OSX Server - Advanced FTP users policies

Hi, I need to ask a pretty simple thing, that for servers should be quite straight forward.
On OSX Server (ver.2.2.2) I can't find any advanced ftp management console. What I mean is that i have let's say three users:
User "A": Administrator
User "B": Project Manager 1
User "C": Project Manager 2
User "D": End User
Folder 1, Folder 2, Folder 3 and Folder 4
User A should see and manage all of them (read+write)
User B should see and manage F1 ("F" stands for folder) and F2 (let's say he's in charge of those two projects)
User C should manage F3 and F4 (but no access to F1 and F2)
User D should only read F4.
I thought this was a reasonably obvious thing to have in the app, although I couldn't find any of these things. Maybe that's just me, but seriously I was thinking as this was an obvious feature for an app called "Server" that has FTP-server features.
Is there any way I can do that?

I thought the exact same thing but apparently not. I ended up having to install PureFTP to get this type of management. I was dissapointed in Apple on this as I was hoping for a GUI. You CAN do this through the command prompt if I'm not mistaken, but just need to google it.

Similar Messages

OSX server open directory users and logic

Hi guys,
Can anyone shed light on this issue, I can't be the 1st person to encounter it. We have a lab with 10 emacs, plus a OSX Xserve, which is set up as a Open Directory Master, the students log in to the workstations through the xserve.
When they try and run logic, we get a load of permission errors, I have tried changing the ownership and permissions to read write everyone, but it doesn't help, has anyone got a fix for this problem

I am assuming you are not using network home directories here, purely using open directory for logging in right? Logic does not play well over a network, but using OSX server for managing users should NOT affect being able to run logic locally on a machine. If you are using network home directories for users then this WILL be a problem. For example, you will get permission errors when trying to record something.

OSX Server / Profilemanager - Duplicate User with Payloads

Hello,
we use the "open directory" on the OSX Mountain Lion Server to authenticate the users of our MDM-devices.
In the "profilemanager" we individually configure different payloads for every user manually.
The user accounts in the "open directory" are without any user folders (only services).
Is there a way to create a user template with default settings and payloads for every user, so that we can clone this user/settings and edit the individual payloads beyond?
Best Regards,
Stefan

You might try posting in the Mac OS X Server category - this is the Leopard Automator forum.

OSX Server profile losing access to CS2 filters

Hi all,
I'm managing a Mac Lab at a high school. Yesterday two students lost access to PS CS2 profiles... only a few were available to them, not the whole standard set.
I fixed it by creating new profiles for the students. I got a call today from the instructor to learn that two more students have lost access to their filter set.
Trashing the PS preferences did not solve the problem. Does anyone know why this would happen. The fix appears to be creating a new profile within OSX Server Workgroup manager... but I need to track down why this is happening seeing as how it looks to be spreading through the directory of students.
Thanks for any help you can provide.
Alan

Hi Ramon,
Sorry it took so long to get back to you. The e-mail notification that you posted went into my Junk email folder...
We are using roaming profiles in OSX Server. The user logs onto their iMac and the Server loads their working environment onto the computer.
The filter set I'm talking about is the stock filters that come with PS CS2. The students who are having problems only have access (or are allowed to use) a few of those stock filters.
I'm sure that something is corrupting the student's preferences within PS... but trashing the preferences doesn't fix the issue. Only when I create a whole new student profile within OSX Server does it get fixed. But it is happening to more students, so I am trying to get a handle on why/how it is happening.
Thanks for your reply.
Cheers,
Alan

Home directory osx server

I planning on using osx server to manage users accounts. Once I setup the user accounts on the server I will have to move the data in the local accounts to another home folder on the local Mac that has the same user name as the one on the server. What is the best way to move user data on a Mac between user accounts? On OSX Server I am going to have the users account home folder point to the local home folder on the Mac.
Any thoughts on the best way to go about having a Managed user account on a sever and have the data storage be on a local Mac.

