Apple 10.6 manual

Mac O S X S e r v er Adv anced Ser ver A dministration V ersi on 1 0. 6 Sno w Le opar d[...]

Apple Inc. K © 2009 Apple Inc. All rights reserved. The owner or authorized user of a v alid copy of Mac OS X Ser v er sof twar e may reproduce this publication for the purpose of learning to use such software. No par t of this publication ma y be reproduced or transmitted for commercial pur poses, such as selling copies of this publication or for[...]

11 Prefac e: About This Guide 1 1 What’ s in T his G uide 1 2 Using Onscreen Help 1 3 Document Road Map 1 4 Viewing PDF Guides Onscreen 1 4 Printing PDF Guide s 1 5 Getting Documentation Updates 1 5 Getting Additional Information 1 6 Chapter 1: Syst em O v er view and Supported Standards 1 6 System Requiremen ts for Installing Mac OS X Ser ver v1[...]

4 Conten ts 3 3 Understanding B ackup Type s 34 Understanding Backup Scheduling 34 Understanding Restores 35 Other Backup Policy Considerations 36 Command-Line Backup and Restoration T ools 36 Understanding Time Machine as a S erver Backup T ool 38 Chapter 3: Administra tion T ools 38 Ser v er Admin 38 Opening and Authenticating in Server Admin 39 [...]

Conten ts 5 58 Single Sign-On 59 About Certicates, SSL, and P ublic Key Infrastructur e 59 Public and P rivate Keys 60 Certicate s 60 About Certicate Authorities (CAs ) 6 1 About Identities 6 1 About Self-Signed Certicate s 6 1 About Intermediate T rust 62 Certicate Manager in Ser ver A dmi n 64 Readying Certicate s 65 Creating a [...]

6 Conten ts 84 About Starting Up for Installation 84 Before Starting Up 85 Starting Up from the Install DVD 85 Starting Up from an Alternate P ar tition 88 Remotely Acce ssing the Install D VD 90 About Ser v er S erial Numbers f or Default Installation P asswords 90 Identifying Remote Servers W hen Installing M ac OS X Server 9 1 Starting Up from a[...]

Conten ts 7 1 24 C hapter 7: Ongoing System Management 1 24 C omputers Y ou Can Use to Administer a Server 1 24 Setting Up an Administrator C omputer 1 25 Using a Non-Mac OS X Computer f or Administration 1 26 U sing the Administration T o ols 1 26 W ork ing with P re-v1 0.6 Computers from v1 0.6 Ser vers 1 27 P or ts Used f or Administration 1 27 [...]

8 Conten ts 1 59 Eliminating Single P oints of F ailure 1 60 Using Xserve for High A vailability 1 6 1 Using Backup P ower 1 6 1 Setting Up Y our S erver for A utomatic Restar t 1 62 Ensuring Proper Opera tional Conditions 1 62 Pro viding Open Direc t or y Replication 1 63 Link Aggregation 1 64 About the Link Aggregation C ontrol Prot ocol (LACP) 1[...]

Conten ts 9 1 88 Chapter 9: Push Notication Serve r 1 88 About Push Notication Serve r 1 89 Starting and Stopping Push Noticatio n 1 90 Changing a Ser vic e’ s Push Notication Serve r 1 9 1 Index[...]

10 Conten ts[...]

11 This guide pro vides a star ting point f or administering Mac OS X Ser ver v1 0.6 using its adv anced administration tools. It contains information about planning , practices , tools, installation, deployment, and more by using Ser v er Admin. Advanc ed S erver Administr ation is not the only guide you need when administering advanced mode serve[...]

12 Prefac e About This Guide Using Onscreen Help Y ou can get task instructions onscreen in Help Viewer while you ’ re managing Mac OS X Ser ver v1 0.6. Y ou can view help on a ser v er or an administrator computer . (An administrator comput er is a M ac OS X c omputer with Mac OS X S erver v1 0.6 administration software installed on it.) T o get[...]

Preface About This Guide 13 Document Road Map Mac OS X v1 0.6 has a suite of guides which can co ver management of individual ser vic es. Each ser vice ma y be dep enden t on other ser vices f or maximum utilit y . The road map below show s some related documenta tion that you may need to fully congure your de sired ser vice to y our specicat[...]

14 Preface About This Guide Viewing PDF Guides Onscreen While reading the PDF version of a guide onscr een: Show bookmarks to see the guide’ s outline, and click a book mark to jump to the  corresponding section. Search for a wor d or phrase to see a list of places where it appears in the document.  Click a listed place to see the page wher e[...]

Preface About This Guide 15 Getting Documentation Updates P eriodically , Apple posts revised help pages and new editions of guides. S ome revised help pages update the lat est editions of the guides. T o view new onscreen help topics for a server application, mak e sure your server or  administrator computer is c onnec ted to the Internet and cl[...]

16 Mac OS X Ser ver giv es you everything you need to pro vide standards-based workgr oup and Internet ser vices — delivering a w or ld-class UNIX ser ver solution that’ s easy to deploy and easy to manage . This chapter con tains information to make decisions about where and how you deploy Mac OS X Ser ver . I t contains general inf or mation [...]

Chapter 1 System Overview and Supported Standards 17 What’ s New in M ac OS X Ser ver v1 0.6 Mac OS X Ser ver v1 0.6 o ers major enhancements in several key areas: Address Book Server  Mac OS X Ser ver v1 0.6 introduce s the rst open standards-based Address Book Ser ver Based on the emerging CardDA V specication, which uses W ebDA V to[...]

OpenCL suppor t  Mac OS X Ser ver v1 0.6 supports OpenCL and mak es it possible for developers t o use the GPU for general computa tional tasks. What’ s New in S er ver Admin Included with Mac OS X Ser ver v1 0.6 is Ser ver Admin, Apple’ s powerful, e xible, full- featured server administration tool. Ser ver Admin is reinforc ed with impro[...]

Chapter 1 System Overview and Supported Standards 19 The follo wing table highlights the capabilities of each conguration tool. Service Set in initial server setup Server Prefer ences Ser ver Admin Address book Optional Ye s Y es Backup your data (websites , databases , calendar les, etc.) No No, use command-line tools and third-part y backup[...]

Service Set in initial server setup Server Prefer ences Ser ver Admin Open Directory master (user accounts and other data) Optional Optional Y es P odcast Producer No No Y es P olicies and managed preference s No Use Workgroup Manager Use Workgroup Manager Print No No Y es Push notication Automatic Automatic Y es Quick Time Streaming No No Y es [...]

Chapter 1 System Overview and Supported Standards 21 A standards-based directory ser vices architecture o ers centralized managemen t of network resource s using any LDAP ser ver–even proprietary ser vers such as Microsoft Active Directory . The open source UNIX foundation makes it easy to port and deploy existing tools to Mac OS X Ser ver . T[...]

 W eb T echnologies: Mac OS X S er ver is a complete AMP stack (a bundle of integrat ed Apache-MySQL-PHP/Perl/Python software). Mac OS X Ser ver web technologies are based on the open sourc e Apache web ser ver , the most widely used HT TP ser ver on the Internet. With per formance optimized for Mac OS X Server , Apache pr ovides fast, reliable w[...]

Chapter 1 System Overview and Supported Standards 23 Â XMPP: Ex tensible Messaging and Pr esence Protoc ol (XMPP) is an op en XML-based messaging protocol used f or messaging and presence information. XMPP ser ves as the basis for Mac OS X Ser ver’ s Push Notication service, as well as iChat Ser ver , and all publish and subscribe functions f[...]

24 Before installing and setting up Mac OS X Ser ver do a little planning and become familiar with your options . The major goals of the planning phase are to make sure that: Ser ver user and administrator needs are addr essed by the ser vers you deploy  Ser ver and service prerequisites that a ec t installation and initial setup are  identi[...]

