Server Admin's Unreliability factor

Hi, I'd like to know how reliable it is to use Server Admin from a remote machine.
I've currently got the following situation: I've set up VPN a long time ago and now after a few updates to OS X server. It seems as if Server Admin is not reporting things correctly. It says VPN is running,l but when you check the VPN details it shows that its not configured. Both 'serveradmin' and Server Admin.app on the actual server report this. However, when I connect with my laptop to VPN, it functions as it did prior to this info disappearing out of Server Admin etc
So apart from wondering about that.... How reliable is Server Admin? I've had FTP break on several occasions, and its broken again today, you can't fix it out of Server Admin. It's as if OS X Server just randomly decide how it wants to run...
I think the only thing that has worked fine from day one with little trouble is. DNS, AFP, NFS.
I'm having trouble trusting os x server...

cat /etc/resolv.conf results
+search s***.p****+
+nameserver 10.0.0.2+
sudo serveradmin fullstatus vpn
+vpn:setStateVersion = 1+
+vpn:configured = yes+
+vpn:servicePortsAreRestricted = "NO"+
+vpn:state = "RUNNING"+
+vpn:servers:com.apple.ppp.l2tp:SubType = "L2TP"+
+vpn:servers:com.apple.ppp.l2tp:CurrentConnections = 0+
+vpn:servers:com.apple.ppp.l2tp:AuthenticationProtocol = "MSCHAP2"+
+vpn:servers:com.apple.ppp.l2tp:pid = 62+
+vpn:servers:com.apple.ppp.l2tp:Type = "PPP"+
+vpn:servers:com.apple.ppp.l2tp:AuthenticatorPlugins = "DSAuth"+
+vpn:servers:com.apple.ppp.l2tp:enabled = no+
+vpn:servers:com.apple.ppp.l2tp:startedTime = "2009-06-16 15:31:01 0200"
+vpn:servers:com.apple.ppp.pptp:SubType = "PPTP"+
+vpn:servers:com.apple.ppp.pptp:CurrentConnections = 0+
+vpn:servers:com.apple.ppp.pptp:AuthenticationProtocol = "MSCHAP2"+
+vpn:servers:com.apple.ppp.pptp:AuthenticatorPlugins = "DSAuth"+
+vpn:servers:com.apple.ppp.pptp:Type = "PPP"+
+vpn:servers:com.apple.ppp.pptp:MPPEKeySize = "MPPEKeySize128"+
+vpn:servers:com.apple.ppp.pptp:enabled = no+
+vpn:logPaths:com.apple.ppp.pptp_ServerLog = "/var/log/ppp/vpnd.log"+
+vpn:logPaths:vpnLog = "/var/log/ppp/vpnd.log"+
+vpn:logPaths:com.apple.ppp.pptp_PPPLog = "/var/log/ppp/vpnd.log"+
+vpn:readWriteSettingsVersion = 1+
+vpn:servicePortsRestrictionInfo = emptyarray+
+vpn:health = emptydictionary+
See both L2TP and PPTP is showing that is enabled=no
I configured L2TP and it's still functioning...

Similar Messages

Server Admin's proxy configuration... whacked? (Doesn't seem to work)

