Apple x manual

Understanding and Using NetInfo Includes infor mation on setting up Mac OS X Ser ver and NetInfo to increase the power of your Mac OS X network[...]

K Apple Computer , Inc. © 2001 Apple Computer , Inc. All rights reserved. Under the copyright laws, this publication may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer , Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) [...]

3 Contents Preface About This Document 7 What’s in This Document 7 Where to Find More Information 8 1 What Is NetInfo? 9 NetInfo: A Service for Mac OS X Processes 9 A Historical P erspective 10 Data Consolidation 10 Data Distribution 11 The P ower of NetInfo: Software That Uses It 12 F older and F ile Ownership 12 Home Directories 13 Mounts 14 Ar[...]

4 Contents Viewing NetInfo Data 25 Using Command Line Utilities 27 The Importance of Planning 27 2 NetInfo Planning 29 General Planning Guidelines 29 Controlling NetInfo Data Visibility 31 Simplifying Changes to NetInfo Data 31 Identifying Computers for Hosting Shared Domains 31 Devising a Binding Strategy 32 User Data Planning 32 Understanding the[...]

Contents 5 Creating Clones 54 Replacing a Master With a Clone 55 Setting Up Windows User Authentication 56 Simple Hierarchies With No Clones 56 Other Hierarchies 57 Disabling Authentication Manager 60 P opulating Domains 60 Setting Up Mounts and Automounting 60 Defining Users and Groups 61 Sharing Printers 62[...]

[...]

7 PREFACE About This Document What’s in This Document If you’re a system or network administrator whose responsibilities include Mac OS X administration, this document will help you understand and implement NetInfo. NetInfo is the director y system that is built into computers running Mac OS X and Mac OS X Server . NetInfo facilitates the manag[...]

8 Preface Where to Find More Information The following information is available for Mac OS X Server administrators. Mac OS X Server is a powerful ser ver platform that delivers a complete range of ser vices to network users, including applications that help you set up and manage your NetInfo data: m Mac OS X Server A dministrator ’s Guide provide[...]

9 CHAPTER 1 1 What Is NetInfo? NetInfo is the built-in Mac OS X director y system. A director y system is sof tware that system and application processes can use to store and find administrative information about resources and users. The Mac OS X login process, for example, consults user information in NetInfo to deter mine whether the name and pa[...]

10 Chapter 1 No matter which application you use, the user information is stored in NetInfo. When a user attempts to log in to a Mac OS X computer , the login process consults the information in NetInfo to authenticate the user . This chapter introduces NetInfo. It briefly describes how it evolved. It samples some of the common ways NetInfo is use[...]

What Is NetInfo? 11 NetInfo consolidates administrative information, simplif ying the interactions between processes and the administrative data they create and use. Processes no longer need to be aware of how and where administrative data is stored. NetInfo does that for them. If a process needs the home director y for a user , it simply retrieves[...]

12 Chapter 1 Likewise, user or network information needed to be changed on the computer where it resided. Some changes, such as network settings, had to be made on multiple computers. As networks grew in size and complexity , it became unwieldy to maintain administrative information using this approach. NetInfo solves this problem by letting you st[...]

What Is NetInfo? 13 If an administrator changes a user ’s UID, the user may no longer be able to modify or even access files and directories she created. Likewise, if the user logs in as a user whose UID is different from the UID used to create the files and directories, the user will no longer have owner access privileges for them. When you de[...]

14 Chapter 1 Home directories are an example of how some Mac OS X processes collaborate to define and use NetInfo data. The Finder can display your home directory automatically because it retrieves its location from your NetInfo user record. But making home directories available is more complicated than simply adding data to a NetInfo user record.[...]

What Is NetInfo? 15 When the user logs in to a computer running Mac OS X, the login process on that computer consults the local NetInfo domain on that computer . If the user’s record is found, the user is granted access to the computer . After login, if the user chooses Connect T o Ser ver from the Go menu to access a computer running Mac OS X Se[...]

16 Chapter 1 Shared domains generally reside on Mac OS X Servers, because ser vers are equipped with tools such as Server Admin for managing network resources and network users. Similarly , you can mak e network resources such as printers visible to certain computers by setting up printer records in a shared domain accessed by those computers. F or[...]

