Instruction/ maintenance manual of the product 10.6 Apple
Go to page of 197
Mac O S X S e r v er Adv anced Ser ver A dministration V ersi on 1 0. 6 Sno w Le opar d.
Apple Inc. K © 2009 Apple Inc. All rights reserved. The owner or authorized user of a v alid copy of Mac OS X Ser v er sof twar e may reproduce this publication for the purpose of learning to use such software.
11 Prefac e: About This Guide 1 1 What’ s in T his G uide 1 2 Using Onscreen Help 1 3 Document Road Map 1 4 Viewing PDF Guides Onscreen 1 4 Printing PDF Guide s 1 5 Getting Documentation Updates 1 5.
4 Conten ts 3 3 Understanding B ackup Type s 34 Understanding Backup Scheduling 34 Understanding Restores 35 Other Backup Policy Considerations 36 Command-Line Backup and Restoration T ools 36 Underst.
Conten ts 5 58 Single Sign-On 59 About Certicates, SSL, and P ublic Key Infrastructur e 59 Public and P rivate Keys 60 Certicate s 60 About Certicate Authorities (CAs ) 6 1 About Identities 6.
6 Conten ts 84 About Starting Up for Installation 84 Before Starting Up 85 Starting Up from the Install DVD 85 Starting Up from an Alternate P ar tition 88 Remotely Acce ssing the Install D VD 90 Abou.
Conten ts 7 1 24 C hapter 7: Ongoing System Management 1 24 C omputers Y ou Can Use to Administer a Server 1 24 Setting Up an Administrator C omputer 1 25 Using a Non-Mac OS X Computer f or Administration 1 26 U sing the Administration T o ols 1 26 W ork ing with P re-v1 0.
8 Conten ts 1 59 Eliminating Single P oints of F ailure 1 60 Using Xserve for High A vailability 1 6 1 Using Backup P ower 1 6 1 Setting Up Y our S erver for A utomatic Restar t 1 62 Ensuring Proper O.
Conten ts 9 1 88 Chapter 9: Push Notication Serve r 1 88 About Push Notication Serve r 1 89 Starting and Stopping Push Noticatio n 1 90 Changing a Ser vic e’ s Push Notication Serve r 1 .
10 Conten ts.
11 This guide pro vides a star ting point f or administering Mac OS X Ser ver v1 0.6 using its adv anced administration tools. It contains information about planning , practices , tools, installation, deployment, and more by using Ser v er Admin.
12 Prefac e About This Guide Using Onscreen Help Y ou can get task instructions onscreen in Help Viewer while you ’ re managing Mac OS X Ser ver v1 0.6. Y ou can view help on a ser v er or an administrator computer . (An administrator comput er is a M ac OS X c omputer with Mac OS X S erver v1 0.
Preface About This Guide 13 Document Road Map Mac OS X v1 0.6 has a suite of guides which can co ver management of individual ser vic es. Each ser vice ma y be dep enden t on other ser vices f or maximum utilit y .
14 Preface About This Guide Viewing PDF Guides Onscreen While reading the PDF version of a guide onscr een: Show bookmarks to see the guide’ s outline, and click a book mark to jump to the  corresponding section. Search for a wor d or phrase to see a list of places where it appears in the document.
Preface About This Guide 15 Getting Documentation Updates P eriodically , Apple posts revised help pages and new editions of guides. S ome revised help pages update the lat est editions of the guides.
16 Mac OS X Ser ver giv es you everything you need to pro vide standards-based workgr oup and Internet ser vices — delivering a w or ld-class UNIX ser ver solution that’ s easy to deploy and easy to manage . This chapter con tains information to make decisions about where and how you deploy Mac OS X Ser ver .
Chapter 1 System Overview and Supported Standards 17 What’ s New in M ac OS X Ser ver v1 0.6 Mac OS X Ser ver v1 0.6 o ers major enhancements in several key areas: Address Book Server  Mac OS X Ser ver v1 0.
