10.x.x.x
yourserver:~ login$ host 10.x.x.x
3.34.2.10.in-addr.arpa domain name pointer yourserver.yourdomainname
yourserver:~ login$
Also be sure to follow "burton11234's" posts. https://discussions.apple.com/people/burton11234?view=overview -
Best way to connect mac clients through Lion Server to AD?
Ok, so here's what we are trying to set up for our school network. We currently have a 2003 server system hosting our PCs.
Authentication - through 2003 server AD
When client logs in:
Mac Client -------sends info to --------> Lion Server ----passed data through to-----> 2003 Server
2003 Server -----responds with authentication----> Lion Server ---applies profile management to client------> Mac Client
My thought is that Lion Server needs to connect to the 2003 server via the active directory setup in Users and Groups, but the clients should be connecting to the Lion server via LDAP3.
We can authenticate to the AD server directly from the clients or from the server, no issues there. Yet putting the Lion Server in "attached to another server" mode in Server Admin Tools doesn't Kerberize, even after giving proper permissions to the server via AD. I'm assuming that Kerberization needs to happen in order for Lion server to pass ther login data from the mac client to the 2003 server and vice versa, right?
Also, we would like to have the users' 2003 network user folders on the desktop automatically, or preferrably what they access when they go to Home. I noticed some options in Profile Manager as well as Workgroup Manager to make this happen. I assume that once the data between the 3 is working proerly, this will be close to a no-brainer.
So, advice is much appreciated here, first time setting up this type of hybrid system. Thanks!I appreciate all your help. I really do.
This is basically what I needed to know - You said,
"The audio out on a TV will source whatever input is associated with the current screen."
With my current macmini to TV setup - I have to have a separate audio line (apart from the dvi cable for video ) to the TV. I was not sure if that macmini audio line to the TV would transfer to the receiver. If it did not then I assumed (since the macmini only has one audio out line that I would have to split that audio line - one to the TV and one to the receiver ). That was my thinking anyway, but if whatever is on the screen will transport to the receiver then I should have no problem.
Thank you again for helping me think through this.
Pete -
Lion Server problem - Computer is already a network directory server
So I purchased Lion Server to trial it at home and it is not going well. Initially I was having issues connecting to the web interfaces for profile manager, etc. The server was not responding and so I uninstalled server and reinstalled it from the Mac Store (FYI: Apple has charged me for the OS and the server app as a result of this for some reason!!!)
With Server reinstalled I went to set up the server as a network directory and am shown this message every time I try to set up the directory admin account: "Computer is already a network directory server - This computer is already configured to manage network accounts. It cannot be configured again."
This leaves me unable to set up any profile or device management, I have tried the following solutions:
Uninstall and reinstall server
Deleted ServerVersion plist
Reinstalled Lion
Reinstalled Lion with format of HDD (although I did recover from a Time Machine Backup which included settings)
Any help would be appreciated.Sorry I copied the wrong log.
What is happening is the Open Directory Assistant attempts to create and Open Directory Master but fails claiming there was a configuration error and to view the configuration log which I have copied below.
2011-07-28 19:57:45 +0000 command: /usr/bin/ldapmodify -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
2011-07-28 19:57:45 +0000 command: /usr/bin/ldapsearch -x -LLL -H ldapi://%2Fvar%2Frun%2Fldapi -b cn=config -s base olcServerID
2011-07-28 19:57:45 +0000 command: /usr/bin/ldapmodify -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
2011-07-28 19:57:45 +0000 command: /usr/sbin/mkpassdb -o -u diradmin -p -q
2011-07-28 19:57:46 +0000
2011-07-28 19:57:48 +0000 command: /usr/sbin/mkpassdb -setadmin 0xdc9dacf8b95311e0b494d49a20d93acc 0
2011-07-28 19:57:48 +0000 Admin's entry UUID is: 9134bc0a-a748-4161-b6b2-53c136b933b9
2011-07-28 19:57:48 +0000 Setting SASL realm to <SERVER.FREEMAN.PRIVATE>
2011-07-28 19:57:48 +0000 command: /usr/sbin/mkpassdb -setrealm SERVER.FREEMAN.PRIVATE
2011-07-28 19:57:48 +0000 command: /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.PasswordService.plist
2011-07-28 19:57:49 +0000 Stopping LDAP server (slapd)
2011-07-28 19:57:52 +0000 Starting LDAP server (slapd)
2011-07-28 19:57:52 +0000 Waiting for slapd to start
2011-07-28 19:57:52 +0000 ...
