Troubleshooting PPPoE and DHCP on Lion Server 10.7

I am almost out of ideas, so I wanted to test our gurus out here:
I am setting up a small office network and don't quite have those last pieces of knowledge to get it running. It was working fine for us, until we needed to set up the VPN server.
PRIOR SETUP:
Internet -> Modem --> Time Capsule PPPoE Dial UP with DHCP Service --> Mac Pro Lion Server 10.7.4 and other "clients"
Mail Server worked
File Sharepoints worked
Jabber server worked
VPN did not
I read in forums that it would be difficult to do double NATs (which is what I think is happening with VPN server set up behind a Time Capsule). So, I decided to wreck the current set up and gamble on putting the Server forward in the chain.
NOW IT LOOKS LIKE THIS:
Internet --> Modem ---> Mac Pro PPPoE Dialup through System Preferences --> and then not sure how to get the rest running...
Ethernet 1 on MacPro is connected to the Modem
Ethernet 2 on MacPro is connected to a client notebook for testing DHCP (failed miserably)
Note: This minimal setup somehow allowed me to get logged on successfully to the VPN Server on the Mac Pro, but it was just luck and I'm not sure how it happened. BUT the bad part is now, I can't seem to share this internet connection with the rest of the clients on the network. "no one can see the internet"
1. Fiddled with gateway assistant but didn't get my clients to connect to the internet.
2. Fiddled with Internet Connection Sharing outside of the Server Admin. Didn't work.
KEY QUESTIONS:
- Can you share a PPPoE connection with an office on Lion Server?
- Can you share it AND have VPN access for those who want to log in?
BONUS:
When I get to using Gateway Assistant something weird comes up. Two Ethernet 1 Ports appear during the WAN chooser: (WHY???)
But my network settings look like this (There is only ONE Ethernet 1):
OTHER USEFUL SCREENSHOTS:
THANKS ALL in advance for checking this out and helping!

Similar Messages

Adding redirect path and pattern in Lion server for configuring software update server

Adding redirect path and pattern in Lion server for configuring software update server.Any changes

Ok, after days of browsing on the forum I found the following hint on another discussion related to AFP access:
"This may be a service ACL issue.
It turns out one of the latest Apple updates turned on Service ACL's which caused AFP connections to be blocked. Once I fixed the Service ACL in Server Admin... all connections and Single Sign On worked."
Well, after allowing access to all services to all users with Server Admin, we were finally able to log in the server with our admin account...
So, there must have been an update that turned on ACL's which caused even our local access, probably for OD/Kerberos, on the server to be restricted.

Ok, taking the leap. Tossing out all Windows servers and going with Lion Server only!

Help! We are retiring our Windows 2000 server (finally) and going with Lion Server only. We are transitioning from Windows to Mac and have 30 PC's running XP and a few scattered Windows 7 PC's (Lab). We have teachers and staff using Mac computers. Can I authenticate my windows pc's to Lion server?

1. We are running lion on the old Xservs because we had them. Thought they still would be good file servers. And we thought Lion would work on them but know that mountain lion will not
2. We have looked up some errors and they have to do with spotlight not getting index finnished with all the adobe files in folders, subfolders and subsubfolders. The vnode errors have something to do with lots ofmopen files but we do not know why. Maybe all these many directiries of files in deep hierarchy of adobe CS which the department does shared work directly on the server is issue. We have tried to get them tomuse as archive only but they do not habe a clue how to do shared work on separate clients. This deparment is not very savy in use but imtense Adobe CS users and my concern is these old file servers cannot take this kind of use.?
Imposted the logs because i have no clue to why they keep filling up (the vnodes).

Is there a difference between the Mac Mini Server and installing the Lion Server on an iMac?

So, I was wondering what the difference is between installing the Lion Server on an iMac as opposed to buying the Mac Mini Server because the iMac may be a cheaper solution for me since I intend to purchase a new monitor, keyboard, mouse and accessories if i purchase the Mac Mini Server.

If you intend to leave the server running all the time a Mac mini server would probably make more sense. It isn't necessary to keep a monitor, mouse and keyboard connected to the server as you can use the server management tools, remote desktop and SSH via the terminal window on your iMac to manage the server remotely once it's up and running.

Does switching between PPPoE and DHCP cause complications?

I've been trying to help a colleague with a MacBook Pro sort out wireless networking issues. At her desk, she connects by Ethernet to her DSL modem, which uses PPPoE. When roaming her office she uses a Linksys Wireless N modem, which serves up IP addresses via DHCP (and is connected to a second modem elsewhere on the premises). There seems to be no simple way of switching between the wireless and the wired connection: when I unplug the Ethernet cable, even though there's a wireless signal, there's no Internet connectivity. And when I plug the Ethernet back in, I have to go into System Preferences and reselect Ethernet manually and confirm all the settings before it'll connect. I tried creating locations but this didn't seem to have any effect.
I'm reading a lot of posts that suggest the MacBook Pros have wireless networking difficulties. Is this an inherent problem, then, that we're dealing with or might it have to do with the conflicting protocols?
Any insights would be much appreciated.

