OSX Server / Profilemanager - Duplicate User with Payloads

Hello,
we use the "open directory" on the OSX Mountain Lion Server to authenticate the users of our MDM-devices.
In the "profilemanager" we individually configure different payloads for every user manually.
The user accounts in the "open directory" are without any user folders (only services).
Is there a way to create a user template with default settings and payloads for every user, so that we can clone this user/settings and edit the individual payloads beyond?
Best Regards,
Stefan

You might try posting in the Mac OS X Server category - this is the Leopard Automator forum.

Similar Messages

OSX server open directory users and logic

Hi guys,
Can anyone shed light on this issue, I can't be the 1st person to encounter it. We have a lab with 10 emacs, plus a OSX Xserve, which is set up as a Open Directory Master, the students log in to the workstations through the xserve.
When they try and run logic, we get a load of permission errors, I have tried changing the ownership and permissions to read write everyone, but it doesn't help, has anyone got a fix for this problem

I am assuming you are not using network home directories here, purely using open directory for logging in right? Logic does not play well over a network, but using OSX server for managing users should NOT affect being able to run logic locally on a machine. If you are using network home directories for users then this WILL be a problem. For example, you will get permission errors when trying to record something.

OSX Server - Advanced FTP users policies

Hi, I need to ask a pretty simple thing, that for servers should be quite straight forward.
On OSX Server (ver.2.2.2) I can't find any advanced ftp management console. What I mean is that i have let's say three users:
User "A": Administrator
User "B": Project Manager 1
User "C": Project Manager 2
User "D": End User
Folder 1, Folder 2, Folder 3 and Folder 4
User A should see and manage all of them (read+write)
User B should see and manage F1 ("F" stands for folder) and F2 (let's say he's in charge of those two projects)
User C should manage F3 and F4 (but no access to F1 and F2)
User D should only read F4.
I thought this was a reasonably obvious thing to have in the app, although I couldn't find any of these things. Maybe that's just me, but seriously I was thinking as this was an obvious feature for an app called "Server" that has FTP-server features.
Is there any way I can do that?

I thought the exact same thing but apparently not. I ended up having to install PureFTP to get this type of management. I was dissapointed in Apple on this as I was hoping for a GUI. You CAN do this through the command prompt if I'm not mistaken, but just need to google it.

Help with OSX server mail setup

Please if anyone can tell me what I am doing wrong, I would be very grateful. I have a company with an externaly hosted website and an an internally hosted email (OSX server). I have everything kind of working, but some things don't seem quite right. I'll explain below:
I have a purchased domain: mycompany.com hosted by godaddy.
I am using Godaddy name servers: ns65.domaincontrol.com and ns66.domaincontrol.com
The external godaddy DNS has an a name entry for my mail server: mail pointing to 123.123.123.123 (which is my companies external static IP address).
There is also a null (@) a name record for my website hosting service (squarespace) pointing to 456.456.456.456
There is a cName record www pointing to the squarespace domain "www.squarespace6.com" (know this is unusual, but it is how squarespace asks this to be set up and does not work otherwise)
There is an MX record with priority 10 and host name @ pointing to mail.mycompany.com
I have a airport extreme router with the appropriate ports forwarded to the OSX server.
The DNS servers on the router are pointed to the internal IP address of the OSX server
I did not change the domain name on the router (mistake?) it is currently san.rr.com
On the OSX server I have set up host name to be mycompany.comDNS is set up with primary zone being mycompany.com
Primary Zone entries include
nameserver = mycompany.com
machine record host name is mycompany.com and the IP address is the internal IP address of the OSX server
another machine record with host name "mail" and IP address is the internal IP address of the OSX server.
Finally, there is a mail exchanger record with mail server "mail.mycompany.com" and priority 10
There are 2 entries autocreated in the Reverse zone
Mail is setup and running on the OSX server providing mail for "mail.mycompany.com"
Users are setup with email address: [email protected] (note: without the mail subdomain - I think this is OK?)
I am using self signed certificate.
In my clients (windows Thunderbird, Mac Mail, iOS mail), the settings are for the incoming mail server host name to be "mail.mycompany.com" and the outgoing also to be "mail.mycompany.com"
I woud have expected this to be imap.mycompany.com and smtp.mycompany.com respectively, but it doesn't work when I input these values and works with the former. Have I set this up wrong?? imap seems to require SSL on port 993 and SMTP seems to require TLS on port 587.Outlook on PC gives me an error that after googling appears to be a problem with not recognizing a fuly qualified hostname form the SMTP client. I see the fix, but wanted to know if that meant that my server didn't have a fully qualified host name and whether I should change that rather than just remove that restriction???
The final problem is that my outgoing emails seem to be getting caught up in other people's spam filters too frequently. What is the main reason for this? Is it because I have set something up wrong and it brings up flags or is it simply because I am not a huge hosting company, or somethign else althogether?
If you've gotten this far, big thanks! If you can help me, even more thanks!