OpenCL suppor t  Mac OS X Ser ver v1 0.6 supports OpenCL and mak es it possible for developers t o use the GPU for general computa tional tasks. What’ s New in S er ver Admin Included with Mac OS X Ser ver v1 0.6 is Ser ver Admin, Apple’ s powerful, e xible, full- featured server administration tool.
Chapter 1 System Overview and Supported Standards 19 The follo wing table highlights the capabilities of each conguration tool. Service Set in initial server setup Server Prefer ences Ser ver Admin Address book Optional Ye s Y es Backup your data (websites , databases , calendar les, etc.
Service Set in initial server setup Server Prefer ences Ser ver Admin Open Directory master (user accounts and other data) Optional Optional Y es P odcast Producer No No Y es P olicies and managed pre.
Chapter 1 System Overview and Supported Standards 21 A standards-based directory ser vices architecture o ers centralized managemen t of network resource s using any LDAP ser ver–even proprietary ser vers such as Microsoft Active Directory . The open source UNIX foundation makes it easy to port and deploy existing tools to Mac OS X Ser ver .
 W eb T echnologies: Mac OS X S er ver is a complete AMP stack (a bundle of integrat ed Apache-MySQL-PHP/Perl/Python software). Mac OS X Ser ver web technologies are based on the open sourc e Apache web ser ver , the most widely used HT TP ser ver on the Internet.
Chapter 1 System Overview and Supported Standards 23 Â XMPP: Ex tensible Messaging and Pr esence Protoc ol (XMPP) is an op en XML-based messaging protocol used f or messaging and presence information.
24 Before installing and setting up Mac OS X Ser ver do a little planning and become familiar with your options . The major goals of the planning phase are to make sure that: Ser ver user and administ.
Chapter 2 Planning Server Usage 25 During the planning stage, you ’ll also decide which installation and ser ver setup options best suit your needs. For example , G etting Star ted contains an example that illustrates server installation and initial setup in a small business scenario with the ser ver in using Server Prefer ences.
If you ’ve been planning to replac e a Windows NT c omputer , consider using Mac OS X Ser ver with its extensive built-in suppor t for Windows clients. Mak e sure that administrators familiar with the se other systems are par t of the planning process.
Chapter 2 Planning Server Usage 27 Home folders for netw or k users can be consolidated ont o one ser ver or distributed  among various servers. Although you can move home f olders, you might need to change a large number of user and share poin t records, so devise a strategy that will persist for a reasonable amoun t of time.
Dening a M igration Str ategy If you’ re using Mac OS X Ser ver v1 0.4–1 0.5 or a Windows-based ser ver , examine the oppor tunities for mo ving data and settings to Mac OS X S er ver v1 0.6. Upgrading and Migrating from an Earlier V ersion of Mac OS X Ser ver If you’ re using computers with Mac OS X Ser ver v1 0.
Chapter 2 Planning Server Usage 29 The rst aspect primarily involv es director y ser vices integration. Identify which Mac OS X Ser ver computers will use existing directories (such as Active Directory , LDAPv3, and NIS directories) and existing authentication setups (such as Kerberos).
F or example, if you use Mac OS X Ser ver to provide DHCP , network time, or BootP ser vices to other servers, you should set up the ser vers that provide these services and initiate the services before you set up servers that depend on those services.
Chapter 2 Planning Server Usage 31 Making Sure Required Ser ver Hardware I s Av ailable Y ou might want to postpone setting up a server until all its hardware is in place . F or example, you might not want to set up a server whose data you wan t to mirror until all disk drives y ou need for mirroring are available .
Understanding Backup and Restore P olicies There are man y reasons to have a backup and rest ore polic y . Y our data is subject to failure because of failed c omp onents, natural or manmade disasters, or data corruption. Sometimes data loss is beyond your con trol to prevent, but with a backup and restore plan, you can restore y our data.
