Progression to Lion Server ?

We are looking to upgrade our Server from 10.6 to Lion Server and have a few questions that we cannot find answers to. Was hoping someone here might be able to help.
A. After initial download/install and connection to Apple for Profile Manager Push Certification, does Lion Server require to be connected to the internet?
B. Does Lion Server work with OS X 10.5, 10.6 clients? (everything I find mentions 10.7 clients but not earlier)
C. Has anyone had any issues with Lion Server and the internal RAID of a intel XServe [Xeon circa 2006/2007]?
Any answers would be helpful, thanks.

Its not as missing as not working as expected.
Ill try make som examples...
I cannot connect with VNC anymore because something with the protocoll changed. May be a bad setting hopefully.
MYSQL was scrapped and replaced.
Webserver: Odd stuff going on here... Cannot remove default site, I cannot understand how to create a reverse proxy site, I dont understand how to allow a subsite to show files directly without a start page, I dont understand how to set a start page (if you for example got index.php and index.htm or index.html - which one is default?
Wiki stuff got corrupted on SLS upgrade - works fine on raw install. Not that I use this anyways...
In general - every module got about 3 settings now (yes I exaggerate a bit now) compare to lots of settings in SLS.
You can probably edit apache files directly but I dont want to do that. I want my cookie cutter gui to give me the easy to use life I had with SLS

Similar Messages

Lion Server without a Static IP - Worth it?

I'm running a small video production company, and I'm considering setting up my iMac with Lion Server for use in organizing productions. I love the idea of having calendars that multiple people can update and expand upon, a wiki or custom website for sharing progress and updates, shared contacts for keeping track of cast and crew, distributing files like scripts and footage, and eventually setting it up to host my website and company email.
My problem is that I don't have a static IP, and from what I've found, I can't afford one right now. That being said, I'm fine holding off on the webhosting and email for now, and I imagine I'll lose the ability to do push notifications as well, but I'm still interested in the system. Having the calendars and contacts update whenever the employee logs into the local network at the office would work for us. But I wanted to check: is that how it would go down? It would sync the info when each device logged onto our network and then they could go about their merry way, or is it more complicated than that?
I'm fairly technically savvy, (I work part-time as a web designer, and I actually work at an Apple store as well), so I imagine I can handle the setup and such. I'm just curious as to how much of my desired functionality will even work with the "update whenever you enter the network" pattern. Is that how it would go down, or is it more dependant on a static IP, even for local-network use?
-Nerrolken

Linc is right, but I'd add a little clarification.
Lion Server does want a static IP address. It's perfectly happy if that address is on your LAN. Make sure it's on the same subnet as the LAN (Ethernet) side of your Internet router/gateway/access point. Configure the router to reserve a static IP for your server--so that a DHCP query will give your iMac the same IP every time--or narrow the range of IPs the router doles out to exclude the static address you assign your iMac.
If the day comes when you do want to publish some services to the Internet, configure port forwarding for those services in your Internet router and, as Wittless said, sign up for DynDNS or a similar service so your users can find you. Lion Server handles all of this automatically if you use AirPort Extreme or Time Capsule, but it's almost as easy to manage with non-Apple network gear.
Best of luck.

How do I switch off Time Machine in Lion Server remotely?

So here's what I want to do:
I have a mac mini with OSX Lion Server running providing wireless backups for the laptops in the house. I want to rsync these backups, as sparsebundle images, to a machine at my work.
I have the rsync working over ssh correctly, and have verified that if I rsync a sparsebundle there and back again then everything works fine. However, this only works if the sparsebundle wasn't mounted at the time of the sync.
I can use 'ssh xxx@xxx "hdiutil info"' to determine if the image is mounted, but I would like ideally to be able to switch off time machine remotely for the duration of the rsync copy.
Does anyone know of a command-line way of switching off Time Machine in OSX Lion Server from the command line.
As an extra question, for bonus marks, is there any way of verifying that a sparsebundle is mountable from a windows machine?