Sounds like you're talking about a Mobile user account, where the home directory is stored on a server, but synced automatically to the client machine.
http://docs.info.apple.com/article.html?path=ServerAdmin/10.4/en/c2um.html

Trying to limit a user on OSX Server to one directory for FTP

Hey there everybody,
I'm trying to set up a client FTP for a new mac mini running OSX Server (Mavericks). FTP is enabled and I am able to get and put files but, the server is going to be used for a client services company and we will need to use it to transfer files back and forth without allowing access to the whole machine. The core issue is when I FTP in as a user I can still move around and see folders and files. I would like to create a user that can only see one folder or directory and only get / put files to that one place. Can't seem to find any similar posts, though I would assume this is fairly common.
Huge thanks in advance!

Hello again,
I have tried sending messages from my webmail account in another domain and get the following reply:
This is the Postfix program at host www.patrickwgill.com.
I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.
For further assistance, please send mail to <postmaster>
If you do so, please include this problem report. You can
delete your own text from the message returned below.
The Postfix program
<[email protected]>: Command time limit exceeded:
"/usr/bin/cyrus/bin/deliver"
Reporting-MTA: dns; www.patrickwgill.com
Arrival-Date: Sun, 8 Jan 2006 14:05:25 -0500 (EST)
Final-Recipient: rfc822; [email protected]
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; Command time limit exceeded:
"/usr/bin/cyrus/bin/deliver"
So, it appears to be just hanging for some reason and timing out. Any ideas? I really appreciate your help.

OsX server ftp-server

HI,
I am struggling with the setup of the ftp-server under osX server (10.4.10)
Think I managed to get what I wanted pretty much by trial&error, however one thing is nagging me.
I disabled all sharepoints for FTP use, bot anonymous and registered, however when a user logs on, either registered or anonymous, he still sees aliasses (folder with the little arrow in the bottom-left corner of the icon) of all my shaprepoints.
I have tried to trash them, and restart the ftp server , however no joy
Is it possible to limit the view an ftp user get to those folders that have ftp access
Thanks
Pim

I thought the exact same thing but apparently not. I ended up having to install PureFTP to get this type of management. I was dissapointed in Apple on this as I was hoping for a GUI. You CAN do this through the command prompt if I'm not mistaken, but just need to google it.

FTP Access on OSX Server via a browser

I have a number of ftp clients set up which can succesfully upload/download files using ftp client software (Fetch/Easy FTP).
I have a windows user who wants to upload his stuff via ftp in his web browser (IE presumably).
Not had any success (Guest access is disabled) with his account settings in browser though I can get in using same settings in ftp client.
Is this possible with the built in ftp element of OSX Server without having to install something like Rumpus?

IE is the only browser I know of that supports FTP upload via the web browser window. Most Mac browsers that I'm aware of simply pass the FTP connection off to the Finder to deal with.
The Finder, of course, doesn't support FTP upload.
So unless your clients are comfortable working in the command line, you're going to need some additional software. That software could be as simple as an AppleScript application that performs the upload, but you're going to need something.

Is it possible to share an aperture library with different users using osx server.

is it possible to share an aperture library with different users using osx server.

Not really. You should not be sharing an Aperture library over a network. It's not designed for that and you'll likely corrupt your library at some point.

Is there a way to have a wiki on osx server where users can be created at first logon? (for a semi-public wiki)

Hello,
I am installing an osx server that will be primarly used as a wiki for collaboration.
Problem: there will be many users from various organisations -> creating users manually on the server is not an option.
Is there a way to have a page/something where users will login and the account will be created at first logon? (after being approved if possible).
I'd want my users to go to the wiki and do something like click a "new user" or "create account" button then fill a form. The account in th directory would be then auto magically created.
Does this feature already exist for osx server with the built-in wiki?

Just generate the TTS on a separate slide and then assign the audio file created in the LIbrary to whatever object you need.

How can local user send message to other user via OSX server in mac maverick

I just install OS X server in mac mavericks and enable services such as message, DNS, VPN, etc. I also create local users and local network users. I add some local users from OSX server to Message app in order to message to server, but I cannot send any message to those user, even Bonjour is available but I cannot use it to send message in local network.
I already followed all Server Help in Messages like in this image:
I try to access to my local OS X server via IP address by using other PC, Mac and iPhone and I can get this interface:
I already try in iPhone to send message to local user in OS X server after accessing to OS X server via IP Address, but I don't know how local user can get that message and I see nothing in message_archives of message data of server. Therefore, how each user in OSX server can message to each other across OSX server ? Does Admin have to write some codes or make configuration for providing message services to those users ?
Message was edited by: chhanmalin

Client users need to use XMPP client app to log in to server with account name like in server , then user can send message to other users in server. Client users can use iphone, pc, or mac.