As third party 802.11n routers are still using a draft standard, you may run into issues with them if their firmware isn't up to date. See my WiFi FAQ (x) for potential solutions.
(x) Links to my pages may give me compensation.

How To Install A (Almost) Working Lion Server With Profile Management/SSL/OD/Mail/iCal/Address Book/VNC/Web/etc.

I recently installed a fresh version of Lion Server after attempting to fix a broken upgrade. With some help from others, I've managed to get all the new features working and have kept notes, having found that many or most of the necessary installation steps for both the OS and its services are almost entirely undocumented. When you get them working, they work great, but the entire process is very fragile, with simple setup steps causing breaks or even malicious behaviors. In case this is useful to others, here are my notes.
Start with an erased, virgin, single guid partitioned drive. Not an upgrade. Not simply a repartitioned drive. Erased. Clean. Anything else can and probably will break the Lion Server install, as I discovered myself more than once. Before erasing my drive, I already had Lion and made a Lion install DVD from instructions widely available on the web. I suppose you could also boot into the Lion recovery partition and use disk utility to erase the OS X partition then install a new partition, but I cut a DVD. The bottom line is to erase any old OS partitions. And of course to have multiple, independent backups: I use both Time Machine with a modified StdExclusions.plist and Carbon Copy Cloner.
Also, if you will be running your own personal cloud, you will want to know your domain name ahead of time, as this will be propagated everywhere throughout server, and changing anything related to SSL on Lion Server is a nightmare that I haven't figured out. If you don't yet have a domain name, go drop ten dollars at namecheap.com or wherever and reserve one before you start. Soemday someone will document how to change this stuff without breaking Lion Server, but we're not there yet. I'll assume the top-level domain name "domain.com" here.
Given good backups, a Lion Install DVD (or Recovery Partition), and a domain name, here are the steps, apparently all of which must be more-or-less strictly followed in this order.
DVD>Disk Utility>Erase Disk [or Recovery Partition>Disk Utility>Erase Partition]
DVD>Install Lion
Reboot, hopefully Lion install kicks in
Update, update, update Lion (NOT Lion Server yet) until no more updates
System Preferences>Network>Static IP on the LAN (say 10.0.1.2) and Computer name ("server" is a good standbye)
Terminal>$ sudo scutil --set HostName server.domain.com
App Store>Install Lion Server and run through the Setup
Download install Server Admin Tools, then update, update, update until no more updates
Server Admin>DNS>Zones [IF THIS WASN'T AUTOMAGICALLY CREATED (mine wasn't): Add zone domain.com with Nameserver "server.domain.com." (that's a FQDN terminated with a period) and a Mail Exchanger (MX record) "server.domain.com." with priority 10. Add Record>Add Machine (A record) server.domain.com pointing to the server's static IP. You can add fancier DNS aliases and a simpler MX record below after you get through the crucial steps.]
System Prefs>Network>Advanced>Set your DNS server to 127.0.0.1
A few DNS set-up steps and these most important steps:
A. Check that the Unix command "hostname" returns the correct hostname and you can see this hostname in Server.app>Hardware>Network
B. Check that DNS works: the unix commands "host server.domain.com" and "host 10.0.1.2" (assuming that that's your static IP) should point to each other. Do not proceed until DNS works.
C. Get Apple Push Notification Services CA via Server.app>Hardware>Settings><Click toggle, Edit... get a new cert ...>
D. Server.app>Profile Manager>Configure... [Magic script should create OD Master, signed SSL cert]
E. Server.app>Hardware>Settings>SSL Certificate> [Check to make sure it's set to the one just created]
F. Using Server.app, turn on the web, then Server.app>Profile Manager> [Click on hyperlink to get to web page, e.g. server.domain.com/profilemanager] Upper RHS pull-down, install Trust Profile
G. Keychain Access>System>Certificates [Find the automatically generated cert "Domain", the one that is a "Root certificate authority", Highlight and Export as .cer, email to all iOS devices, and click on the authority on the device. It should be entered as a trusted CA on all iOS devices. While you're at it, highlight and Export... as a .cer the certificate "IntermediateCA_SERVER.DOMAIN.COM_1", which is listed an an "Intermediate CA" -- you will use this to establish secure SSL connections with remote browsers hitting your server.]
H. iOS on LAN: browse to server.domain.com/mydevices> [click on LHS Install trust cert, then RHS Enroll device.
I. Test from web browser server.domain.com/mydevices: Lock Device to test
J. ??? Profit
12. Server Admin>DNS>Zones> Add convenient DNS alias records if necessary, e.g., mail.domain.com, smtp.domain.com, www.domain.com. If you want to refer to your box using the convenient shorthand "domain.com", you must enter the A record (NOT alias) "domain.com." FQDN pointing to the server's fixed IP. You can also enter the convenient short MX record "domain.com." with priority 11. This will all work on the LAN -- all these settings must be mirrored on the outside internet using the service from which you registered domain.com.
