Profile Manager backup size growing quickly

Over the past 2 weeks Profile Manager (or PostgreSQL) has been creating backup files at a very high rate (in total more than 800 backups since March 30th). Each of these backup files are 16.7 MB in size (by now more than 14GB in total) and have this format '000000010000000x000000nn' (with x a capital character and nn a hexdecimal sequential number). The location of the backups is: /Library/Server/ProfileManager/Data/backup.
Questions:
What purpose do these backups serve?
Is something wrong (since it only started 2 weeks ago)?
Can I stop it?
Can I delete older ones safely?
What changed recently on my server:
Installed Server 3.1 (March 22nd) and Server 3.1.1 (April 4th)
Renewed my server certificate (was about to expire April 25yj so warnings since March 26th or 27th)
I did make some changes to profiles March 22nd. Also enrolled a new device
Thanks for the help

The files are created by PostGreSQL and contain WAL (write-ahead-logging) data. It's still not clear why these files should be growing at more than 33 MB a day.
Why is there no snapshot of the database taken, past WAL files deleted and new ones started every day/week/month? Can I do this myself? I'm now wasting 16GB of storage as an inefficient backup for PostgreSQL.

Similar Messages

Profile manager backup

Dear all,
Can profile manager backup by time machine?
if it can't then how to backup and restore profile manager correctly
i tried to use time machine to restore the profile manager but i try to use profile manger to reset ipad password ,update ipad profile doesn't.
any methods fix it ?
Thanks

The files are created by PostGreSQL and contain WAL (write-ahead-logging) data. It's still not clear why these files should be growing at more than 33 MB a day.
Why is there no snapshot of the database taken, past WAL files deleted and new ones started every day/week/month? Can I do this myself? I'm now wasting 16GB of storage as an inefficient backup for PostgreSQL.

Database size grow quickly

hi,
we are facing a problem with the datebase size wich are growing so fast (>150 Mo) compared to the installation and the volume of data we have.
we have ~ 15 infocube/ODS: 3 are configured with the full update method, 12 are delta updated.
have you any idea that can help us solve this problem?
Thank you.

If you are sure about PSA (is the first reason of uncontrolled grow).
Check how many request you have in the infocube and the average record per request. Probably you need the Compression of the InfoCube.
Records that had been uploaded with the same key may be contained in an InfoCube several times but with a different request ID. This differentiation is necessary to be able to delete single requests out of an InfoCube after they have been uploaded.
http://help.sap.com/saphelp_nw04/helpdata/en/ca/aa6437e7a4080ee10000009b38f842/frameset.htm
Chack also the aggregates, but compression reduce also aggregates.
Reagrds,
Sergio

Backup size growing more than expected

I have about 180GB of data on my system and a 500GB volume dedicated to Time Machine. For the past few weeks I've been scanning a lot of old photos, which go into a folder before being imported into iPhoto, and are then deleted from the folder. As expected, the free space on the Time Machine volume steadily decreased as the photos were backed up from the folder and the iPhoto library.
When I started running out of space on the Time Machine volume I deleted all backups of the temp folder, but I only got a fraction of the expected space back. I know I can exclude the above folder from backups if I want, but how do I tell what is taking up the additional space?

There's been some confusion while talking about iPhoto because prior to version '08 the library wasn't a package, it was just a folder. Everyone who has indicated that TimeMachine is only backing up new photos has turned out not to be using the newest version. I'll be honest, I've not taken a look at how iPhoto '08 behaves with Time Machine - I'll put that on my list of things to do - my long list of things to do.
The link you posted makes out that TimeMachine just backs up the changes that occur in a package, not the entire package. It is possible that the engineers have specifically hard coded special treatment for iPhoto, but it makes no sense for TM to just back up changes to packages. That would make rewinding to previous applications, among other things, more difficult than it need be.

Backup Server Settingd - Including Profile Manager

We want to ensure that we have a backup of our server settings and also the network settings of the machine. We have experienced issues with TimeMachine in the past and want to ensure we are backing our server up including the Profile Manager database and active directory database.
Thanks,
James.