Osx server lost users

OSX 10.7 Server edition lost users. Only the one local account is showing in server.app. I read every forum I could find about the topic, nothing helped:
- Completely reconfiguring and testing DNS settings, with the help of Hoffman labs tutorial.
- Open directory changing to standalone server, and back to Open Directory Master (with restoring backup of OD data)
I ended up with a 'bricked' mac mini: After power on, I see the apple logo with the rolling gear, and that's it. I restored from a previous time machine backup, resulting in the initial problem: all users lost.
I'm really stuck with this one. Please help!

I did do a disk verify, was ok.
No s.m.a.r.t errors
Meanwhile, I accidentally found the issue:
I did the dns check with another machine: a client, which turned out to be fine. But on the server account itself the DNS setting in network preferences pointed to googles dns servers before pointing to its own ip address. That was the issue resulting in a disappeared userlist (only after restarting: clearly, my server has never restarted in some months). It is then also impossible to re-setup the open directory master.
Thanks for the answer.

New OSX Server Installation - User Home Folders Dissapear after on logout

hi all,
Can anyone help me identify this problem that i`m getting with a new fresh install and setup of OSX-server 10.4.10? Basically i have setup the server but when users are logging out of their binded 10.4.10 macs their home folders are dissapearing off of the server. If anyone needs anymore detailed information on the configuration please let me know
thanks,

Hi
You will see the 99 folder on the Server. It will be in the folder designated for Home Folder creation and automounting. It gets created if there are no home folders.
Is this the only server on the network?
What happens if you create a new user and home folder, one whose log in name and password does not exist anywhere else and is also not the clients local admin account. On the client click other and log in with that account. On logout does this users home folder disappear off the server?
Tony