You are now ready to begin turning on your services. Here are a few important details and gotchas setting up cloud services.
Firewall
Server Admin>Firewall>Services> Open up all ports needed by whichever services you want to run and set up your router (assuming that your server sits behind a router) to port forward these ports to your router's LAN IP. This is most a straightforward exercise in grepping for the correct ports on this page, but there are several jaw-droppingly undocumented omissions of crucial ports for Push Services and Device Enrollment. If you want to enroll your iOS devices, make sure port 1640 is open. If you want Push Notifications to work (you do), then ports 2195, 2196, 5218, and 5223 must be open. The Unix commands "lsof -i :5218" and "nmap -p 5218 server.domain.com" (nmap available from Macports after installing Xcode from the App Store) help show which ports are open.
SSH
Do this with strong security. Server.app to turn on remote logins (open port 22), but edit /etc/sshd_config to turn off root and password logins.
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
I'm note sure if toggling the Allow remote logins will load this config file or, run "sudo launchctl unload -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ; sudo launchctl load -w /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist" to restart the server's ssh daemon.
Then use ssh-keygen on remote client to generate public/private keys that can be used to remotely login to the server.
client$ ssh-keygen -t rsa -b 2048 -C client_name
[Securely copy ~/.ssh/id_rsa.pub from client to server.]
server$ cat id_rsa.pub > ~/.ssh/known_hosts
I also like DenyHosts, which emails detected ssh attacks to [email protected]. It's amazing how many ssh attacks there are on any open port 22. Not really an added security feature if you've turned off password logins, but good to monitor. Here's a Lion Server diff for the config file /usr/share/denyhosts:
$ diff denyhosts.cfg-dist denyhosts.cfg
12c12
< SECURE_LOG = /var/log/secure
> #SECURE_LOG = /var/log/secure
22a23
> SECURE_LOG = /var/log/secure.log
34c35
< HOSTS_DENY = /etc/hosts.deny
> #HOSTS_DENY = /etc/hosts.deny
40a42,44
> #
> # Mac OS X Lion Server
> HOSTS_DENY = /private/etc/hosts.deny
195c199
< LOCK_FILE = /var/lock/subsys/denyhosts
> #LOCK_FILE = /var/lock/subsys/denyhosts
202a207,208
> LOCK_FILE = /var/denyhosts/denyhosts.pid
> #
219c225
< ADMIN_EMAIL =
> ADMIN_EMAIL = [email protected]
286c292
< #SYSLOG_REPORT=YES
> SYSLOG_REPORT=YES
Network Accounts
User Server.app to create your network accounts; do not use Workgroup Manager. If you use Workgroup Manager, as I did, then your accounts will not have email addresses specified and iCal Server WILL NOT COMPLETELY WORK. Well, at least collaboration through network accounts will be handled clunkily through email, not automatically as they should. If you create a network account using Workgroup Manager, then edit that account using Server.app to specify the email to which iCal invitations may be sent. Server.app doesn't say anything about this, but that's one thing that email address entry is used for. This still isn't quite solid on Lion Server, as my Open Directory logs on a freshly installed Lion Server are filled with errors that read:
2011-12-12 15:05:52.425 EST - Module: SystemCache - Misconfiguration detected in hash 'Kerberos':
     User 'uname' (/LDAPv3/127.0.0.1) - ID 1031 - UUID 98B4DF30-09CF-42F1-6C31-9D55FE4A0812 - SID S-0-8-83-8930552043-0845248631-7065481045-9092
Oh well.
Email
Email aliases are handled with the file /private/etc/postfix/aliases. Do something like this
root:           myname
admin:          myname
sysadmin:       myname
certadmin:      myname
webmaster:      myname
my_alternate:   myname
Then run "sudo newaliases". If your ISP is Comcast or some other large provider, you probably must proxy your outgoing mail through their SMTP servers to avoid being blocked as a spammer (a lot of SMTP servers will block email from Comcast/whatever IP addresses that isn't sent by Comcast). Use Server.app>Mail to enter your account information. Even then, the Lion Server default setup may fail using this proxy. I had to do this with the file /private/etc/postfix/main.cf:
cd /etc/postfix
sudo cp ./main.cf ./main.cf.no_smtp_sasl_security_options
sudo echo 'smtp_sasl_security_options = noanonymous' >> ./main.cf
sudo serveradmin stop mail
sudo serveradmin start mail
Finally, make sure that you're running a blacklisting srevice yourself! Server Admin>Mail>Filter> Use spamhaus.org as a blacklister. Finally, set up mail to use strong Kerberos/MD5 settings under on Server Admin>Mail>Advanced. Turn off password and clear logins. The settings should be set to "Use" your SSL cert, NOT "Require". "Require" consistently breaks things for me.
If you already installed the server's Trust Certificate as described above (and opened up the correct ports), email to your account should be pushed out to all clients.
iCal Server