The files are created by PostGreSQL and contain WAL (write-ahead-logging) data. It's still not clear why these files should be growing at more than 33 MB a day.
Why is there no snapshot of the database taken, past WAL files deleted and new ones started every day/week/month? Can I do this myself? I'm now wasting 16GB of storage as an inefficient backup for PostgreSQL.

How do I backup profile manager database on OS X Yosemite?

Hello guys,
I'm struggling to find an answer on how to backup profile manager database(devices, groups etc.) on Yosemite(server 4), so far I only found a few threads for Mavericks (10.9) & Server 3 saying to type the following command via terminal: "sudo pg_dump -U _postgres -c device_management > $HOME/device_management.sql"
Although this command applies to Mavericks(server 3) I decided to give it a shot but as expected I got this error message:
"pg_dump: [archiver (db)] connection to database "device_management" failed: could not connect to server: No such file or directory
Is the server running locally and accepting
connections on Unix domain socket "/var/pgsql_socket/.s.PGSQL.5432"?"
I also tried to backup & restore profile manager's database with TimeMachine but unfortunately it didn't worked..
It seems that TimeMachine misses the profile manager's data folders(see thread: Profile Manager not being backed up in Time Machine?)
and I saw that other people also complained about this problem.
As we're a company who holds thousands of devices & integrates them on daily basis to profile manager, I would be very pleased to know how to backup our Profile manager's database.
Please see this question as HIGH importance, I really hope to get an answer ASAP..
Thanks in advance for all the repliers!
Yours sincerely,
Daniel Adler.

Hi Strontium90,
Thanks for your reply!!
I tried your command, but unfortunately i got the following error msg:
"too many command-line arguments (first is "devicemgr_v2m0")
Try "pg_dump --help" for more information."
Please correct me if I'm wrong: assuming command was successful, I should've seen 'profileManager.sql' file at my desktop(output path = ~/Desktop/) which is the Profile Manager's database file I guess, right? and where is the restoration path located? in case I want to restore Profile Manager's database with the created backup file('profileManager.sql').
Also you mentioned: "Automate to perform daily", how can I automate this command?
Thanks a lot for your support!
Have a nice day.
Yours sincerely,
Daniel Adler.

How can I disable backup for managed app with profile manager?

I use Server App 3.1.2 to manage iOS devices with profile manager.
Is it possible to exclude managed app's backup from users iCloud or iTunes backup?
thanks
Paolo

Hi,
Please use the following link (under "Manage Print Apps" to cancel/remove it:
http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02940901&cc=us&dlc=en&lc=en&product=5058336&tmp...
Regards.
BH
**Click the KUDOS thumb up on the left to say 'Thanks'**
Make it easier for other people to find solutions by marking a Reply 'Accept as Solution' if it solves your problem.

Profile Manager replication / failover / backup

I'm in the process of getting to grips with using profiles as a replacement for things I've always done with Workgroup Manager / MCX.
I'm running Server 10.10.3 with a replica Open Directory on a second server, which works fine but it seems to me that the profile management system does not provide a straightforward replica / failover facility. Is this correct, or have I missed something?
What are people doing to ensure that when their primary server fails the secondary one can takeover as cleanly as possible? E.g. do you have a list of directories / files that can be rsynced to keep Server 2 ready to take over, perhaps with some manual intervention?
TIA
C.

Chris,
Profile Manager does not currently support replication or distribution in any meaningful sense. There are solutions from other MDM vendors that do have these features, but they'll cost you about $20 per device instead of per server.