I just upgraded to Apache2 so that I could, sensibly, use the Server Admin app to manage all my web sites. Previously, my various httpd conf files were too complicated and I had resorted to hand coding them.
The good news is Server Admin and Apache2 are much closer to functional.
One bit of bad news: I can't get the reverse proxies to work consistently. Once set up, I get the most peculiar mix of success and failure -- almost at random. For example, some URIs load; others don't; sometimes a page loads, but it's style sheet doesn't.
What I want is simply this:
*/confluence (proxy to) localhost:8081/confluence
Using hand-edited config files, I'd usually do something along these lines (and this works great, by the way, if I stick it into 0000any_80www.mydomain.com.conf:
ProxyRequests Off
ProxyPassReverse /confluence http://localhost:8081/confluence
ProxyPass /confluence http://localhost:8081/confluence
So, off to Server Admin to make this work. I tried checking "Enable Reverse Proxy" and specifying a Proxy Path of "/confluence" and a Worker URL of http://localhost:8081/confluence. This ended up created the following entry in my 0000_...conf file:
<IfModule modproxybalancer.c>
ProxyPass /confluence balancer://balancer-group/
ProxyPassReverse /confluence balancer://balancer-group/
<Proxy "balancer://balancer-group">
BalancerMember http://localhost:8081/confluence
</Proxy>
</IfModule>
I wasn't able to figure out what a Sticky Session Identifier, Route or Load Factor would be used for... so I left those blank. Perhaps that's why it's not working... sure would be nice if there was some help in Server Admin...
Hm. Anyhow, Ok, looks alright. I'm not totally sure about the balancer bits (like why they are there), but I don't see why it wouldn't work. But... IT DOES NOT. I get totally inconsistent results. Some pages load, some don't. Sometimes I get some page assets, while others don't come through. Bah. However, if I get rid of the above, and simply put this in:
ProxyRequests Off
ProxyPassReverse /confluence http://localhost:8081/confluence
ProxyPass /confluence http://localhost:8081/confluence
It works great. Only problem is, anytime I edit a server configuration, Server Admin goes and deletes those lines! I think I've found a way around it though. I put the above lines into a "0000.proxy" file (in /etc/apache2/sites/0000.proxy) and now I've added this line:
Include "/etc/apache2/sites/0000.proxy"
At the bottom of my 0000_...conf file. So far, Server Admin hasn't deleted that line... and it seems to be working.
BUT, I'd just LOVE it if someone could tell me how to make this work without hacking around in the command line! Very annoying -- and of course, my proxies are showing up in Server Admin, and I really wish that would work.

Hi there
For the benefit of anyone looking at this thread, what is meant here is that if you choose to open the help for RoboHelp, you have an abiliity to add a comment. That comment may be kept private or shared with others. If you elect to share it with others, it is generally added as a comment into the pages that provide the help. If approved, Adobe may amend the help topic to reflect the new information.
@Jared - Was that information missing in your file? I thought when you elected to use this file that it was automatically populated with all available settings. And unfortunately (IMNSHO) the settings don't immediately reflect the settings in the dialog. (I think they should, as a starting point. At least, that's the behavior *I* expected the first time I played with the feature. I was admittedly taken aback when it didn't work that way.)
Assuming the setting was missing, how did you manage to sort what setting should be added?
Cheers... Rick
Helpful and Handy Links
RoboHelp Wish Form/Bug Reporting Form
Begin learning RoboHelp HTML 7, 8 or 9 within the day!
Adobe Certified RoboHelp HTML Training
SorcerStone Blog
RoboHelp eBooks

Server Admin only shows 201 messages in Mail Queue

This issue has been haunting me since 10.5.0 and I can't seem to get rid of it. It's not crucial, but very obnoxious. In Server Admin (from multiple computers) the mail queue will only show a maximum of 201 messages. If there are more than that I have a cryptic "message" at the end of the list that has a message ID of "FFFFFFFFFFFF" and the Recipients Field has [...]
I would love to be able to see all the messages in my queue if possible, but haven't found anywhere to fix this.
Any help would be very appreciated.

Thanks Alex. We aren't bouncing spam on our mail server, but I do notice that a lot of the mail is from MAILER-DAEMON. I'm assuming it's "User not Found" messages from hosts that don't really exist. I've tweaked the server using some suggestions from osx.topicdesk.com to clear some of those out, but it hasn't been 100% effective.
I think part of the issue is that the server is a dual G4 Xserve and is scanning junk mail on all messages. I assume that those two factors contribute to the backup of mail in the queue.
As for volume of mail, we receive 100k a month.