Chapter 2 Planning Server Usage 33 Y our organization must determine the following: What must be backed up? Â What should not be backed up (as per organization policy)? Â How granular are the re sto.
Understanding Backup Scheduling Backing up les requires time and resourc es. Before deciding on a backup plan, consider the following que stions: How much data will be backed up? Â How much time w.
Chapter 2 Planning Server Usage 35 Consider the follo wing questions: How long will it take to restor e data at each level of granularity? Â F or example, how long will a deleted le or email take .
 Capacity . If you back up only a small amount of data, low-capacity storage media can do the job . But if y ou need to back up large amounts of data, use high-capacity devices , such as a RAID .
Chapter 2 Planning Server Usage 37 F or example, Time M achine doesn ’t back up user and group director y records , email, DNS records , A ddress Book shared groups, iCal Ser ver calendars, and so forth. It only save s the settings made in S er ver Pr eferences and Server Admin, and whether a ser vice is on or o .
38 Manage Mac OS X Ser ver using graphical applications or command-line tools . Mac OS X Ser ver v1 0.6 administration applications must be run from either Mac OS X Ser ver v1 0.6 or Mac OS X v1 0.6. Ser ver Admin Y ou use Ser ver Admin to administer services on Mac OS X Ser ver computers.
Chapter 3 Administra tion T ools 39 Ser ver Admin In ter face The Ser ver Admin in ter face is shown here, with each element explained in the following table .
D Main Work Area: Shows status and conguration options. This looks di erent for each service and for each context button selected. E A vailable servers: Lists the local-network scanner , which y ou can use to discover servers to add to your server list.
Chapter 3 Administra tion T ools 41 Ser ver Assistant Ser ver Assistant is used f or : Remote server installations  Initial setup of a local ser ver  Initial setup of remote servers  Preparing data f or automated setup  The Ser ver Assistant initial page is sho wn here.
Ser ver Pr eferences Ser ver Pr eferences is the simplied administration application y ou need for managing Mac OS X Ser ver v1 0.6. Y ou can use Ser ver Prefer ences in addition to or instead of Ser ver Admin and W orkgroup Manager : Manage basic user and group settings.
Chapter 3 Administra tion T ools 43 W orkgroup Manager In ter face The W or kgroup Manager interface is shown here, with each element explained in the following table .
Customizing the W orkgroup Manager Envir onment There are sev eral ways to tailor the Workgr oup M anager environment: T o open W or kgroup Manager Pref erences, cho ose Workgroup Manager > Â Pref erences.
Chapter 3 Administra tion T ools 45 T o identify the Xser ve computer to monitor , click Add Ser ver , identify the ser ver , and enter user name and passwor d information for an administrator of the server . If adding the local ser ver , use ’1 27 .
iCal Ser vice Utility iCal Ser vice Utility gives users access to shared inf ormation about locations and resource s. Users can use iCal Ser vice Utilit y to set up information about shared resource s and locations for use with iCal Ser vice.
Chapter 3 Administra tion T ools 47 Syst em Image M anagement Y ou can use the following Mac OS X Ser ver applications to set up and manage NetBoot and NetInstall images: Â System Image Utility creates Mac OS X disk images . It’ s installed with Mac OS X Ser ver software in the /Applications/Server/ folder .
Command-Line T ools If you’ re an administrator who prefers t o work in a command-line environment , you can do so with Mac OS X Ser ver . F rom the T erminal application in M ac OS X, you can use t.
Chapter 3 Administra tion T ools 49 P odcast Capture , Composer , and Produc er P odcast Capture takes audio and video from a local or remote camer a, capture s screen activity , or uploads Quick Time les into P odcast Producer for enc oding and distribution.
Apple Remote Desktop Apple Remote Desktop (ARD), which you can optionally purchase, is an easy-to-use network-computer management application. I t simplies the setup , monitoring , and maintenance of r emote computers and lets y ou interact with users.