What Is NetInfo? 17 While some devices may need to be used only by specific departments, some resources, such as personnel forms, may need to be shared by all employees. Y ou could make a directory of those forms visible to ever ybody by setting up a share point for the director y in a shared domain known as the root domain, which is always named [...]

18 Chapter 1 A hierarchy can be as simple as a local domain and a root domain, or it can contain one or more shared domains between the local and root domains, as in this education example. Each shared domain is called a parent domain, and the domain immediately below it in the hierarchy is called a child domain. In this example, the local domain o[...]

What Is NetInfo? 19 Domain visibility depends on the computer , not the user . So when a user logs in to a different computer , different NetInfo administrative data may be visible to that computer . In the educational scenario, an under graduate can log in to a graduate student’s computer if the undergraduate’s user record resides in the Stude[...]

20 Chapter 1 There are three binding choices, each of which offers a different way for the computer hosting the child domain to locate a computer hosting its parent domain. The protocol you use to bind any two domains depends mainly on the topology of the network: m Broadcast binding. This protocol, which is the default, is best for binding domains[...]

What Is NetInfo? 21 Once binding has occurred, Mac OS X processes interact transparently with NetInfo. Rebinding occurs when any network location or settings change or when network connections are lost, then re-established. If a parent domain becomes unavailable for any reason, many local processes, even opening applications that reside locally , m[...]

22 Chapter 1 Inside NetInfo When a Mac OS X computer starts up and domain binding occurs, a NetInfo daemon called nibindd starts. The nibindd daemon starts another daemon—netinfod—for each domain on the computer . Then nibindd listens for requests from netinfod processes asking for parents, checking for the appropriate netinfod process and init[...]

What Is NetInfo? 23 Each netinfod process manages interactions with a domain ’s NetInfo database. Infor mation in a NetInfo database is organized into directories, which are specific categories of NetInfo records, such as users, machines, and mounts. F or example, the users director y contains a record for each user defined in the domain. Here [...]

24 Chapter 1 m homedirstyletype is used by Server Admin to distinguish among home director y styles none, local, and custom. m home is the absolute path to the user ’s home director y . m home_loc is present if the home director y is on an Apple file server . Its value is a Mac OS X property list that contains the domain name of the AFP server w[...]

What Is NetInfo? 25 Setting Up Search Policies When a process requests NetInfo administrative data, the default search policy is to search the login hierarchy , starting with the local domain, then proceeding toward the root domain until the needed data is located. Binding determines the order in which parent domains are searched. If you want to ex[...]

26 Chapter 1 When the domain is open, select a director y . The illustration below shows the window for a domain called MyDomain. At the bottom of the window , you see the properties of the machines record of a computer named computer01. This computer has a record in the machines director y because it hosts a master or clone of the domain. There ar[...]

What Is NetInfo? 27 m If the domain has a child on the same computer , the child’s tag is listed, preceded by the domain name and a /. In this example, computer01/local indicates that the domain has a child named computer01 that has the NetInfo tag “local.” Using Command Line Utilities Several command line utilities that interact with NetInfo[...]

[...]

29 CHAPTER 2 2 NetInfo Planning The goal of NetInfo planning is to design a hierarchy of NetInfo domains that gives your Mac OS X users easy access to the network resources they need and minimizes the time you spend maintaining NetInfo data. This chapter provides information that will help you decide what your NetInfo hierarchy should look like. It[...]

30 Chapter 2 If you want to share information among Mac OS X computers, you need to set up at least a root domain. Hierarchies this simple may be completely adequate when all your network computer users share the same resources, such as printers or share points that contain home directories or applications. L ar ger , more complex or ganizations ca[...]

NetInfo Planning 31 Controlling NetInfo Data Visibility If you want certain NetInfo data to be visible to all computers in a NetInfo hierarchy , you’d store that data in the root domain of the hierarchy . T o make NetInfo data visible only to a subset of computers, store it in a shared domain below the root domain. Y ou might want to set up share[...]

32 Chapter 2 Select computers that will not be replaced frequently and that have adequate capacity for growing domains. While you can move a domain after it has been set up, you may need to reconfigure computers that bind to the shared domains to ensure that the login hierarchies you originally established remain intact. If a shared domain will su[...]

NetInfo Planning 33 When a user logs in to the computer , all the user records in the login hierarchy are available for authenticating the user . NetInfo searches for a user record that contains the user name entered by the user in the login window , starting with the local domain and proceeding through the login hierarchy . If a user record that c[...]

