Terminal Commands to clean Open Directory and Profile Manager

Hi,
So I've made the fun decision to move to ML Server as we are just getting services up and we should be on the most recent software to start. I have had interment luck with Open Directory and Profile Manager and was looking for a way to wipe the data bases and start clean.
I have tried getting to the ( usr/share/devicemgr/backend and running wipDB.sh. however the database doesnot exist.
It would be nice to clean the databases and setting instead of doing a full reinstall of MT Lion.
Thanks!
~FSU IT

So just found the fix for Profile Manger.
http://support.apple.com/kb/HT5349
Thanks to this post for finding it - https://discussions.apple.com/thread/4142185?tstart=0

Similar Messages

Hosting web service on one Xserve and Profile Manager on another?

Hello.
I'm trying to get Profile Manager running on a second Xserve in our studio but I'm having an issue making connections to it from the WAN because I already have HTTP and HTTPS running on a different Xserve.
The set up is something like this:
Xserve001 (xs1.mydomain.com)
- DNS
- Web service hosting a secure site (via SSL) on port 443
- Web service hosting a non-secure site on port 80
Xserve002 (xs2.mydomain.com)
- Open Directory Master
- Profile Manager on ports 80, 443, 1640
Since the router/firewall (between the WAN and be two Xserves on the LAN) handles port forwarding, right now, http and https connections (i.e., ports 80 & 443) are forwarded to Xserve001 for the web hosting.
I would like to enable Profile Manager on Xserve002, but connections won't work from the WAN (via xs2.mydomain.com) because ports 80 & 443 are forwarding to Xserve001 (from within the LAN we're fine because DNS handles everything without going through the router).
So, what would I need to do to get this to work when attempting connections from the WAN?
Thanks,
Kristin.

This is tricky to do, especially since you have multiple SSL certificates involved.
Ordinarily I'd say the easist option is to have xs1 proxy the connection to xs2 - that way all requests come into xs1 which then determines specific requests are for the profile manager and sends them across the local network.
This will work well enough for port 80 requests, but the SSL requests will fail unless you either have a wildcard SSL certificate (e.g. for *.mydomain.com) or you have a certificate that includes both hostnames.
Without one of these options on your server you're doomed to failure because clients will warn of a hostname mismatch in the SSL certificate (you asked for xs2.mydomain.com but I got a certificate from xs1.mydomain.com) and I don't think iOS or Mac OS X will allow you to connect in this manner.
The other solution hinges around your internet connection, and whether you only have a single IP address or multiple. If you have multiple then you can setup a different public IP address to map to xs2. This is probably the all-round easiest solution, especially when dealing with NAT networks.

OXS server 3 with mavericks, it will not load up the assistant with open directory and will not allow me to use old open directory it was not a clean install just upgrade. any help or advise appreciated as i really need the server.

OXS server 3 with mavericks, it will not load up the assistant with open directory and will not allow me to use old opeopen directory and will not allow me to use old open directory it was not a clean install just upgrade. any help or advise appreciated as i really need the server.

I wonder if the disk being referred to is actually your iPod which is not plugged in. Maybe something has stuck thinking the iPod should be there.
Try completely removing all the iTunes related programs according to this method.
http://support.apple.com/kb/HT1923
Restart you PC and see if startup improves.
If it doesn't improve you need to consider the possibility that there is something else going on.
If The problem goes away, hopefully a fresh install will be OK.

Open Directory and passwords

Hi, I have come across something really odd someone pointed out to me with Tiger Server, and this is something I've not been able to duplicated on Panther Server, or at least I don't think I have been able to.
The situation is this: There are three people in my workgroup who have "administrative" privileges for our small server cluster. When logging into one of the servers, it is possible for a person with administrative privileges to log into the server with any user existing user name, and use their own password, or the global administrative password to log into any account. This does seem weird to me. Is there an article somewhere that explains this? I've done a bit of searching, but am not sure on what I am looking for here.
I am starting to work with Open Directory and LDAP sharing of login information across a series of three servers and am wonder if it might be linked to this, and why/how, etc. Anyone with any good or bad thoughts on this.
Thanks so much.

Hi trotter,
In fact this is a feature called 'masquerading' by Apple which can be very helpful, particularly when when troubleshooting permissions issues on mouted volumes. It allows admins to mount volumes via afp 'as users'.
It was first implemented for Apple servers back in ASIP 6, and the feature exists in both Panther and Tiger.
If you don't want this feature you can uncheck Serrver Admin > AFP > Access > Enable Administrator to masquerade... I believe the box is unchecked by default so one of the admins must have checked it.
IMHO it would also be very useful for admins to be able to have the options to masquerade to user OD/NetInfo accounts also.
HTH,
b.