51 By vigilantly adhering to security policies and practices , you can minimize the threa t to system integrity and data privacy . Mac OS X Ser ver is built on a robust UNIX foundation that c ontains many security feature s in its core architecture. State-of-the-art, standards-based technologies protect your server , network, and data.
About Network Security Network security is as impor tant to data integrity as physical security . Although someone might immediately see the need to lock down an e xp ensive server , he or she might not immediately see the need to r estric t access to the data on that same server .
Chapter 4 Enhancing Security 53 This allows an organiza tion to provide ser vices to the external network while protecting the internal network from being compr omised by a host in the DMZ. I f someone compromises a DMZ host, he or she cannot connect to the internal network.
In theor y , MA C ltering allows a network administrator to permit or deny network access to hosts and device s associated with the MAC address , although in practice there are methods to a void this form of access control thr ough address modication (spoong) or the physical e xchange of network cards between hosts.
Chapter 4 Enhancing Security 55 Most transport encr yption requires the participation of both par ties in the transaction. Some ser vices (such as SMTP mail service) can’ t reliably use such techniques, so encr ypting the le itself is the only method of reliably securing the le conten t.
 Secure VM: Secure VM encr ypts system vir tual memor y (memor y data temporarily written to the hard disk), not user les. I t improves syst em secur ity by keeping vir tual memor y les from being read and exploited .  Disk Utility : Disk Utility can create disk images whose conten ts are encr ypted and password prot ec ted.
Chapter 4 Enhancing Security 57 In Mac OS X Ser ver , users trying to access services (like logging in to a director y-aware workstation, or tr ying to mount a remote v olume) must authenticate by pro viding a login name and password bef ore privileges for the users can be determined.
W eb Ser vice (Apache via the SPNEGO Simple and P rotected GSS-API Negotiation  Mechanism protocol) Xgrid   Storing passwords in user acc ounts. This approach might be useful when migrating user accounts from earlier server versions.
Chapter 4 Enhancing Security 59 Kerberos also provides a single sign-on en vironment where users must authen ticate only once a day , week, or other period of time, easing authentication loads for users . Mac OS X Ser ver and Mac OS X versions 1 0.3 through 1 0.
W eb, mail, and dir ec tor y ser vices use the public key with SSL to negotiate a shared key for the duration of the c onnec tion. F or example, a mail ser ver will send its public key to a connecting client and initiate negotiation for a secure c onnec tion.
Chapter 4 Enhancing Security 61 About Identitie s Identities are a c er ticate and a private key , together . The cer ticate identies the user , and the priv ate key corresponds to the certicate. A single user can have sev eral identities; for any giv en user each cer ticate could have a di erent name , email address , or issuer .
Several keychains can hold certicates: Â SystemRootC er ticates: This keychain holds root certicates that ship with Mac OS X. The cer ticates already hav e trust given to them. Â System: This keychain holds certicates that the computer administr ator can add.
Chapter 4 Enhancing Security 63 The Ser ver Admin in ter face is shown below , with Cer ticates selected. Certicate Manager provides int egrated management of SSL certicates in Mac OS X Ser ver for services that allow the use of SSL certicates.
When certicates and keys are impor ted via Certicate Manager , they are put in the /etc/certicates/ directory. The director y contains four PEM formatt ed les for every identity : The cert.
Chapter 4 Enhancing Security 65 Creating a Self-Signed C er ticate A self-signed certicate is generated at server setup. Although it is available for use , you may wan t to customize the information in the certicate, so you would create a new self-signed certicate.
4 Click the Action button below the certicates list and choose “Generate Certicate Signing Request (CSR).” Certicate manager creates the signing r equest and shows the ASCII text version in the sheet. 5 Click Save to sa ve the CSR to the disk.
Chapter 4 Enhancing Security 67 5 If you override the defaults , provide the following information in the next few screens: A unique serial number for the root certicate  The number of days the C.