Remote Server Admin not working from outside of network for 1 server

Our company recently changed ISPs and I had to change our two 10.4 server's IP addresses. We have a mail server (intel xserve) and a file/web server (quicksilver g4). Both servers have two network cards in them. The problem is two-fold:
1- I can successfully manage the Xserve machine locally on our network and from my home. However, I can only manage the Quicksilver g4 server locally. Any kind of external access is not even acknowledged.
2- I'm not sure if I missed any steps when changing IP addresses for these server-based computers. Also, I'm not sure if I correctly set our dns names to the correct IP address.
For some background, this is the exact IP update process I used for each server:
Quicksilver G4 (file/web server) - Installed network card #2 and configured it with the new Public IP in the "System Preferences/Network" panel. In Server Admin I set our website to use the new public IP address. (network card #2 has no firewall device in between it and the internet.)
Then, I configured the default network card #1 to a static, yet private IP address that's behind our DLink firewall device with the rest of our network.
Intel Xserve (e-mail server) - Network card #1 was the only one setup before our network change. It had a static, public IP address. When we changed ISPs, I configured network card #2 to the new static, public IP address supplied to us by the new ISP in the "System Preferences/Network" panel. This new IP address is where all email traffic currently gets pointed to. (All mail is successfully sent and delivered.) Until our former ISP gets shutdown, I still have network card #1 configured to the older static public IP address. After the old ISP is shut off, I plan on changing network card #1 to a static, private address.
Any assistance would be greatly appreciated.
Mac OS X (10.4.8)

What should I check in AD? I am by no means an expert with AD.
Yes, I am using the same client OS.
I am talking about RDP over the internet, like from home to the office. We have a static IP assigned to the router from ISP. A static internal IP assigned to the server on the LAN. And the router port forwards 3389 to the assigned IP.
It was working fine before we reinstalled Server 2012. These are the steps I took when reinstalling:
1. format drive and install OS
2. rename the server
3. install SQL server
4. Install TFS and SharePoint
5. Add Active Directory role and promote to Domain Controller
6. Add domain users
7. Enable remote access on the server and add users to remote access list

Mail Server Relay Authentication Failure in Server Admin

I need to set up Mail Server to relay through my ISP. I know that I can authenticate to smtp.comcast.net:587 using my account and TLS usnig a mail client.
However, when I use Server Admin to configure my server's SMTP to send all outgoing email through this relay (Server Admin>Mail>Settings>General>
Rely outgoing mail through host: smtp.comcast.net:587
Authenticate to rely with user name: user
I get the SMTP error:
SASL authentication failed: cannot authenticate to server smtp.comcast.net[76.96.62.117]: no mechanism available
There are no toggles on Server Admin to specify TLS or SSL or anything for authentication.
Does anyone know how to tell Server Admin how to authenticate an SMTP relay to smtp.comcast.net using TLS, which is apparently what comcast expects?

Wow, this is an obscure solution, but it works. According to this thread, the problem is that:
Although Comcast advertises "AUTH LOGIN PLAIN", the Postfix SASL library won't do plain text auth by default. It needs to be told it's okay with:
smtp_sasl_security_options = noanonymous
Solution:
$ su -
$ cd /etc/postfix
$ cp main.cf main.cf.no_smtp_sasl_security_options
$ echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
$ serveradmin stop mail
$ serveradmin start mail
I'm not sure how often /etc/postfix/main.cf is overwritten, but presumably this happens every time you change and save Mail settings in Server Admin, so you must redo these steps every time you change the Mail server if you want to use smtp.comcast.net as your mail relay.
AAPL, would you please add a toggle to handle this in Server Admin?

How can I block Server Admin from accessing a server?

I've got a G5 FTP server running Server 10.5.7 that sits outside our firewall. Oddly I find that I can enter the IP and login info via Server Admin and voila - I have access. All sharing services are off and all remote access services in System Prefs are off. I want this system totally locked down except for the FTP server app I run. What do I need to kill to prevent access via Server Admin? Or anything else for that matter?
My concern is that via Server Admin someone could really mess things up and of course turn on services that would grant them full access.
Thanks

Oh sorry - I put this in the wrong category.
I'll duplicate this in the 10.5 section

Open directory Server admin APP, crashes

HI all.
ON my 10.7.2 lion server for some reason my server admin app keeps crashing under the Open
directory Section...
Here are the screen shots..

Also I cant make any changes under the Open Directory in server Admin...
Everything is greyed OUT...

How do I create a virtual directory in Snow Leopard Server Admin program?

Hi, how do you use the server admin program in snow leopard server to create an apache virtual directory? I can't see it in the applet anywhere. Thank you.

Well this is what I thought too but I don't think I'm doing something right. I have a default website on port 80 and I created a second site on the same port. They are two different websites. One is the initial one that comes stock with the osx. The second one I created.
When I browse to my server I get the second site. How can I get the default to be the one that points to the mail, wiki, calendar stuff, while my second domain is something totally different.
http://myserver (should be the default stuff like mail.)
http://myserver/mysecondsite (should be my other stuff.)
The problem is that when I go to http://myserver it is going to http://myserver/mysecondsite
What am I doing wrong? Thank you.