Open Directory and Mobile Home Folders

Hi All,
I am a bit confused about Open Directory and Mobile Accounts! here is our scenario. We have an Open Directory setup and all Accounts are set to mobile, accounts are almost 250+, my main problem is the Synchronization Conflicts, the accounts are automated to sync every 30 mins, the problem is every now and then schronization conflict windows popups, our users are complaining almost everytime, another problem is all of the users home folder has a qouta of 5GB, problem is there are users who excedd on the qouta some goes up to 60GB and 100GB, how do i solve this two problems. i am about to loose my mind. We setup like this in order for us to have a backup of all files of the users in case problem arises in the workstation. i have notice that synching file error comes up if you have temporary files used by any applications. the home folder of each user will exclude library, trash, music and entourage databse. Please Do help me.!!! Anyone who knows..?
Environment
OD Server - MacOS X Server Tiger 10.4.4
Workstations - mix MacOS X Tiger 10.4.4 - 10.4.7
AFP Home Folder - MacOS X Server Tiger 10.4.6 mounted Xsan Volume for home folders
johnaris
PLEASE HELP!

Thanks for the info, by now i will look into that little utility that is very helpful (console!)
Yes, I was thinking of synching our users at login and logout, the problem here is that, users here has bigger home folders.. mostly about 3GB, and it will took time to login a user, about 6-10 mins, depends on the network, we have networks users that that has slow networks and fast network on video editing users. What I did is that i excluded the Library in the synch options on each unit here, since we are not using Apple's Mail and iCal, it did minimize the synching error but the temp files and date discripancies are mostly that will generate an error, I am having really problems with this.
thanks for the info i really appreciate it.

Certificate and Profile Manager

I've had my server setup and running for awhile now and its working fairly well for the first time in months.
However, when trying to enable Profile manager, I got this error:
The error occurred while processing a command of type 'exportIdentity' in plug-in 'servermgr_certs'.
I've had OD up and runnig for awhile and the system made its typical OpenDirectory Intermediate CA as part of that process.
But in addition to the above error, when I go to profile manager, no certificate shows up. Any ideas how to fix this error?

I'm running into the same problem. I upgraded an Open Directory server from 10.6.8 to 10.8.2. I'm running the latest version of Server.app. I have a valid code signing certificate from DigiCert. When I try to import it I get errors and now when I open up the Profile Manager service I receive the error "'exportidentity' in plug-in 'servermgr_certs'". I can only choose a self-signed cert and even with that chosen I still receive that error.

Print server, AD, and Profile Manager

Having a number of issues that I can resolve regarding printing--I am trying to set up profiles in the Profile Manager, but printers are not available or visable. However they are visable in the workgroup manager. The printers reside on Windows print server (2008 R2). Further I can add the printers to my server, but they are not visable in the "Printer Sharing" section of "sharing". So with that, I have a few questions:
1. Do I need to turn on Kerberos in CUPS? User's don't authenticate to our printers via Kerberos, but via the Account manager of the individual printers.
2. Why do settings in Workgroup manager not apply? I can add the printers via LDAP the the new groups I have added, but when I open profile manager the changes or printers are not implemented.
3. How do I make printers visible in Profile Manager?
I have scoured the net and several manuals, but I can seem to stumble upon the correct answer.

Hi,
I have the same issue, very frustrating. Using a Win 2003 AD and 10.8.2 server and clients. If i use WGM I can see all users and groups correctly, but Server.app and Profile Manager does not show them correct.
Strange that we see issues like this since Profile Manager has been around for a while, really interested to hear other peoples experiences.
PS I see a similar thing here: https://discussions.apple.com/thread/4417085?start=0&tstart=0

User synchronization issue between Active Directory and Solution manager.

Requirement:
Synchronize the users between Active directory and solution manager system.
What we did:
1. Created RFC connection (LDAP_RFC) for LDAP connector.
2. Created new LDAP connector that utilize the RFC (LDAP_RFC).
3. Created new logical LDAP Server(CUA).Here we have to maintain the connection
details to the physical directory.
4. We maintained the communication user that is used by the LDAP connector to bind the LDAP Directory Server.
5. In transaction LDAPMAP specific SAP data fields, we mapped to the desired
directory attributes.
6. Testing from LDAP transaction working fine. We are able to see the attributes and
values from Active directory.
Issue:
When executed the program RSLDAPSYNC_USER for user synchronization from t-code se38 with below selection .
LDAP Server = CUA (created earlier)
LDAP Connector = LDAP_RFC (RFC connection created created ealier)
In the tab: (Object that exist both in the directory and in the Database:)
Selected: Compare Time Stamp.
In the tab: (Objects the only exist in the Directory.)
Selected : Create in Database.
In the tab(Objects that only Exist in the Database:
Selected: Ignore Object.
Result from the report shows that connection to LDAP server is fine and 0(zero) objects in Directory.
The program does not create any new user in the Solution Manager system.
Any help on this issue greatly appreciated.
Thanks & Regards,
Harish

where did you see this error ? is there anymore details.
i think the account you are using for Sync does not have Replicate Directory Changes permission in AD. follow below article and give Replicate directory changes permission.
http://technet.microsoft.com/en-us/library/hh296982(v=office.15).aspx
Thanks, Noddy

