Setting up DNS & OD

Question

I'm following the Lynda.com excellent OS X Leopard Server tutorial by Sean Colins, and have DNS configured. All the suggested checks (reverse lookup & changeip) give correct results. However, when I configure Open Directory I come up against a problem that Sean warns must be corrected to prevent future problems. No matter what I've tried (and each time I've tried and failed I've reformatted and reinstalled), when I get to the screen after setting the Master Domain Administrator, the Kerberos Realm autofills with "ADVANCED.LOCAL" (the Search Base looks correct). Sean states clearly that if it doesn't autofill with "ADVANCED.MYDOMAIN.COM" something is wrong. I take his warning to get this right very seriously since I've had nothing but trouble with DNS-related issues in the past. But I can't figure out what I'm doing wrong that I don't get the correct autofill at this point. Any guidance you might be able to give me will be greatly appreciated.

Answer 1

Hi Doug
if they're issues from the beginning there's really no practical way to fix them
That does seem to be the case with Leopard. Although its not consistent? With Tiger it had to be really bad before contemplating giving up and starting fresh.
I posted something a while back that seemed to assist others in the early days of Leopard and before lydna.com had anything available. Perhaps you might find it useful? It is rather long but I hope concise enough to hopefully get you going?
The instructions are for the GUI only with no manual configuration and hardly any recourse for the command line. They also assume this will be the only server on the network with an existing 3rd-Party router providing access to the internet. The Router's IP address is 172.16.16.1
Substitute appropriately the example given for your situation. The example used is for a pretend business called ‘My Business’. I'm going to assume you have started with a clean installation and that the hardware used meets Apple's minimum requirements for Leopard Server:
http://www.apple.com/uk/server/macosx/specs.html.
After installing the Server Software the Server Setup Assistant will launch. There will be a series of prompts/windows that will appear. How you answer some of these will be important in preventing problems later on. When prompted by the Setup Assistant select 'Advanced'. As you progress past this point you'll be prompted to create the default System Administrator Account (UID 501). Use Administrator as the long name and admin as the short name with admin as the password. You can change this later on. For the Network Settings (TCP/IP) assign a fixed IP address of 172.16.16.254, a subnet mask of 255.255.255.0 and the router/gateway IP address as 172.16.16.1. Key in any ISP supplied DNS Server IP addresses in the DNS Servers field. You can key in the Router IP address instead as this will pass on any ISP DNS Addresses the router picks up on its WAN port. Disable Ipv6. The next part is the most important. When prompted for DNS details in the first field key in 'server.mybusiness.com', key in 'server' in the second field, although this should autofill for you, don't worry if it does not. Make sure the .local name says server.local. I have seen it default to .private. You can't edit this bit but selecting it and dismissing it should 'reset' it back to .local. Don’t start or configure any services. You can leave Remote Management/Screen Sharing (VNC) on as they are enabled by default.
Two important things to note at this stage: Root is enabled by default on Server Installations as is SSH access. Some System Admins have no problem with root and ssh being enabled as they will see this as two useful tools in administering and troubleshooting the server. On the other hand having root and SSH enabled can be seen as a security risk. Deal with this as seems appropriate to you. You can disable these later on using the Sharing Preferences Pane for SSH and the Directory Utility for root.
Save the configuration as a text file and apply the settings. You should be presented with the log in window or the desktop with Server Admin automatically launching. Depending which version of Leopard Server installed SA may report it can't find the server or it may prompt you to start configuring Services. Whichever it is dismiss the warnings/prompts and quit out of Server Admin. This is the time to test internet connectivity as well as running Software Update and installing all the updates relevant for the server. Make sure the server is fully up to date before doing anything else.
