Setting up Open Directory and iCal server.

Hello:
I'm new to open directory - please help or point me in the right direction. I'm trying to set up a OSx server 10.5 running on a PowerMac G4.
I need iCal/DNS/FS/VPN/WEB/Open Directory as services enabled.
For testing purposes I've set up a small network with three machines all running 10.5.6.
I've tired over and over to do this via an advanced server but have not be able to get everything to work so I did a basic server allowing the server set up to input all my settings. Everything built and started up without issue but I could not get iCal to work. I let the set up sit over night and when I returned the next morning the MacMini screen had a window saying that a directory server has been found that offers these following services ...WEB - iCal etc. Do you want to configure your workstation. I did and everything worked as aspected. I thought that I finally got it!
I wanted to see the all of the settings so I converted the server to an advanced server and everything still worked. ( From the one workstation ).
I imported a users exported file from the server I'm trying to fix then the groups file. Everything still worked from the Mac Mini but I could not connect from the other workstation.
I never received the Open Directory message about services being offered etc.
Both machines have identical network settings ( Fixed I.P. pointing the DNS to the server.) AFP sees the server from both workstations but I can not login from the third workstation using any known good user name and password not even the admin or the Macmini account and password that works from the Mac mini. I don't really know anything about open directory, do you need to register the computer name with the server or something to that effect.
Why would it take hours for that original service offering to go out to the first workstation?
Thanks for any help you can offer. All of my OSX server experience has been setting up file servers never any of the other offerings.
Thanks,
Rick

Sorry,
I posted this to the wrong forum. I re-posted in Open Directory.
Thanks,
Rick