Using a CA to Crea te a Cer ticate for Someone Else Y ou can use your CA certicate to issue a cer ticate to someone else. By doing so you are stating you wan t to be a trusted par ty that can cer tify the identity of the cer ticate holder .
Chapter 4 Enhancing Security 69 7 Click the Import button. If prompted , en ter the private key passphrase. Managing Certicates After you creat e and sign a cer ticate, you won ’t do much more with it. Since certicates cannot be edited , you can either delete, replace, or revoke cer ticates after they are created .
F or instruc tions on how to do this, see “ Replacing an Existing Certicate ” on page 71 . Distributing a CA Public Certicate to Clien ts If you’ re using self-signed cer ticates , a warning appears in most user applications saying that the CA is not recogniz ed.
Chapter 4 Enhancing Security 71 5 Click Save . Renewing an Expiring Certicate Certicates have an e xpiration date and must be renewed periodically . Renewing a certicate is the same as replacing a certicate with a newly generated one with an updated expiration dat e.
SSH and SSH Keys SSH is a network protocol that e stablishes a secure channel between your computer and a remote computer . I t uses public-key cr yptography to a uthenticate the remote computer . I t also provides trac encryption and data integrity exchanged between computers.
Chapter 4 Enhancing Security 73 The -b ag sets the length of the keys to 1,024-bits , -t indicates to use the RSA hashing algorithm, -f sets the le name as id_rsa, and -P f ollowed by two single-quote marks sets the private key passwor d to be null.
$count = @{[$_ =~ /$match/g]}; if($count > 0) { $flag = 1; } } close SBUFF; if($flag == 1) { "ssh $server -x -o batchmode=yes shutdown -r now" } } Administra tion Level Security Mac OS X Ser ver can use another level of access con trol for added security .
Chapter 4 Enhancing Security 75 Y ou can determine which ser vices other admin group users can modify . T o do this, the administrator making the determination must have full, unmodied access. The process f or setting administration level privileges is found in “ Tiered Administration P ermissions” on page 1 49 .
Securit y Best P rac tices Ser ver administrators must make sure that adequat e secur ity measures are implemented to pr otec t a ser ver from attacks. A compromised ser ver risks the resource s and data on the ser ver and risks the resources and data on other connected systems.
Chapter 4 Enhancing Security 77 Do not use administrator (UNIX “ admin” group) accounts for daily use.  Restrict the use of administration privileges by keeping the admin login and password separat e from daily use. Back up critical data on the system regularly , with a copy stored at a secure o-site  location.
Creating C omplex P asswords Use the following tips t o create complex passwords: Use a mix of alphabetic (upper and lower case), numeric, and special characters  (such as ! and @). Don ’t use words or combinations of wor ds found in a dictionar y of any language.
79 Whether you install Mac OS X Ser ver on a single server or a cluster of ser vers , there are tools and proc esses to help the installation and deploymen t succeed. Some computers come with Mac OS X Ser ver software already installed . Other computers need the ser ver software installed.
Step 3: Set up the environment If you are not in complete con trol of the network environment (DNS servers, DHCP ser ver , rewall, and so for th) coordinate with your network administra tor before installing.
Chapter 5 Installation and Deployment 81 “ Â Installing Remotely with Ser ver Assistant” on page 101 “ Â Installing Remotely with Screen Sharing and VNC ” on page 1 02 “ Â Using the installer Command-Line T ool to Install Ser ver Software” on page 1 04 Step 7: Set Up Ser vices Restart from the target disk to proceed to setup .
Setting Up Network Ser vices Before you can install, you must set up the following for y our network ser vice: Â DNS: Y ou must have a fully qualied domain name f or each ser ver ’ s IP addess in the DNS system. The DNS zone must hav e the reverse-lookup record for the name and address pair .
Chapter 5 Installation and Deployment 83 Mac OS X Ser ver Install Disc The Install Disc has a Documentation folder with Getting Started , Installation & Setup W orksheet , and a Read Me le. I t also contains an Other Installs folder , which has the following installer packages: Ser verAdministrationSoftware.