Server.app>Calendar>Turn ON and Allow Email Invitations, Edit... . Whatever you do, do NOT enter your own email account information in this GUI. You must enter the account information for local user com.apple.calendarserver, and the password for this account, which is stored in the System keychain: Keychain Access>System> Item com.apple.servermgr_calendar. Double-click and Show Password, copy and paste into Server.app dialog. This is all described in depth here. If you enter your own account information here (DO NOT!), the iCal Server will delete all Emails in your Inbox just as soon as it reads them, exactly like it works for user com.apple.calendarserver. Believe me, you don't want to discover this "feature", which I expect will be more tightly controlled in some future update.
Web
The functionality of Server.app's Web management is pretty limited and awful, but a few changes to the file /etc/apache2/httpd.conf will give you a pretty capable and flexible web server, just one that you must manage by hand. Here's a diff for httpd.conf:
$ diff httpd.conf.default httpd.conf
95c95
< #LoadModule ssl_module libexec/apache2/mod_ssl.so
> LoadModule ssl_module libexec/apache2/mod_ssl.so
111c111
< #LoadModule php5_module libexec/apache2/libphp5.so
> LoadModule php5_module libexec/apache2/libphp5.so
139,140c139,140
< #LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
< #LoadModule encoding_module libexec/apache2/mod_encoding.so
> LoadModule auth_digest_apple_module libexec/apache2/mod_auth_digest_apple.so
> LoadModule encoding_module libexec/apache2/mod_encoding.so
146c146
< #LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
> LoadModule xsendfile_module libexec/apache2/mod_xsendfile.so
177c177
< ServerAdmin [email protected]
> ServerAdmin [email protected]
186c186
< #ServerName www.example.com:80
> ServerName domain.com:443
677a678,680
> # Server-specific configuration
> # sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart
> Include /etc/apache2/mydomain/*.conf
I did "sudo mkdir /etc/apache2/mydomain" and add specific config files for various web pages to host. For example, here's a config file that will host the entire contents of an EyeTV DVR, all password controlled with htdigest ("htdigest ~uname/.htdigest EyeTV uname"). Browsing to https://server.domain.com/eyetv points to /Users/uname/Sites/EyeTV, in which there's an index.php script that can read and display the EyeTV archive at https://server.domain.com/eyetv_archive. If you want Apache username accounts with twiddles as in https://server.domain.com/~uname, specify "UserDir Sites" in the configuration file.
Alias /eyetv /Users/uname/Sites/EyeTV
<Directory "/Users/uname/Sites/EyeTV">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
Alias /eyetv_archive "/Volumes/Macintosh HD2/Documents/EyeTV Archive"
<Directory "/Volumes/Macintosh HD2/Documents/EyeTV Archive">
    AuthType Digest
    AuthName "EyeTV"
    AuthUserFile /Users/uname/.htdigest
    AuthGroupFile /dev/null
    Require user uname
    Options Indexes MultiViews
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
I think you can turn Web off/on in Server.app to relaunch apached, or simply "sudo apachectl -D WEBSERVICE_ON -D MACOSXSERVER -k restart".
Securely copy to all desired remote clients the file IntermediateCA_SERVER.DOMAIN.COM_1.cer, which you exported from System Keychain above. Add this certificate to your remote keychain and trust it, allowing secure connections between remote clients and your server. Also on remote clients: Firefox>Advanced>Encryption>View Certificates>Authorities>Import...> Import this certificate into your browser. Now there should be a secure connection to https://server.domain.com without any SSL warnings.
One caveat is that there should be a nice way to establish secure SSL to https://domain.com and https://www.domain.com, but the automagically created SSL certificate only knows about server.domain.com. I attempted to follow this advice when I originally created the cert and add these additional domains (under "Subject Alternate Name Extension"), but the cert creation UI failed when I did this, so I just gave up. I hope that by the time these certs expire, someone posts some documentation on how to manage and change Lion Server SSL scripts AFTER the server has been promoted to an Open Directory Master. In the meantime, it would be much appreciated if anyone can post either how to add these additional domain names to the existing cert, or generate and/or sign a cert with a self-created Keychain Access root certificate authority. In my experience, any attempt to mess with the SSL certs automatically generated just breaks Lion Server.
Finally, if you don't want a little Apple logo as your web page icon, create your own 16×16 PNG and copy it to the file /Library/Server/Web/Data/Sites/Default/favicon.ico. And request that all web-crawling robots go away with the file /Library/Server/Web/Data/Sites/Default/robots.txt:
User-agent: *
Disallow: /
Misc
VNC easily works with iOS devices -- use a good passphrase. Edit /System/Library/LaunchDaemons/org.postgresql.postgres.plist and set "listen_addresses=127.0.0.1" to allow PostgreSQL connections over localhost. I've also downloaded snort/base/swatch to build an intrusion detection system, and used Macports's squid+privoxy to build a privacy-enhanced ad-blocking proxy server.