Similar Messages

After Updating to Server 4.1 Open directory and LPAD gone

Hello,
two days ago I discovered that Open directory was not working on our Server (Mac Mini 2012). I suspect it stopped working after updating to 10.10.3 and OS-X Server 4.1. When I try to start Open directory in the Server App the Server App prompts: Unable to load Replica List. When I try to recreate my Open directory Server I Get: OD Server already exists.
I get the following log entries:
LDAP Log
Apr 11 22:03:02 server.seju.eu slapd[925]: @(#) $OpenLDAP: slapd 2.4.28 (Feb 24 2015 21:45:59) $
[email protected]:/BinaryCache/OpenLDAP/OpenLDAP-499.32.4~1/Objects/servers/slapd
Apr 11 22:03:02 server.seju.eu slapd[925]: daemon: SLAP_SOCK_INIT: dtblsize=8192
Apr 11 22:03:02 server.seju.eu slapd[925]: TLS: OPENDIRECTORY_SSL_IDENTITY identity preference overrode configured olcTLSIdentity "APPLE:server.seju.eu"
Apr 11 22:03:02 server.seju.eu slapd[925]: slap_add_listener: opened additional listener 'ldaps:///'
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb(dc=server,dc=seju,dc=eu): unable to allocate memory for mutex; resize mutex region
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb_db_open: database "dc=server,dc=seju,dc=eu" cannot be opened, err 12. Restore from backup!
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb(dc=server,dc=seju,dc=eu): txn_checkpoint interface requires an environment configured for the transaction subsystem
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb_db_close: database "dc=server,dc=seju,dc=eu": txn_checkpoint failed: Invalid argument (22).
Apr 11 22:03:02 server.seju.eu slapd[925]: backend_startup_one (type=bdb, suffix="dc=server,dc=seju,dc=eu"): bi_db_open failed! (12)
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb_db_close: database "dc=server,dc=seju,dc=eu": alock_close failed
Apr 11 22:03:02 server.seju.eu slapd[925]: slapd stopped.
Open Directory Log
2015-04-11 21:57:10.624284 CEST - AID: 0x0000000000000000 - opendirectoryd (build 382.20.2) launched...
2015-04-11 21:57:10.752590 CEST - AID: 0x0000000000000000 - Logging level limit changed to 'error'
2015-04-11 21:57:10.916732 CEST - AID: 0x0000000000000000 - Initialize trigger support
2015-04-11 21:57:10.951833 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/SystemCache.bundle'
2015-04-11 21:57:10.958469 CEST - AID: 0x0000000000000000 - Module: SystemCache - failed to load persistent state - Input/output error
2015-04-11 21:57:10.962533 CEST - AID: 0x0000000000000000 - Registered node with name '/Active Directory' as hidden
2015-04-11 21:57:10.962833 CEST - AID: 0x0000000000000000 - Registered node with name '/Configure' as hidden
2015-04-11 21:57:10.963182 CEST - AID: 0x0000000000000000 - Discovered configuration for node name '/Contacts' at path '/Library/Preferences/OpenDirectory/Configurations//Contacts.plist'
2015-04-11 21:57:10.963194 CEST - AID: 0x0000000000000000 - Registered node with name '/Contacts'
2015-04-11 21:57:10.963438 CEST - AID: 0x0000000000000000 - Registered node with name '/LDAPv3' as hidden
2015-04-11 21:57:10.966901 CEST - AID: 0x0000000000000000 - Registered node with name '/Local' as hidden
2015-04-11 21:57:10.968600 CEST - AID: 0x0000000000000000 - Registered node with name '/NIS' as hidden
2015-04-11 21:57:11.031990 CEST - AID: 0x0000000000000000 - Discovered configuration for node name '/Search' at path '/Library/Preferences/OpenDirectory/Configurations//Search.plist'
2015-04-11 21:57:11.032007 CEST - AID: 0x0000000000000000 - Registered node with name '/Search'
2015-04-11 21:57:12.343838 CEST - AID: 0x0000000000000000 - Discovered configuration for node name '/LDAPv3/127.0.0.1' at path '/Library/Preferences/OpenDirectory/Configurations/LDAPv3/127.0.0.1.plist'
2015-04-11 21:57:12.343888 CEST - AID: 0x0000000000000000 - Registered subnode with name '/LDAPv3/127.0.0.1'
2015-04-11 21:57:13.549377 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/legacy.bundle'
2015-04-11 21:57:13.551131 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/search.bundle'
2015-04-11 21:57:13.554053 CEST - AID: 0x0000000000000000 - '/Search' has registered, loading additional services
2015-04-11 21:57:13.554064 CEST - AID: 0x0000000000000000 - Initialize augmentation support
2015-04-11 21:57:13.557920 CEST - AID: 0x0000000000000000 - Successfully registered for Kernel identity service requests
2015-04-11 21:57:13.557940 CEST - AID: 0x0000000000000000 - Adjusting kernel ID cache (100 -> 250) and membership cache (100 -> 500)
2015-04-11 21:57:13.575235 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/PlistFile.bundle'
2015-04-11 21:57:13.578418 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/FDESupport.bundle'
2015-04-11 21:57:13.583810 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleID.bundle'
2015-04-11 21:57:13.615788 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ConfigurationProfiles.bundle'
2015-04-11 21:57:13.619666 CEST - AID: 0x0000000000000000 - Registered subnode with name '/Local/Default'
2015-04-11 21:57:13.632498 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ldap.bundle'
2015-04-11 21:57:13.845588 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleODClientLDAP.bundle'
2015-04-11 21:57:13.849664 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleODClientPWS.bundle'

I had a similar problem. A couple days after upgrading, I encountered OD's "Unable to load replica" problem and had my server's certificate deleted from my system keychain!
Server.app + OD + LDAP are all extremely fragile and I just don't trust them during transitions, so I always keep an independent bootable backup with Carbon Copy Cloner and this preflight script. I'll post my notes for recovering OD below, but in my case, nothing worked this time, and I couldn't start OD robustly across reboots. Fortunately for me, my 12 hour old bootable backup was working, so I just used CCC to copy my bootable backup back. Not sure what I would have done had that not worked short of rebuilding everything from scratch.
Pre-steps:
0. Bootable backups, Time Machine backups, and dirserv backups of everything.
1. Disk Utility: Fix disk permissions, Fix disk
2. PRAM reset, Command-Option-P-R at boot
3. DiskWarrior to rebuild the disk directory
Possible steps to fix OD:
# Fix Open Directory "Unable to load replica"
# Try this first:
# https://support.apple.com/en-us/HT200018
# Quit Server.app
sudo mkdir /var/db/openldap/migration/
sudo touch /var/db/openldap/migration/.rekerberize
sudo killall PasswordService
# Open Server.app
# Try this second:
# http://apple.stackexchange.com/questions/79141/how-to-fix-failing-open-directory -database-cn-authdata-cannot-be-opened-err
sudo serveradmin stop dirserv
sudo launchctl unload -w /System/Library/LaunchDaemons/org.openldap.slapd.plist
sudo db_recover -h /var/db/openldap/authdata/
sudo /usr/libexec/slapd -Tt
sudo launchctl load -w /System/Library/LaunchDaemons/org.openldap.slapd.plist
sudo serveradmin start dirserv
# Try this third:
# https://discussions.apple.com/thread/6018956
sudo serveradmin stop dirserv
sudo slapconfig -restoredb /private/var/backups/ServerBackup_OpenDirectoryMaster.sparseimage
sudo serveradmin start dirserv
# Try this fourth (assuming ccc_preflight od backup):
# https://discussions.apple.com/thread/6018956
sudo serveradmin stop dirserv
sudo slapconfig -restoredb /private/var/backups/odbackup/od_2015-04-11.sparseimage
sudo serveradmin start dirserv
# Try this last:
sudo rsync -va /your-backup-drive-possibly-TM/private/var/db/openldap/authdata/ /private/var/db/openldap/authdata/
If your server cert gets deleted from the System keychain, you'll need to boot into the bootable backup and export the certificate+key that looks like hostname.domainname.tld, signed by IntermediateCA_HOSTNAME.DOMAINNAME.TLD_1, copy this to the server drive, import back into the System keychain. The cert should then appear within Server.app again. See here for how to do this if all you have is the System keychain file.
If anyone has reliable advice how to fix a corrupt OD that would be a huge help.