Can�t open array and object manager

Hello,
i�ve done a fresh install of SGD 4 on Fedora Core 3.
Here I am not able to open array and object manager. I see them running in
the webtop but get no display.
I get the following logs:
in wm_errors: X connection to unix:10.0 broken (explicit kill or server
shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:12.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
..skipping...
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:12.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
~
and in error.log
2005/03/01 18:31:54.951 (pid 20049) pem/circuit #0
Tarantella Secure Global Desktop Enterprise Edition(4.0) ERROR:
An error occurred reading on circuit fdcircuit. Reason: (9) Bad file
descriptor.
The current operation has failed.
If persistent, restart the server.
Restarting the server doesn�t help.
I�ve also set the xscecurity flag to 0.
This all works fine with Fedora Core 2
Anyone any Idea?
Thanks a lot

Hi Matthias,
I had similar problems with (local) X apps.
via ssh, and I mean they arose with tta vers.
3.42. The problem seems to appear, because
both tta and ssh (with X forwarding) are
using a X-display range from :10 upward.
So, one simply can resolve this by using a different X-display offset for
ssh, by setting:
X11DisplayOffset 100
(for exsample) in sshd_config.
Then tta still uses displays :10, :11, ...
but ssh is using :100, :101, ...,
(assuming that 90 X/RDP emulator-session are enough in this installation!)
Don't forget to send a SIGHUP to the master
sshd after changing sshd_config, telling
'him' to re-read it's config-file.
One can verify the effect, by calling
'ssh localhost' and executing: echo $DISPLAY
this should give something like:
localhost:100.0
Kind regards,
Tankred
Matthias wrote:
Hello,
not all login authorities are disabled. I have only NT auth. enabled. This
works fine in EE 3.40 on RH 9 and on SGD4.0 on Fedora Core 2. But seems
not to run on Fedora Core 3.
Matthias
Carmelo wrote:
Mattias,>>
>
http://www.tarantella.com/support/documentation/sgd/ee/4.0/help/en-us/base/indepth/disabled_all_login_authorities.html
Regards,
Matthias wrote:
I think I�ve fixed it.
I just edited ssh_conf and enabled X11forwarding and it works for me.
But now I have changed the login authority only to NT auth. and I am no
longer able to log in to tarantella....
Matthias wrote:
Hello,
i�ve done a fresh install of SGD 4 on Fedora Core 3.
Here I am not able to open array and object manager. I see them running
in
the webtop but get no display.
I get the following logs:
in wm_errors: X connection to unix:10.0 broken (explicit kill or server
shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:12.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
...skipping...
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
X connection to unix:12.0 broken (explicit kill or server shutdown).
X connection to unix:10.0 broken (explicit kill or server shutdown).
~
and in error.log
2005/03/01 18:31:54.951 (pid 20049) pem/circuit #0
Tarantella Secure Global Desktop Enterprise Edition(4.0) ERROR:
An error occurred reading on circuit fdcircuit. Reason: (9) Bad file
descriptor.
The current operation has failed.
If persistent, restart the server.
Restarting the server doesn�t help.
I�ve also set the xscecurity flag to 0.
This all works fine with Fedora Core 2
Anyone any Idea?
Thanks a lot

Open Directory and AFP

Hello, I have been having some problems setting up Tiger Server to have the clients home directory hosted on the server. When the client tries to login, it gives them an error saying they are unable to log on at this time because of afp. If anyone could help or point me to a guide it would be appreciated.
-Bobby