2011-07-28 19:57:54 +0000 Configuring Kerberos server, realm is SERVER.FREEMAN.PRIVATE
2011-07-28 19:57:54 +0000 command: /usr/sbin/kdcsetup -f /LDAPv3/ldapi://%2Fvar%2Frun%2Fldapi -w -a diradmin -p **** -v 1 SERVER.FREEMAN.PRIVATE
2011-07-28 19:58:18 +0000 Contacting the Directory Server
Authenticating to the Directory Server
Creating Kerberos directory
Creating KDC Config File
Creating Kerberos Database
Creating new random master key
Creating Kerberos Admin user
Creating ACL file
Adding kerberos auth authority to admin user
Starting kdc & kadmind
Adding the new KDC into the KerberosClient config record
Finished
2011-07-28 19:58:18 +0000 command: /usr/sbin/kdcsetup -e
2011-07-28 19:58:18 +0000 command: /usr/sbin/sso_util configure -x -r SERVER.FREEMAN.PRIVATE -f /LDAPv3/ldapi://%2Fvar%2Frun%2Fldapi -a diradmin -p **** -v 1 all
2011-07-28 19:58:19 +0000 command: /usr/sbin/mkpassdb -kerberize
2011-07-28 19:58:19 +0000 Updating user records and principals
2011-07-28 19:58:34 +0000 Asking OpenDirectoryConfig to bind to server: 127.0.0.1
2011-07-28 19:58:38 +0000 Attempting to open /LDAPv3/127.0.0.1 node
2011-07-28 19:58:38 +0000 Verified /LDAPv3/127.0.0.1 node is available
2011-07-28 19:58:40 +0000 command: /usr/sbin/sso_util info -r /LDAPv3/127.0.0.1 -p
2011-07-28 19:58:40 +0000 Creating Root CA
2011-07-28 19:58:41 +0000 ***Error creating domain CA. Error - The specified item already exists in the keychain.
2011-07-28 19:58:41 +0000 Root CA creation failed with error - -25299
2011-07-28 19:58:41 +0000 Destroying OD master as CA creation failed with error 75
2011-07-28 19:58:41 +0000 Logging slapd container data to /var/run/slapconfig_error_1311883121
2011-07-28 19:58:41 +0000 Stopping LDAP server (slapd)
2011-07-28 19:58:44 +0000 command: /usr/sbin/slapcat -l /var/run/slapconfig_error_1311883121/user.ldif
2011-07-28 19:58:44 +0000 command: /usr/sbin/slapcat -b cn=authdata -l /var/run/slapconfig_error_1311883121/authdata.ldif
2011-07-28 19:58:45 +0000 Error retrieving kerberos realm
2011-07-28 19:58:45 +0000 CopyReplicaArray: ldap_search_ext_s failed
2011-07-28 19:58:45 +0000 Error retrieving replica array
2011-07-28 19:58:45 +0000 command: /bin/launchctl unload -w /System/Library/LaunchDaemons/com.apple.opendirectorybackup.plist
2011-07-28 19:58:45 +0000 Deleting Cert Authority related data
2011-07-28 19:58:45 +0000 No intCAIdentity, not removing int CA from keychain
2011-07-28 19:58:45 +0000 command: /bin/launchctl unload -w /System/Library/LaunchDaemons/com.apple.xscertd.plist
2011-07-28 19:58:45 +0000 command: /bin/launchctl unload -w /System/Library/LaunchDaemons/com.apple.xscertd-helper.plist
2011-07-28 19:58:45 +0000 command: /bin/launchctl unload -w /System/Library/LaunchDaemons/com.apple.xscertadmin.plist
2011-07-28 19:58:45 +0000 _destroyLDAPServer: Failed to find computer record named server.freeman.private$: 2100 Connection failed to the directory server.