OXS server 3 with mavericks, it will not load up the assistant with open directory and will not allow me to use old open directory it was not a clean install just upgrade. any help or advise appreciated as i really need the server.

OXS server 3 with mavericks, it will not load up the assistant with open directory and will not allow me to use old opeopen directory and will not allow me to use old open directory it was not a clean install just upgrade. any help or advise appreciated as i really need the server.

I wonder if the disk being referred to is actually your iPod which is not plugged in. Maybe something has stuck thinking the iPod should be there.
Try completely removing all the iTunes related programs according to this method.
http://support.apple.com/kb/HT1923
Restart you PC and see if startup improves.
If it doesn't improve you need to consider the possibility that there is something else going on.
If The problem goes away, hopefully a fresh install will be OK.

Open Directory and Mobile Home Folders

Hi All,
I am a bit confused about Open Directory and Mobile Accounts! here is our scenario. We have an Open Directory setup and all Accounts are set to mobile, accounts are almost 250+, my main problem is the Synchronization Conflicts, the accounts are automated to sync every 30 mins, the problem is every now and then schronization conflict windows popups, our users are complaining almost everytime, another problem is all of the users home folder has a qouta of 5GB, problem is there are users who excedd on the qouta some goes up to 60GB and 100GB, how do i solve this two problems. i am about to loose my mind. We setup like this in order for us to have a backup of all files of the users in case problem arises in the workstation. i have notice that synching file error comes up if you have temporary files used by any applications. the home folder of each user will exclude library, trash, music and entourage databse. Please Do help me.!!! Anyone who knows..?
Environment
OD Server - MacOS X Server Tiger 10.4.4
Workstations - mix MacOS X Tiger 10.4.4 - 10.4.7
AFP Home Folder - MacOS X Server Tiger 10.4.6 mounted Xsan Volume for home folders
johnaris
PLEASE HELP!

Thanks for the info, by now i will look into that little utility that is very helpful (console!)
Yes, I was thinking of synching our users at login and logout, the problem here is that, users here has bigger home folders.. mostly about 3GB, and it will took time to login a user, about 6-10 mins, depends on the network, we have networks users that that has slow networks and fast network on video editing users. What I did is that i excluded the Library in the synch options on each unit here, since we are not using Apple's Mail and iCal, it did minimize the synching error but the temp files and date discripancies are mostly that will generate an error, I am having really problems with this.
thanks for the info i really appreciate it.

Reconfigure Open Directory in Yosemite Server

Is it possible to delete and reconfigure Open Directory in Yosemite server?
The host name and configuration were modified after Open Directory was activated and I get the message "Unable to load replica list" in the Settings Tab of Open Directory on the Server App (Server 4.0.3 (Build 14S350)). I think the best way would be to start over the automatic configuration.