Creating Open Directory Replica fails with Server Admin Error Value 1127

Hallo,
I have seen a lot of similar threads here and they were helpful up to a certain point, but in the end, they did not solve my problem.
Currently, it comes down to this. The Server Admin Error message ist really meaningless and I could not find a single for the error value on the whole wide web. As such, I switched to the command line versions of the tools involved to geht more meaningful results. It worked. Specifically, creating a replica of an openldap master means using slapconfig.
When executing
slapconfig -createreplica master.ourdomain.com diradmin
as root on the prospective replica machine, I get the following error message:
ssh command failed with status 127
That command is not allowed with the root account via public key authentication.
That makes perfect sense to me, but how is it meant to work then?
Executing slapconfig as admin tells me that this tool is to be executed as root. On the other hand, root login via ssh is not allowed in Mac OS X by default, which seems fine to me. I even changed /etc/sshd_config on the Open Directory Master machine to "PermitRootLogin yes". However, neither reloading ssh using launchctl nor restarting the whole server made this setting operational. Trying to login from command line as root still tells me:
root login is not permitted to this machine via public key authentication.
While this is the current state where I need help urgently, I changed some other things before. I tell about to exclude these issues as possible reason of failure. I got this message for quite a while:
Replica Setup failed : This machine does not have a valid computer name
I was sure, this machine meant the target machine, the open directory master, because the domain had changed there once before I had taken over responsibility as an admin in this environment. And in fact, changeip disguised an issue there. The command proposed by changeip to fix the situation did not seem appropriate because this machine is multihomed with a public and a private IP adress. Proper name resolution is available for both interfaces including reverse lookup. I dont like this setup, but it was the only way to get mail service running smoothly. Running changeip on the machine itself using these arguments
changeip /LDAPv3/127.0.0.1 internalIP internalIP old.ours.com current.ours.com
reported success in updating password server, open directory, both interfaces, hostconfig (which in fact did not change) and samba. It reported an issue with kadmin which is related to Kerberos (we dont use Kerberos yet).
Changing the hostname of the server using changeip did not solve the issue. I then found the hint to check with scutil. This showed that the Hostname was not set on the prospective replica machine. (A question aside: in how many place is the hostname stored? The traditional /etc/hostname has gone, but seems to be replaces with several other configuration files and databases. I cant see this as an advantage). Setting the hostname using scutil worked fine. However, it did not solve the problem either. At least, slapconfig now started to complain about not being able to log in as root instead of failing from the start.
I also checked all log files on bboth machines that might have to do with openldap, as there are /var/log/slapd.log, /var/log/system.log and /Library/Log/slapconfig.log. I also checked the log of th layer on top of openldap which is /Library/Log/DirectoryService.server.log. None of them revealed anything noticeable beside a lot of of entries that I have googled in the last few hours and which all dont seem to be associated with the problem in question.
I will take a break now, but I have to fix this until tomorrow and I hope to get the ultimate hint from you, dear reader.
Thanks and bye, Christian Völker

ssh command failed with status 127
That command is not allowed with the root account via public key authentication.
Initial OD replication takes place via 'ssh'. If you have 'sshd' configured on the OD Master to authenticate with public keys then the OD replica will not be able to communicate with the OD Master via 'ssh'. You must configure the OD Master to use 'ssh' with password authentication and root login enabled.
Demote the replica back to standalone. Stop any services that you may have running on the primary network interface. Then stop any services that you may have running on the secondary network interface. In the 'Network' System Prefpane remove the IP number from the secondary interface then deactivate the secondary network interface.
Assign the private IP address and hostname that you wish to use for the replica to the primary network interface. Assign the 'public' IP number to the secondary interface. Check the DNS to see that the IP address and hostname for the primary network interface resolve both forward and reverse for the hostname of the replica that you have chosen. If it does not, fix your DNS before proceeding.
In the 'Sharing' System Prefpane, change the name of the machine to the hostname (server.domain.tld) of the replica that you have chosen. Then use 'changeip -checkhostname' to see if the IP/hostname matches. Fix it if it doesn't.
Then configure the /etc/sshd_config file on the OD master like this:
\# Authentication:
PermitRootLogin yes
PasswordAuthentication yes
PubkeyAuthentication no
and the /etc/ssh_config file on the OD replica like this:
PasswordAuthentication yes
PubkeyAuthentication no
Then from the OD replica as the 'root' user issue:
slapconfig -createreplica <ODMasterIPorFQDN> <diradmin user>
Make sure that the 'diradmin' user's password contains only alpha-numeric characters -no 'option-characters' or symbols, change it first if it does. Once the process completes, reactivate the secondary interface for the 'public' IP and check the configuration of services that will be using that IP, then start your other services. Secure the 'ssh' service on both machines to disable password authentication and 'root' logins.