I'm going to answer my own question:
I was more or less completely on the wrong track. When performing a networked time-machine backup the sparse bundle is mounted on the remote machine for one thing. So hdiutil won't tell me if the backup is going on.
Also, backing up the sparsebundle is probably a bad idea in general, since if it's corrupt then none of the files will be easily recoverable.
So instead I've written a bash script that
a) mounts the sparse bundle on the server machine. If this fails, then a backup is in progress. The script exits in this case, but I guess it could always try again
b) Performs an rsync on the contents of the sparsebundle
c) ejects the sparsebundle.
For those interested, here's the script. Note that I had to build rsync 3.0.9 to get this to work, the bundled rsync barfs on the hardlinks in time machine backups.
(go here http://www.behindtherack.com/?p=308 for the rsync build instructions).
And here's the script
#!/bin/bash
user=dave
remotehost=your.home.machine
remoteport=5050
sshkeyfile=~/ssh.key.file
imagepath="/Volumes/tmachine/Shared Items/Backups/machine-name.sparsebundle"
remotepath="/Volumes/Time\ Machine\ Backups/Backups.backupdb/machine-name/Latest/"
localpath=~/Local-backup-path
# mount path
mountresult=`ssh $user@$remotehost -p$remoteport -i $sshkeyfile "hdiutil mount \"$imagepath\" -readonly"`
devpath=${mountresult%% *}
# did the mount work out?
if [[ "$devpath" == /dev/disk* ]]
then
          echo "Mount succeeded, remote disk mounted to $devpath"
else
          echo $mountresult
          echo $devpath
          echo "Remote mount failed, exiting"
          exit
fi
# now run the rsync
/usr/local/bin/rsync -rv --rsync-path="/usr/local/bin/rsync" --rsh="ssh -p$remoteport -i $sshkeyfile -l $user" "$user@$remotehost:$remotepath" $localpath
# unmount sparsebundle
ssh $user@$remotehost -p$remoteport -i $sshkeyfile "hdiutil eject $devpath"

Lion Server Time Machine sparsebundles

Subject indicates where I think my problem lies, but for background:
MacBook Pro got bit by Thunderbolt firmware upgrade snafu last week. Contacted Apple Store the next morning, saw Genius at 11:00. Concuded hardware and firmware were OK and because I had a Time Machine backup less than an hour old I gave permission to install a fresh 10.7.3 image on my bare metal.
Got home and booted Command-R. Happily saw my Time Machine shares on Mac Mini Server running Lion Server 10.7.4. Yes, "shares." A Backup and Backup-1.
As a Lion Server novice I found a tip here to "defaults write /private/var/db/dslocal/nodes/Default/sharepoints/Backups timeMachineBackup '(1)' to make my shared mountpoint work with Time Machine over the network. Perhaps thats how one does it if one doesn't have Server. I later found the Time Machine panel in Server and turning that on gave me a Backups-1 share as well.
So back with Command-R my MacBook Pro saw both the Backups and Backups-1, I navigated to Backups and it saw its previous Time Machine archive. I started a bare metal restore and happily went to bed. Next morning found the restore stopped at about 20% of the progress bar and message instructing me to reboot the computer. Repeated, same results.
Back to Command-R I reinstalled a new copy of Lion from Apple over the internet. Did minimal configuration until I could get into Time Machine and try to manually pull files. Again it quit unexpectedly no matter holding the Option key to Verify Backups passed.
So back to the Mac Mini Server I turn off Sharing from System Preferences and Time Machine from Server. The /private/var/db/dslocal/nodes/Default/sharepoints/Backups file disappears when Server Time Machine is turned off.
I have attempted to move "David Kelly's MacBook Pro.sparsebundle" from "/Volumes/Macintosh HD2/Backups" to "/Volumes/Macintosh HD2/Shared Items/Backups" where Server Time Machine seems to expect it. The problem now is that the MacBook Pro doesn't see this Time Machine archive in that location, or see it at all.
I have performed the Disk Utility verify tasks listed in the Time Machine FAQ with no errors found or repaired.
I have seen a -6584 error this week but don't remember exactly when: https://discussions.apple.com/thread/3123920?start=0&tstart=0
How can I get the sparsebundle back under Time Machine Server?