Many Open Directory problems can be resolved by taking the following steps. Test after each one, and back up all data before making any changes.
1. The OD master must have a static IP address on the local network, not a dynamic address. It must not be connected to the same network with more than one interface; e.g., Ethernet and Wi-Fi.
2. You must have a working DNS service, and the server's hostname must match its fully-qualified domain name. To confirm, select the server by name in the sidebar of the Server application window, then select the Overview tab. Click the Edit button on the Host Name line. On the Accessing your Server sheet, Domain Name should be selected. Change the Host Name, if necessary. The server must have at least a three-level name (e.g. "server.yourdomain.com"), and the name must not be in the ".local" top-level domain, which is reserved for Bonjour.
3. The primary DNS server used by the server must be itself, unless you're using another server for internal DNS. The only DNS server set on the clients should be the internal one, which they should get from DHCP if applicable.
4. Only if you're still running Mavericks server, follow these instructions to rebuild the Kerberos configuration on the server.
5. If you use authenticated binding, check the validity of the master's certificate. The common name must match the hostname and domain name. Deselecting and then reselecting the certificate in Server.app has been reported to have an effect in some cases. Otherwise delete all certificates and create new ones.
6. Unbind and then rebind the clients in the Users & Groups preference pane. Use the fully-qualified domain name of the master.
7. Reboot the master and the clients.
8. Don't log in to the server with a network user's account.
9. Disable any internal firewalls in use, including third-party "security" software.
10. If you've created any replica servers, delete them.
11. If OD has only recently stopped working when it was working before, you may be able to restore it from the automatic backup in /var/db/backups, or from a Time Machine snapshot of that backup.
12. As a last resort, export all OD users. In the Open Directory pane of Server, delete the OD server. Then recreate it and import the users. Ensure that the UID's are in the 1001+ range.
If you get this far without solving the problem, then you'll need to examine the logs in the Open Directory section of the log list in the Server app, and also the system log on the clients.

Address Book and iCal Server backups

I'm working to implement a company-wide Address Book, iCal, and iChat server via Lion Server where I work, and I've gotten most of the setup figured out (I think), and am approaching the point where I can roll it out to a few users for further testing. However, before I'm allowed to move forward any further w/ it I have to have two means of backing up in place and ready to be rolled out at the same time as the server—so I'm planning on using Time Machine as one so it does the entirety of the server and its data/settings, but they also want me to do one of the Address Book Server and iCal Server databases individually, like back up the folder the data is, so we can, if ever necessary, import the backup databases to another computer, so we at least have the content, if not the full server functionality. And, for obvious reasons, it can't be backed up locally.
So I'm looking for a means of doing this and would love any input anyone has. Ease of use/setup is pretty important as this is my first time setting Server up and I've no programming knowledge. I'm fairly sure I'll be able to find (or write my own, though that's unlikely) or modify and AppleScript that simply copies/duplicates a Finder item, and I know I can have iCal automatically run a script (so I'd just have it run every night at midnight or something), but I have yet to figure out how to get the script to copy the folder to a specified location on a different server (or, for that matter, if it's even possible, though I'm sure it is...right?). But that's not what I'm trying to ask here...though I certainly wouldn't mind if someone had thoughts on it and wanted to share them ! I just really would like to know which folders to back up, since it's not simply making an archive of the local Address Book.app database.
And, since I'm already here writing a post, I'll ask one other question that's been nagging at me: in Server Admin.app, with the server (not the services) selected in the sidebar on the left, the Access pane selected in the primary Server Admin window, and Services selected, and trying to dictate which users/groups can access which services, the user can click the "+" in the lower-left corner of the window where added users would appear, and another window pops up next to the Server Admin window that shows a list of the users (and groups if you click the appropriate button). My question is, why does it show me _krb_anonymous, _krb_changepw, and a total of 81 other items? I understand more or less what they are (in a very general sense), but why are they shown as users? More importantly, do they have to be listed there? Technically I'm probably the only one that's going to be the administrator, and I'll know not to add them or modify them, but I don't want anything related to those items appearing in a directory search in Address Book when I get it set up (as they are showing up now; for instance, one user I created is Sandy, and I have it set to include directory contacts in searches, so on a client machine that is correctly communicating w/ the server (add a user, it appears in a minute on another client machine, and vice versa) if I go to search for that name as soon as I type "s" Sandy, the actual user shows up, but so do five or six other things, all of which are items from the aforementioned list in Server Admin (pretty much anything that has an "s" in it, which of course makes sense)—and that's what I don't want, I don't want the users to search for someone, see something like _krb_anonymous pop up, then think something is screwed up and call me and demand I come fix their computer!).
Any thoughts, suggestions, and such are more than welcome and much appreciated!
Thank you to all...