How we set up multiple websites on OSX Server

BACKGROUND
After fiddling and futzing around for weeks (actually since last year) I've finally figured out how to set up multiple websites (virtual sites) using one port and one IP address. While there seems to be lots of discussion on this topic, it seems that the basic assumption is that one knows everything about websites, DNS and all that stuff, which I do not.
When our network was originally established the engineer set up a wiki and also configured webmail, so we had two sites, one secured for mail and the other open for Calendar and the wiki. We were not hosting any websites locally because our school website is hosted by a company in New England.
This year I wanted to set up websites for teachers and students. As great as the wiki is, there are some things it just can't do as well as a website. So I figured if I set up the sites teachers could link back and forth from one to the other. In addition kids could now start to use a real website instead of the cobbled together file mess I had when we ran a Windows network. Also iWeb is a much more accessible tool than FrontPage.
SERVER SIDE:
Snow Leopard Server - 10.6.4
There are two - actually three pieces if you want your iWeb clients to connect to the server: Server Side Web Services, DNS and, in my case, FTP.
================================================ SERVER SIDE - WEB SERVICES
If you haven't turned on Web services, you'll need to open Server Admin and do that. If you don't know how to set up web services - just reply and I'll step you through that as well.
Once web services are set up and turned on, you'll see it listed under your server’s name in the Server Admin sidebar. Click on "Web" and then click on the "Sites" tab at the top of page. This is where you list all your sites.
Click the plus button and enter the fully qualified name of your site, for example: "students.myschool.org". Don't use the defaults here (no name) - that's what got me in trouble before. BE SPECIFIC!
You'll be looking at the "General" tab (the other tabs, "Options", "Realms", etc. we'll deal with in a second).
On the "General Tab", the default IP address ("any") and port (80) is just fine. We'll run everything over port 80. (Apache figures all the virtual site stuff out - you don't need your rocket science degree for that.)
"Web Folder:" is important because this is how you'll "segment" your websites. While I would NEVER do this again, we have a solid state hard drive for the OS and a RAID array for our data files. IF you have that, make sure you do NOT use the default "Web Folder" because it will store all your files on your solid state drive. There may not be enough room, over time, on that drive. I've not experienced it yet, but it's my understanding that if the drive fills up, the server shuts down.
I store my web sites on a folder on the RAID array.
Everything else on that tab can be left as the default. (Just make sure that you have an "index.html" or "index.php" file in your web folder root, but iWeb will take care of that for you.)
I would put in your email address in the "Administrator Email:" field.
Under "Options" you really don't have to put anything. I've tested making websites with iWeb and it doesn't appear that anything needs to be checked.
Nothing needs to be entered in "Realms" as well from what I see working w/ iWeb.
The defaults in "Logging" are fine.
You can leave "Security" alone, but we do have a (self-issued) certificate listed for our webmail site.
"Aliases" is important. Under "Web Server Aliases" you enter how you want the site to respond to when users type in a URL in their web browsers.
When our web server was initially set up the engineer set up "wiki.myschool.org" on port 80 and "mail.myschool.org" on port 443. In the aliases section was nothing but a "*" (the wildcard character). That means, from what I can figure out, that the webserver will respond to these sites regardless of what is typed in the URL. (Well, something like that - point is, if you create OTHER websites, you'll NEVER get to them because the wildcard character in the "Aliases" section, in effect, grabs those web requests and redirects them to the sites that are already there.
In my case I deleted both of those wild card characters. For my "wiki.myschool.org" site, I entered "mail.myschool.org". That means if you type EITHER "wiki." or "mail.", go to the site that’s stored in the “Web Folder” we set up when those sites were created.
For "mail.myschool.org" I just DELETED the wildcard character. I wanted that site (since it was secured) only to respond to "mail." - nothing else. (You're not going to that secured site for any other reason than to get your mail.)
"Proxy" can be left blank. Have no idea what that does. As time permits I'll do some research and figure out what it's used for.
"Web Services" is if you want to provide any MORE services to this particular site. Most likely you'll want to uncheck all the boxes. For our "wiki." site, we have checked "Wikis", "Blogs", and "Calendar". For our "mail." site we have those checked PLUS "Mail".
I would create a separate "Web Folder" for each of your sites. I don't know if that's a requirement but for housekeeping purposes, I would keep the sites separated. And I SUSPECT that it's "best practice" to separate your wiki from your other websites.
SERVER SIDE - DNS
OK...now you have to make your site reachable and the only way to do that is to set up DNS so that folks don't need to type in the IP address of your web server. You need to set up DNS inside your network and, if you want folks in the outside world to reach your website, you'll need to set up an external DNS as well. I'm going to cover INTERNAL DNS - if you don't know how to set up EXTERNAL DNS - reply or email me and I'll post those instructions.
Most likely you have already created Zones for you network...all you really need to do is create "Aliases" so that when you type "students.myschool.org" your web browser will know that site resides on IP address XXX.XXX.XXX.XXX.
If you've set up Zones then you already have a "Machine" setting that translates your server’s name to an IP address and vice versa.
All you need to do is create an "Alias" (CNAME) record for, in this case, "students". You’ll see the choices for types of records when you click the "Add Record" button.
There are only two fields to configure for a record: "Alias Name" - in this case "students" and "Destination" - in this case "servername.myschool.org". (You've already entered a machine record that says "servername" = 192.168.1.x.)
That's it for Internal DNS.
SERVER SIDE - FTP
Now you have to get iWeb to communicate with the webserver.
There are only three ways iWeb will communicate with webservers: MobileMe, Local Folder and FTP Server.
Local Folder is really only practical if you want to host a website on a laptop (I was blown away initially when I found out that all Macs had a built-in web server - how neat is that?). I think there are some very cool things teachers could do with configuration, and, of course, you wouldn't need to set up any web services on the web server, but that's for another discussion. You need to set up FTP services on the web server.
Turn on and enable FTP on your webserver.
You can leave the defaults for "General", "Messages" and "Logging". "Advanced" is the only thing you want to set. I set "Authenticated Users See:" to "Home Folder Only". I set the "FTP Root" to the same root folder in which I plan to store my web sites (/VOLUMES/RAID Array/WebServer/Documents). This setting sets that folder only to be accessible via FTP.
I would suggest returning to your DNS settings and adding one more "Alias". Set "ftp." to point to your webserver. Why? So folks can edit their sites from home (see below).
CAVEAT: If you are running FTP on other servers, make sure that the settings here do not conflict with the settings on the other servers. For example, I'm running FTP on my file server so that my scanners can communicate with it. However, I configure my FTP settings by machine name and NOT "ftp.myschool.org".
================================================
CLIENT SIDE - CONFIGURING iWEB
Now you have to configure iWeb so that it will communicate with your server.
Click on the "Site" icon so that "Site Publishing Settings" appears.
Publishing:
"Publish to:" = "FTP Server"
You can set the "Site name:" and "Contact email:" to whatever you want. But see below!
FTP Server Settings:
"Server address"=ftp.myschool.org (you could also enter in servername.myschool.org or the IP address. However, if you want folks to be able to work on the site from home, you will need to configure external DNS for that. If you use the IP address, you're out of luck for remote access to the site. (You can do it but it's beyond the scope of this discussion.)
"Username" & "Password" should be your user's network login credentials.
"Directory/Path" - this is important. Remember, you set your "FTP Root" to be "/VOLUMES/RAID Array/WebServer/Documents". If you leave this field blank then the website will be dumped into this folder. If you are only setting up one site, that may be OK. However I wanted to set up a "students" site folder, a "faculty" site folder and a separate site for our literary magazine.
THEREFORE: I have, in my ..../Documents folder (on the server), a "students" folder, a "faculty" folder, and a "litmag" folder.
SO...in my "Directory/Path:" field, I have "/faculty". That means the full path to this website is "ftp root/faculty" or "/VOLUMES/RAID Array/WebServer/Documents/faculty" (You don't need a trailing "/" character. iWeb will automatically append the folder for you user depending on what you entered in "Site Name:" in the "Publishing" area.
Website URL:
This is the root website depending on whether it is "students" or "faculty". Since iWeb will append the site name to this root website, I accomplished what I hoped to accomplish in this post (http://discussions.apple.com/message.jspa?messageID=12288561#12288561).
Faculty sites will be @ http://faculty.myschool.org/username. Students @ http://students.myschool.org/username. PERFECT!
iWeb is such a GREAT tool - NOW the kids can start using it!
I want to reiterate that this works for our school but it should work for you as well. There may be better ways to do this but it works for us.
Hope this has been helpful and you won't have to spend weeks trying to figure this all out by yourself!