Well, actually they are both getting caught up in spam filters and bounced back. I actually realized that part of the problem is that I have a dynamic IP address, but it doesn't change. Regardless, on the bounce back it looks like hotmail and other domains are rejecting email from my IP and recognize it as dynamic. This was a test server that i would by physically taking to my business where there is a static business IP address (Cox).
Sorry for the very long original message, but it seems that most people don't post enough information for the problem to be solved in their original posts and I was hoping to provide as much detail as possible.
The other is the question of "are things set up right?" It seems strange to me that both my outgoing and incoming servers are "mail.mycompany.com" and not imap.mycompany.com and smtp.mycompany.com and I wonder if this is going to cause me to have problems?
Is it a problem that my email addresses are [email protected] and not [email protected]?
Was I supposed to change the domain name on the router?
Also is it going to be a problem that I am using a self signed certificate?

OSX Server profile losing access to CS2 filters

Hi all,
I'm managing a Mac Lab at a high school. Yesterday two students lost access to PS CS2 profiles... only a few were available to them, not the whole standard set.
I fixed it by creating new profiles for the students. I got a call today from the instructor to learn that two more students have lost access to their filter set.
Trashing the PS preferences did not solve the problem. Does anyone know why this would happen. The fix appears to be creating a new profile within OSX Server Workgroup manager... but I need to track down why this is happening seeing as how it looks to be spreading through the directory of students.
Thanks for any help you can provide.
Alan

Hi Ramon,
Sorry it took so long to get back to you. The e-mail notification that you posted went into my Junk email folder...
We are using roaming profiles in OSX Server. The user logs onto their iMac and the Server loads their working environment onto the computer.
The filter set I'm talking about is the stock filters that come with PS CS2. The students who are having problems only have access (or are allowed to use) a few of those stock filters.
I'm sure that something is corrupting the student's preferences within PS... but trashing the preferences doesn't fix the issue. Only when I create a whole new student profile within OSX Server does it get fixed. But it is happening to more students, so I am trying to get a handle on why/how it is happening.
Thanks for your reply.
Cheers,
Alan

Mac Mini OSX Server Version and installation

I am very interested in the New Mac Mini with OSX server configuration.
But I would like to know what is the difference between the "Retail" OSX server version and the "Bundled" OSX server version which came with the Mac Mini ?
Can the "Bundled" server version be installed on another intel-based Mac ( in case of hardware failure in the Mac Mini ) ?

The difference is that this is server software, it is not the Mac OS X client software for day-to-day use on a Pro or Consumer Mac.
The bundled software according to the Mac mini Server specs page is on an Install/Restore DVD. These are usually machine specific so it will not be usable by directly placing it in the ODD of another Mac, it should spit the disc out as unusable. But there are ways to connect the Macs and install the software to another Mac. However, the End User Agreement licenses the software for installation on only one Mac at a time.
Dah•veed

Overwrite osX server for osX

Have a need to set up previously formatted mf mac g4 in osX server as workstation but cannot overwrite osX server software. Tried in slave mode over firewire cable. How do i remove the osX server software and replace with normal mac osX ? Can anyone help. Thanks.