See the following:
Folders You Can Move to Your new Mac
From the Home folder copy the contents of Documents, Movies, Music, Pictures, and Sites.
In your /Home/Library/ folder:
/Home/Library/Application Support/AddressBook (copy the whole folder)
/Home/Library/Application Support/iCal (copy the whole folder)
Also in /Home/Library/Application Support (copy whatever else you need including folders for any third-party applications)
/Home/Library/Keychains (copy the whole folder)
/Home/Library/Mail (copy the whole folder)
/Home/Library/Preferences/ (copy the whole folder)
/Home /Library/iTunes (copy the whole folder)
/Home /Library/Safari (copy the whole folder)
/Home /Library/Calendars (copy the whole folder)
If you want cookies:
/Home/Library/Cookies/Cookies.plist
/Home/Library/Application Support/WebFoundation/HTTPCookies.plist
For Entourage users:
Entourage is in /Home/Documents/Microsoft User Data
Also in /Home/Library/Preferences/Microsoft
For FireFox:
/Home/Library/Applications Support/FireFox
/Home/Library/Preferences/org.mozilla.firefox.plist
Credit goes Macjack for this information.

Open Directory and connection to shared folders fail

Hi,
For testing i've setup an Open Directory Master (Leopard server 10.5.2) with shared folders and portable home directories.
Login and synhronizing works as it should. But once logged in, when i click on the server in finder i just get connection failed. When i choose "connect as" and log in as the same user and password as authenticated at the login to the computer (authenticated to OD) it works.
I thought it should work like a single sign on?
Any clues?

Hi
If you browse the discussion forum you should find this:
http://discussions.apple.com/thread.jspa?threadID=1251475&tstart=0
Basically browsing using the Finder or Side Panel does not work well or breaks easily (as far as I can tell it has been like this since 10.2). In an OD environment trying to connect and getting a ticket using that method will probably fail. The workaround - or the 'fix' - is to use 'Connect to Server' from the Go Menu using the Server's IP address. In my experience it does not seem to matter whether AFP is set to Kerberos, Any or Standard for the authentication method. It also does not seem to matter whether the Server is configured in Standard or Advanced.
I've not come across anything yet regarding Workgroup. Probably in that configuration it may not be an issue as this mode - as far as I can see - is ideal for AD-OD integration. In that environment OSX Server would not be the KDC and mac clients will be using the AD for SSO.
Since this has been happening since 10.2 I don't see Apple addressing this anytime soon, however you never know?
Tony

Can't turn on open directory in the server app

hi, i can't turn on open directory in the server app, I am running the new version of Mavericks (10.9.2)
please help me

If DNS services aren't properly configured and operating correctly, then various other parts of the OS X Server environment tends to be somewhere between flaky and unstable.
To verify DNS is working correctly, launch Terminal.app from Applications > Utilities and issue the following harmless diagnostic command:
sudo changeip -checkhostname
You'll need to enter an administrative password for the sudo, might see a one-time message about the use of sudo, then see some configuration information, and then an indication that no changes are required, or that there are issues with the network or with local DNS services. This tool will spot most local DNS and network errors, but will not spot an erronous configuration using the .local top-level domain; don't do that.
If you do not have another DNS server on your local network — the screen shot shows DNS isn't running locally, but it's possible there's another DNS server in use. If you do not have a local DNS server (and you're on a NAT'd network) here's how to set up DNS on a NAT'd network — DNS is essential for proper operations of OS X Server, and on a private NAT'd network, that's only possible with your own DNS services. You cannot successfully reference off-network DNS servers here (not the DNS servers at your ISP, nor at Google, and not via a low-end firewall that might have a DNS resolver, etc), as these off-NAT'd network DNS servers do not return the necessary IP-address-to-domain-name translations necessary for your hosts. These name-to-address and address-to-name DNS translations are part of distributed authentication and network encryption.

Terminal Commands to clean Open Directory and Profile Manager

Hi,
So I've made the fun decision to move to ML Server as we are just getting services up and we should be on the most recent software to start. I have had interment luck with Open Directory and Profile Manager and was looking for a way to wipe the data bases and start clean.
I have tried getting to the ( usr/share/devicemgr/backend and running wipDB.sh. however the database doesnot exist.
It would be nice to clean the databases and setting instead of doing a full reinstall of MT Lion.
Thanks!
~FSU IT

So just found the fix for Profile Manger.
http://support.apple.com/kb/HT5349
Thanks to this post for finding it - https://discussions.apple.com/thread/4142185?tstart=0

Open directory in mavericks server.