Hi
For 10.4 Server you should really post in the 10.4 OD Forum here:
http://discussions.apple.com/forum.jspa?forumID=713
However it does not really matter. You may find what follows useful:
A Simplified Method for Deploying Open Directory Services
A centralized authentication and authorization service providing automounting home folders for network users and control for service administrators using managed preferences. Ideal for Schools, Colleges, Libraries, Universities and in some cases, Private Companies
These instructions are for the GUI only with no manual configuration and hardly any recourse for the command line. These instructions also assume that this will be the only server on the network.
Substitute appropriately the examples given for your situation. The example used is for a pretend school called ‘High School’
Assuming you have installed the Server Software and on restart the Server Setup Assistant has launched. We’ll use Administrator as the long name and admin as the short name with admin as the password for the default Server Administrator account (UID 501). We’ll assign a fixed IP address of 172.16.16.254, a subnet mask of 255.255.255.0 and the router/gateway IP address offering access to the internet as 172.16.16.1. Key in any ISP supplied DNS Server IP addresses in the DNS Servers field in the Network Preferences Control Panel. The server name will be server. You will see the server name in the Sharing Preferences Pane (server.local) as well as Server Admin > Computers & Services. The Server can be reached either using this name, its IP address, its loopback address and later on, after the DNS Service has been configured, its Fully Qualified Domain Name (FQDN). Don’t start any services apart from Remote Desktop, save the configuration as a text file and restart the Server. After the restart log in using the newly created System Administrator account details. Now would be a good time to test internet connectivity as well as running Software Update and installing all the updates relevant for the server.
Start simple file services first: AFP and if necessary Windows. If there is more than one PC already on the network switch off Workgroup Master Browser and Domain Master Browser found in Server Admin > Windows > Advanced > Services. Create a test user in the local server directory (NetInfo) and test using a client computer to access the default share points: Users, Groups, Public. Don’t be tempted to delete these folders as the server will complain. If you don’t want to use these you can simply unshare the share points and create new ones. You could for example create share points on a connected XServe RAID and share these instead. Save any changes made.
The instructions that follow are for simple DNS Settings which will do to successfully deploy an Open Directory Master
Click on DNS Service Settings > Zones > click the + icon > General. The Server IP address will already be there, key in the Fully Qualified Domain Name (FQDN). This can either be a real world domain name or a pretend domain name. As long as it resembles fully qualified domain names it will do, avoid using .local.
In this example we will use server.highschool.sch.org.
Save the changes
Now click Start Service. You will have to click Start Service twice as Server Admin does not start the service the first time as that is when the config files are written. These are kept in two locations: /etc/host.config and /var/named. The second time you click Start Service you will get the green light. Now set the Logging level to Debug and save the changes again. Launch System Preferences > Network > Configure > TCP/IP > key in the Server’s own IP address 172.16.16.254 in the DNS Servers field and remove any other IP address. Apply and save changes. Launch a web browser and see if you can get on the internet. Inspect the DNS logs in Server Admin and you will see entries starting with createfetch as well as received control command channel status: ready. By this time you should be on the internet using the server’s own IP address instead of ones supplied by your ISP or Router. Test and qualify the DNS Service by launching terminal and issuing the host command:
host server.highschool.sch.org
server.highschool.sch.org has address 172.16.16.254
host 172.16.16.254
254.16.16.172.in-addr.arpa domain name pointer host172-16-16-254.in-addr.server.highschool.sch.org
This qualifies the forward and reverse pointers for the DNS Service
Remember that a properly configured and qualified DNS service is crucial to the more advanced technologies available on OSX Server. Apple themselves recommend using DNS even if the Server is providing simple file services such as AFP
If you want the Server to issue IP addresses then consider using the DHCP Service. If your router is already doing this then there is no need to bother just yet. Once you get comfortable and familiar with the Server you could look at this later on.
Back to Server Admin
Click on Open Directory > Settings > Select Standalone and now select Open Directory Master. As soon as you do this you will be prompted to create the Directory Administrator account, by default diradmin. You can’t use the standard administrator account. You dont have to use diradmin as the name you can use another name, but don’t be tempted to use admin. For this example we will leave it as it is as well as defining the password as diradmin. If DNS Services are correctly configured you will see the Kerberos Realm field already filled in for you and it will look like this: SERVER.HIGHSCHOOL.SCH.ORG. As you can see it will be the FQDN but in capitalized form. The search base will be automatically filled in also and it will look like this: dc=server,dc=highschool,dc=sch,dc=org.