When you install and set up Mac OS X Ser ver on a computer that has a dis play and keyboard, it ’ s already an administrator computer . T o make a computer with Mac OS X into an administrat or computer , you must install additional software. Important: If you hav e administrative applications and tools from Mac OS X Server v1 0.
Chapter 5 Installation and Deployment 85 Star ting Up from the Install DVD This is the simplest method of starting the computer , if y ou have physical access the ser ver and it has DVD drive.
However , if you are reinstalling regularly , or if you are creating an external Fir ewire drive-based installation to take to v ar ious computers, or if you need some other kind mass distribution (such as clustered Xserves without DVD drives installed), this method can be very ecient.
Chapter 5 Installation and Deployment 87 4 Select File > New > Disk Image from <device>. 5 Give the image a name; select Read-only , Read/W rite, or Compressed as the image type; and then click Save. 6 After the image is complete , select the image from list on the left.
Tip: ∏ Y ou can use asr to restore a disk o ver a network, multicasting the blocks to client computers. Using the multicast ser ver feature of asr , you could put a copy of the installer image on a par tition of all computers that can rec eive the multicast packets.
Chapter 5 Installation and Deployment 89 This is usually the rst eight characters of the server ’ s built-in hardware serial number . F or more information about this password , see “ About Ser ver Serial Numbers for Default Installation P asswords ” on page 90 .
2 Identify the target server . If you don ’t know the IP address and the remote server is on the local subnet, you can nd ser vers using the comannd line. For more inf ormation about this process, see “Identifying Remote Ser vers When Installing Mac OS X Ser ver ” on page 90.
Chapter 5 Installation and Deployment 91 Y ou can use the dns-sd tool to identify computers on the local subnetwhere y ou can install ser ver software. Enter the following from a comput er on the same local net work as the ser ver: dns-sd -B _sa-rspndr.
Step 1: Create a NetInstall image from the Install DVD This step doesn ’t need to be done on the tar get computer . I t can be done on an administrator computer tha t has enough free space to image the entire Install DVD . Step 2: Start up the computer from the NetBoot ser ver There are f our ways of doing this, depending on your en vironment.
Chapter 5 Installation and Deployment 93 If you’ re using an installation disc for Mac OS X Ser ver v1 0.6, y ou can per form these tasks from another networked computer using VNC viewer software, such as Apple Remote Desktop , bef ore beginning a clean installation.
A case-sensitive volume is supported as a star t volume format. An HFSX le system for Mac OS X Ser ver must be specically selected when erasing a volume and preparing a disk before initial installation. If you are planning to use NFS, you should use case-sensitive HFSX.
Chapter 5 Installation and Deployment 95 Pa r titioning a Disk Y ou can use the Installer to open Disk Utilit y and then use Disk Utility to par tition the installation target disk int o desired volumes.
Additional information about diskutil and other uses can be f ound in Introduction to Command-Line Administr ation. F or complete command syn tax for diskutil, consult the tool’ s man page. The specic command issued depends on y our disk format needs and the hardware in use.
Chapter 5 Installation and Deployment 97 Y ou can combine RAID sets to combine their benets. F or example, you can create a RAID set that combines the fast disk access of a striped RAID set and the data protection of a mirrored RAID set.
5 Drag the disks to the window . 6 F ollow the instructions in the window to set parameters. 7 Click Create . Y ou can nd instructions for par titioning the hard disk into multiple volume s, creating a RAID set, and erasing the target disk or partition by viewing Disk Utilit y Help.
Chapter 5 Installation and Deployment 99 Erasing a Disk or P ar tition Y ou have several options f or erasing a disk, depending on your preferred tools and your computing en vironment: Â Erasing a disk using Disk Utility: Y ou can use the Installer to open Disk Utility and then use it to erase the target v olume or another volume.