Move anything on the hard disk you want to keep to another drive, and then perform the first option which the Installer lets you do from those listed here.
(16627)

OSX server + Private Network (and NAT) + Airport Extreme: Incompatibility ?

DHCP on Airport Extreme (AE) prevents some private network configuration.
*Imagine the following:*
- An AE that shares a public IP for your private network (NAT) => DHCPd is on (not an option)
- A Mac Mini with snow leopard and some services activated (Calendars, Wiki, Open Directory, ...) and a DNS with a private domain (e.g. you server is called: minisrv1.private)
- Client with account linked to an account on the OSX server
*Your problem:*
You can't activate a DHCP server on your OSX server: it will conflict with the one in your AE.
All your DHCP clients will get your AE address as DNS server and consequently wont be able to resolve any of your private addresses in your private domain
Your server will advertise all it's services with private domain's addresses
*==> All your client machines will get un-reachable services information (like iCal cannot connect to iCal server minisrv1.private)*
A solution might be to "trick" down the DHCP on the AE:
http://discussions.apple.com/thread.jspa?threadID=121990
Message was edited by: Philippe Rochat

I don't believe your analysis is correct.
You're right that when using the AirPort Extreme as an edge router connected to your ISP, and using NAT/DHCP to share its connect, the AE will configure all clients to use the AE as the DNS server (it actually acts as a DNS proxy).
However, it is still entirely possible to use your own, internal, private DNS server for those clients.
You see, the AE has its DNS server configuration in the Internet tab - this is where the AE will direct all DNS lookups, including those from DHCP clients.
Your solution is to just tell the AE to use your internal server for its DNS. That way it will be able to resolve your .private domain, and will enable all DHCP clients to do the same.

Home directory osx server

I planning on using osx server to manage users accounts. Once I setup the user accounts on the server I will have to move the data in the local accounts to another home folder on the local Mac that has the same user name as the one on the server. What is the best way to move user data on a Mac between user accounts? On OSX Server I am going to have the users account home folder point to the local home folder on the Mac.
Any thoughts on the best way to go about having a Managed user account on a sever and have the data storage be on a local Mac.

Sounds like you're talking about a Mobile user account, where the home directory is stored on a server, but synced automatically to the client machine.
http://docs.info.apple.com/article.html?path=ServerAdmin/10.4/en/c2um.html

Is it possible to share an aperture library with different users using osx server.

is it possible to share an aperture library with different users using osx server.

Not really. You should not be sharing an Aperture library over a network. It's not designed for that and you'll likely corrupt your library at some point.

Yosemite Server: Apache shm errors with proxy_balancer | SASL errors using user alias