2011-07-28 19:58:45 +0000 Updating ldapreplicas on primary master
2011-07-28 19:58:45 +0000 Unable to locate primary master
2011-07-28 19:58:45 +0000 Primary master node is nil!
2011-07-28 19:58:45 +0000 Unable to locate ldapreplicas record: 0 (null)
2011-07-28 19:58:45 +0000 Error setting read ldap replicas array: 0 (null)
2011-07-28 19:58:45 +0000 Error setting write ldap replicas array: 0 (null)
2011-07-28 19:58:45 +0000 Could not retrieve xmlplist from ldapreplicas: 0 (null)
2011-07-28 19:58:45 +0000 Error synchronizing ldapreplicas: 0 (null)
2011-07-28 19:58:45 +0000 Removing self from the database
2011-07-28 19:58:45 +0000 Warning: An error occurred while re-enabling GSSAPI.
2011-07-28 19:58:45 +0000 Stopping LDAP server (slapd)
2011-07-28 19:58:46 +0000 cleanKeytab: unable to retrieve default realm -
Lion Server Install Failure/Incomplete
Hi,
I just purchased and tried to install Lion Server. After a few hours of being stuck at "Configuring System", and the progress bar being "stuck" for over 45 minutes, it just crashed. Now launching the app just brings the server menu but none of the services can be accessed (almost all menu entries are grayed out).
So I can't re-install (because it thinks it's already installed) and the install is incomplete and thus wont work! This is very annoying.
Apple, I love you guys but for those of us who are playing with server, don't give us the one button for dummies UI. Maybe some of us are techs who aren't afraid of the command line or "advanced" menus (an option like --force-reinstall would be nice right now!!!).
Any suggestions???
Thanks,
PS: What's with the install UI window with a cropped progress bar and icons? The window can't be resized nor scrolled ???Since Lion Server is essentially an app, you can throw it in the trash and re-download it. I believe that what that application does is give you front-end access to tools that are already on your system, and adds a few command-line tools such as slapconfig.
I would try this: trash the application, you can even try using something like AppCleaner, which finds associated plists. Then, go to /Library/Receipts. There is a plist in there that contains the install history. find and remove any entries associated with install. Don't worry if you accidentally delete something that isn't associated, as it is ust a receipt list, but it is alway a good idea to make a backup of the original, just in case.
Once you do that, reboot the machine into single user mode and run "fsck -fy" from the command line. once that completes, reboot and run repair permissions from disk utility. Finally, re-download the app from the App Store and re run the installer. You might need to hold down the option key to re-download, but either way, it should come back down and run again.
If none of that work, I would go with the backup, wipe, and install suggestiosn from above. Grab youself an extneral hard drive (a good investment anyway), clone the machine with Carbon Copy Cloner, and then wipe and re-install. -
I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root: myname
admin: myname
sysadmin: myname
certadmin: myname
webmaster: myname
my_alternate: myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
AuthType Digest
AuthName "EyeTV"
AuthUserFile /Users/uname/.htdigest
AuthGroupFile /dev/null
Require user uname
Options Indexes MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080 # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost # Default is localhost
REMOTEPORT_DEFAULT=3128 # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
-p) shift; # -p option
SSHPORT=$1;
shift;;
*) TUNNEL_DETAILS=$1; # 1st argument option
shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])} # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*} # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR#:} # delete :
if [ "$CAR" != "" ] # leading or trailing port specified
then
REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@} # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR} # cut this string from TUNNEL_DETAILS
CAR=${CAR%@} # delete @
if [ "$CAR" != "" ] # leading or trailing port specified
then
USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ] # no hostname given
then
HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
&& echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
|| echo "SSH tunnel FAIL." -
How do I best share an iPhoto library to several users on a Lion Server?
I am considering setting up a Lion Server to use for our family of five. The one thing I struggle to understand from searching for information here, and throughout the Internet is: Can I set up a Lion server to have shared libraries for iTunes and iPhoto, and what is the best way to set it up? I would also like to understand if such a shared setup would create any issues with reduced functionality and/or performance?