Installing Locally fr om the Installation Disc Y ou can install Mac OS X Ser ver directly onto a computer with a display , a keyboard, and a DVD drive attached , as shown in the f ollowing illustration: Installer application or installer tool in T erminal application If you have an Install DVD , the optical drive must be able t o read DVD discs.
Chapter 5 Installation and Deployment 101 After installation is complete , the target ser ver restarts and you can per form initial ser ver setup . Chapt er 6 , “ Initial Ser ver Setup ,” on page 1 08 describes how .
3 Select the target ser ver from the list of servers waiting for installation. If neither the target server nor the list appear , make sure the target ser ver is on the same local subnet as the administrator computer . 4 If the target computer is not on the same local subnet as the administrat or computer , add the ser ver manually .
Chapter 5 Installation and Deployment 10 3 F or detailed instruc tions for connecting to a computer running from an Install DVD , see “Remotely Accessing the Install DVD” on page 88. Important: If you perform an upgrade, make sure that saved setup da ta won’ t be detected and used by the server .
sudo shutdown -r now # Method 2 sudo systemsetup -liststartupdisks sudo systemsetup -setstartupdisk <path to disk root> Using the installer C ommand-Line T ool to Install Ser ver Soft ware Y ou use the installer tool to install ser ver software on a local or remote comput er from the command line.
Chapter 5 Installation and Deployment 10 5 4 If you haven ’t already done so, prepare the disks for installation. F or more information about preparing the disks for installation, see “P reparing Disks for Installing Mac OS X Ser ver ” on page 92 .
Installing Multiple Ser vers Most Ecient Methods of Installation The most ecient method of installation w ould be completely automated . Opening the T er minal application and using the installer tool to initiate each server software installation doesn ’t accomplish this eciently .
Chapter 5 Installation and Deployment 10 7 Upgrading a C omputer from Mac OS X to Mac OS X Ser ver This is not supported in Mac OS X S er ver v1 0.6. Perform a clean installation instead. How to Keep C urrent After you ’ve set up your server , you’ll wan t to update it when Apple releases server software updates.
10 8 Basic characteristics of your Mac OS X Ser ver are established during ser ver setup . The ser ver can opera te in three di erent congurations: advanced , standard , and workgroup . After installing server soft ware , the next task is to set up the server .
Chapter 6 Initial Server Setup 10 9 If you’ re setting up a ser ver without a keyboard or display , you can enter the follo wing in the T er minal application to shut down the server remotely: sudo .
Default SSH and Apple Remote Desktop sta te is enabled. Â Network interfaces (por ts) are congured . Â T CP/IP and Ethernet settings are dened for each por t you want to activa te. Network names are dened . Â The primary DNS name, computer name are dened by the administrator , and local hostname is derived from the computer name .
Chapter 6 Initial Server Setup 111 Â Import Users and Groups This setting connects the ser ver to an existing Open Directory or Active Director y system, impor ting the users and groups from an existing directory system. Y ou can impor t Open Director y users or Active Director y users.
Even if y ou want to change the ser ver ’ s director y setup, selec ting “Congure Manually ” is the safest option, especially if you ’re considering changing a server ’ s shared director y conguration.
Chapter 6 Initial Server Setup 11 3 T o interactively connect to an additional dir ec tor y ser ver: 1 Open the Accounts pane of S ystem Pref erences on your ser ver .
The follo wing illustration shows target ser vers on the same subnet as the administrator computer in one sc enario and target ser vers on a di erent subnet in the other scenario. Both setup scenarios can be used to set up ser vers on the same and di erent subnets.
Chapter 6 Initial Server Setup 11 5 If the computer you wan t to congure doesn ’t appear in the list, you can add it manually by clicking the Add button and supplying the request ed information. 6 Remove comput ers from the conguration list that you don ’t want to set up b y selecting them and click ing the Remove button.