Dear OSX Server Ninjas,
I recently upgraded my 10.9.5 Mac mini running Server 3.2.2 to Yosemite + Server v4, directly to v4.0.3. The box serves the whole Mail/Cal/Contacts/VPN palette as well as some websites, Git repos and some custom software. See below for network setup.
After battling the most blatant issues (some easy to fix but hard to find, others hard on both), I'm almost back to a working server setup … but some things keep bugging me even after days of log-reading and OD tricks. In the last days, I have read countless discussions here as well as on stackoverflow/serverfault/apple.stackexchange and blogs, so I'll try to be as thorough and precise as possible to show what I have tried so far – sorry in advance for the long post
… and since you might not read to the bottom: Thanks in advance for any help, especially with the Apache problem!
My setup
OSX Server v4.0.3 running on Yosemite 10.10.1 ➞ both latest official releases
host + DNS
Hostname configured for public domain mydomain.net, web traffic on selected ports comes in through router NAT
Server has a static IP on the local subnet 192.168.178.0/24
Server running local DNS and performing lookups for all clients in the local subnet, forwarding to the router at 192.168.178.1
Primary zone for mydomain.net with records (A, NS, MX) pointing to said static IP
changeip -checkhostname is successful
Public IP is currently configured at the domain registrar through his name servers
SSL
Trusted third-party certificate installed for host.mydomain.net (Common Name + SAN for two subdomains)
Used to secure all services
Qualys SSL Test Grade B (capped due to OSX's openssl 0.9.x not being capable of TLS1.2 and Intermediate CA SHA-1 )
TLS working both inbound and outbound according to CheckTLS.com
OpenDirectory
Recreated after upgrade (probably not necessary, since issue persists), re-imported groups + users from WGM backup files
Only the server itself is bound to the directory, other devices just access services through network accounts (CRAM-MD5, MD5-Digest)
Problems
Apache shm errors: Apache fails to create slot memory when proxy module is enabled
As soon as I start a service which requires the Apache proxy_balancer module (e.g. Cal/Contacts, ProfileManager), this starts filling up my Apache's error log:
[Mon Jan 12 01:41:17.979882 2015] [proxy_balancer:emerg] [pid 2949] (28)No space left on device: AH01179: balancer slotmem_create failed for p26d9e669--1011640492
[Mon Jan 12 01:41:17.979894 2015] [:emerg] [pid 2949] AH00020: Configuration Failed, exiting
[Mon Jan 12 01:41:28.297127 2015] [slotmem_shm:error] [pid 3026] (28)No space left on device: AH02611: create: apr_shm_create(/private/var/run/slotmem-shm-p26d9e669--1001322955.shm) failed
[Mon Jan 12 01:41:28.297347 2015] [proxy_balancer:emerg] [pid 3026] (28)No space left on device: AH01179: balancer slotmem_create failed for p26d9e669--1001322955
[Mon Jan 12 01:41:28.297355 2015] [:emerg] [pid 3026] AH00020: Configuration Failed, exiting
When I increase the Apache LogLevel to trace1, I get this as well:
[Mon Jan 12 02:11:43.190303 2015] [slotmem_shm:debug] [pid 5501] mod_slotmem_shm.c(367): AH02602: create didn't find /private/var/run/slotmem-shm-p26d9e669-813569972.shm in global list
This causes the Apache to crash constantly, which is … unnerving. After googling around for a while, I tried the following steps:
Stop Services that use the Apache (Web, *DAV, ProfileManager)
sudo apachectl stop
Remove all orphan cache/slot files (.shm, ssl-cache, proxy.*) from /private/var/run
Reboot the server
Start up the Services again
Curiously enough, this worked for a while! But I was getting several log messages about dropped proxy connections, and sometimes the ProfileManager page would time out. Then, the issue started to reappear and does not seem to be fixed again with the steps above. I looked through the Apache config files and config plists for the Services in question, as well as the default config files. The only thing I have so far is that as long as there are no active proxy connections, the Apache runs smoothly – but all goes awry when slotmem files are created (a lot of them). Sometimes, I am able to turn on the Calendar service, but switching on Contacts produces the error … one time, I even got Calendar + Contacts running, and all went well until I enabled Profile Manager.
I found several error reports with similar or identical errors from other Apache 2.4.x users, but most of those were developer talk on mailing lists, or suggested steps that did not work for me (or were inapplicable on the OS X Server Apache environment).
SASL errors using user alias for WebDAV-Digest authentication
Short version: I am unable to authenticate through WebDAV-Digest with a user's alias (defined in Server Admin > Users > Context Menu > Advanced Options or WGM). Using the main short name of the same user works flawlessly. Password Server Error log just shows:
AUTH2: {234023578237md5hash2384234, mainshortname} WEBDAV-DIGEST authentication failed, SASL error -13 (password incorrect).
The password is 100% correct: When I set up a test CalDAV account and put in alias+PW, it did not work (OS X Dialog showed “could not be verified”, Server log as above). Leaving the password field filled and just switching the user to the main short name went through instantaneously, with the Server log showing
AUTH2: {234023578237md5hash2384234, mainshortname} WEBDAV-DIGEST authentication succeeded.
Notice the same MD5 hash and canonical short name, yet different results. I don't know if this is a new “feature”, a result of mail aliases being handled differently (at least I read that somewhere) …
Additional Questions
Should I configure the DNS for public use, instead of the Split-Brain configuration (local network gets local IP, outside traffic is directed by registrar NS)? I read several articles explaining that Split-Brain is common in large organizations, but might introduce weird networking issues. Entering the external IP as a Round Robin alternative for the internal does not seem sensible to me.
I also have a question concerning LDAP log entries like this one below, but I'll put that in this already open discussion:
=> bdb_idl_delete_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994)

Today the same error occurred on a customers server.
We don't use Calendar or Contacts.
We only have some websites configured and want use NetInstall for deployments.
As soon as I disable the Profilemanager the httpd starts over and other websites and NetInstall via HTTP are working fine.
When I reenable Profilemanager the httpd processes are gone and I see the same stuff in Apache's error log...