Setting up mavericks server - open directory displays error " server was successfully configured as a directory server but an error occurred" I have tried everything. Can anyone help ?

Does the server show up in the Server list as (Master)? If so, delete it, make absolutely sure your DNS set up and try again.
Even though I hsve a fully qualified Domain name, SERVER.DOMAIN.COM and my reverse lookup set weith my ISP. if I do a lookup for the IP of my server it returns server.domain.com, found Open Directory was much happier if I used the DNS server on the Server Itselfl
In Server DNS created a Primary Zone for my doman, domain.com. Then a Machine A Record for server,domain.com. It automatically made a nameserer record of server.domain.com and the Reverse Zone and server mapping for reverse lookup. Then set it to perform lookups for this server only. Then set 127.0.0.1 as the First DNS server in System Network Settings before any ISP DNS Servers. Then for good measure also entered my ISPs DNS servers in as forwarding servers. Then setup Open Directory with the correct domain with no errors.

How to best set up a mail and calendar server for a church

I am the IT guy for a smaller church of 200 regular attendees. We want to start hosting our own mail and calendar server. We bought a mac mini and installed mac os x server. So far I have enabled the mail, calendar, and contacts sections of the server but we aren't live quite yet (domain is not pointed at the server yet). My question is, I do not know much about profile manager or open directory, would those benefit me at all? I do not wish to manage devices, I just want to make the most use out of the computer as a mail server primarily. I have found some limitations on users and groups where I wish I could do more (such as creating mailing lists that include e-mails that are not hosted from within the server without creating a user that forwards to personal e-mail for every person).
Would open directory and/or profile manager add more functionality to the computer as a mail server?
Thank you

@camelot
What is it exactly open directory will give me that I cannot do with the regular software in this regard? I am not sure what you mean by a signle shared mailbox and calendar.
@cpragman
Google apps for business was something I was looking into at one point but decided not to use it. Once we grow more I can see us moving over to it but with just maybe 5 people tops having a real e-mail address it seems a little overkill. (I apologize, I omitted that from my original question, i only put in the number of attendees)
@Lincdavis
Fortunately I don't care about whether they can create it themselves or not . And your comment about creating a sharing-only user. Do you mean for every external e-mail I want in a mailing list, I need to create a user for them (with services disabled) and then change mail options to forward to their personal e-mail?
Then go back to groups, create a group that can be e-mailed, and add those users to it?
Thanks

Open Directory and passwords

Hi, I have come across something really odd someone pointed out to me with Tiger Server, and this is something I've not been able to duplicated on Panther Server, or at least I don't think I have been able to.
The situation is this: There are three people in my workgroup who have "administrative" privileges for our small server cluster. When logging into one of the servers, it is possible for a person with administrative privileges to log into the server with any user existing user name, and use their own password, or the global administrative password to log into any account. This does seem weird to me. Is there an article somewhere that explains this? I've done a bit of searching, but am not sure on what I am looking for here.
I am starting to work with Open Directory and LDAP sharing of login information across a series of three servers and am wonder if it might be linked to this, and why/how, etc. Anyone with any good or bad thoughts on this.
Thanks so much.

Hi trotter,
In fact this is a feature called 'masquerading' by Apple which can be very helpful, particularly when when troubleshooting permissions issues on mouted volumes. It allows admins to mount volumes via afp 'as users'.
It was first implemented for Apple servers back in ASIP 6, and the feature exists in both Panther and Tiger.
If you don't want this feature you can uncheck Serrver Admin > AFP > Access > Enable Administrator to masquerade... I believe the box is unchecked by default so one of the admins must have checked it.
IMHO it would also be very useful for admins to be able to have the options to masquerade to user OD/NetInfo accounts also.
HTH,
b.

Do I need to use open directory on Yosemite Server, I'm only looking to use file sharing and VPN

I'm setting up a new mac mini server with Yosemite and I was wondering if there are any advantages or disadvantages to not using the open directory service? The only services I'm planning on using are File Sharing and VPN.

You don't need Open Directory unless you want to manage user accounts centrally on the server.