34 Chapter 2 Each automatically mounted director y has a NetInfo mount record in one of the domains in the login hierarchy . Y ou can view a mount record using NetInfo Manager by selecting the mounts director y , then selecting a computer and share point. Here is one of the mount records for the automatically mounted directories visible under /Netw[...]

NetInfo Planning 35 Although any user who can log in to a particular Mac OS X computer can view the directories and resources associated with domains in the computer ’s login hierarchy , each user ’s NetInfo user record determines several aspects of the login environment: m The UID in the record determines the files or operations the user has [...]

36 Chapter 2 F or example, user records for T ony Smith and T om Smith contain the short name “tsmith” and the password “smitty .” When T ony logs in to his computer with a user name “tsmith” and the password “smitty,” he is authenticated using the record in the Students domain. Similarly , T om can use the same login entries at his[...]

NetInfo Planning 37 If T ony has a user record in his local domain that has the same names and password as his record in the Students domain, the Students domain ’s record for T ony would be masked. T ony ’s local domain should offer a name/password combination that distinguishes it from the Students domain ’s record. If the Students domain i[...]

38 Chapter 2 Managing UIDs The UID is a critical element in ensuring users have full access to the directories and files they create as well as to their home directories. Most of the time, individual users should have unique UIDs. Assigning the same UID to different user records is risky unless you have a specific reason for doing so, such as to [...]

NetInfo Planning 39 Group Data Planning Groups are used to assign director y and file access privileges to collections of users. Here is what a group record looks like in NetInfo Manager . It is a simple record that contains only the name of the group, the group ID (GID), and a list of the short names of users who are members of the group. This se[...]

40 Chapter 2 When a user attempts to access a director y or file the user doesn ’t own, group privileges are checked: m First the GID of the user’s primar y group is compared with the GID associated with the director y or file. If they match, the user is granted group access privileges. m If they do not match, NetInfo searches through the log[...]

NetInfo Planning 41 Now suppose that a file, MyDoc, resides on a computer accessible to both T ony and T om. The file is owned by a user with the UID 127. It has read-only access privileges for AllStudents. T om is not a member of AllStudents, but the short name in his user record, “tsmith,” is the same as T ony ’s, who is in AllStudents. W[...]

[...]

43 CHAPTER 3 3 Setting Up NetInfo Hierarchies After you have decided what the topology of your NetInfo hierarchy should look like and identified which computers will host shared domains, you are ready to create the hierarchy and populate its domains with records. The Overall Process These are the main steps for setting up NetInfo hierarchies: Step[...]

44 Chapter 3 Step 5: Populate domains Add user , group, mount, and printer records to the appropriate domains in your hierarchy . See “P opulating Domains” on page 60. Setting Up the Root Domain of a Simple Hierarchy The simplest NetInfo hierarchy consists of a root domain and one or more local domains that bind to it. T o create the root domai[...]

Setting Up NetInfo Hierarchies 45 6 Click Save, then click OK when a message tells you to restart the computer . It will tak e a few minutes for your changes to be completed. When changes are complete, click the Close button in the NetInfo Domain Setup window and restart the computer . Setting Up Shared Domains in Deeper Hierarchies When you need t[...]

46 Chapter 3 Here is a summar y of requirements for machine records in a NetInfo domain: m The machines director y of ever y shared domain must have a record for ever y computer where the domain resides. These machine records contain a serves property having the value ./ tag , where ./ refers to the current domain and tag is the NetInfo tag of the [...]

Setting Up NetInfo Hierarchies 47 The English domain, which resides on server2, also needs two machine records — one to identify its parent (the root domain) and one for itself. Here is the English domain ’s machine record that identifies its parent. The NetInfo server for the English domain can find the NetInfo server for its parent domain b[...]

48 Chapter 3 Step 2: Define the root domain and its relationship to the Math domain On server1, you now have a local domain that is configured to bind statically to a root domain. Use the following procedure to create the actual root domain you want and define the Math domain as a child of the root domain: 1 Log in as root to ser ver1. 2 Open the[...]

Setting Up NetInfo Hierarchies 49 5 Use nidomain ’s list command to verif y that you now have three domains on server 1: [server1:~] root# nidomain -l tag=network udp=768 tcp=769 tag=local udp=766 tcp=767 tag=myschool udp=854 tcp=855 Y ou can also list all the netinfod processes running on ser ver1. There is one for each domain: [server1:~] root#[...]