OK...here's how we did it.
To get access to the website you created from outside your network there are a couple of steps.
First, you have to have a STATIC IP address from your ISP. If you have a T1 circuit, no problem...you usually get a couple of static IPs you can use. However, if you have a cable modem circuit, most likely you have a dynamic IP address which changes when you connect to the internet. Usually a static IP will cost a bit more because the ISP has to go through a couple of steps to set it up for you. But once you have the address, you now have a way for folks outside your network to connect with you.
(I’m also assuming that you use a router of some sort through which traffic flows out to the internet and that you aren’t using connection sharing or something like that.)
The next thing you need to do is have your new static IP address associated with the server on which you are hosting your website. You've probably already done that if your website works inside your network. However, you've associated a private ip (192.168.x.x, etc.) to your web server. That doesn't mean anything to folks on the outside because private IP addresses are just that - private - folks can't access them. (I won't get into VPN because that's a whole other topic.)
The way you associate your new static IP address to your web server is through some sort of dns application from your ISP. For example, we use TierraNet to manage our external DNS information. They have a web interface control panel that is very similar to the DNS interface for XServer. You can create CNAME records (aliases - other ways that folks can access your servers).
Basically you create an "A" (CNAME) record with a fully qualified domain name (e.g. webserver.myschool.org) and point it to your public IP address (XXX.XXX.XXX.XXX) which you just got from your ISP. It's going to take a while (24-48 hours) for this change to take effect. BTW, you can create as many “A” records as you want. For example mail.myschool.com and wiki.myschool.com could point to the same place.
You want to make sure that the fully qualified domain name you enter in the external dns utility matches the name you used when you created your internal dns records on your XServer.
OK...so now folks can get to your domain - but, remember, you have a private network IP scheme between them and you. You now have to tell your router that when web traffic arrives, allow it inside the network and direct it to your web server.
Let's say your public IP address is 205.100.112.50 and your web server is 192.168.0.5.
You have to create, in your router’s "Security Zone" (router companies call them different things) a couple of rules. Usually the first rule is: "Let everything inside the network get out to the web." You've probably already done that if folks inside the network can reach the internet.
You then have to tell the router to allow web traffic (port 80) into your network AND redirect that traffic to 192.168.0.5.
We use AdTran routers and they have a web interface which allows you to write "rules" affecting public and private traffic. Public is folks outside the network, private is folks inside.
AdTran calls them "Security Zones" and you modify those zones with policies.
So my "Policy" would say, in the above example, redirect traffic from my public IP (205.100.112.50) -> to my web server -> (192.168.0.5).
THEN you have to modify this policy with what AdTran calls "Traffic Selectors". You've said, OK, you can get in, but WHAT can get in?
The "Traffic Selector" is written to say: "Permit" "TCP" traffic from 205.100.112.50 only through Port 80. (That's the port that web traffic goes over. If you wanted a secure website, you'd add another traffic selector that opens port 443, for example.)
I'll tell you I'm no genius when it comes to this. I called AdTran and had them configure my router for me. I told them what I wanted done, they remoted into the router and configured it. But then I could go to the web interface and see what they did and then added rules later on when I wanted, for example, to get access to the network via Apple Remote Desktop or VPN into the network on my iPad.
I'd bet that your router has a maintenance agreement that includes this service and if it doesn't it should have.
I did find that I still had issues when I tried to set this up originally and it had to do with the ORDER of the policies. I can’t remember exactly what the issue was, but, effectively one of the policies highjacked traffic before the policy that I wanted got triggered. Simply moving them around in the list fixed that issue. So if you have this set up but still can’t access the site, check the order of your rules.
I don’t know if that helps or not, but I try to think about this stuff conceptually and then get someone to help me with the details. I work with this stuff so infrequently that I forgot how I did something 6 months or a year ago. I’m in the process of creating a wiki for the school which documents all this stuff, but that’s a major undertaking.
Cheers,
John