Open directory and Directory Utility

I'm in a public school system that has everything running within a private IP setting. We have a Leopard server that has been set up so that access by means of a public IP and DNS entry is possible. Ports have been opened to allow iChat, iCal, web, and ARD to function. What we have not been able to do is to use Directory Utility to connect to OD. ARD is working well from outside the district. I can use Directory Utility inside the firewall, but not on the public side of it. Can do a lookup on the DNS entry, but not ping the machine by IP nor by name. I've looked to see if I've missed a port, but I'm not sure what might be missing. I've not located anything that would provide a port that Directory Utility might need to be able to make it through the firewall. Any help or possible direction would be appreciated.

You should post to the server products forums.

DNS, Open Directory, and wow my head hurts

OK, I’m slowly pulling my ear hairs out over this. My comprehension of the DNS world is modest at best (I know enough to get into trouble). I did not set up most of this (not the DNS parts anyway), and I’m trying to unravel what exactly is going on. Maybe it’s exactly as it should be; but it seems awfully convoluted to me, so if you’re bored and want to show off your expertise and ability to explain it to a kindergartener, please read on…
Let’s say my Domain is mydomain.com. (You can probably figure out what it really is, but I’d rather not sprinkle a post with it.)
Our firewall is a Sophos UT320. It obviously supports forwarding of DNS info from our ISP. While it’s own documentation says it does not have a full-fledged dns server, it does have something called “Static Entries” which seems to be a bare-bones dns server of sorts. I can set any static domain name (myserver.mydomain.com for example), point it to a server on our lan, and everyone internally can get to that server by using myserver.mydomain.com instead of 192.168.blah.blah. It also supports reverse DNS, so if I issue a host 192.168.blah.blah command from my computer, I get “blah.blah.168.192.in-addr.arpa domain name pointer myserver.mydomain.com.” My guess is that it’s only serving up A records. No one from outside our LAN can access these servers or records (unless they’re on a VPN of course).
Now, in our lan, we have a bunch of Mac Servers. Our Open Directory server has DNS service enabled on it, and the primary zone is set to od.mydomain.com. It has some A records pointing to myserver.mydomain.com, myotherserver.mydomain.com, etc.
Another server, located at, myserver.mydomain.com, has a DNS service who’s primary zone is mydomain.com (yes, it matches our external domain name). It contains A records for itself, the OD Server, and others.
Reverse lookup works fine throughout the lan.
All DNS Servers’ Forwarders are our router.
I did a test where I turned off all these internal DNS servers (yes, there’s more) and pointed all the servers to the router. It seemed fine at first, I could issue HOST commands to and from every server to every other one and resolve both names and addresses. The router seemed to be doing fine.
After a day or so (I assume after the TTL elapsed), people started getting permissions errors on the servers, so I turned it all back on.
This is with 10.6.8 Servers (one is running 10.9 but it doesn't seem to have DNS running).
So here’s my questions:
Why would my OD Server’s DNS Service’s primary zone be “od.mydomain.com” and not just “mydomain.com”?
Does it make sense (or even matter) to have these DNS entries ending in mydomain.com when that’s our website’s address? (We host our own site and email server, btw.)
Why would OD not work after all these DNS Servers were turned off, when HOST command shows it can get to every other machine and they can get to it? What else, besides the A record and reverse lookup, could be included in the full-blown DNS servers that wouldn’t be in the Sophos bare-bones one, but still allow reverse lookups to function? What else does OD want from DNS??
Wouldn’t it be better, even if this all was necessary, to set up a single internal DNS Server (ok, maybe plus a backup)? Why would this service be running, with a variety of A records, on almost every server we have?
Is there a site that can explain DNS, and actually define every acronym, abbreviation, etc it uses? Every time I try to learn something I go down a wiki rabbit hole.
Thanks!
Jeff

OK, the answer to this seemed to be to not rely on Sophos' "Static Entries" DNS functionality. Even though it allows "HOST" commands to work for both reverse and forward lookups, OD and/or Kerberos needs more. Once I made a zone on our OD Server that listed itself, our replica server, AND our email server (which uses Kerberos), and made what I think is now a proper secondary DNS server on our replica server, and pointed the OD server's DNS to itself, the replica to itself, and kept the email server using the Sophos for DNS, it worked.

Setting up Open Directory and iCal server.

Similar Messages

Maybe you are looking for