Finally figured it out on my own 2 weeks later.
You have to open the Lion Server app and then turn on Time Machine on the server.
It will then ask what disk you want to use, which in my case was an external 2tb USB.
My confusion was that this is not they way you had to do it on Snow Leopard Server.
On SLS, I never used Time Machine, but had to partition my external disk individually for each user. e.g. 2tb disk was partioned into 4 separate volumes. This was necessary to keep one user's Time Machine backup from taking up the whole disk and not leaving room for the other users.
You then setup these partitions as Time Machine Sharepoint which would then show up as a choice on the users machine under Time Machine preferences, select disks.
Therefore, under SLS, a user could select from any number of partions to backup to on the server. On Lion Server, it appears you do not have a choice and can only backup to the one disk you selected on the Server App.
At the risk of carrying on a conversation with myself online, my concern is now about limiting the size of the individual user's sparse bundle to again keep one user from taking up the entire disk for their Time Machine. I guess that is another fight for another day.

Can't install Lion Server. Any log anywhere ?

Hi all,
I've been trying to install Lion Server for hours. I tried upgrading or starting from a blank partition, and get the same behavior : after the usual reboot, the installer starts but never progresses.
My set-up is a bit specific : MacPro 3,1, with a 10.6.8 Server on a 2xSSD RAID-0 volume (hooked to the 2 spare SATA ports on the motherboard), and Users on another regular disk.
I thought the RAID could be an issue, so also tried on a clone on a regular disk, it did not work.
I finally tried on a blank partition, on one of my regular disks, did not work as well...
I then tried all this from the ESD image restored to another partition... no difference.
I have the impression to have tried all combinations with exactly the same result, I haven't found any log to explain the failure, would you have any idea ?
One thing I noticed is that the Lion Disk Utility on the ESD image is not able to verify the RAID volume (permissions or disk), it just does nothing, with no error. Unplugging the SSDs from the mobo may be my last option...
HELP ! ;-)

OK, NOW I get it... What I was trying to install was the MacOS Lion Server DMG from the Apple Developer site - of which I am a paying member.
As soon as I stopped trying that approach and opened the Appstore application on my machine, clicked on purchases, saw the LION SERVER entry (which is what I purchased) and clicked on INSTALL, everything went perfectly well and my problem is solved.
YEAA!

Lion Server odbc mysql install training/help

Is there any video training available from apple. They don't to document anymore. I am looking to install mysql and odbc on my Lion Server, but would like to see what Apple supports versus all of the incomplete product websites trying to sell me something without documentation.
I have look at Lynda.com and it's ok. But know seems to approach training from what you might really use a server for. I need my Lion Server for my Web server development, not a Work Group Server. I am developing with PHP, HTML5, MySQL, and Flex ? maybe. Not sure of the future but moving away from Java because of to many frameworks and it has become to fragment as a development environment.

Same issue here. re-patitioned HD, install Lion 10.7, downloaded server app, progress bar sticks, get "network error" message. Create new network location, delete previous lovations, same result. Refresh DCHP lease, same result. Set static IP, same result. Use wireless, same result.
Where to next??

OS X Mountain Lion server spontaneous DHCP?

I have DHCP service provided to a small school network by an Xserve running 10.6.8 server, not the new Mac mini server running 10.8.2, because the service is much more configurable in the old version (likely known to anyone perusing this forum). But we started having printing issues, and it turns out that the Mac mini started giving out IP addresses recently, despite the service being "off." Since it didn't have the reservations set, it gave some printers the wrong IP. I never turned the service on, but I wonder if the 10.8.2 update adding it to the Server app actually turns it on.
The Console log shows lots of DHCP Offers and acks, it should show none. Under Server.app Services, "Your Mac now provides these services: File Sharing, Software Update, Netinstall (which services the iMac lab). Under DHCP, the service is off, but it shows clients to which it leased an address.
I restricted the pool down to two addresses to reduce the possible problems, but I want to know a long-term fix. Something is horked.

I should clarify my thoughts
Have you noticed the progressive dumbing down and removal of services with osx server since snow leopard
If you read the kb for mountain lion server you'll see that netinstall can use the dhcp service independently
At one stage there was no GUI for dhcp at all and upgrading lion to mountain lion preserved dhcp setting
http://support.apple.com/kb/HT5412
Additional Information
The bootpd process, which is used by the DHCP service, is also used by the NetInstall service, but you can use either service independently or both together.
I have heard of cases of the bootpd.plist having no dhcp entries
Try running
sudo serveradmin fullstatus netboot
And have a look at dhcp

Is Lion Server Better than SL Server?