Privacy Enhancing Filtering Proxy and SSH Tunnel
Lion Server comes with its own web proxy, but chaining Squid and Privoxy together provides a capable and effective web proxy that can block ads and malicious scripts, and conceal information used to track you around the web. I've posted a simple way to build and use a privacy enhancing web proxy here. While you're at it, configure your OS and browsers to block Adobe Flash cookies and block Flash access to your camera, microphone, and peer networks. Read this WSJ article series to understand how this impacts your privacy. If you configure it to allow use for anyone on your LAN, be sure to open up ports 3128, 8118, and 8123 on your firewall.
If you've set up ssh and/or VPN as above, you can securely tunnel in to your proxy from anywhere. The syntax for ssh tunnels is a little obscure, so I wrote a little ssh tunnel script with a simpler flexible syntax. This script also allows secure tunnels to other services like VNC (port 5900). If you save this to a file ./ssht (and chmod a+x ./ssht), example syntax to establish an ssh tunnel through localhost:8080 (or, e.g., localhost:5901 for secure VNC Screen Sharing connects) looks like:
$ ./ssht 8080:[email protected]:3128
$ ./ssht 8080:alice@:
$ ./ssht 8080:
$ ./ssht 8018::8123
$ ./ssht 5901::5900 [Use the address localhost:5901 for secure VNC connects using OS X's Screen Sharing or Chicken of the VNC (sudo port install cotvnc)]
$ vi ./ssht
#!/bin/sh
# SSH tunnel to squid/whatever proxy: ssht [-p ssh_port] [localhost_port:][user_name@][ip_address][:remotehost][:remote_port]
USERNAME_DEFAULT=username
HOSTNAME_DEFAULT=domain.com
SSHPORT_DEFAULT=22
# SSH port forwarding specs, e.g. 8080:localhost:3128
LOCALHOSTPORT_DEFAULT=8080      # Default is http proxy 8080
REMOTEHOST_DEFAULT=localhost    # Default is localhost
REMOTEPORT_DEFAULT=3128         # Default is Squid port
# Parse ssh port and tunnel details if specified
SSHPORT=$SSHPORT_DEFAULT
TUNNEL_DETAILS=$LOCALHOSTPORT_DEFAULT:$USERNAME_DEFAULT@$HOSTNAME_DEFAULT:$REMOT EHOST_DEFAULT:$REMOTEPORT_DEFAULT
while [ "$1" != "" ]
do
case $1
in
    -p) shift;                  # -p option
        SSHPORT=$1;
        shift;;
     *) TUNNEL_DETAILS=$1;      # 1st argument option
        shift;;
esac
done
# Get local and remote ports, username, and hostname from the command line argument: localhost_port:user_name@ip_address:remote_host:remote_port
shopt -s extglob                        # needed for +(pattern) syntax; man sh
LOCALHOSTPORT=$LOCALHOSTPORT_DEFAULT
USERNAME=$USERNAME_DEFAULT
HOSTNAME=$HOSTNAME_DEFAULT
REMOTEHOST=$REMOTEHOST_DEFAULT
REMOTEPORT=$REMOTEPORT_DEFAULT
# LOCALHOSTPORT
CDR=${TUNNEL_DETAILS#+([0-9]):}         # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    LOCALHOSTPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEPORT
CDR=${TUNNEL_DETAILS%:+([0-9])}         # delete shortest trailing :+([0-9])
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEPORT=$CAR
fi
TUNNEL_DETAILS=$CDR
# REMOTEHOST
CDR=${TUNNEL_DETAILS%:*}                # delete shortest trailing :*
CAR=${TUNNEL_DETAILS##$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR#:}                            # delete :
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    REMOTEHOST=$CAR
fi
TUNNEL_DETAILS=$CDR
# USERNAME
CDR=${TUNNEL_DETAILS#*@}                # delete shortest leading +([0-9]):
CAR=${TUNNEL_DETAILS%%$CDR}             # cut this string from TUNNEL_DETAILS
CAR=${CAR%@}                            # delete @
if [ "$CAR" != "" ]                     # leading or trailing port specified
then
    USERNAME=$CAR
fi
TUNNEL_DETAILS=$CDR
# HOSTNAME
HOSTNAME=$TUNNEL_DETAILS
if [ "$HOSTNAME" == "" ]                # no hostname given
then
    HOSTNAME=$HOSTNAME_DEFAULT
fi
ssh -p $SSHPORT -L $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT -l $USERNAME $HOSTNAME -f -C -q -N \
    && echo "SSH tunnel established via $LOCALHOSTPORT:$REMOTEHOST:$REMOTEPORT\n\tto $USERNAME@$HOSTNAME:$SSHPORT." \
    || echo "SSH tunnel FAIL."