Chapter 2 Planning Server Usage 25 During the planning stage, you ’ll also decide which installation and ser ver setup options best suit your needs. For example , G etting Star ted contains an example that illustrates server installation and initial setup in a small business scenario with the ser ver in using Server Prefer ences. Determining Whet[...]

If you ’ve been planning to replac e a Windows NT c omputer , consider using Mac OS X Ser ver with its extensive built-in suppor t for Windows clients. Mak e sure that administrators familiar with the se other systems are par t of the planning process. What are the characteristics of the network into which the server will be installed? Â Do you [...]

Chapter 2 Planning Server Usage 27 Home folders for netw or k users can be consolidated ont o one ser ver or distributed  among various servers. Although you can move home f olders, you might need to change a large number of user and share poin t records, so devise a strategy that will persist for a reasonable amoun t of time. For information abo[...]

Dening a M igration Str ategy If you’ re using Mac OS X Ser ver v1 0.4–1 0.5 or a Windows-based ser ver , examine the oppor tunities for mo ving data and settings to Mac OS X S er ver v1 0.6. Upgrading and Migrating from an Earlier V ersion of Mac OS X Ser ver If you’ re using computers with Mac OS X Ser ver v1 0. 4 or v1 0.5 , consider up[...]

Chapter 2 Planning Server Usage 29 The rst aspect primarily involv es director y ser vices integration. Identify which Mac OS X Ser ver computers will use existing directories (such as Active Directory , LDAPv3, and NIS directories) and existing authentication setups (such as Kerberos). F or options and instruc tions, see the additional informat[...]

F or example, if you use Mac OS X Ser ver to provide DHCP , network time, or BootP ser vices to other servers, you should set up the ser vers that provide these services and initiate the services before you set up servers that depend on those services. The amount of setup infrastructure you r equire depends on the complexit y of your site and what [...]

Chapter 2 Planning Server Usage 31 Making Sure Required Ser ver Hardware I s Av ailable Y ou might want to postpone setting up a server until all its hardware is in place . F or example, you might not want to set up a server whose data you wan t to mirror until all disk drives y ou need for mirroring are available . Y ou might also want to wait unt[...]

Understanding Backup and Restore P olicies There are man y reasons to have a backup and rest ore polic y . Y our data is subject to failure because of failed c omp onents, natural or manmade disasters, or data corruption. Sometimes data loss is beyond your con trol to prevent, but with a backup and restore plan, you can restore y our data. Y ou nee[...]

Chapter 2 Planning Server Usage 33 Y our organization must determine the following: What must be backed up? Â What should not be backed up (as per organization policy)? Â How granular are the re storation needs? Â How often is the data backed up? Â How accessible is the data: in other words, how much time will it take to restor e it? Â What pr[...]

Understanding Backup Scheduling Backing up les requires time and resourc es. Before deciding on a backup plan, consider the following que stions: How much data will be backed up? Â How much time will the backup take? Â When does the backup need to happen? Â What else is the computer doing during that time? Â What sort of resource allocation [...]

Chapter 2 Planning Server Usage 35 Consider the follo wing questions: How long will it take to restor e data at each level of granularity? Â F or example, how long will a deleted le or email take to restore? Ho w long will a full hard disk image take to restor e? How long would it take to return the whole network to its state three da ys ago? W[...]

 Capacity . If you back up only a small amount of data, low-capacity storage media can do the job . But if y ou need to back up large amounts of data, use high-capacity devices , such as a RAID .  Speed. When your goal is to keep your ser ver av ailable most of the time, restoration speed becomes a big factor in deciding which type of media to [...]

Chapter 2 Planning Server Usage 37 F or example, Time M achine doesn ’t back up user and group director y records , email, DNS records , A ddress Book shared groups, iCal Ser ver calendars, and so forth. It only save s the settings made in S er ver Pr eferences and Server Admin, and whether a ser vice is on or o . The following service setting[...]

38 Manage Mac OS X Ser ver using graphical applications or command-line tools . Mac OS X Ser ver v1 0.6 administration applications must be run from either Mac OS X Ser ver v1 0.6 or Mac OS X v1 0.6. Ser ver Admin Y ou use Ser ver Admin to administer services on Mac OS X Ser ver computers. S er ver Admin also lets you s pecify settings that suppor [...]

Chapter 3 Administra tion T ools 39 Ser ver Admin In ter face The Ser ver Admin in ter face is shown here, with each element explained in the following table . O N M L K J I H G F E D C B A A Ser ver List: Shows ser vers, groups, smart groups, and if desired, the administered services for each server Y ou selec t a group to view a status summary fo[...]

D Main Work Area: Shows status and conguration options. This looks di erent for each service and for each context button selected. E A vailable servers: Lists the local-network scanner , which y ou can use to discover servers to add to your server list. F All Servers: Shows all computers added to Server Admin, regardless of status. G Ser ver:[...]

Chapter 3 Administra tion T ools 41 Ser ver Assistant Ser ver Assistant is used f or : Remote server installations  Initial setup of a local ser ver  Initial setup of remote servers  Preparing data f or automated setup  The Ser ver Assistant initial page is sho wn here. Ser ver Assistant is opened from the Server menu of Ser ver Admin. The [...]

Ser ver Pr eferences Ser ver Pr eferences is the simplied administration application y ou need for managing Mac OS X Ser ver v1 0.6. Y ou can use Ser ver Prefer ences in addition to or instead of Ser ver Admin and W orkgroup Manager : Manage basic user and group settings. Â Congure essen tial ser vice settings such as: le sharing ser vice[...]

Chapter 3 Administra tion T ools 43 W orkgroup Manager In ter face The W or kgroup Manager interface is shown here, with each element explained in the following table . J I H G F E D B C A A Ser ver Admin: Click to open the Ser ver Admin application. B Settings Buttons: Click Accounts t o view or edit account settings, or click Preference s to view[...]

Customizing the W orkgroup Manager Envir onment There are sev eral ways to tailor the Workgr oup M anager environment: T o open W or kgroup Manager Pref erences, cho ose Workgroup Manager > Â Pref erences. Y ou can congure options such as if DNS names are resolv ed, if the Inspector is enabled, if you need to enter a search query to list rec[...]

Chapter 3 Administra tion T ools 45 T o identify the Xser ve computer to monitor , click Add Ser ver , identify the ser ver , and enter user name and passwor d information for an administrator of the server . If adding the local ser ver , use ’1 27 .0.0. 1’ for the IP address. If adding a remote server , enter the ser ver’ s L OM hostname or [...]

iCal Ser vice Utility iCal Ser vice Utility gives users access to shared inf ormation about locations and resource s. Users can use iCal Ser vice Utilit y to set up information about shared resource s and locations for use with iCal Ser vice. iCal Ser vice Utility Interface The iCal Service Utilit y inter face is shown here , with each elemen t exp[...]

Chapter 3 Administra tion T ools 47 Syst em Image M anagement Y ou can use the following Mac OS X Ser ver applications to set up and manage NetBoot and NetInstall images: Â System Image Utility creates Mac OS X disk images . It’ s installed with Mac OS X Ser ver software in the /Applications/Server/ folder . The System Image Utility interface is[...]

Command-Line T ools If you’ re an administrator who prefers t o work in a command-line environment , you can do so with Mac OS X Ser ver . F rom the T erminal application in M ac OS X, you can use the built-in UNIX shells (sh, csh, tsh, zsh, bash) to use tools for installing and setting up server sof tware and for conguring and monitoring serv[...]

Chapter 3 Administra tion T ools 49 P odcast Capture , Composer , and Produc er P odcast Capture takes audio and video from a local or remote camer a, capture s screen activity , or uploads Quick Time les into P odcast Producer for enc oding and distribution. P o dcast Composer creat es the workow instructions for P odcast Producer . Xgrid Ad[...]