For those of you who have upgraded your Snow Leopard servers to Lion, is it worth it? I have upgraded my desktop Macs and my MBP to Lion, but I hesitate to upgrade the Mac mini servers I am running for my company because of upgrade glitch and performance concerns.
My impression of Lion at this point is that most of the enhancements are in the user controls and the desktop, which are not important issues for the servers. The Macs that I upgraded from SL to Lion actually appear to be more sluggish than before, particularly when it comes to network performance and streaming, so I have yet to see an actual performance advantage beyond the changes to the user interface.
I also have a lot of web applications using MySQL and I have read reports of the Lion upgrade breaking MySQL from the SL install. I am also running the Apache security module (ModSecurity), which was difficult to install in SL. I had to manually build the library files for it so I'm assuming the Lion upgrade will break the ModSecurity installation.
Are my fears unfounded or will an upgrade to Lion from SL be problematic on a production server that's run for a business?

I wouldn't upgrade it yet on a production machine since there are issues. Actually it's probably best to do it on a test Server and manually migrating the data over to Lion Server at this point.
It's true a lot of things break if you just do a plain upgrade over SLS since I upgraded my own test server to evaluate Lion Server before upgrading my clients SLS. I have yet seen any upgrades from any server version work well. Something normally doesn't transfer well and best to manually migrate stuff.
If you do a clean install of Lion and then Install Lion Server most things work pretty well so far such as mail and apache, and OD.
NOTE: However you need to have at least at DNS already running on another machine so when Lion Server does a reverse name lookup, It'll find the name of the server. If you at any point change the name of the Lion Server, you'll break links and other stuff don't seem to work well. This also solves the issue of nstat_lookup_entr failed.
So far I've Installed Pure-FTPd Manager 1.8 and Recompiled pure-ftpd 1.0.32 and works fine in 10.7 Server. I'll give more of a progress report over the next few days as I configure the server to my liking.
Even though Apple removed mysql in Lion Server. You can install mysql from mysql.com, Mac OS 10.6 64bit version. As for what I read online, it should work. I've installed it but haven't tested it yet, but should have it running in the next day and see how it runs.

Upgrade from Snow Leopard Server to Lion Server hangs at configuring services...

I am running the Mac mini with snow leopard server 2.53 ghz 2GB of ram, 2x500GB hard drives, and have followed through the process to install Lion Server. The installation appears to be hung at the Configuring Services section of the setup process. I have left it for a couple of hours and nothing has progressed.
Should I leave it longer, hoping that it will work through the process (if in fact it is working through something)?
How long should this normally take?
As this is my work server, hosting mail, web, FTP, and file sharing, it is rather important to get it up and running as quickly as possible.
Any thoughts on how I can get it moving?
Hard power off of the Mac Mini reboots the machine, then proceeds back to the setup page, and then hangs on the same Configuring Services.
Any assistance would be much appreciated.
Thanks.

Lion Server Upgraders,
beware and proceed with caution.
Apple web site is naively optimistic on the upgrade process:
"To upgrade your Mac to OS X Lion, you don’t need to drive to a store, bring home a box, and install a bunch of discs. All you do is click the Mac App Store icon, buy Lion for $29.99, and your Mac does the rest. Just make sure you have what you need to download Lion to your Mac."
And then has a 3 step process...
This is completely miss leading.
Read this document first: http://manuals.info.apple.com/en_US/lion_server_upgrading_migrating.pdf
It will make it readily apparent that moving from Snow Leopard Server to Lion is not going to be simple.
Having done this twice now.. I have found that:
1. Open Directory migration is a weak point. Lion & Snow Leopard Open Directory are not compatible, so if you have masters & replica then expect trouble. I have an unresolved issue trying to get a simple Lion Server to Lion Server Open Directory replica up and running. This compatibility seems to also cause migration to fail, as I found that all my local User/Groups transferred ok but non of the /127.0.0.1/LDAPv3 (Open Directory) ones did. This is a very important item, as all the mail accounts in dovecot use LDAP generated UID, so you have to be careful that you do not loose mail accounts.
2. Mail - your mail aliases will not transferred, so you will need to reapply the aliases.
3. Web Server Setup - This broke, under migration as I gather the entire Web serving tree has changed. In particular I had "Snow Leopard" Web Mail (which is based on Squirel) on my "Snow Leopard" Server and this is now dead...
4. Digital Certificates - I found that the valid (ie signed by trusted CA's) did not get migrated, so I had to re-imported my Digital Certificates. If you have paid for third party CA certificates then make sure you have got these copied somewhere, as if you loose them then you will likely need to go to your provider and get a certificate revocation and new certificate, which will cost you money!
Cheers,
Zebity.