How can I make my Lion Server into a Lion Workstation?

How can I downgrade my Mac OS X Lion Server to just a standard Mac OS X Lion machine?
I've tried everything including re-installing Lion. When re-installing Lion, it seems to automatically pickup on the fact that this is a Server OS & installs Lion Server OS.
I want to simply downgrade my Lion machine to be running the standard Lion OS instead of Lion Server.
In case you're wondering, this is on my iMac 27" which I originally upgraded from Snow Leopard to Lion, then from Lion to Lion Server.

@Chris BeHanna
You were right for the firewall Issue. I was also running IPSecuritas and I installed Lion Server and the traffic stopped responding on the tunnel, although it connected well.
I figured out that, for some reason, even if the ServerAdmin indicated that the server firewall (my local "new" server, my own machine) was inactive, some rules must had been set during Server.app installation.
Anyway, what I did was activate the firewall, and then, allow all traffic on every ip. You can do that in the ServerAdmin app.
And then the traffic turned back on, on the IPSecuritas tunnels.
The next step would be to be configure rules precisely, but since I am already behind a firewall, I prefer using a "transparent" setting.

Using Lion Server Radius for authenticating "other" clients

Hi I've been trying to get the Radius service in Lion Server to authenticate users of my SQUID web proxy. I have followed the squid wiki's instructions to configure the squid server as a radius client and pass authentication requests to the Lion Server Radius (I hope). However I'm trying to configure and test the Lion Server Radius. As Lions Server Admin GUI for radius only lets to add Airport Basestations, I've been trying to dig around for what underlying config files to edit. I have tried 2 methods of adding the client details to radius:
1. By editing the /etc/raddb/client.conf, and adding/changing (for example):
client localhost {
     secret     = mysecretpassphrase
client 192.168.0.0/24 {
     secret              = mysecretpassphrase
     shortname       = local-lan-clients
and restarting squid. Nothing seems to get mentioned in the radius log file! So I'm not completely convinced that the Lion Radius took any notice of this!
2. Instead of above, added the same client info using radiusconfig:
$ sudo radiusconfig -addclient 192.168.0.0/24 local-lan-clients other <return>
- then it prompts for the secret. With this command I notice the entry/event is recognised in the radius log file, and also looks like some SQL activity. If I dont specify "other" for the nas-type, it defaults to "Aiport Base Station" or similar.
OK, so forgetting about SQUID for a minute, I can't even get that far as I'm just trying to test the config using the "radclient" utility from the Lion Server and the squid server:
$ sudo radclient localhost auth mysecretpassphrase <return>
and... no response, just hangs, nothing in radius log either.
The Lion Firewall allows TCP and UDP requests into the Radius authentication port.
Any ideas what else I need to do? Scratching my head, I'm wondering if it is anything to do with SSL? e.g. do I need to make the authentication using the self-signed certificate that Open Directory has? I presume any Airport Base Stations added to radius will use this certificate to establish a secure connection for authentication.

The RADIUS server in OS X Server is a standard FreeRADIUS implementation with Apple's own custom GUI frontend for configuring it and which only allows adding AirPort base-stations. In Mountain Lion Server it is even limited to a specific configuration for the AirPort base-station.
However if you follow the normal command-line instructions and steps for configuring FreeRADIUS then it will be possible to add any type of RADIUS client.
While as far as I can see by manually configuring the FreeRADIUS server in OS X Server should enable you to do what you want, most people chose to configure Squid to use either a PAM or the LDAP modules for Squid to in this case authenticate directly to Open Directory (which is of course based on LDAP).
I myself have used a PAM in the past with Squid to successfully configure Squid to authenticate users via Open Directory. I was even able to specific an Open Directory group and only allow members of that group access via the Squid Proxy Server. I then went a bit OTT and set up another open-source tool (which was discontinued and I had to fix to get working) to process the Squid logs and store them in MySQL, and then setup FileMaker Pro to connect to the MySQL database via ODBC to allow producing reports.
Unfortunately the AFP458 website had a major redesign a while ago and many previous technical articles on it are now hard to find. I had used two articles on that site to guide me through setting up Squid and the PAM on a Mac server. I believe the two articles I used are the ones listed below.
http://afp548.com/2004/09/08/using-os-x-open-directory-to-authenticate-squid-pro xy-server/
http://afp548.com/2004/12/13/squid-server-using-ldap-authentication/

Mac OS X Lion Server - Clean Installation

I do have a Mac mini server with OS X Snow Leopard Server. I would like to go to Lion Server but I don't want to use the default installation method.
I understood, that Lion Server usually is no operating system but an App, which is to be installed by App Store. This is a nice feature for users who have any OS X Lion device such as a Mac Book or an iMac and want to have server features with them.
But this doesn't fit for a dedicated server system!
How can I perform a clean installation of OS X Lion Server on a new partition?
(I don't want to upgrade my Snow Leopard Server partition to Lion Server, before I have tested that everything is working as expected. And I especially don't want to install Lion first and than add Lion Server as an App.)