Apache virtual host with OSX Server?

I have been running OSX Server for a while now, and just recently I decided to get McMyAdmin for my Minecraft server. The web client for McMyAdmin runs on port 8080, but I wanted it on port 80. I wanted to use it with my domain, so I just created a sub domain and pointed it to my server. The problem is that OSX Server apparently doesn't let me use port 80, even when websites are turned off. I decided to delete Server and just use plain apache. This worked until I realized that my website was only accessible locally. I have all the correct ports forwarded, etc. But I get the error:
Response Error.
Technical description:
502 Bad Gateway - Response Error, a bad response was received from another proxy server or the destination origin server.
when I try to connect from outside my network. This is probably just some simple thing I missed but it would be nice if someone could just point out what I did wrong here. Back to the point, I want to know how to run the proxy to my web client on port 8080 AND ALSO run OSX Server with or without apache virtualhost.
Thanks in advance,
Eamon

Web is stupidly easy - Apache has extensive support for multiple virtual hosts in a single server and will happily support as many domains/hostnames as you can throw at it.
Mail is a little trickier since it needs to hook into some kind of directory server to validate user addresses.
Mac OS X's Open Directory does support this, but it's a little cumbersome (basically every user has to exist in the main Open Directory domain as well as having a secondary email address(es) in the other domain(s).
This can get especially tricky when you have users with the same shortname in different domains - for example if you give [email protected] a secondary email address of [email protected] and you then get a new user [email protected], you can't give the third 'joe' the address 'joe' in Open Directory since that's already taken. This means he'll have to login using different credentials from his email address. Confused yet? You bet.
If you're prepared to eschew Open Directory you can just use Postfix's built-in support for virtual hosting, but it's a little more complex to setup and support and is entirely command-line based (i.e. there's no GUI for setting it up or supporting it).
So, for that reason you might be prepared to setup multiple virtual machines for each domain. It really depends on how much the domains are related (if at all).

OSX Server - Advanced FTP users policies

Similar Messages

Maybe you are looking for