Today we share libraries across several accounts on one computer, and that works mostly fine, although with some restrictions (only one account can have iPhoto open at a time, which is not much of an issue if on same computer; iTunes can share music but not Apps, ...)I followed Apple's support team's instruction to create iPhoto on the new external hard drive (My Passport) - and then drag and drop the existing iPhoto library onto it from the Master file.
Don't know who told you that but it would be difficult to be more wrong.
Make sure the drive is formatted Mac OS Extended (Journaled)
1. Quit iPhoto
2. Copy the iPhoto Library from your Pictures Folder to the External Disk.
3. Hold down the option (or alt) key while launching iPhoto. From the resulting menu select 'Choose Library' and navigate to the new location. From that point on this will be the default location of your library.
4. Test the library and when you're sure all is well, trash the one on your internal HD to free up space.
Regards
TD -
Using Mountain Lion Server so my family can have separate logins and connect via Screen Share.
Works great, each has their own home directory and permissions are perfect.
Now setting up iTunes for each with their own Library (not shared), thus keeping multiple Libraries.
I get this;
This Computer is already associated with an Apple ID.
If you download past purchases with your Apple ID, you
cannot auto-download past purchases with a different
Apple ID for 90 days.
What!
So what it is on the same computer, they are completely separate Libraries never to be mixed.
If this works, I only need to keep one computer up and running, instead of three.
Each can do their syncing/backup and connect to the various Airplay/AppleTVs I have around the house.
How do I fix this.
ThanksBottom line is you can't - easily.
You need to make sure that you log out of the server each time otherwise the ID is running. To explain, if you had a laptop with different people using it, your solution works fine. Each time someone logs in, the iTunes ID is different so it works as you can only have one person using the laptop at any one time.
Now, turning your problem inside-out, you want people to be able to log into iTunes concurrently to use their own version of the program with their own library. This does not seem to work and you get the conflicted ID error message. Even though iTunes is running under their own login ident, I have never been able to get this working reliably and was told that iTunes is NOT a network-aware application as it is designed to be single user.
The way I got around this was to login as XYZ and to make sure that the ID was changed in iTunes accordingly. However, it did not always work so I gave up with the whole thing. -
Photoshop CS6 can't save to server after upgrading to Mac OS Yosemite Server from Mac Lion Server
We recently upgraded our server from a Mac Pro 2008 with OS X Lion Server to a Mac Mini 2014 with LaCie 20TB 5Big Thunderbolt 2 RAID drive. Everything is working fine with the exception of Photoshop. It does it intermittently but once it happens it will continue to do so. We get message like "Can't save to disk because of disk error" and "Can't save file because of program error" . Sometime we are able to do a "save as" and save over it. Most of the time we have to "save as" with a different file name and then rename and recopy the file. We have check permission on all the file as well as the server HD has ignore ownership checked. Again only three things changed. 1) Sever hardware change from Mac Pro to Mac Mini. 2) Server software upgraded from 10.7 Lion to 10.10 Yosemite(both have the latest update). 3) Drive when from internal on Mac Pro to External Thunderbolt 2 LaCie drive. We have no problem with Illustrator or Indesign. Only Photoshop. Anyone with any suggestion is greatly appreciated.
Unfortunately you seem to be using Photoshop in a way that Adobe discourages, so you may not be getting a lot of helpful advice.
Networks, removable media | Photoshop | CS4 and later -
How do I add a wildcard domain to Additional Domains in Websites on Mac OS Mountain Lion Server?
I could do this in Lion Server, but I can't in Mountain Lion (when I try to type * it doesn't type anything). Is there a file I can change with emacs to get this working? I've added the wildcard domain to /var/named/db.mydomain.TLD (see the wildcard domain section) but I need it in the web server as well for this to work.
I found the answer here:
/Library/Server/Web/Config/apache2/sites/0000_any_<port>_example.com.conf
And just before </VirtualHost> put the line:
ServerAlias *.example.com -
How do I get my airport extreme to show up under hardware in my Lion server app.
My airport extreme is not showing up in Hardware in my lion server app. How do i configure the settings on my airport extreme to work with the lion server app?