You can purchase Lion server from the app store
and when the download is complete and prompted to
install, select cancel. Then, locate the downloaded installer
in the Applications folder and follow these instructions
to create an install disk or USB stick:
http://reviews.cnet.com/8301-13727_7-20080989-263/how-to-create-an-os-x-lion-ins tallation-disc/?tag=mncol
Then, you should be able to install on a partition of
your chosing.
I strongly suggest that you clone your current install
and backup any data should something go awry.

Upgrade to OS X Lion Server

I am currently running a Mac Mini server setup in a RAID-1 configuration. I wanted to upgrade to OS X Lion Server. I went to the App Store, and found out that I need to purchase OS X Lion and OS X Lion Server to upgrade. I made the purchase, and now, I cannot install the upgrade. They system starts to install OS X Lion. I get to the screen to restart, I get a message saying that the system is shutting down applications, and then i get:
An error occurred while preparing the installation. Try running this application again.
I have tried resetting the PRAM and NVRAM, and I got the same results.
I tried navigating to the DMG file, mounting the DMG, and running the install, and I got the same results.
What am I missing? Is there some special item that I need to download, or a hidden step to take to upgrade from OS X Snow Leopard Server to OS X Lion to OS X Lion Server?

I had the same issue and I solved it with the following steps. Before you proceed connect an External SuperDrive to your Mac Mini, create a full backup of your system and read carefully the following manual
http://manuals.info.apple.com/en_US/lion_server_upgrading_migrating.pdf
1) In your OSX Snow Leopard installation, go to System Preferences to perform a software update check.
2) Buy and download OSX Lion (and OSX Lion Server if you have OSX Snow Leopard Server) from App Store, after download do not proceed with installation.
3) Make a bootable OSX Lion Installation DVD performing these steps:
3.1) Go to the Applications folder and locate the Install Mac OS X Lion package, right-click the package and choose "Show Package Contents".
3.2) Go to the /Contents/SharedSupport/ folder and locate the InstallESD.dmg. Use Disk Utility to burn this image to DVD.
4) Reboot the Mac Mini holding the "C" key at startup and proceed through the installation process steps, when you are prompted to choose where to install OSX Lion, select the RAID volume. An alert will appear to remind that some features will not be available if you install OSX Lion on a RAID Volume, choose "Continue" to proceed.
5) After the installation process, during which the Mac Mini reboots at least twice, log in with your credentials and go to System Preferences to perform a software update check.
I've tested it with Mac Mini Server and OSX Lion 10.7.3 Installation Package and it worked.

Anyone aware of a step by step guide to setup lion server?

Anyone aware of a step by step guide to setup lion server? Looking to bin my SBS and movr to lion server but need an idiots guide to step by step setup.

Hi Joe,
Thanks for the info. Was also looking for a step by step guide on installtion of all the different modules, i.e. mail, profile manager, wiki for example. Maybe im just to use to windows server but the mac server just seems too simple. Maybe i am over complicating things.

How to reinstall OS X Lion Server

I'm newbie os x admin . I bought new Mac Mini 2010 with Lion Server. I want to do RAID 0 with my HDD.
I make image for Recovery Partition. Then format partition and do RAID 0.
I setup with Mac OS X Lion 10.7 GM build 11A511
I success to install but .... No Lion Server.
I try to check Mac Store but I found I need to buy Lion Server License ?
These is my Question
1. Lion Server that pre-install with Mac Mini is not license version or not?
2. Should I restore from recovery partition and get Lion Server from them ?
3. How I make recovery DVD or anything that easy to reinstall ?
Thank You very much.

The 2010 Mac mini Server did not come with Lion Server, it was shipped with Snow Leopard Server. To go from Snow Leopard to Lion is a paid upgrade, not a free update. Up until Snow Leopard there was a SL client OS and a SL Server OS. Now Lion Server is an add-on purchase to the Lion client. So you must buy and install the Lion client, then the second step is to buy and install the Lion Server add-on. You purchase both Lion and Lion Server through the Mac App Store.

Lion server migration from 10.6 wiki dead, mail dead, ical dead

i have a mac mini w leopard server- everything worked perfect
i upgrade and migrated to lion server
nothing working, wiki, mail, or icalendar
any ideas-
other than going back to restore of timemachine of leopard server
thanx
CT

One thing that jumps out from your brief description of the problem is a bug in the persent iteration of Lion Server that occurs when the "Dedicate system resources to server services" box is checked (or, honestly, when it's unchecked too -- read on). This is located within Server.app. in the left pane, select your machine under the hardware section. The second tab, settings, contains this option. I'd try either ticking or unticking the box and then restarting and then trying to start those services again. Though the bug was initially reported as related to this similar problem (the one you describe) occurring when this box is checked, I've found that toggling between on to off, or off to on (depending on the current state) and then restarting, seems to help get things going again. Sometimes this has to be done twice. As well, until Apple issues a fix for these Server.app related problems, it's best, once you get your server configured, to keep from opening Server.app when possible. Just opening it seems to cause problems. One example of this is checking the mail quota box and entering a value. It seems to stick fine, but when Server.app is opened again, the box is unchecked once again. This one happens every time.