Setting up new Lion Server - Accessing documents

We are in the process of upgrading from a 10.4.11 server.
We are not migrating anything over, and are starting from scratch. I've configured users and groups but had a question regarding documents.
On our old server, we used share points to store all our working files. In Lion, I see a "Give this group a shared folder" button. Inside that are "All My Files" and "Documents".
Is there any right or wrong way to store all our working files (small ad agency with art files that are accessed internally and externally). Would I be ok to use that for our working documents? Or should it be a folder somewhere else that is accessed through a share point?
Once I configure the folder on the Lion server I will be copying the files over from the old server
Thanks in advance.

Well, you are again asking questions that don't have a clear answer. Let's first look at the physical drive.
So, yes, the mini comes with two drives. But if you are placing the OS on one drive and data on the other, you have no redundancy. The mini is lacking enough redundant features, don't trust your data to a single drive. I would recommend mirroring the two drives and storing OS and Data on the same volume or storing just OS on the internal drives and getting a raid capable device for your data. Since the mini is a closed box, having your data outside at least allows you the portability in the event the mini fails. Otherwise, when AppleCare tells you to ship them your mini that will not power on, away goes your data.
As for structure, I tend to work in this fashion. Lets assume you are sharing from the boot volume. It will look something like this:
/Applications
/Library
/System
/Shared Items
/Users
I suggest doing something like this to avoid Apple's structure:
/Applications
/Library
/System
/Shared Items
/SharedFolders
     /Share 1
     /Share 2
     /Share 3
     /Work in Progress
/Users
But doing this, you are sharing the folders called Share 1, Share 2, Share 3, Work in Progress. The parent folder, SharedFolders, is simply a container and requires no special permissions since users don't interact with it. However, it makes a convienient container to targer for backup purposes. So instead of defining a backup source for multiple folders, you simply do the one that contains all your shares.
Now the other big change that you will need to wrap you head around is that in 10.4.x you were likely using POSIX inheritance. That no longer exists. You can only set your shares to use ACLs. Now this is generally a good thing. However, if your crew is using CS4 and older, you are going to have an issue with saving to the share. Especially with Photoshop. If you are CS 5 and above you "should" be ok.
Protect your data. Mirror the drives. It is the only redundancy you have on a mini. But remember... redundancy is not backup.

OD client (lion server) safari crashes when downloading an email attachment

I have a user who is having Safari and sometimes Finder crash whenever she downloads an email attachemnet from her iCloud account. Shes signing into iCloud via Safari (v6.0), she wants to download a 1mb PDF and when ever she clicks save, it starts to download, you see the progress bar in the download manager, and then you get the spinning wheel of death.
her user account is a OD account (lion server) with remote home folder.
other users with the same config are not reporting the same problem.
has anyone ells experienced this with OD user accounts?
is she signs into icloud on a local user account the issue does not persist.
please advise.

Hi Kevin,
So last night I updated to 10.7.5 and the issue persisted.
I then went into the users Library and removed the following:
- Safari folder
- anything that had to do with Safari from teh cash folder
- removed the Safari plist file from the prfrence folder
This set the files and settings back to default, so things like home page, browsing history, etc. will go missing
...its like using Safari for the first time ...again.
The good thing is this seems to have resolved the issue, i successfully downloaded PDFs and jpegs that previuosly crashed the system. Time will tell but sofar my end users have not reported any crashes.