Apple Remote Desktop Apple Remote Desktop (ARD), which you can optionally purchase, is an easy-to-use network-computer management application. I t simplies the setup , monitoring , and maintenance of r emote computers and lets y ou interact with users. The ARD interface is shown here. Y ou can use ARD to: Contr ol and obser ve computer screens. [...]

51 By vigilantly adhering to security policies and practices , you can minimize the threa t to system integrity and data privacy . Mac OS X Ser ver is built on a robust UNIX foundation that c ontains many security feature s in its core architecture. State-of-the-art, standards-based technologies protect your server , network, and data. The se techn[...]

About Network Security Network security is as impor tant to data integrity as physical security . Although someone might immediately see the need to lock down an e xp ensive server , he or she might not immediately see the need to r estric t access to the data on that same server . The follo wing sec tions provide considerations , t echniques, and [...]

Chapter 4 Enhancing Security 53 This allows an organiza tion to provide ser vices to the external network while protecting the internal network from being compr omised by a host in the DMZ. I f someone compromises a DMZ host, he or she cannot connect to the internal network. The DMZ is often used to connect servers that need to be accessible from t[...]

In theor y , MA C ltering allows a network administrator to permit or deny network access to hosts and device s associated with the MAC address , although in practice there are methods to a void this form of access control thr ough address modication (spoong) or the physical e xchange of network cards between hosts. T ranspor t Encr yption[...]

Chapter 4 Enhancing Security 55 Most transport encr yption requires the participation of both par ties in the transaction. Some ser vices (such as SMTP mail service) can’ t reliably use such techniques, so encr ypting the le itself is the only method of reliably securing the le conten t. T o learn more about le encr yption, see “ About[...]

 Secure VM: Secure VM encr ypts system vir tual memor y (memor y data temporarily written to the hard disk), not user les. I t improves syst em secur ity by keeping vir tual memor y les from being read and exploited .  Disk Utility : Disk Utility can create disk images whose conten ts are encr ypted and password prot ec ted. Disk images a[...]

Chapter 4 Enhancing Security 57 In Mac OS X Ser ver , users trying to access services (like logging in to a director y-aware workstation, or tr ying to mount a remote v olume) must authenticate by pro viding a login name and password bef ore privileges for the users can be determined. Y ou have several options f or authenticating users: Â Open Dir[...]

W eb Ser vice (Apache via the SPNEGO Simple and P rotected GSS-API Negotiation  Mechanism protocol) Xgrid   Storing passwords in user acc ounts. This approach might be useful when migrating user accounts from earlier server versions. However , this appr oach may not suppor t clients that require netw ork-secure authentication protocols , such[...]

Chapter 4 Enhancing Security 59 Kerberos also provides a single sign-on en vironment where users must authen ticate only once a day , week, or other period of time, easing authentication loads for users . Mac OS X Ser ver and Mac OS X versions 1 0.3 through 1 0.6 suppor t Kerberos version 5 . About Certicates , SSL, and Public Key Infrastructure[...]

W eb, mail, and dir ec tor y ser vices use the public key with SSL to negotiate a shared key for the duration of the c onnec tion. F or example, a mail ser ver will send its public key to a connecting client and initiate negotiation for a secure c onnec tion. T he connec ting client uses the public key to encr ypt a response t o the negotiation. Th[...]

Chapter 4 Enhancing Security 61 About Identitie s Identities are a c er ticate and a private key , together . The cer ticate identies the user , and the priv ate key corresponds to the certicate. A single user can have sev eral identities; for any giv en user each cer ticate could have a di erent name , email address , or issuer .[...]

Several keychains can hold certicates: Â SystemRootC er ticates: This keychain holds root certicates that ship with Mac OS X. The cer ticates already hav e trust given to them. Â System: This keychain holds certicates that the computer administr ator can add. All users on a given client can read fr om this k eychain. The trust sett[...]

Chapter 4 Enhancing Security 63 The Ser ver Admin in ter face is shown below , with Cer ticates selected. Certicate Manager provides int egrated management of SSL certicates in Mac OS X Ser ver for services that allow the use of SSL certicates. On installation, the ser ver create s a self-signed cer ticate for immediate use from inf [...]

When certicates and keys are impor ted via Certicate Manager , they are put in the /etc/certicates/ directory. The director y contains four PEM formatt ed les for every identity : The certicate  The public key  The trust chain  The concatena ted version of the cer ticate plus the trust chain (for use with some  ser vices) [...]

Chapter 4 Enhancing Security 65 Creating a Self-Signed C er ticate A self-signed certicate is generated at server setup. Although it is available for use , you may wan t to customize the information in the certicate, so you would create a new self-signed certicate. This is especially important if you plan on having a CA sign your certi?[...]

4 Click the Action button below the certicates list and choose “Generate Certicate Signing Request (CSR).” Certicate manager creates the signing r equest and shows the ASCII text version in the sheet. 5 Click Save to sa ve the CSR to the disk. Y our CA will have instructions on how to transfer the CSR t o the signer . Some CAs require [...]

Chapter 4 Enhancing Security 67 5 If you override the defaults , provide the following information in the next few screens: A unique serial number for the root certicate  The number of days the CA functions before expiring  The type of user cer ticate this CA is signing  Whether to creat e a C A website f or users to access f or CA cer [...]

Using a CA to Crea te a Cer ticate for Someone Else Y ou can use your CA certicate to issue a cer ticate to someone else. By doing so you are stating you wan t to be a trusted par ty that can cer tify the identity of the cer ticate holder . Before you can cr eate a cer ticate for someone , tha t person must generate a CSR. T he user [...]

Chapter 4 Enhancing Security 69 7 Click the Import button. If prompted , en ter the private key passphrase. Managing Certicates After you creat e and sign a cer ticate, you won ’t do much more with it. Since certicates cannot be edited , you can either delete, replace, or revoke cer ticates after they are created . Y ou cannot change [...]

F or instruc tions on how to do this, see “ Replacing an Existing Certicate ” on page 71 . Distributing a CA Public Certicate to Clien ts If you’ re using self-signed cer ticates , a warning appears in most user applications saying that the CA is not recogniz ed. O ther software, such as the LDAP client, refuses to use SSL if the ser[...]

Chapter 4 Enhancing Security 71 5 Click Save . Renewing an Expiring Certicate Certicates have an e xpiration date and must be renewed periodically . Renewing a certicate is the same as replacing a certicate with a newly generated one with an updated expiration dat e. T o renew an expiring certicate: 1 Request a new certicate from [...]

SSH and SSH Keys SSH is a network protocol that e stablishes a secure channel between your computer and a remote computer . I t uses public-key cr yptography to a uthenticate the remote computer . I t also provides trac encryption and data integrity exchanged between computers. SSH is frequently used to log in t o a remote machine to execute com[...]

Chapter 4 Enhancing Security 73 The -b ag sets the length of the keys to 1,024-bits , -t indicates to use the RSA hashing algorithm, -f sets the le name as id_rsa, and -P f ollowed by two single-quote marks sets the private key passwor d to be null. The null private key password allo ws for automat ed SSH connec tions. Keys are equivilant to [...]

$count = @{[$_ =~ /$match/g]}; if($count > 0) { $flag = 1; } } close SBUFF; if($flag == 1) { "ssh $server -x -o batchmode=yes shutdown -r now" } } Administra tion Level Security Mac OS X Ser ver can use another level of access con trol for added security . Administrat ors can be assigned to ser vices they can congure. T hese limitat[...]

Chapter 4 Enhancing Security 75 Y ou can determine which ser vices other admin group users can modify . T o do this, the administrator making the determination must have full, unmodied access. The process f or setting administration level privileges is found in “ Tiered Administration P ermissions” on page 1 49 . Ser vice Lev el S ecurity Y [...]