How To: Host Two Domains on Lion Server - One IP

Here is the situation: I own a new MacMini and have installed Lion Server. All of my updates are current. I have purchased two domains from a reputable “Gddy” source. (I don’t know if I can use there official name). I think I am doing something wrong because I have to type the “www.”mydomain.com to get to my websites. How do I host my two sites?
Here is what I have done so far and have been somewhat successful. For purposes I will refer to my domains in this question as domain1.com and domain2.com. At Gddy my DNS A records for @ both point to my single IP. In addition my www CNAMEs point to @ for both my domains.
My server admin DNS read the following:
Name – 1.168.192.in-addr.arpa / Type – Reverse Zone / Value - Blank
Sub Name – 192.168.1.6 / Type – Reverse Mapping / Value – server.mydomain1.com.
Name – server.mydomain1.com / Type – Primary Zone / Value – Blank
Sub Name – server.mydomain1.com. / Type – Machine / Value – 192.168.1.6
In Lion server I have Web Server turned on and have setup the following web sites:
server.mydomain1.com
www.mydomain2.com
www.mydomain2.com
I am using iWeb and have both websites loading through SFTP successfully.
I am using a SSH certificate I created using my apple ID
Questions:
Why do my customers need to type the www to access my domains?
Do I need to setup another primary zone called server1.mydomain2.com?
Currently everything works fine if you type the www before the domains but I am now on a mission to refine my sites. If users get errors trying to get to my site then they will stop trying and I don't want that. Apple community please help. This stuff really amazes me and the fact that I am somewhat "catching on" is a great feeling. Thank you.

As Belle points out, this has little or nothing to do with DNS. It's all about Apache.
When a request comes in, Apache looks at the hostname of the request to determine which site's configuration to use for that request.
Right now you have two 'sites' configured - 'www.domain1.com' and 'www.domain2.com'.
When a request comes in for, say, http://domain1.com/ Apache does that same lookup, except it doesn't find a match - you don't have any configuration for 'domain1.com', only 'www.domain1.com'. THESE ARE DIFFERENT.
There is absolutely no automatic relationship between a host record (e.g. 'www.domain1.com') and its parent domain (e.g. 'domain1.com'). It makes no difference that you have a DNS CNAME that maps one hostname to another because Apache isn't doing DNS lookups on the incoming requests.
The solution, as indicated, is to tell Apache the list of hostnames that match each site. By telling the 'www.domain1.com' site that it's valid for 'domain1.com' as well (and even 'foo.domain1.com' or 'bar.domain2.com' if you want, too), Apache can serve the request with the appropriate configuration.

IChat & iCal can't authenticate to Lion Server 10.7.2

I've enabled iChat and iCal Server through our local 10.7.2 Server which has DNS set up correctly. I can add the server account via a client's System Preferences (under other - Mac OS X server) and it authenticates with my shortname correctly.
However, when I load iCal or iChat, I get this error message:
iChat can't login to servername.ourdomain.co.nz because your login ID or password is incorrect.
Where the account is [email protected]
The password and username is correct.
Console throws this error:
>22/11/11 3:03:31.135 PM imagent: [Warning] XMPPConnection: Error: Error Domain=XMPPErrorDomain Code=105 "The operation couldn�t be completed. (XMPPErrorDomain error 105.)" UserInfo=0x7f81bbe2a3e0 {XMPPErrorText=service requested for unknown domain}
DNS is set up correctly and we are using a FQDN to connect (it's working for Profile Management, Software Update Server and Web Services) but I can't get iChat or iCal to work correctly.
How can I get clients to authenticate?
I have also asked this question on Serverfault, here: http://serverfault.com/questions/333468/ichat-and-ical-cant-authenticate-to-lion -server-10-7-2

Where are you adding these users? You should be adding them on the Lion SERVER, in the server app, under Accounts -> Users. I presume you are running open directory?
I am adding them on the Lion Server, under Accounts -> Users.
The usernames have no domain in them. So, example name might be steve. When you are adding a new user on the lion server through serverapp, the user name shown in the box that says "Account Name" is what goes in the user name fields in iCal and address book. Those are added by adding a new account within iCal or Address Book app on the client.
I'm only using the short name to add the accounts on the Lion client. However, both iCal and iChat require a FQDN as part of the login - they amend @servername.domain.co.nz as part of the account. This is normal behavior for both iChat and iCal on Lion Server.
"I can add the server account via a client's System Preferences (under other - Mac OS X server)". Where!? I don't see any other - Mac OS X server on any client. I assume Mac clients? Are you doing Lion server network accounts? Local accounts?
Anyway, the name that is the user name is the short name. There is no domain part. So, not sure why you have a domain part to the name. The domain gores in the server address in address book or iCal.
You're correct - you only add the shortname in the client's system preferences, but iChat and iCal add the FQDN part to the login.
Here is what the dialogue box that I am talking about on the client:

Troubleshooting PPPoE and DHCP on Lion Server 10.7

Similar Messages

Maybe you are looking for