Save changes.
Launch Directory Access /Applications/Utilities and click on LDAPv3, authenticate if required to do so. Inspect the configuration setting there and you should see the Server’s loopback address 127.0.0.1 has been entered as a New Configuration. This is normal and gets added upon promotion. Now launch Workgroup Manager and select the appropriate Directory Node LDAPv3/127.0.0.1. Authenticate using the newly created Directory Administrator account: diradmin. If everything has gone well you will see the Directory Administrator user (UID 1000) already there. Create a new user called Andrew Barton, short name: andybarton, UID 1025, password andyb, click Save. Select Sharing and make sure that the default Users folder is set to share, now click on Network Mount and click the lock, authenticate using the diradmin account and set the Users home folder to automount Home Directories. Click Save. Click Accounts, select Andy Barton, click Home, verify that the Home Folder path says afp://server.highschool.sch.org/Users, select this and click Create Home Now followed by Save. Navigate to the Finder, double click the Server hard drive, double click the Users folder and verify that the folder andybarton has been created. Double clicking on this folder will show the usual set of home folders with no entry signs on all of them apart from public and sites. Carry on populating the LDAP Directory Node with desired users. Once you have finished click on the Groups tab and create a group and call it Music Class, populate this group with desired users. We will look at Managed Preferences (MCX) for this group later on.
In this example Music Class has 30 iMacs. Use the first iMac as a model for all the others. Create an administrator account on the first iMac with a strong password. Avoid using Administrator and admin as these could conflict with the Server admin account. Don’t use a User Account already created on the Server. I will use MC Administrator as the long name and mcadmin as the short name, switch off auto log-in. Install all relevant site license software on this mac. Set the iMac’s name in the Sharing Preferences Pane to iMac01, the .local part will be automatically filled in for you, save all changes. Run all software updates available for the mac, restart the mac. You can now use this mac as the ‘Golden Mac’ – a template for all the other iMacs. You can target disk mode this first mac to the second mac and after cloning change the name of the second mac to iMac02. Or you could image iMac01 to an external firewire drive, connect the drive to the server and use Apple Remote Desktop (ARD) to push out the image to all the other macs. You could also use System Image Utility, PackageMaker and NetInstall. As you can see there are numerous ways of doing this.
Back to iMac01
Log in using the mcadmin account, launch Directory Access (Applications/Utilities), click on the lock and authenticate, select LDAPv3, click Configure, deselect ‘Add DCHP-supplied LDAP servers to automatic search policies’, click New and key in either the IP address 172.16.16.254 or better still its FQDN. If you are going to use the Server’s FQDN then make sure the Server’s IP address is in the clients DNS Servers field. Server discovery should be fairly quick, you will see iMac01.local’s computer in the first field and you will be prompted for a network user name and password, don’t bother with this just click OK and then continue, you will then see the Server Configuration in the Services window, click OK. Click on Authentication and verify that Custom Path is displayed, you should see /LDAPv3/172.16.16.254 or the server FQDN as the second Directory Domain displayed (the first one will be the local NetInfo node and will be grayed out). Do the same for the Contacts tab, click OK and quit Directory Access, select log out from the Apple menu and you should now see a log in window displaying the local mcadmin account as well as ‘Other’. Click Other, key in andybarton as the name and andyb as the password, you should now be logged into the Home Folder for that user on the server. Launch TextEdit, type a few words and save the Untitled document to the Documents folder, now log out. Go to Workgroup Manager, select Sharing, select Users, select andybarton, select Documents and you should see the Untitled document grayed out.
Managed Preferences or MCX
Select the Music Class Group, click on Preferences > Finder > Views > Always > Default View and select the smallest setting for the dock size, click Done, go back to the client and log in again as andybarton and see if the dock size has changed. The order in which managed preferences take precedence are:
User
Computer
Group
If a setting is defined in Group and also defined differently in Users, the Users setting will take precedence. Managed Preferences can be accumulative also. What can be managed for Users and Groups are the same. Computer Lists are the same with the addition of Energy Saver. Play with these settings as seems appropriate to you. If you decide to manage clients using Computer Liststhen create your own (by type and location), try not to use the default lists. The same advice applies to Network Views.
As time goes by and you become more familiar and comfortable you can start integrating the Software Update Service, NetBoot/NetInstall, Mail Services, Print Services and any other Service that seems appropriate to you.
Hope this helps, Tony