Securit y Best P rac tices Ser ver administrators must make sure that adequat e secur ity measures are implemented to pr otec t a ser ver from attacks. A compromised ser ver risks the resource s and data on the ser ver and risks the resources and data on other connected systems. T he compromised system can then be used as a base to launch attacks o[...]

Chapter 4 Enhancing Security 77 Do not use administrator (UNIX “ admin” group) accounts for daily use.  Restrict the use of administration privileges by keeping the admin login and password separat e from daily use. Back up critical data on the system regularly , with a copy stored at a secure o-site  location. Backup media is of little [...]

Creating C omplex P asswords Use the following tips t o create complex passwords: Use a mix of alphabetic (upper and lower case), numeric, and special characters  (such as ! and @). Don ’t use words or combinations of wor ds found in a dictionar y of any language.  Don ’t append a number to an alphabetic word (for example , “wacky2”) to[...]

79 Whether you install Mac OS X Ser ver on a single server or a cluster of ser vers , there are tools and proc esses to help the installation and deploymen t succeed. Some computers come with Mac OS X Ser ver software already installed . Other computers need the ser ver software installed. For example , installing Mac OS X Ser ver v1 0.6 on a compu[...]

Step 3: Set up the environment If you are not in complete con trol of the network environment (DNS servers, DHCP ser ver , rewall, and so for th) coordinate with your network administra tor before installing. A func tioning DNS system with full reverse lookups and a rew all to allow conguration constitute a minimum f or the setup environme[...]

Chapter 5 Installation and Deployment 81 “ Â Installing Remotely with Ser ver Assistant” on page 101 “ Â Installing Remotely with Screen Sharing and VNC ” on page 1 02 “ Â Using the installer Command-Line T ool to Install Ser ver Software” on page 1 04 Step 7: Set Up Ser vices Restart from the target disk to proceed to setup . For mo[...]

Setting Up Network Ser vices Before you can install, you must set up the following for y our network ser vice: Â DNS: Y ou must have a fully qualied domain name f or each ser ver ’ s IP addess in the DNS system. The DNS zone must hav e the reverse-lookup record for the name and address pair . Not having a stable, functioning DNS system with r[...]

Chapter 5 Installation and Deployment 83 Mac OS X Ser ver Install Disc The Install Disc has a Documentation folder with Getting Started , Installation & Setup W orksheet , and a Read Me le. I t also contains an Other Installs folder , which has the following installer packages: Ser verAdministrationSoftware.mpkg  Use this package to instal[...]

When you install and set up Mac OS X Ser ver on a computer that has a dis play and keyboard, it ’ s already an administrator computer . T o make a computer with Mac OS X into an administrat or computer , you must install additional software. Important: If you hav e administrative applications and tools from Mac OS X Server v1 0.4 or earlier , do [...]

Chapter 5 Installation and Deployment 85 Star ting Up from the Install DVD This is the simplest method of starting the computer , if y ou have physical access the ser ver and it has DVD drive. Installer application or installer tool in T erminal application If the target server is an Xser ve with a built-in DVD drive, start the ser ver using the In[...]

However , if you are reinstalling regularly , or if you are creating an external Fir ewire drive-based installation to take to v ar ious computers, or if you need some other kind mass distribution (such as clustered Xserves without DVD drives installed), this method can be very ecient. This method is suited to installing on comput ers that you d[...]

Chapter 5 Installation and Deployment 87 4 Select File > New > Disk Image from <device>. 5 Give the image a name; select Read-only , Read/W rite, or Compressed as the image type; and then click Save. 6 After the image is complete , select the image from list on the left. 7 In the menu, selec t Images > Scan Images for Restor e. 8 Pr [...]

Tip: ∏ Y ou can use asr to restore a disk o ver a network, multicasting the blocks to client computers. Using the multicast ser ver feature of asr , you could put a copy of the installer image on a par tition of all computers that can rec eive the multicast packets. F or example, restoring an image called Installer .dmg to the par tition Ex traHD[...]

Chapter 5 Installation and Deployment 89 This is usually the rst eight characters of the server ’ s built-in hardware serial number . F or more information about this password , see “ About Ser ver Serial Numbers for Default Installation P asswords ” on page 90 . T o access the computer with VNC: 1 Start the target computer from the Instal[...]

2 Identify the target server . If you don ’t know the IP address and the remote server is on the local subnet, you can nd ser vers using the comannd line. For more inf ormation about this process, see “Identifying Remote Ser vers When Installing Mac OS X Ser ver ” on page 90. 3 Use the T erminal to open a secure shell connection to the tar[...]

Chapter 5 Installation and Deployment 91 Y ou can use the dns-sd tool to identify computers on the local subnetwhere y ou can install ser ver software. Enter the following from a comput er on the same local net work as the ser ver: dns-sd -B _sa-rspndr._tcp. This command returns the IP addre ss and the EthernetID (in addition to other information) [...]

Step 1: Create a NetInstall image from the Install DVD This step doesn ’t need to be done on the tar get computer . I t can be done on an administrator computer tha t has enough free space to image the entire Install DVD . Step 2: Start up the computer from the NetBoot ser ver There are f our ways of doing this, depending on your en vironment. T [...]

Chapter 5 Installation and Deployment 93 If you’ re using an installation disc for Mac OS X Ser ver v1 0.6, y ou can per form these tasks from another networked computer using VNC viewer software, such as Apple Remote Desktop , bef ore beginning a clean installation. W ARNING: B efore partitioning a disk, creating a RAID set, or erasing a disk or[...]

A case-sensitive volume is supported as a star t volume format. An HFSX le system for Mac OS X Ser ver must be specically selected when erasing a volume and preparing a disk before initial installation. If you are planning to use NFS, you should use case-sensitive HFSX. An HFSX volume can be case sensitive or case insensitiv e. Case sensitivi[...]

Chapter 5 Installation and Deployment 95 Pa r titioning a Disk Y ou can use the Installer to open Disk Utilit y and then use Disk Utility to par tition the installation target disk int o desired volumes. Y ou can erase the target volume using the Mac OS Extended format, Mac OS Ex tended (Jour naled) format, M ac OS Extended format (Case-Sensitive) [...]

Additional information about diskutil and other uses can be f ound in Introduction to Command-Line Administr ation. F or complete command syn tax for diskutil, consult the tool’ s man page. The specic command issued depends on y our disk format needs and the hardware in use. T ake care to use command-line argumen ts that apply to your speci[...]

Chapter 5 Installation and Deployment 97 Y ou can combine RAID sets to combine their benets. F or example, you can create a RAID set that combines the fast disk access of a striped RAID set and the data protection of a mirrored RAID set. T o do this, create two RAID sets of one type and then create a RAID set of another type, using the rst t [...]

5 Drag the disks to the window . 6 F ollow the instructions in the window to set parameters. 7 Click Create . Y ou can nd instructions for par titioning the hard disk into multiple volume s, creating a RAID set, and erasing the target disk or partition by viewing Disk Utilit y Help. T o view Disk Utility Help, open Disk Utilit y on another Mac c[...]

Chapter 5 Installation and Deployment 99 Erasing a Disk or P ar tition Y ou have several options f or erasing a disk, depending on your preferred tools and your computing en vironment: Â Erasing a disk using Disk Utility: Y ou can use the Installer to open Disk Utility and then use it to erase the target v olume or another volume. Y ou can erase t[...]

Installing Locally fr om the Installation Disc Y ou can install Mac OS X Ser ver directly onto a computer with a display , a keyboard, and a DVD drive attached , as shown in the f ollowing illustration: Installer application or installer tool in T erminal application If you have an Install DVD , the optical drive must be able t o read DVD discs. Y [...]