Managing backup systems for referenced image masters

The manual says:
+Aperture doesn’t back up the masters of referenced images located outside the Aperture library. *You must maintain your own backup system of referenced image masters.* Aperture does back up the versions, previews, and metadata information associated with referenced images, but not the masters themselves.+ (my bolding)
So, somehow, I ended up with some images (older, it seems) in the vault but other images (newer) as referenced. An incomplete back up to the vault. I understand how I can move those referenced to the Vault but:
1) is there a fast way to find and select all the referenced masters for this move? Like a menu item or a button in a dialog box that says "Find and move all referenced Masters to the vault"? Simple eh?
2) why does Apple not allow you to keep referenced Masters out of the vault but a copy of the Master backed up in it? When it goes to reinstall (hopefully never!), it can just reinstall the whole vault in Aperture - if need be. I could live with this especially if it makes backing up all my Masters easy and recovering all of them assured.
3) Since #2 is not possible for now - how do people back up referenced files and why do you do referenced over Vaulted or a combination of the two (which is what I have but, not knowing I was doing this)? I would like to be able to look at images on my MacBook Pro but really keep the bulk of the images and editing on a MacPro.
4) when I imported iPhoto to Aperture, did they all come in as vault Masters or referenced?

Joseph Coates wrote:
...when I imported iPhoto to Aperture, did they all come in as vault Masters or referenced?
Images are imported according to settings you select. Probably you initially imported using a Managed-Images Library. To import by Reference from within Aperture, import images from the hard drive folder into Aperture selecting "Store files in their current location."
...how do people back up referenced files
Using any normal data backup method. I like to simply manually Finder-copy to external hard drives.
and why do you do referenced over Vaulted or a combination of the two (which is what I have but, not knowing I was doing this)?
Actually the correct syntax is Referenced over Managed. Vault refers to one type of backup routine that does include Managed Masters.
The primary problem with using a Managed-Masters Library instead of a Referenced-Masters Library is that for almost all modern digital photogs using Aperture their quantity of image files will grow quickly, rapidly taking more and more space on a single internal hard drive if Managed-Masters keeps all image files on a single internal hard drive.
Hard drives slow as they fill, so unless a multi-drive SATA/eSATA array is used a Managed-Library drive will sooner or later lose performance. Use of Referenced-Masters allows the Library to forever stay small enough not to overfill a single drive.
Personally I consider separate backup of Masters outside Aperture's Vault protocol a benefit, not a negative.
Using a Managed-Masters Library works even for for laptop/iMac owners if completed Projects with Masters are constantly purged from Aperture but that is inappropriate workflow for most photogs, and the benefits of using a Managed-Masters workflow are minimal.
I would like to be able to look at images on my MacBook Pro but really keep the bulk of the images and editing on a MacPro.
Although various user workarounds exist, the issue of synching your laptop Library with your desktop Library has not (yet) been addressed by Apple. IMO Apple's failure (still) to address this key issue is a travesty; Apple's single-user Filemaker has had that capability since the 1980's.
I suggest going to "Provide Aperture Feedback" under the Aperture menu and requesting that Apple provide single-user synch capabilities for two Libraries (such as the laptop/desktop setups that you and I both have). Note that it is important to specify single-user, two-Libraries, because multi-user scenarios are entirely different solutions that - unlike single user solutions - are usually very complex and expensive.
-Allen Wicks

Profile Manager Woes

Just purchased 600 iPads. As we were enrolling the iPads, Profile Manager (via Safari) seemed ok speed for a web app. As we got over 100 iPads enrolled, Profile Manager began slowing down. Now that we have 600 iPads enrolled (and we will be getting another 5,000 over the next 2 years), Profile Manager is now very slow and buggy.
I have a brand new Mac Mini Server (OS X Server 10.7.2) 4GB RAM.
When I launch Safari and log into Profile Manager, I must wait around 5 minutes for Profile Manager to load before I can begin using it.
That is NOT acceptable.
Does my experience match others?

Problem solved. Profile Manager in OS X 10.7.4+ is now supporting our 2,000 iPads quite well (this will grow another 1,000 next school year).
Only issue now is there is now way of backing up the data in Profile Manager. I can backup the entire computer (Carbon Copy Cloner), but would rather just backup my Profile Manager data. Similar to what OS X Server has with Open Directory.

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

Backup size says 2.0 GB, but I have all backup options turned off. Why is my backup size still 2.0 GB?