Command-Line Remove Open Directory Server

What is the terminal command to remove an Open Directory server?

On LDAP server open the Terminal and run this:
+sudo slapconfig -destroyldapserver+
*man slapconfig* will give you more interesting options

DNS, Open Directory, and wow my head hurts

OK, I’m slowly pulling my ear hairs out over this. My comprehension of the DNS world is modest at best (I know enough to get into trouble). I did not set up most of this (not the DNS parts anyway), and I’m trying to unravel what exactly is going on. Maybe it’s exactly as it should be; but it seems awfully convoluted to me, so if you’re bored and want to show off your expertise and ability to explain it to a kindergartener, please read on…
Let’s say my Domain is mydomain.com. (You can probably figure out what it really is, but I’d rather not sprinkle a post with it.)
Our firewall is a Sophos UT320. It obviously supports forwarding of DNS info from our ISP. While it’s own documentation says it does not have a full-fledged dns server, it does have something called “Static Entries” which seems to be a bare-bones dns server of sorts. I can set any static domain name (myserver.mydomain.com for example), point it to a server on our lan, and everyone internally can get to that server by using myserver.mydomain.com instead of 192.168.blah.blah. It also supports reverse DNS, so if I issue a host 192.168.blah.blah command from my computer, I get “blah.blah.168.192.in-addr.arpa domain name pointer myserver.mydomain.com.” My guess is that it’s only serving up A records. No one from outside our LAN can access these servers or records (unless they’re on a VPN of course).
Now, in our lan, we have a bunch of Mac Servers. Our Open Directory server has DNS service enabled on it, and the primary zone is set to od.mydomain.com. It has some A records pointing to myserver.mydomain.com, myotherserver.mydomain.com, etc.
Another server, located at, myserver.mydomain.com, has a DNS service who’s primary zone is mydomain.com (yes, it matches our external domain name). It contains A records for itself, the OD Server, and others.
Reverse lookup works fine throughout the lan.
All DNS Servers’ Forwarders are our router.
I did a test where I turned off all these internal DNS servers (yes, there’s more) and pointed all the servers to the router. It seemed fine at first, I could issue HOST commands to and from every server to every other one and resolve both names and addresses. The router seemed to be doing fine.
After a day or so (I assume after the TTL elapsed), people started getting permissions errors on the servers, so I turned it all back on.
This is with 10.6.8 Servers (one is running 10.9 but it doesn't seem to have DNS running).
So here’s my questions:
Why would my OD Server’s DNS Service’s primary zone be “od.mydomain.com” and not just “mydomain.com”?
Does it make sense (or even matter) to have these DNS entries ending in mydomain.com when that’s our website’s address? (We host our own site and email server, btw.)
Why would OD not work after all these DNS Servers were turned off, when HOST command shows it can get to every other machine and they can get to it? What else, besides the A record and reverse lookup, could be included in the full-blown DNS servers that wouldn’t be in the Sophos bare-bones one, but still allow reverse lookups to function? What else does OD want from DNS??
Wouldn’t it be better, even if this all was necessary, to set up a single internal DNS Server (ok, maybe plus a backup)? Why would this service be running, with a variety of A records, on almost every server we have?
Is there a site that can explain DNS, and actually define every acronym, abbreviation, etc it uses? Every time I try to learn something I go down a wiki rabbit hole.
Thanks!
Jeff

OK, the answer to this seemed to be to not rely on Sophos' "Static Entries" DNS functionality. Even though it allows "HOST" commands to work for both reverse and forward lookups, OD and/or Kerberos needs more. Once I made a zone on our OD Server that listed itself, our replica server, AND our email server (which uses Kerberos), and made what I think is now a proper secondary DNS server on our replica server, and pointed the OD server's DNS to itself, the replica to itself, and kept the email server using the Sophos for DNS, it worked.