Lion Server Install Failure/Incomplete

Hi,
I just purchased and tried to install Lion Server. After a few hours of being stuck at "Configuring System", and the progress bar being "stuck" for over 45 minutes, it just crashed. Now launching the app just brings the server menu but none of the services can be accessed (almost all menu entries are grayed out).
So I can't re-install (because it thinks it's already installed) and the install is incomplete and thus wont work! This is very annoying.
Apple, I love you guys but for those of us who are playing with server, don't give us the one button for dummies UI. Maybe some of us are techs who aren't afraid of the command line or "advanced" menus (an option like --force-reinstall would be nice right now!!!).
Any suggestions???
Thanks,
PS: What's with the install UI window with a cropped progress bar and icons? The window can't be resized nor scrolled ???

Since Lion Server is essentially an app, you can throw it in the trash and re-download it. I believe that what that application does is give you front-end access to tools that are already on your system, and adds a few command-line tools such as slapconfig.
I would try this: trash the application, you can even try using something like AppCleaner, which finds associated plists. Then, go to /Library/Receipts. There is a plist in there that contains the install history. find and remove any entries associated with install. Don't worry if you accidentally delete something that isn't associated, as it is ust a receipt list, but it is alway a good idea to make a backup of the original, just in case.
Once you do that, reboot the machine into single user mode and run "fsck -fy" from the command line. once that completes, reboot and run repair permissions from disk utility. Finally, re-download the app from the App Store and re run the installer. You might need to hold down the option key to re-download, but either way, it should come back down and run again.
If none of that work, I would go with the backup, wipe, and install suggestiosn from above. Grab youself an extneral hard drive (a good investment anyway), clone the machine with Carbon Copy Cloner, and then wipe and re-install.

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

How do I best share an iPhoto library to several users on a Lion Server?

I am considering setting up a Lion Server to use for our family of five. The one thing I struggle to understand from searching for information here, and throughout the Internet is: Can I set up a Lion server to have shared libraries for iTunes and iPhoto, and what is the best way to set it up? I would also like to understand if such a shared setup would create any issues with reduced functionality and/or performance?
Today we share libraries across several accounts on one computer, and that works mostly fine, although with some restrictions (only one account can have iPhoto open at a time, which is not much of an issue if on same computer; iTunes can share music but not Apps, ...)

I followed Apple's support team's instruction to create iPhoto on the new external hard drive (My Passport) - and then drag and drop the existing iPhoto library onto it from the Master file.
Don't know who told you that but it would be difficult to be more wrong.
Make sure the drive is formatted Mac OS Extended (Journaled)
1. Quit iPhoto
2. Copy the iPhoto Library from your Pictures Folder to the External Disk.
3. Hold down the option (or alt) key while launching iPhoto. From the resulting menu select 'Choose Library' and navigate to the new location. From that point on this will be the default location of your library.
4. Test the library and when you're sure all is well, trash the one on your internal HD to free up space.
Regards
TD

I'm trying to use Mountain Lion Server so my family can have separate logins via Screen Share to their iTunes.

Using Mountain Lion Server so my family can have separate logins and connect via Screen Share.
Works great, each has their own home directory and permissions are perfect.
Now setting up iTunes for each with their own Library (not shared), thus keeping multiple Libraries.
I get this;
This Computer is already associated with an Apple ID.
If you download past purchases with your Apple ID, you
cannot auto-download past purchases with a different
Apple ID for 90 days.
What!
So what it is on the same computer, they are completely separate Libraries never to be mixed.
If this works, I only need to keep one computer up and running, instead of three.
Each can do their syncing/backup and connect to the various Airplay/AppleTVs I have around the house.
How do I fix this.
Thanks

Bottom line is you can't - easily.
You need to make sure that you log out of the server each time otherwise the ID is running. To explain, if you had a laptop with different people using it, your solution works fine. Each time someone logs in, the iTunes ID is different so it works as you can only have one person using the laptop at any one time.
Now, turning your problem inside-out, you want people to be able to log into iTunes concurrently to use their own version of the program with their own library. This does not seem to work and you get the conflicted ID error message. Even though iTunes is running under their own login ident, I have never been able to get this working reliably and was told that iTunes is NOT a network-aware application as it is designed to be single user.
The way I got around this was to login as XYZ and to make sure that the ID was changed in iTunes accordingly. However, it did not always work so I gave up with the whole thing.

Progression to Lion Server ?

Similar Messages

Maybe you are looking for