I had an iPhone 4 updated to the iOS 7.1.2 version, and I recently purchased an iPhone 5s. When I got the 5s, I transferred all of my camera roll pictures from my 4 to my PC in a file folder and deleted all the photos from my 4 camera roll. I also turned off the "camera roll" backup option in my iCloud storage settings. However, my backup size still said I had a large backup size, so I turned off all the apps in the backup options under the iCloud storage tab. Along with all the apps, I turned off the backup for the Mail, Contacts, Calendars, Reminders, etc. Yet, my backup size on my 4 still said 2.0 GB, and my 5s needs more backup storage without purchasing any extra storage.
I'm not sure if I should completely delete my 4 backup or if there is a solution without completely deleting its backup. If there is a possible solution to decrease my backup size without deleting the backup, what is that solution? If deleting the 4 backup is the best option, what are the "risks" of deleting the backup? Like would I lose anything I restored onto my 5s from the 4 backup, etc.?

Hi girdster,
Thanks for using Apple Support Communities. Based on what you stated, it sounds like you need to manage your iCloud storage. I would recommend that you read this article, This tells you how to manage and how to delete a backup.
Manage your iCloud storage - Apple Support
Cheers,
Mario

'Profile Server Not Available' error when trying to access Profile Manager

Hello all,
I'm totally, totally new to OS X Server, but I have a class full of new iMac's and MacBook's that I want to be able to manage all in one go. Don't really mind about File Sharing, access from anywhere in the world etc. but I just want to be able to push updates to all of them at once as well as manage some default settings for them all.
I've set up most of what I can see I need to do in OS X Server such as the server itself as a .local, Profile Manager, Websites, VPN, Open Directory and Software Update, but when I try to access my .local through any browser, I get the main screen, but get an error page when I try to go into Profile Manager that says 'Profile Server Not Available. Please wait a moment and try again.'
Can anyone suggest where they think I might be going wrong or need to do? I can give more information or screenshots if needed, juts let me know. Any help super appreciated
Yours,
Elliot

Hey,
Sorry, because I'm so new I don't quite get what you mean. A little more information is I'm using my MacBook which is connected to the same WiFi network as the other Mac's. What do you mean by the FQDN?
I'm able to type in the IP address etc. on any other of the Mac's and it loads the 'Welcome to OS X Server' page, it's just when I select Profile Manager, I get the error. Thanks for getting back though, appreciated the quick help.. and I'm still super stuck. I've got a whole day on it today ha.
Elliot

How do I change the order of the profiles in profile manager?

I have several profiles and I know that I can use profile manager to delete the profile without deleting the files, then add the profile back, but it is a very clunky way to change the order they are in. Is there any quicker way to change the order of the profiles?

Thank you both. My problem was that I was looking in the wrong place for the profiles.ini file. I'm not sure now where it was I was looking, but I found it quickly with the links cor-el gave. I didn't want to use command line option (though it is a good suggestion) because that would increase the clutter from icons and I was attempting to reduce clutter.
Again thank you both for the quick response.

LPX file size grows every time I save (with almost no changes) - WHY?

Hi all,
I am just now starting to move from Logic 9 to Logic Pro X. I first imported a very simple file from logic nine as a folder project and did not import anything except the file.
- Then, I immediately saved it. took more than 30 secs on core i7 - why so long?
- next I "saved a copy as" file 1a - file size 700k - nice and small.
- that I loaded the first logic X file back in and muted a few things and saved again
- I made some other very minor changes like muting and re-saved three or four times.
Here is what is strange –
Original file = 1 MB
main LX file was 2 megs and each subsequent save gained about 1 MB each time I hit save! So, the final grew to 6 MB after just a few saves!
I checked to see if there was some large edit history file I could purge – but it was empty because all I had done was change some mutes…
Q: what is going on with this large file size growing every time I hit save without any major changes – I would like to know what's going on.

It has to do with undo history, backups, and autosaves. You can see these if you right click on the file and show package contents. Explore in there and you should see these growing in the alternatives folder. I would imagine there is kind of a limit to how many of these there are, but haven't looked to closely at it.

Profile Manager backup size growing quickly

Similar Messages

Maybe you are looking for