How do i find out if the server admin daemon is running

Hi All,
I've got an OS X server that for some reason ( probably due to me pratting around) has decided not to have a working server admin prog. I can fire up the client program and point it at any of the IP addresses that the server is looking at and then you get an error message basically saying that the server admin daemon is not contactable.
So ...
1). How can i find out if the back end daemon is running
2). what port(s) does it listen on
3). How can I turn on some logging to see what's happening when I run serve admin
4). Any other tips as to how to find out why its not working
Rgds
Alex

You should post this in one of the forums in the Mac OS X Server v10.5 Leopard category. You'll get better response there.

Server Admin Graphing No Longer Works in 10.4.6

Has anyone else noticed that the graphing functions no longer work in 10.4.6?
I have also noticed that the CPU % Usage in the System - Hardware displays 62% no matter that the system is idle. This only appears on my single processor G4 not my Dual G4 Xserve.

Ever since I have upgraded to Xserve 10.4.6 the graphing function does not work and shows 0% - pretty light load for a dual 867 MHz G4 and about 12 users at the time
It is my hope that Apple does fix the problem shortly - it's useful to see the load on the CPU and network. Over the last while I did notice that the CPU load was "creeping" up steadily when the "Server Admin" utility was left running. The graph did not creep up when "Server Admin" was terminated and a graph was plotted after a few days.

Lion server VPN + Server Admin Tools 10.7

Hi,
I followed this guide http://macminicolo.net/lionservervpn to try to set up VPN on my lion mac mini server.
I also used Server Admin Tools 10.7 as instructed in the guide.
After completing the steps in the guide, I cannot get VPN to work, plus I have extra problems as below:
my mini cannot connected to the Internet or local network shares. I found under "Network" setting there was extra VLan created by the system automatically showing as "System Test--Connection error". After I delete this extra connection and revert my Ethernet to its original settings I can connect to the Internet again.
Server Admin Tools 10.7 seem to retains all its settings from the guide on NAT, Firewall etc. doesn't matter if I had removed the current server and created a new server in the left pane. Is there anyway I can restore the Server Admin Tools to its programme defaults? I suspect these settings are affecting my networks and I cannot get rid of them completely.
Would VPN still work if I just set it up in the server app? I haven't been able to get it work this way. I also want to find out is your guide for using the VPN to connect to the Internet off the server as a way to bypass restrictions? Do I have to set it up this way as the guide if I just to want to set up a VPN for simple fireshareing?
What did this command in the guide do to my mini? I was hopping if I cannot get VPN to work, then I should at least reverse the effects of this command. How do I undo this command please? "sudo serveradmin settings vpn:Servers:com.apple.ppp.l2tp:DNS:OfferedServerAddresses:_array_index:0 = "192.168.2.1"

Thanks BrianFL. This helps hugely. Yes, I just to set up a simple filesharing VPN not the kind of VPN that bypass Internet censorship. I use ethernet connection directly from my router yes.
1. I just need to use the server app to set up a VPN and port forwarding. That is it?
2. The setting I have made according to the guide with Server Admin Tools seems never going away, even after I deleted the server that has all the settings inside Server Admin Tools. Upon creating a new server inside Server Admin Tools, the new server inherits all the settings from the one I just deleted. Any idea how I can restore to Server Admin Tools's defaults settings?
3. Even VNC (I use RealVNC) on the mini stopped working after I made changes according to the guide and deleted all the changes I can find. What is the address format for lion's build in VNC (192.168.0.100:5800?) like? I forgot how it is.
Thanks so much!