50 Chapter 3 Step 3: Create the future English domain In this step, you create a root domain on server2 using NetInfo Domain Setup. L ater , this domain will become the English domain. 1 Ensure that server2 has a valid DNS entr y in your DNS ser ver . 2 Log in as root to ser ver2. 3 Open NetInfo Domain Setup. Click the lock icon to log in. In the ?[...]

Setting Up NetInfo Hierarchies 51 Step 5: Add a machine record for the English domain to the root domain On server1, add a machine record to the root domain to identif y the English domain. Use the same process as in step 4, but set up the machine record properties like this: m The name should be server2. m The IP address should be server2’s IP a[...]

52 Chapter 3 DHCP Binding When you configure a Mac OS X computer to locate its parent using DHCP binding, the parent’s IP address and NetInfo tag are provided by a DHCP server rather than using information you enter using Director y Setup. T o use DHCP binding, you must first configure a DHCP server to provide this infor mation. Use this proce[...]

Setting Up NetInfo Hierarchies 53 c Select the machines director y in the Director y Browser list. d Choose New Subdirector y from the Director y menu. Double-click new_director y in the lower list and enter the DNS name of the child computer . e Choose New Property from the Director y menu. Double-click new_ property and change it to “ip_address[...]

54 Chapter 3 Locating and Using Masters and Clones When a Mac OS X process requests information from NetInfo: m The parent for the local domain is located using the binding information set up in Director y Setup. m Other parent domains are located by searching the machines director y of the domain for records with a serves property of the for m ../[...]

Setting Up NetInfo Hierarchies 55 This command copies the database tagged “myschool” from its host (server1) to a database having the same tag on the current computer , server2. 5 Restart server2. Now ser ver2 hosts two master domains and a clone: [server2:~] root# ps aux | grep netinfod root 183 0.0 0.4 1784 500 ?? S 0:00.34 netinfod local (ma[...]

56 Chapter 3 Setting Up Windows User Authentication T o authenticate Windows users using NetInfo so they can take advantage of the Windows services on Mac OS X Ser ver , ensure that all the shared domains in your hierarchy reside on Mac OS X Servers. Mac OS X Server has two ways to validate Windows users’ passwords: m Encr ypted password validati[...]

Setting Up NetInfo Hierarchies 57 4 Check the Authentication Manager box. 5 Click Save and close NetInfo Domain Setup. 6 Restart the server . Authentication Manager is now enabled for both the local and the root domains. 7 Open Server Admin and use the Users & Groups module to reset passwords of existing users who will be using Windows computer[...]

58 Chapter 3 Set Up Masters Use this procedure for servers hosting masters: 1 Log in as the root user to the ser ver where the master resides. 2 Open the T er minal application, located in /Applications/Utilities. 3 Enter the following command line, substituting the NetInfo tag name of the master for tag: [server1:~] root# tim -init -auto tag 4 Whe[...]

Setting Up NetInfo Hierarchies 59 Set Up Local Domains on Other Mac OS X Computers Use the following procedure to enable Authentication Manager for the local domain on any other Mac OS X computers that will bind into the hierarchy: 1 Log in to the computer as the root user . 2 Open the T er minal application, located in /Applications/Utilities. 3 E[...]

60 Chapter 3 Disabling Authentication Manager F ollow these steps if you no longer want to use A uthentication Manager: 1 In the /etc/hostconfig file, ensure that this line exists: AUTHSERVER=-NO- 2 Remove all files that have a “.tim” extension from / var/db/netinfo. 3 Using NetInfo Manager , remove the /config/authentication_server records[...]

Setting Up NetInfo Hierarchies 61 5 Select an automount option. If you choose “Mount dynamically in /Network/Servers,” share points are listed in the /Network/Servers folder and mount when the user selects them. If you choose “Mount statically in,” share points mount automatically at client startup in the location you specify, usually/Netwo[...]

62 Chapter 3 Sharing Printers Use the Print module of Server Admin to create a record for a printer in a shared NetInfo domain: 1 Open Server Admin on a ser ver that has the domain in its login hierarchy . 2 In the File & Print tab, click Print and choose Show Print Monitor . 3 If the printer you want to add to the domain is not listed, click N[...]