10.9 Server Filesharing - Duplicate connected user

Fresh install of 10.9 Server - Did not migrate settings from previous server install *just because*. User environment < 10 people. We use file sharing, server time machine, and CardDAV. No need for anything else.
From the beginning, had major problem with filesharing borking saved files for all osx users connected over samba. Lovely. Had no idea how to fix or why osx clients weren't connecting over AFP, so I partitioned a section for the occasional bootcamp user and turned off samba for the rest of the network drives.
Now I've got Kerbos authentication failures for the network scanner that sends files to a SMB dropbox share point setup on the server. A server restart fixes this, but restarting file sharing does not. On top of that, I've got persisting permissions that seem to manifest in screwed up Numbers files (09', the version that doesn't suck) I can open and edit files, but copy/paste doesn't work nor does it allow you to add a new table unless you copy the file to the desktop. Then no problem with the file.... otherwise no other finder permissions problems - messed up huh?
When I go to try to figure this out this morning - now I see this.
So - Seriously? I've got one user with over 300 duplicate filesharing connections. This stuff just used to work despite my lack of experience. So Apple Community looking for advice - My choices are:
1. Hire a professional to fix this. (where do I find one? Last time I brought in a professional from a local authorized repair shop to fix a previous permissions problem, their answer was, "yeah, ACL's don't work right, you should just use POSIX". Yeah, thanks, I already knew ACLs weren't working - that's why I called you)
2. Rebuild the server from the beginning. (what went wrong the last time? Since the last time I setup OSX server, the only thing different this time was that I didn't use workgroup manage to create user profiles because it seemed like it was built into the Server app. So if I rebuild should I go to yosemite or downgrade to Lion, which seemed to work fine?)
3. Fix or live with the problems (Any ideas on how to fix, Apple Community?)
4. Quit. (anyone have a job opening in my field that pays 2x what I make now and doesn't involve relocating or screwing around with this stuff? didn't think so)
Message was edited by: sgladfelter

I do use 3.2.2.
I turned off SMB to my main share point, and left it on for the share point the scanner (which uses an unknown version of the SMB protocol) is setup to drop files on. The scanner worked for a couple of weeks and then randomly quit - in Console I see Kerbos authentication failures when attempting to connect. A server restart seemed to fix this problem a couple of times, but it has since quit and I've sort of let this problem go.
A restart also fixed the duplicate connections, and so far hasn't cropped up again. I'm still getting Kerbos authentication failures for my CardDAV accounts and my SMB connections, as stated above.
I haven't gone to yosemite yet since my current setup is working. The $20 upgrade doesn't phase me. I'd gladly throw $200 down if it worked as well as it did in snow leopard. As it is, I feel like I may as well be running linux for the amount of time I've had to spend in a shell the last couple of months.
Still debating on going back to Lion. The thing that ***** about this is that when I was considering the downgrade, I realized that since I installed Mavericks on the same machine, albeit a separate drive, the apple recovery utility will now boot into Mavericks instead of Lion as it did before. So now I've got no way to re-install Lion since disks weren't included. I can still use the old installation, but that is plagued by problems of an entirely different nature (prompting the update in the first place).
I sure this whole environment we have now is intentional, but I don't see how its beneficial to the user. Its analogous to the iDevice marketplace - when you update an app and it gets worse or doesn't work at all, you have no way of going backwards to a previous version. This wouldn't bother me if you're talking about a free app. But when I pay for an app and the developer adds in advertisement down the road or breaks it for my iOS version (I don't update my phone either) - well lets just say that in the ideal "user bill of rights" we should have the right to decide whether to use a newer version or go back to the old one.