Mail, Server Admin, MySQL running very, very slow

Hi all,
I have this Leopard Server on a Mac Mini and I experience some big bottlenecks on mail services (especially webmail), Server Admin connections (both local and remote), and also connections with mySQL clients (remote). Local MySQL is working fine. It is not the same for mail and Server Admin. They are very slow also for local connections. Any idea? Hint: I'm using a USB-ethernet adapter (from Apple) for my public IP's (I have 2 of them) and I use built-in ethernet for local network. I've switched them, I tried only with the built-in ethernet... no change. Please help... my enthusiasm about this server solution is getting lower and lower... Thank you very much

pterobyte wrote:
Have a look at system.log and mailaccess.log for clues to begin with.
Server Admin is usually slow (locally and remotely) when the DNS (forward and reverse) setup is not correct.
Since mySQL seems to have only problems when used remotely, I'd look at bandwidth, routers and switches involved.
Is mail only slow when used via webmail or via any IMAP client?
You're a genius as usually
It seems that I removed my reverse zone accidentally... I didn't even think to look at DNS setting before you told me... Thank you very much

Share point in server admin not working correctly... I think

I suspect that the share point in server admin is not working correctly. In workgroup manager when I click on a user and then click on the "home" tab, under the full path field I see a file path of:
afp://server.mydomain.com/Users
However if I go to Server Admin -> AFP -> Share Points then click on the Users share and then click on the share point tab below, enable auto mount is disabled. How can this be possible? I thought for a directory to show up in home in workgroup manager it had to be set as an auto mount. Has something possibly corrupted? And what?

Here's a bit more information about our setup and our experiences with Apple's CUPS implementation:
On the server, all printer queues are set up with only lpr and ipp sharing enabled with the PPD setting for each printer set to Generic Postscript. We found that setting the PPD to the printer specific one on the server caused problems when clients tried to use printer specific options, like paper tray selection, etc.. The selection would be undone, apparently because the driver on the server would override the previous settings. Using Generic Postscript allows the client PPD settings to go through unmodified. Our printers are general a mix of HP LaserJets and some Sharp Copiers.
All clients use lpd to the server queues with the printers' actual PPDs configured. Using ipp is superior in that printer feedback (jams, out of toner, etc) makes it back to the clients, but ipp only works when the client, the server, and the printer are on the same network. If the ipp client is not on the same network, the client spooler immediately goes into a paused state and the print job is stuck on the client.
Using lpd to the server queues works reliably, but there is no feedback to the client. Jobs disappear from the client queue and go to the server, appearing to the user as a successful print. If the printer is down, there's nothing they can see or do about it.

Can not start Weblogic Server Admin

Hi,
I am new to Weblogic and trying to install v12.1.1 on Windows 7 64 bit. The installation "seems" to have gone fine, however I cannot see User Projects under “start” =>”all programs” => “Oracle Weblogic” => “user projects” => “base_domaine” => “start admin server for Weblogic server”
I have tried to run the startWebLogic.cmd from the install directory, but I get the below error and nothing starts.
Enter username to boot WebLogic server:admin
<07-Oct-2013 12:12:40 o'clock BST> <Error> <Security> <BEA-090782> <Server is Running in Production Mode and Native Library(terminalio) to read the pa
ssword securely from commandline is not found.>
<07-Oct-2013 12:12:40 o'clock BST> <Notice> <WebLogicServer> <BEA-000388> <JVM called the WebLogic Server shutdown hook. The server will force shutdow
n now.>
<07-Oct-2013 12:12:40 o'clock BST> <Alert> <WebLogicServer> <BEA-000396> <Server shutdown has been requested by <WLS Kernel>.>
<07-Oct-2013 12:12:40 o'clock BST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN.>
C:\app\vicente\product\11.2.0\Middleware\user_projects\domains\base_domain>
Could you please advise what the issue may be?
I have my Java home in the PATH variables and the machine is also running my Orcale Database 11.2.0.3
Thanks

Hello, pay attention to: "to read the password securely from commandline is not found"
when you execute startWebLogic.cmd the terminal request you a password. You didn't type the password.
Solution:
Execute startWebLogic.cmd
Type the password.

Server Admin's Unreliability factor

Similar Messages

Maybe you are looking for