After Updating to Server 4.1 Open directory and LPAD gone

Hello,
two days ago I discovered that Open directory was not working on our Server (Mac Mini 2012). I suspect it stopped working after updating to 10.10.3 and OS-X Server 4.1. When I try to start Open directory in the Server App the Server App prompts: Unable to load Replica List. When I try to recreate my Open directory Server I Get: OD Server already exists.
I get the following log entries:
LDAP Log
Apr 11 22:03:02 server.seju.eu slapd[925]: @(#) $OpenLDAP: slapd 2.4.28 (Feb 24 2015 21:45:59) $
[email protected]:/BinaryCache/OpenLDAP/OpenLDAP-499.32.4~1/Objects/servers/slapd
Apr 11 22:03:02 server.seju.eu slapd[925]: daemon: SLAP_SOCK_INIT: dtblsize=8192
Apr 11 22:03:02 server.seju.eu slapd[925]: TLS: OPENDIRECTORY_SSL_IDENTITY identity preference overrode configured olcTLSIdentity "APPLE:server.seju.eu"
Apr 11 22:03:02 server.seju.eu slapd[925]: slap_add_listener: opened additional listener 'ldaps:///'
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb(dc=server,dc=seju,dc=eu): unable to allocate memory for mutex; resize mutex region
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb_db_open: database "dc=server,dc=seju,dc=eu" cannot be opened, err 12. Restore from backup!
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb(dc=server,dc=seju,dc=eu): txn_checkpoint interface requires an environment configured for the transaction subsystem
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb_db_close: database "dc=server,dc=seju,dc=eu": txn_checkpoint failed: Invalid argument (22).
Apr 11 22:03:02 server.seju.eu slapd[925]: backend_startup_one (type=bdb, suffix="dc=server,dc=seju,dc=eu"): bi_db_open failed! (12)
Apr 11 22:03:02 server.seju.eu slapd[925]: bdb_db_close: database "dc=server,dc=seju,dc=eu": alock_close failed
Apr 11 22:03:02 server.seju.eu slapd[925]: slapd stopped.
Open Directory Log
2015-04-11 21:57:10.624284 CEST - AID: 0x0000000000000000 - opendirectoryd (build 382.20.2) launched...
2015-04-11 21:57:10.752590 CEST - AID: 0x0000000000000000 - Logging level limit changed to 'error'
2015-04-11 21:57:10.916732 CEST - AID: 0x0000000000000000 - Initialize trigger support
2015-04-11 21:57:10.951833 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/SystemCache.bundle'
2015-04-11 21:57:10.958469 CEST - AID: 0x0000000000000000 - Module: SystemCache - failed to load persistent state - Input/output error
2015-04-11 21:57:10.962533 CEST - AID: 0x0000000000000000 - Registered node with name '/Active Directory' as hidden
2015-04-11 21:57:10.962833 CEST - AID: 0x0000000000000000 - Registered node with name '/Configure' as hidden
2015-04-11 21:57:10.963182 CEST - AID: 0x0000000000000000 - Discovered configuration for node name '/Contacts' at path '/Library/Preferences/OpenDirectory/Configurations//Contacts.plist'
2015-04-11 21:57:10.963194 CEST - AID: 0x0000000000000000 - Registered node with name '/Contacts'
2015-04-11 21:57:10.963438 CEST - AID: 0x0000000000000000 - Registered node with name '/LDAPv3' as hidden
2015-04-11 21:57:10.966901 CEST - AID: 0x0000000000000000 - Registered node with name '/Local' as hidden
2015-04-11 21:57:10.968600 CEST - AID: 0x0000000000000000 - Registered node with name '/NIS' as hidden
2015-04-11 21:57:11.031990 CEST - AID: 0x0000000000000000 - Discovered configuration for node name '/Search' at path '/Library/Preferences/OpenDirectory/Configurations//Search.plist'
2015-04-11 21:57:11.032007 CEST - AID: 0x0000000000000000 - Registered node with name '/Search'
2015-04-11 21:57:12.343838 CEST - AID: 0x0000000000000000 - Discovered configuration for node name '/LDAPv3/127.0.0.1' at path '/Library/Preferences/OpenDirectory/Configurations/LDAPv3/127.0.0.1.plist'
2015-04-11 21:57:12.343888 CEST - AID: 0x0000000000000000 - Registered subnode with name '/LDAPv3/127.0.0.1'
2015-04-11 21:57:13.549377 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/legacy.bundle'
2015-04-11 21:57:13.551131 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/search.bundle'
2015-04-11 21:57:13.554053 CEST - AID: 0x0000000000000000 - '/Search' has registered, loading additional services
2015-04-11 21:57:13.554064 CEST - AID: 0x0000000000000000 - Initialize augmentation support
2015-04-11 21:57:13.557920 CEST - AID: 0x0000000000000000 - Successfully registered for Kernel identity service requests
2015-04-11 21:57:13.557940 CEST - AID: 0x0000000000000000 - Adjusting kernel ID cache (100 -> 250) and membership cache (100 -> 500)
2015-04-11 21:57:13.575235 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/PlistFile.bundle'
2015-04-11 21:57:13.578418 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/FDESupport.bundle'
2015-04-11 21:57:13.583810 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleID.bundle'
2015-04-11 21:57:13.615788 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ConfigurationProfiles.bundle'
2015-04-11 21:57:13.619666 CEST - AID: 0x0000000000000000 - Registered subnode with name '/Local/Default'
2015-04-11 21:57:13.632498 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ldap.bundle'
2015-04-11 21:57:13.845588 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleODClientLDAP.bundle'
2015-04-11 21:57:13.849664 CEST - AID: 0x0000000000000000 - Loaded bundle at path '/System/Library/OpenDirectory/Modules/AppleODClientPWS.bundle'

I had a similar problem. A couple days after upgrading, I encountered OD's "Unable to load replica" problem and had my server's certificate deleted from my system keychain!
Server.app + OD + LDAP are all extremely fragile and I just don't trust them during transitions, so I always keep an independent bootable backup with Carbon Copy Cloner and this preflight script. I'll post my notes for recovering OD below, but in my case, nothing worked this time, and I couldn't start OD robustly across reboots. Fortunately for me, my 12 hour old bootable backup was working, so I just used CCC to copy my bootable backup back. Not sure what I would have done had that not worked short of rebuilding everything from scratch.
Pre-steps:
0. Bootable backups, Time Machine backups, and dirserv backups of everything.
1. Disk Utility: Fix disk permissions, Fix disk
2. PRAM reset, Command-Option-P-R at boot
3. DiskWarrior to rebuild the disk directory
Possible steps to fix OD:
# Fix Open Directory "Unable to load replica"
# Try this first:
# https://support.apple.com/en-us/HT200018
# Quit Server.app
sudo mkdir /var/db/openldap/migration/
sudo touch /var/db/openldap/migration/.rekerberize
sudo killall PasswordService
# Open Server.app
# Try this second:
# http://apple.stackexchange.com/questions/79141/how-to-fix-failing-open-directory -database-cn-authdata-cannot-be-opened-err
sudo serveradmin stop dirserv
sudo launchctl unload -w /System/Library/LaunchDaemons/org.openldap.slapd.plist
sudo db_recover -h /var/db/openldap/authdata/
sudo /usr/libexec/slapd -Tt
sudo launchctl load -w /System/Library/LaunchDaemons/org.openldap.slapd.plist
sudo serveradmin start dirserv
# Try this third:
# https://discussions.apple.com/thread/6018956
sudo serveradmin stop dirserv
sudo slapconfig -restoredb /private/var/backups/ServerBackup_OpenDirectoryMaster.sparseimage
sudo serveradmin start dirserv
# Try this fourth (assuming ccc_preflight od backup):
# https://discussions.apple.com/thread/6018956
sudo serveradmin stop dirserv
sudo slapconfig -restoredb /private/var/backups/odbackup/od_2015-04-11.sparseimage
sudo serveradmin start dirserv
# Try this last:
sudo rsync -va /your-backup-drive-possibly-TM/private/var/db/openldap/authdata/ /private/var/db/openldap/authdata/
If your server cert gets deleted from the System keychain, you'll need to boot into the bootable backup and export the certificate+key that looks like hostname.domainname.tld, signed by IntermediateCA_HOSTNAME.DOMAINNAME.TLD_1, copy this to the server drive, import back into the System keychain. The cert should then appear within Server.app again. See here for how to do this if all you have is the System keychain file.
If anyone has reliable advice how to fix a corrupt OD that would be a huge help.