Hi there, it's pretty easy, see this link & check back if you have any problems...
http://email.about.com/od/macosxmailtips/qt/et_gmailosxmail.htm -
Unable to add/remove users in Mountain Lion Server (Options are greyed out)
For some reason, im unable to add/remove users in Mountain Lion server. The + and - are greyed out. It seems like something is wrong with the permissons because it looks like it cant write the the Ldav3 file (although that may be speculation). Does anyone have any advice for me? I URGENTLY need to add users.
Maybe theres a way to restore default permssions for the boot drive (if that in fact is the issue). Hopefully there is a way that I can fix this while leaving all users, groups, their permissions and shares intact.Anything interesting and relevent in the server logs?
Anything interesting in the server alerts?
Since it's far and away the most common cause of problems with OS X Server and with distributed authentication (Open Directory is entirely based on network encryption and digital certificates and on responses from your local DNS server(s)), verify your local DNS configuration is working and requires no changes with the following Terminal.app (Applications > Utilities) harmless, diagnostic command:
sudo changeip -checkhostname
sudo requires an administrative password. You might get a one-time warning about the sudo, and that can safely be ignored. The command will display some details, and indicate whether the local configuration appears valid and no changes are required, or further diagnostics for (most) common errors that can arise. -
Running Lion Server on a FCP Machine?
Is it a sin to run Mac OS X Lion Server on a machine I purchased to do video editing with? If you don't want to address the normative question, can you tell me how much RAM it takes to run Lion Server? I have 16 GBs, purchased for motion graphics. I don't do a lot of motion graphics, but it's good to have the RAM and the processing power all together when you need it.
Thanks for your input!>I assumed that Prem Pro and After Effects will run both 32 and 64 bit OS.
No, 64bit only... see below
Adobe's MINimums http://www.adobe.com/products/premiere/tech-specs.html
-Programs won't display if they will not install on your computer
-http://helpx.adobe.com/creative-cloud/kb/all-apps-displayed-aam.html -
I am trying to allow guests on windows to connect to shares on my Lion server but it keeps asking for a password for guest. I have allow guest users to access this share enabled but it still does not work.
Ditto. Guest accounts shouldn't have a password. No way to enter one in System Prefs...
-
regarding mountain lion server: clients experience intermittent service connections. the server system log has the following error- Client handshake failed (6):113: Server not accepting client connections. any suggestions would be greatly appreciated - thank you
Hi Jason
I was getting the same behavior after Apple support had me delete some plist files to get Airplay going. I was also getting the following error:
the error occurred while processing a command of type 'writesettings' in the plug-in 'server vpn'
I went into ~/Library/Preferences/ and /Library/Preferences/ and deleted every plist contating the word server. I had to re-set up my server (meaning walk through some intial steps) but all of my settings were still there after that and everything started working again.
Just a thought, obviously try at your own risk but it worked for me.
Kellen
Maybe you are looking for
-
Edits (especially contrast changes) not saving in iPhoto 08- any solutions?
A major hassle for me is the fact that (at least on my machines) changes to contrast while editing are not shown in the thumbnail or "browse" when completing the edit with "Done" or an arrow. Changes to exposure, temperature etc ARE saved and visible
-
How to stay Signed In in ASC forums?
With our first Apple -- a MacBook Pro with Mountain Lion -- these forums have been helpful on a few confusing issues. But each time I get an email that someone has replied to one of my ASC discussion threads, and I click on the link in the email, I h
-
IPad music library inconsistent with iTunes Library
I recently sync my iPad mini 3 with my iTunes library, I noticed the music is not consistent with my iTunes library I checked by Artist, and for example, when I checked Aerosmith, in my ipad the "Pump" album is not displaying under artist, is showing
-
I do not have a home computer. How do I use Firefox on my iPhone ?
The only computer I have is my iPhone.
-
Photoshop CS5 Freeze with Type Tool
I know I've read others posting this same issue... I'm just wondering what the common denominator is here... Anyone who is having the same issue, are you using Suitcase Fusion to manage your fonts? or is that not a factor? Are there others of you who