Chapter 5 Installation and Deployment 101 After installation is complete , the target ser ver restarts and you can per form initial ser ver setup . Chapt er 6 , “ Initial Ser ver Setup ,” on page 1 08 describes how . Installing Remotely with Ser ver Assistant T o install Mac OS X S er ver on a remote server from the server Install DVD, installa[...]

3 Select the target ser ver from the list of servers waiting for installation. If neither the target server nor the list appear , make sure the target ser ver is on the same local subnet as the administrator computer . 4 If the target computer is not on the same local subnet as the administrat or computer , add the ser ver manually . a Choose Insta[...]

Chapter 5 Installation and Deployment 10 3 F or detailed instruc tions for connecting to a computer running from an Install DVD , see “Remotely Accessing the Install DVD” on page 88. Important: If you perform an upgrade, make sure that saved setup da ta won’ t be detected and used by the server . If saved setup data is used, the ser ver setti[...]

sudo shutdown -r now # Method 2 sudo systemsetup -liststartupdisks sudo systemsetup -setstartupdisk <path to disk root> Using the installer C ommand-Line T ool to Install Ser ver Soft ware Y ou use the installer tool to install ser ver software on a local or remote comput er from the command line. For inf or mation about installer , see the i[...]

Chapter 5 Installation and Deployment 10 5 4 If you haven ’t already done so, prepare the disks for installation. F or more information about preparing the disks for installation, see “P reparing Disks for Installing Mac OS X Ser ver ” on page 92 . If the target volume has the late st M ac OS X Ser ver v1 0.5 or 1 0.4. 1 1 installed , when yo[...]

Installing Multiple Ser vers Most Ecient Methods of Installation The most ecient method of installation w ould be completely automated . Opening the T er minal application and using the installer tool to initiate each server software installation doesn ’t accomplish this eciently . However , scripting the command-line tool (using known v[...]

Chapter 5 Installation and Deployment 10 7 Upgrading a C omputer from Mac OS X to Mac OS X Ser ver This is not supported in Mac OS X S er ver v1 0.6. Perform a clean installation instead. How to Keep C urrent After you ’ve set up your server , you’ll wan t to update it when Apple releases server software updates. There are sev eral ways to acce[...]

10 8 Basic characteristics of your Mac OS X Ser ver are established during ser ver setup . The ser ver can opera te in three di erent congurations: advanced , standard , and workgroup . After installing server soft ware , the next task is to set up the server . There are several ways to set up a server: Set up ser vers interactively . Â Auto[...]

Chapter 6 Initial Server Setup 10 9 If you’ re setting up a ser ver without a keyboard or display , you can enter the follo wing in the T er minal application to shut down the server remotely: sudo shutdown now Connecting to the Network During Initial Ser ver Setup Before setting it up f or the rst time, tr y to place a ser ver in its nal n[...]

Default SSH and Apple Remote Desktop sta te is enabled. Â Network interfaces (por ts) are congured . Â T CP/IP and Ethernet settings are dened for each por t you want to activa te. Network names are dened . Â The primary DNS name, computer name are dened by the administrator , and local hostname is derived from the computer name . F [...]

Chapter 6 Initial Server Setup 111 Â Import Users and Groups This setting connects the ser ver to an existing Open Directory or Active Director y system, impor ting the users and groups from an existing directory system. Y ou can impor t Open Director y users or Active Director y users. Y ou must provide a director y administrator name and passwor[...]

Even if y ou want to change the ser ver ’ s director y setup, selec ting “Congure Manually ” is the safest option, especially if you ’re considering changing a server ’ s shared director y conguration. Changing from hosting a directory to using another ser ver ’ s shared director y or vice versa, or migrating a shared NetInfo doma[...]

Chapter 6 Initial Server Setup 11 3 T o interactively connect to an additional dir ec tor y ser ver: 1 Open the Accounts pane of S ystem Pref erences on your ser ver . 2 Click Login Options and then click Open Directory Utilit y . 3 Click the Add (+) button, and then choose the director y ser ver from the pop-up menu or enter the directory ser ver [...]

The follo wing illustration shows target ser vers on the same subnet as the administrator computer in one sc enario and target ser vers on a di erent subnet in the other scenario. Both setup scenarios can be used to set up ser vers on the same and di erent subnets. Subnet 1 Subnet 2 Welc ome Welc ome Welc ome If a target server is on a di [...]

Chapter 6 Initial Server Setup 11 5 If the computer you wan t to congure doesn ’t appear in the list, you can add it manually by clicking the Add button and supplying the request ed information. 6 Remove comput ers from the conguration list that you don ’t want to set up b y selecting them and click ing the Remove button. 7 Authenticat e [...]

The automa tic approach is useful when you: Have mor e than a few ser vers to set up  W ant to prepare for setting up servers that aren ’t yet a vailable  W ant to save setup data f or backup purposes  Need to reinstall servers frequently  Y ou can keep backup copies of setup data les on a network le ser ver . A lternatively , you c[...]

Chapter 6 Initial Server Setup 11 7 Y ou can dene generic setup data that can be used to set up any ser ver . F or example, you can dene generic setup data for a server that’ s on order , or to congure 50 Xser ve computers y ou want to be identically congured . Y ou can also save setup data that’ s tailored for a server . Important:[...]

Using Encryption with Setup Data Files Saved setup data can be encrypted for extra security . Bef ore a ser ver sets itself up using encr ypted setup data, it must have acce ss to the passphrase used when the data was encrypted. F or interactive setup, the passphrase is entered using Server Assistant during setup . If you want to st ore the passwor[...]

Chapter 6 Initial Server Setup 11 9 If setup data is encr ypted , the server needs the correct passphrase before setting itself up. Y ou can use Ser ver Assistant to supply the pass phrase interactively , or y ou can supply the passphrase in a le con taining the passphrase in the same folder as the corresponding a uto setup prole but with a .[...]

T o use setup data from a le remotely: 1 Create the f older for the setup le on the remote server . a Connect to the remote server . ssh root@<server address> b Create the saved setup f older on the remote ser ver . mkdir /Auto Server Setup 2 Copy the sa ved setup le from the administrator computer to the r emote target computer . [...]

Chapter 6 Initial Server Setup 12 1 Handling Setup Errors When a server encounters a setup problem, Ser ver Assistant shows a de scription of the setup error , and giv es some oppor tunit y to either x it or tr y again. If you are setting up the target server remotely , you are given the option to share its screen and interact via the Server Ass[...]

Setting Up Ser vices After installation and initial startup, the rst time you open Ser ver Admin, you see any ser vices that wer e congured during ser ver setup listed underneath the ser ver’ s name in the ser ver list. If no ser vices were congur ed during ser ver setup, Ser ver Admin prompts you to select the services you want to c on?[...]

Chapter 6 Initial Server Setup 12 3 Setting Up Open Director y Unless your server must be integrat ed with another vendor ’ s director y system or the director y architecture of a server you’ re upgrading needs changing immediately , you can begin using the directories you congur ed during ser ver setup. The online help and Mac OS X Ser ver [...]

12 4 This chapter sho ws you how to complet e ongoing management f or your systems , including setting up administrator c omputers, designating administrat ors, and maintaining service uptime. Read the following sections as a basic introduction to Mac OS X Ser ver management: “ Â Computers Y ou Can Use to Administer a Server ” on page 12 4 “[...]

Chapter 7 Ongoing System Management 12 5 In the following illustra tion, the arrows originat e from administrator computers and point to servers the administrator computers might be used t o manage. Mac OS X Ser vers Mac OS X administrator computer When you ’ve installed and set up a Mac OS X Ser ver that has a display , keyboard, and optical dri[...]