Before starting any services enable and configure DNS first. Launch Server Admin. You may get a message stating the server can't be found. Don't worry about this simply remove it from the list when asked. Select Add Server and key in 'server.local' along with the admin name and password. You can if you wish use the 172.16.16.254 address as well as the loopback (127.0.0.1) address. Later on after DNS has been configured you can use its FQDN (Fully Qualified Domain Name). You should now be logged into Server Admin. Select the Server name and select Settings and select Services. Enable the DNS Service. This should now be available under the server name in the left hand pane. Select DNS and Select Zones. You should see nothing in the zones. Select Add Primary Zone. As soon as you do this Server Admin will 'helpfully' autofill the top window with a zone name and a Reverse Pointer Setting. These will be defaulted to example.com and ns 10.0.0.1. Select the Zone as well as clicking the disclosure triangle to reveal the Named Server Record (ns). Start with the zone first and edit example.com to read mybusiness.com. The Fully Qualified tick box should be ticked and grayed out. In the Server field, edit the server name to read server. DON'T CLICK SAVE YET! Next select the ns record and edit the server name to read server and the IP address to read 172.16.16.254. NOW CLICK SAVE. As soon as you do this the Reverse Pointer field should autofill itself with the relevant information based on what you have already keyed in. Select Settings and key in the Forwarders field your ISP's DNS Server Addresses. You don't have to enable Zones Transfer although it does not hurt at this stage if you do. Up the Logging levels to debug and start the Service. Next go the Network Preferences Pane and replace the ISP DNS Server IP addresses or the Router's IP Address with the server's own IP address: 172.16.16.254. Apply the changes and launch a web browser. You should now be on the internet using the Server's own DNS Service.
Test and qualify the DNS Service by launching terminal and issuing the host command:
host server.mybusiness.com
server.mybusiness.com has address 172.16.16.254
host 172.16.16.254
254.16.16.172.in-addr.arpa domain name pointer host172-16-16-254.in-addr.server.mybusiness.com
This qualifies the forward and reverse pointers for the DNS Service. I also like to run nslookup:
nslookup server.mybusiness.com
Server: 172.16.16.1
Address: 172.16.16.1#53
Non-authoritative answer:
Name: server.mybusiness.com
Address: 172.16.16.254
You can also issue this command:
sudo changeip -checkhostname
Supply the password when prompted, you should see this:
Primary address = 172.16.1.254
Current HostName = server.mybusiness.com
DNS HostName = server.mybusiness.com
The names match. There is nothing to change.
That should pretty much clinch it.
Now configure simple file services: AFP and if necessary Windows. Don't enable Guest Access and leave Any Method as the Authentication Method to be used for the AFP Service. Start the Services. Create a test user in the local server directory and test using a client computer to access the default share points: Users, Groups, Public. Don’t be tempted to delete these folders as the server will complain. If you don’t want to use these you can simply unshare the share points and create new ones. You could for example create share points on a connected XServe RAID and share these instead. Save any changes made.
Get into the habit of quitting out of Server Admin and Workgroup Manager when not using them. Focus on Server Admin now and enable the Open Directory Service. Select Settings and change the role from Standalone to Open Directory Master. Apart from confirming the Directory Administrator long and short names as well as defining a password everything should auotfill for you. Kerberos Realm name and Search Base should derive themsevles from what is set in the DNS Service. SERVER.MYBUSINESS.COM for the Kerberos Realm Name and dc=server,dc=mybusiness,=dc=com for the Search Base. Once you get the green light launch Directory Utility, select 'Show Advanced Settings', select LDAPv3 and confirm the Server has created an entry for itself. Inspect the entry and you should see the Server's loopback address (127.0.0.1). This is normal. Quit out of Server Admin and launch Workgroup Manager authenticate the /LDAPv3/127.0.0.1 node and you should see Directory Administrator (UID 1000) waiting for you. Populate the node with desired users.
Apple have moved File Sharing administration away from Workgroup Manager to Server Admin. Select the Server Name and click on File Sharing. By default ACLs are enabled on 10.5 Server. If you don't wish to use ACLs you have to disable them using the command line:
sudo fsaclctl -p path -d disable (where path is the volume)
To re-enable ACLs do the following:
sudo fsaclctl -p path -d enable
You must always restart the server after either enabling or disabling ACLs.
If you want the Server to issue IP addresses then consider using the DHCP Service. You must have a DHCP service running somewhere for NetBoot/NetInstall services to work. If your router is already doing this then there is no need to bother just yet. Once you get comfortable and familiar with the Server you could look at this later on.
As ever how internal DNS Services are configured is absolutely crucial to how effective the server is going to be. Especially true for LDAP Services. Pretty much everything available in Leopard Server will benefit from having internal DNS Services configured correctly. SUS, iCal, iChat, Mail and Web. Internal DNS Services do not have to be configured on the server itself just as long as they are configured somewhere (on another server for example) on the private network will do.
What you could do is install and configure the server connected to a standalone switch/router with nothing else connected. This should eliminate the possibility of something 'exotic' impacting on the server's initial setup. You can manually download ServerCombo Updates and install them that way. Once you are satisfied shut it down and introduce it to the real network when ready.
Hope this helps
Tony