Cannot open firefox or profile manager, checked firewalls and allowed firefox

I restored my system to 3 days before the issue and still won't work. When I run a compatibility check through windows 7 (64 bit) it tells me firefox is not compatible. Until 2 days ago I only used firefox now I have downloaded several times, uninstalled, changed firewall to allow firefox using windows or McAfee security, tried opening profile manager to create a new profile but my computer does nothing.
error message in C:\program files (x86)\Mozilla firefox\browser\chrome.manifest
"Windows cannot access the specified device, path, or file. You many not have the appropriate permissions to access the item"

Note that using System Restore can cause your Firefox installation to get corrupted because not all files are restored (only files in a white-list), so be cautious with using System Restore.
*You may lose data in the Firefox profile folder like .js and .ini files.
Do a clean reinstall and delete the Firefox program folder before (re)installing a fresh copy of the current Firefox release.
Download a fresh Firefox copy and save the file to the desktop.
*Firefox 23: http://www.mozilla.org/en-US/firefox/all.html
Uninstall your current Firefox version, if possible, to cleanup the Windows registry and settings in security software.
*Do NOT remove personal data when you uninstall your current Firefox version, because all profile folders will be removed and you lose personal data like bookmarks and passwords from profiles of other Firefox versions.
Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.
*(32 bit Windows) "C:\Program Files\Mozilla Firefox\"
*(64 bit Windows) "C:\Program Files (x86)\Mozilla Firefox\"
*It is important to delete the Firefox program folder to remove all the files and make sure that there are no problems with files that were leftover after uninstalling.
*http://kb.mozillazine.org/Uninstalling_Firefox
Your bookmarks and other personal data are stored in the Firefox profile folder and won't be affected by an uninstall and (re)install, but make sure that "remove personal data" is NOT selected when you uninstall Firefox.
If you keep having problems then also create a new profile.
*http://kb.mozillazine.org/Profile_folder_-_Firefox
*http://kb.mozillazine.org/Profile_backup
*http://kb.mozillazine.org/Standard_diagnostic_-_Firefox#Clean_reinstall

Setting up Open Directory and iCal server.

Hello:
I'm new to open directory - please help or point me in the right direction. I'm trying to set up a OSx server 10.5 running on a PowerMac G4.
I need iCal/DNS/FS/VPN/WEB/Open Directory as services enabled.
For testing purposes I've set up a small network with three machines all running 10.5.6.
I've tired over and over to do this via an advanced server but have not be able to get everything to work so I did a basic server allowing the server set up to input all my settings. Everything built and started up without issue but I could not get iCal to work. I let the set up sit over night and when I returned the next morning the MacMini screen had a window saying that a directory server has been found that offers these following services ...WEB - iCal etc. Do you want to configure your workstation. I did and everything worked as aspected. I thought that I finally got it!
I wanted to see the all of the settings so I converted the server to an advanced server and everything still worked. ( From the one workstation ).
I imported a users exported file from the server I'm trying to fix then the groups file. Everything still worked from the Mac Mini but I could not connect from the other workstation.
I never received the Open Directory message about services being offered etc.
Both machines have identical network settings ( Fixed I.P. pointing the DNS to the server.) AFP sees the server from both workstations but I can not login from the third workstation using any known good user name and password not even the admin or the Macmini account and password that works from the Mac mini. I don't really know anything about open directory, do you need to register the computer name with the server or something to that effect.
Why would it take hours for that original service offering to go out to the first workstation?
Thanks for any help you can offer. All of my OSX server experience has been setting up file servers never any of the other offerings.
Thanks,
Rick

Sorry,
I posted this to the wrong forum. I re-posted in Open Directory.
Thanks,
Rick

Terminal Commands to clean Open Directory and Profile Manager

Similar Messages

Maybe you are looking for