Using the A dministration T ools Information about administration tools can be f ound on the pages indicated in the following table . Use this application or tool To S ee Command-line tools Administer a server using a UNIX command shell. “Command-Line T o ols” (page 48) iCal Service Utility Add locations and resour ces to your iCal server . “[...]

Chapter 7 Ongoing System Management 12 7 Y ou can use Workgroup Manager on a v1 0.6 ser ver to manage Mac OS X clients running the latest Mac OS X v1 0.5. However , af ter you edit a user record using W orkgroup Manager on v1 0.6, y ou can only access it using Workgroup Manager on v1 0.6. P or ts Used for A dministration F or Apple’ s administrat[...]

Ser ver Admin Basics Y ou use Ser ver Admin to administer services on Mac OS X Ser ver computers. S er ver Admin also lets you s pecify settings that suppor t multiple ser vices, such as creating and managing SSL certicates and specifying which users and groups can access ser vices. Adding and Removing Servers in Ser ver Admin The servers you ca[...]

Chapter 7 Ongoing System Management 12 9 If a ser ver in the Ser vers list appears gray , double-click the ser ver or click the Connect button in the toolbar to log in again. T o enable auto-reconnect the next time you open Ser ver Admin, selec t the “R emember this password in m y k eychain ” while you log in. Grouping Ser vers Manually Ser ve[...]

IP address  OS version  T o create a server smart group: 1 Under the Ser ver list at the bottom of the Server Admin window , click the Add (+) button. 2 Select Add Smar t Group. 3 Name the smart group. 4 Dene the criteria that ser vers will appear in the list and click OK. The group appears in the Server list. W ork ing with Settings for a S[...]

Chapter 7 Ongoing System Management 131 The follo wing table contains a summar y of what you nd for each button: T oolbar button Shows Overview Information about the server ’ s hardware , software, ser vices, and status. Logs The system log and security systems log. Graphs A pictorial history of ser ver activit y . Sharing Conguration optio[...]

Ser ver-side le tracking for mobile home-sync is a feature of mobile home f olders. F or information about when to enable this feature , see the online help and Mac OS X Ser ver Resources w ebsite at www.apple .com/ser ver/macosx/resourc es/. Â Network pane: Click Network to view or change the ser ver’ s computer name or local hostname, or to[...]

Chapter 7 Ongoing System Management 13 3 The follo wing sec tions give guidance regarding the types of changes will be necessary for a name or IP address change . Understanding Mac OS X Ser ver Names Three names are used b y Mac OS X S er ver: computer name, local hostname, and DNS name. They ar e used by di erent parts of the system for di e[...]

Y our network conguration might hav e other domains, computers, and record types that are impacted by a server ’ s IP address change (SR V records , f or instance). T hese other records should b e examined thoroughly after an y change to a ser ver ’ s IP address. If the ser ver is a DNS server , use the tool changeip to change the NS, A, and[...]

Chapter 7 Ongoing System Management 13 5 Changing the DNS name of the directory ser ver requires that all bound machines be rebound to the new directory name and address. If you have set up a Kerber os environment, the Kerb eros realm does not change when the hostname is changed. Fir ewall Changing the IP address of the F irewall can signicantly[...]

VPN VPN ser vers allocate IP addre ss ranges to VPN clients and mediate DNS queries of VPN clients. Any of these can be a ec ted by a change to the VPN ser ver ’ s IP address or domain name. Additionally , the VPN server contains routing denitions based on IP addresses . A change to the IP addr ess can make those routing addresses unreachab[...]

Chapter 7 Ongoing System Management 13 7 MySQL In general, MySQL is not a ected by changing an IP address or DNS name. However , none of the data in the databases is alter ed when the DNS name or IP address are changed. Y ou are responsible f or replacing reference s to the DNS name and address (if used) in your databases . If you set a database[...]

F or the most par t, changing the net work address or DNS name of a le server has no internal a ec t on le ser vices. T he le ser vice processes monitor network int er faces for changes and adapt as nece ssar y without administrator intervention. No fur ther conguration is required . A few places migh t need conguration settings c[...]

Chapter 7 Ongoing System Management 13 9 IMAP and POP Dovecot, the IMAP and POP ser vice, loads the fully-qualied domain name at startup and conguration reload . After a change, Dovecot must be restarted or given a SIGHUP command , at a minimum). Y ou must also restart if you manually edited the listen or ssl_listen parameters. SMTP P ostx[...]

Address Book Service Changing the IP address of an A ddress Book ser ver does not a ect new connections to the server; however , it can disconnect existing client connections. If you manually edited the BindHT TPP or ts or BindSSLPorts options in the carddavd .plist le, edit them again and restart the ser vice. Changing the DNS name of an Add[...]

Chapter 7 Ongoing System Management 141 Certicates for C ollaboration Ser vices AddressBook, iCal, and iChat ser vers that use SSL will need new cer ticates. Y ou might need regenerate or r epurchase the cer ticates. Use S er ver Admin t o imp or t the new certicates, then congure each service’ s new certicate. Understanding IP [...]

T o change the IP address of the P odcast Producer comput er : 1 Stop the Xgrid job queue when empty (or stop and empty it). 2 Recongure DNS, Open Director y , DHCP , and other infrastructure ser vices. F or example, in DNS, change the A record IP address of the P odcast Producer server . 3 Use changeip to change the IP address of the P odcast P[...]

Chapter 7 Ongoing System Management 14 3 Software Update Ser vice  Xgrid  After Software Update changes the DNS name or IP address , a number of changes must be made by the clients. However , the following guidelines for the server should be follow ed. Print Print service needs no changes if the IP address change s. I f the DNS name changes, th[...]

Changing the IP Addr ess of a Ser ver Y ou can change the IP address of a server using the Network pane of System Pref erences or the networksetup tool. Do not turn o the primar y network interface and then turn it back on with a di erent address. S everal services will not get the needed notication to update their conguration. Changing[...]

Chapter 7 Ongoing System Management 14 5 Y ou can use the scutil command-line tool to set the local hostname and local hostname. For more information, see the scutil man page. Do not use the changeip command-line tool to change computer name s, even though the tool is still av ailable. T o change computer name and local hostname: Change the names i[...]

Adding and Removing Services in Ser ver Admin Ser ver Admin can only show y ou the ser vices you are administering , hiding all other ser vice conguration panes un til needed. Before you can administer a service, it must be enabled for the specic server; then that ser vice appears under the ser ver name in the main Ser ver list. T o add or re[...]

Chapter 7 Ongoing System Management 14 7 Con trolling Access t o S er vices Y ou can use Ser ver Admin to congure which users and gr oups can use ser vices hosted by a server . Y ou set up access to services to users and groups using SA CLs. Y ou can set up the same access to all services, or you can select a ser vice and customize its access se[...]

Using SSL for Remot e S er ver Administr ation Y ou can control the level of security of communications between Server Admin and remote servers by choosing Ser ver Admin > P references . By default, Ser ver Admin trea ts communications with remote servers as encrypted using SSL. This uses a self-signed 1 28-bit cer ticate installed in /etc/se[...]

Chapter 7 Ongoing System Management 14 9 The follo wing is the File Sharing conguration pane in Server Admin. Tiered Administr ation Permissions In previous releases of Mac OS X Server , there were two classes of users: admin and everyone else. Admin users could make any change to the settings of an y ser vice or change any directory data includ[...]

Ser ver Admin update s to reect what operations are possible for a user’ s permissions. F or example, some ser vices are hidden or the Settings pane is dimmed when you can only monitor that service. Because the featur e is enforced on the server side, the permissions also impac t the usage of ser veradmin, dscl, dsimpor t, and pwpolic y comman[...]

Chapter 7 Ongoing System Management 151 The follo wing topics describe general W or kgroup Manager usage. Instructions for conducting specic administration tasks are a vailable in Workgroup Manager help and the Mac OS X Ser ver Resources w ebsite at www.apple .com/ser ver/macosx/resource s/. Opening and Authen ticating in W orkgroup Manager W or[...]