Best way to integrate osx server with ms server 2004

I want to be able to manage files & users from either server, the OSX server & Windows Server 2003. What's the best road map & best practices. It's a small network of 5 computers in total. Thanks for all the help. Ben

first of all, to get rid of the duplicates, you tell iTunes to consolidate Library.
I think you may be missing the idea of what iTunes does for you. If you have content, like music, that you want to find the file of, you right click the name of the file in itunes and then "show in finder" . For things like iChat, you can simply drag and drop your music into the chat window from itunes, just like it was finder. iTunes organizes your media for you so you don't have to go looking for it.
The same thing goes with videos.
There is no reason to have two of the same files on your computer. Think of iTunes like finder, only it plays media too.
Not everyone uses itunes. Things like quicktime player, after you do a recording, will save the content into your videos folder. They're not on itunes but it uses your video folder to save the recordings. This is just one example of how your video sidebar icon folder will still be useful.
Delete the backups you have of your media unless they're in a format the itunes doesn't support, like lossess formats such as Flac, because it is pointless and wasteful to have two of the same files for music and video on your computer.

Does simple file and folder sharing on an iMac work with OSX Server?

Hi There
I wonder if I should install OSX Server on an iMac wher several users work on the same files and folders.
My question - before I do something I might regret:
Does simple file and folder sharing on an iMac within several users really work with the help of OSX Server?
All I want to be able to do:
Admin creates a new folder1 and gives it read- and write access for user1 and user2.
User1 creates a subfolder1 in folder1, and a document1 in subfolder1.
User2 edits document1. Later Admin edits document1.
All these simple editing of files and folders (and subfolders) within a main folder should be possible. This is not possible now.
Is everything clear? I'm not a network specialist or something, I just want to give some co-workers access to some data on my computer without problems.

So what you need are recursive permissions.
I suggest you create a group and add user1 and user2 to that group. You can name that group whatever you want, but for now i will call it FSUsers
Execute this in terminal. Replace FSUsers with your new group
sudo chmod -R +a "FSUsers allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextat tr,writeextattr,readsecurity,file_inherit,directory_inherit" /Users/Shared/*
Replace /Users/Shared with the location of your shared folder. Make sure you keep the /* at the end (this allows all subfolders and files to get the same permissions.
If you need to add people to the share just add them to the FSUsers group, the FSUsers group should should also be allowed in the sharing preferences.

Help for first install of macpro with osx server

Hello to all
it's my first message on this forum, i'm seeking for help because i'm kind of new with Mac systems.
I'm gonna explain the problem
So we are going to buy a mac pro and put 4*2To inside with raid 5 and osx server.
The problem is that the cost of installation of sotwre and deployement etc is really expensive.
I need to create a vpn too, this mac pro is gonna be a storage and multiple users must have acces to it. In fact this mac will be connected on the router and users will acces to it on local network then later we're gonna move from our base so the mac will be at the home of one of us and other users will have to access it from outside.
I was thinking avoyding cost of install by doing it myself.
So i've thinked that the best way to do it is by asking help to the community.
Is anyone can help me with this or tell me where i can find tutorials to do it?
I have skills but this is hard form me. The thing is that i learn fast. But i need help.
Maybe my post is not really clear i write as it comes to me, english is not my langage too.
So feel free to ask me questions or informations if you need.
In the same time i'm reading posts on the foum about this kindof installations.
Thank u so much
.anto.

Dear Marcassin
i am happy to help to your problem .
first i would say you must read the Documentation. and you should familier with Mac Os installation System.
in your Mac Server DVD you will find the schedule sheet . print that and plan your server first. it will really help full. then come and list down the all the requirements.
may be you will need more services after that.
But again again again . read that sheet and fill all the requirements. and come back or read specific captors in the Documentation.
if you want more details about the installing sachira.herath at gmail
 certified Pro 10.6/10.5

OSX Server / Profilemanager - Duplicate User with Payloads

Similar Messages

Maybe you are looking for