The follo wing is a sample user record conguration pane in Workgroup Manager: Initially , accoun ts listed are those stored in the last directory node of the ser ver ’ s search path. When you use other Workgroup Manager windows , such as Pr eference s, click Accounts in the t oolbar to return to the account window . T o specify the directories[...]

Chapter 7 Ongoing System Management 15 3 Dening Managed Pref erences T o work with managed preferences f or user accounts, group accounts, or computer lists, click the Preference s icon in the W or kgroup Manager toolbar . The follo wing is the User Preferenc e M anagement Over view pane in Workgroup Manager: Click Details to use the prefer ence[...]

W orking with Direc tory Data T o work with raw director y data, use Workgroup Manager’ s Inspector . The follo wing is the record Inspector pane in Workgroup Manager: T o display the inspector: 1 Choose Workgroup Manager > P references . 2 Enable “Show ‘ All Records’ tab and inspector ” and click OK. 3 Select the “ All records” bu[...]

Chapter 7 Ongoing System Management 15 5 Ser vice Conguration A ssistants Ser ver Admin has congura tion assistants to guide you through setting up services that require more setup than a single c onguration pane. The assistants present you with all conguration panes nece ssar y to fully enable a ser vice. Assistants are a vailable for [...]

Address Book Service File type L oc ation Conguration les /etc/cardav d/cardavd.plist Data /Library/AddressBookSer ver/Documents/ iCal Service File type L oc ation Conguration les /etc/caldavd/calda vd.plist Data /Library/CalendarSer ver/Documents/ iChat Server File type L oc ation Conguration les /etc/jabberd/* Data mysqldump jab[...]

Chapter 7 Ongoing System Management 15 7 Mail—Amavisd File type L oc ation Conguration les /etc/amavisd .conf Data: (default locations) /var/amavis/ Mail—Clam A V File type L oc ation Conguration les /etc/clamav .conf /etc/freshclam.conf Data: (default locations) /var/clamav/ /var/virusmails/ Mail—Mailman File type L oc ation Con?[...]

Notications File type L oc ation Conguration les /etc/emond.d/ /etc/emond.d/rule s/ /Library/Keychains/System.keychain OpenDirector y Ser vice The entire Open Directory conguration can be saved with the ar chive feature. Filetype Location Conguration les /etc/openldap/slapd.conf Data: (default locations) /etc/openldap/ (stop slapd[...]

Chapter 7 Ongoing System Management 15 9 W eb Ser vice File type L oc ation Conguration les /etc/apache2/* (for Apache 2.2) /etc/httpd/* (for Apache 1 .3) /etc/webperfcache/* /Library/Keychains/System.keychain Data: (default locations) /Librar y/WebServer/Documents/ /Library/Logs/WebServer/* /Library/Logs/Migration/webcongmigrator .log (Ap[...]

Some single points of failure include: Computer syst em  Hard disk  P ower supply  Although it is almost impossible to eliminate all single points of failur e, you should minimize them as much as possible. For example , using a backup comput er and a le storage pool for Mac OS X Server eliminates the computer as a single point of failur e.[...]

Chapter 7 Ongoing System Management 161 Using Backup P ower In the architecture of a server solution, power is a single point of failure. I f power goes out, your servers go down without warning. T o preven t a sudden disruption in ser vices, consider adding a backup source of pow er . Depending on your application, you might choose to use a standb[...]

The automa tic restar t options are: Â Restart automatically after a power failure . The power management unit automatically starts up the ser ver after a power failure . Â Restart automatically if the computer free zes. The power management unit automatically starts up the ser ver after the ser ver stops re sponding, has a kernel panic, or freez[...]

Chapter 7 Ongoing System Management 16 3 Link Aggr egation Although not common, the failure of a switch, cable, or net work interface card can cause your server to become unav ailable. T o eliminate these single points of failure , you can use link aggregation or trunking. This technology , also k nown as IEEE 802.3ad, is built into Mac OS X and Ma[...]

About the Link Aggr egation Control P rotocol (LA CP) IEEE 802.3ad Link Aggregation dene s a protocol called Link Aggregation C ontrol Prot ocol (LACP) that is used by Mac OS X Ser ver to aggregate (c ombine) multiple por ts into a link aggregat e (a vir tual por t) that can be used for TCP and UDP connections. When your dene a link aggregat [...]

Chapter 7 Ongoing System Management 16 5 Computer t o Switch In this scenario shown in the following illustr ation, y ou connec t your server to a switch congured for 802.3ad link aggr egation. server1 .example.com Clients 4 x 1 Gbit/s 1 0 Gbit/s The switch should hav e bandwidth for handling incoming trac equal to or great er than that of th[...]

F or example, you can connect two links to the master switch and the remaining links to the backup switch. As long as the master switch is active , the backup switch remains inactive. I f the master switch fails, the backup switch takes over transparen tly . Although this scenario adds redundancy that protects the ser ver from becoming unavailable [...]

Chapter 7 Ongoing System Management 16 7 The interface name bond <num> assigned by the system is di erent from the name you give to the link aggr egate por t conguration. The interface name is for use at the command line, but the por t conguration name is for use in the Network pane of System P references . F or example, if you enter[...]

Load Balancing One factor that can cause services to become unav ailable is ser ver overload. A ser ver has limited resourc es and can ser vice a limited number of requests simultaneously . If the ser ver gets overloaded , it slows down and can eventually crash. One way to o vercome this problem is to distribute the load among a group of servers (a[...]

Chapter 7 Ongoing System Management 16 9 Daemon Over view By the time a user logs in to a Mac OS X system, a number of processes are running . Many of these proce sses are k nown as daemons. A daemon is a back ground process that provides a service to users. For example , the cupsd daemon c oordinates printing requests , and the httpd daemon re spo[...]

The launchctl utility is the command-line tool used to control la unchd. It can: Load and unload daemons  Start and stop launchd controlled jobs  Get system utilization statistics for la unchd and its child processes  Set environmen t settings  17 0 Chapter 7 Ongoing System Management[...]

17 1 E ective monitoring allows you t o detec t potential problems before the y occur and gives you early warning when they occur . Detecting potential problems allows you t o tak e steps to resolv e them before they impact ser ver availability of your servers. In addition, getting an early warning when a problem occurs allows you t o tak e corr[...]

Several factors can be considered for a monit oring response: What are relev ant response methods? In other wor ds, how will the response take  place? What is the time to re sponse? Wha t is an acceptable inter val between failure and  response? What are the scaling considera tions? Can the response plan work with all expected  (and even unex[...]

Chapter 8 Monitoring Y our System 17 3 A green status indicator sho ws the component is OK, a yellow status indicator notes a warning, and a red status indicator notes an error . Ser ver Monitor works for Xserves only . F or more information about Ser ver Monitor , choose Ser ver Monitor Help from Server Monitor ’ s Help menu. Using RAID Admin f [...]

df -Hl Filesystem Size Used Avail Capacity Mounted on /dev/disk0s9 40G 38G 2.1G 95% / In this example, the hard disk is almost full with only 2. 1 GB left. This t ells you that you should act immediately to free s pace on your hard disk before it lls up and causes problems f or your users. Â du . This command tells you how much s pace is used b[...]

Chapter 8 Monitoring Y our System 17 5 If you detect an unusual number of requests coming from the same sourc e, use Fir ewall ser vice to block trac from that source . F or more information about tcpdump, see the corresponding man page . Consider using Ruby , P er l, shell scripts, or AppleScript to automate the monit or ing  process. For exa[...]

The follo wing shows a sample O ver view pane for a single server . This overview shows basic hardware , operating system versions, ac tive services, and graphs of CPU history , network throughput histor y , and disk space. Use the m serveradmin XML web interface. a Open Safari to the following URL: https://<server address>:3 1 1/ser vermgr_i[...]

Chapter 8 Monitoring Y our System 17 7 When a server ker nel panics it abruptly halts all normal system operations. Usually , a kernel process named panic() outputs an error message to the console and st ores debugging information in non volitile memor y to be written to a crash log le upon restarting the computer . Saving the memor y contents o[...]

Setting Up a Core Dump Server Y ou can use any Mac OS X v1 0.5 or later comput er to be a core dump ser ver that ts the following criteria. T he core dump ser ver must: Have a static IP addr ess. Â Be IPv4 network-accessible to all clients using UDP port 1 069 . Â Y ou cannot put the core dump ser ver behind a rewall or NA T unless all clie[...]

Chapter 8 Monitoring Y our System 17 9 Setting Up a Core Dump Clien t A core dump client sends its kernel panic debug information to the c ore dump ser ver address specied in its NVRAM settings. The information is transmitt ed at the time of the panic, so before restarting the computer , allow some time for the data to be sent to the server . Th[...]

Conguring C ommon Core Dump Options By default, core dumps happen using UDP port 1 069 ov er the built-in Ethernet (en0) interface, and the resulting les are st ored in /PanicDumps on the cor e dump ser ver . However , you can congure the cor e dump to use: An alternate UDP port  An alternate network int er face  An alternate le des[...]

Chapter 8 Monitoring Y our System 181 SNMPv2 is the default access pr otocol and the default read-only community string is “public.” Enabling SNMP reporting SNMP access isn ’t enabled by default on Mac OS X Server . T o use SNMP tools to poll your Mac OS X Ser ver for data, you must congure and then enable the service. T o enable SNMP 1 Op[...]

T o enable and congure SNMP: Use the /usr/bin/snmpconf command , which tak es you through a basic text-based m setup assistant for c ongur ing the community name and saves the info in the conguration le. The snmp cong le is located in /usr/shar e/snmp/snmpd.conf . SNMP Congur ation Example Step 1: Customize da ta 1 T o customiz[...]

Chapter 8 Monitoring Y our System 18 3 Step 3: Collect SNMP information from the host T o get the SNMP-available information y ou added, execute this command from a host m that has SNMP tools installed: /usr/bin/snmpget -c public <hostname> system.sysLocation.0 Replace <hostname> with the name of the target host. Y ou should see locatio[...]

There are two main notica tion daemons: syslogd and emond. Â syslogd: The syslogd daemon is a standard UNIX method of monitoring systems. It logs messages in accordance with the settings found in /et c/syslog.conf . Y ou can examine the output les specied in that c onguration by using a le printing or editing utility because they ar[...]

Chapter 8 Monitoring Y our System 18 5 Logging Mac OS X Ser ver maintains standard UNIX log les and Apple-s pecic process logs. Logs f or the OS can b e found in: /var/log  /Library/Logs  ~/Library/Logs  Each process is re sponsible for its own logs, the log level, and verbosit y . Each process or application can write its own log le[...]

Syslog C onguration File The Syslog congura tion le can be found at /etc/syslog.c onf. Each line has the following f ormat: <facility>.<loglevel> <path to logle> Replace <facility> with the process name writing to the log. The path is the standard POSIX path to the log le. Y ou can use asterisks (*) as wildcar[...]

Chapter 8 Monitoring Y our System 18 7 T o run slapd in debugging mode: 1 Stop and remov e slapd from launchd’ s watch list: launchctl unload /System/Library/LaunchDaemons/org.openldap.plist 2 Restart slapd in debug mode: sudo /usr/libexec/slapd -d 99 AFP Logging The server side of Apple File Service Protoc ol (AFP) k eeps track of access and err[...]

18 8 Pr ovide increased ser ver re sponsiveness to clien ts and reduce server load with Push Notication Server . Mac OS X Ser ver v1 0.6 uses an XMPP P ubsub architecture for the Push Notication Ser ver . XMPP P ubsub is an open standard extention to XMPP (XEP-060) that allows ser vers and clients to c ommunicate as needed, rather than client[...]

Chapter 9 Push Notication Server 18 9 Star ting and Stopping P ush Notication When you start push notication on a ser ver , the service broadcasts its av ailabilit y on the local network to other services that suppor t it. This means that when a di erent ser ver turns on a service that suppor ts push notication, the push noticatio[...]

Changing a Ser vice’ s Push Notication Ser ver If push notication is congured on the server , it is listed in the location on the ser vice ’ s settings pane. If another computer on the subnet is congured as a push notication server , it appears in the ser vice’ s setting pane. Y ou can use these instructions to specify a di [...]

A access ACLs 5 5 , 75 IMAP 13 9 IP address restrictions 5 2 Keychain Access Utility 66 LDAP 2 1 , 58 Mac address 5 3 , 90 remote installation 84 , 88 , 90 , 10 1 , 10 2 SACLs 7 5 user 13 2 , 14 7 See also permissions accounts. See user accounts, W orkgroup Manager ACLs (access con trol lists) 55 , 75 Address Book service 1 7 , 14 0 , 15 6 addresse[...]

19 2 Index preparing 64 private keys 59 public keys 59 renewing 7 1 requesting 63 , 64 , 65 root 66 self-signed 6 1 , 65 Ser ver Admin 62 , 14 8 services using 7 1 web service 13 7 wiki ser vices 13 7 changip tool 14 5 chat service. S ee iChat service ClamA V 13 9 clients certicates 70 client-side logging 18 7 core dump information 17 9 group ac[...]

Index 19 3 E email. See mail ser vice emond daemon 18 4 encryption 54 , 5 5 , 59 , 11 8 See also SSL Ethereal packet sning tool 17 5 Ethernet 5 3 , 10 9 , 16 6 exporting ser vice settings 14 6 Extensible Messaging and Presence P rotocol. See XMPP F le services 22 , 13 7 , 18 7 le sharing 14 8 le systems backing up 36 choosing 93 See als[...]

19 4 Index server 14 4 static 82 See also identity IPv6 addressing 22 J journaling, le system 93 junk mail screening 13 9 K Kerberos 2 1 , 57 , 58 , 13 4 kernel panic 17 6 , 17 8 , 17 9 , 18 0 key-based authentication 7 2 , 73 Keychain Access Utility 66 keychain services 62 , 15 5 L LACP (Link Aggrega tion Control Protoc ol) 16 4 launchctl tool [...]

Index 19 5 See also Open Director y OpenCL 1 8 OpenLDAP 2 1 OpenSSL 54 operating environmen t requirements 16 2 P P ack ageMaker 47 packets, data, lt er ing of 52 partitions, disk 86 , 94 , 95 , 97 , 99 passwords 7 7 , 78 , 90 permissions administrator 7 4 , 75 , 14 9 , 15 0 les 5 5 folder 5 5 SACL 7 5 types 55 PHP (PHP Hypertext Preprocessor[...]

19 6 Index Ser ver Admin access control 14 7 as administration tool 12 8 authentication 3 8 certicates 62 , 14 8 conguration methods 1 8 customizing 40 notication system 17 5 opening 38 overview 1 1 , 1 8 , 38 , 39 server status 17 5 service management 14 6 system imaging 47 Ser ver Assistant 4 1 , 10 1 , 10 8 , 15 5 Ser ver Message Block.[...]

Index 19 7 U UDP (User Datagram P rotocol) 52 , 18 0 UNIX 23 updating software 10 7 upgrading from previous server versions 25 , 28 saved setup data 11 7 vs. migration 25 , 28 UPS (uninterruptible power supply) 16 1 user accounts group 15 3 managed preference s 15 3 management of 15 1 mobile 13 2 setup 12 3 See also users User Datagram P rotocol. S[...]