The automa tic approach is useful when you: Have mor e than a few ser vers to set up  W ant to prepare for setting up servers that aren ’t yet a vailable  W ant to save setup data f or backup purposes  Need to reinstall servers frequently  Y ou can keep backup copies of setup data les on a network le ser ver .
Chapter 6 Initial Server Setup 11 7 Y ou can dene generic setup data that can be used to set up any ser ver . F or example, you can dene generic setup data for a server that’ s on order , or to congure 50 Xser ve computers y ou want to be identically congured .
Using Encryption with Setup Data Files Saved setup data can be encrypted for extra security . Bef ore a ser ver sets itself up using encr ypted setup data, it must have acce ss to the passphrase used when the data was encrypted. F or interactive setup, the passphrase is entered using Server Assistant during setup .
Chapter 6 Initial Server Setup 11 9 If setup data is encr ypted , the server needs the correct passphrase before setting itself up. Y ou can use Ser ver Assistant to supply the pass phrase interactively , or y ou can supply the passphrase in a le con taining the passphrase in the same folder as the corresponding a uto setup prole but with a .
T o use setup data from a le remotely: 1 Create the f older for the setup le on the remote server . a Connect to the remote server . ssh root@<server address> b Create the saved setup f older on the remote ser ver . mkdir /Auto Server Setup 2 Copy the sa ved setup le from the administrator computer to the r emote target computer .
Chapter 6 Initial Server Setup 12 1 Handling Setup Errors When a server encounters a setup problem, Ser ver Assistant shows a de scription of the setup error , and giv es some oppor tunit y to either x it or tr y again.
Setting Up Ser vices After installation and initial startup, the rst time you open Ser ver Admin, you see any ser vices that wer e congured during ser ver setup listed underneath the ser ver’ s name in the ser ver list.
Chapter 6 Initial Server Setup 12 3 Setting Up Open Director y Unless your server must be integrat ed with another vendor ’ s director y system or the director y architecture of a server you’ re upgrading needs changing immediately , you can begin using the directories you congur ed during ser ver setup.
12 4 This chapter sho ws you how to complet e ongoing management f or your systems , including setting up administrator c omputers, designating administrat ors, and maintaining service uptime.
Chapter 7 Ongoing System Management 12 5 In the following illustra tion, the arrows originat e from administrator computers and point to servers the administrator computers might be used t o manage.
Using the A dministration T ools Information about administration tools can be f ound on the pages indicated in the following table . Use this application or tool To S ee Command-line tools Administer a server using a UNIX command shell. “Command-Line T o ols” (page 48) iCal Service Utility Add locations and resour ces to your iCal server .
Chapter 7 Ongoing System Management 12 7 Y ou can use Workgroup Manager on a v1 0.6 ser ver to manage Mac OS X clients running the latest Mac OS X v1 0.5. However , af ter you edit a user record using W orkgroup Manager on v1 0.6, y ou can only access it using Workgroup Manager on v1 0.
Ser ver Admin Basics Y ou use Ser ver Admin to administer services on Mac OS X Ser ver computers. S er ver Admin also lets you s pecify settings that suppor t multiple ser vices, such as creating and managing SSL certicates and specifying which users and groups can access ser vices.
Chapter 7 Ongoing System Management 12 9 If a ser ver in the Ser vers list appears gray , double-click the ser ver or click the Connect button in the toolbar to log in again. T o enable auto-reconnect the next time you open Ser ver Admin, selec t the “R emember this password in m y k eychain ” while you log in.
IP address  OS version  T o create a server smart group: 1 Under the Ser ver list at the bottom of the Server Admin window , click the Add (+) button. 2 Select Add Smar t Group. 3 Name the smart group. 4 Dene the criteria that ser vers will appear in the list and click OK.
Chapter 7 Ongoing System Management 131 The follo wing table contains a summar y of what you nd for each button: T oolbar button Shows Overview Information about the server ’ s hardware , software, ser vices, and status. Logs The system log and security systems log.
Ser ver-side le tracking for mobile home-sync is a feature of mobile home f olders. F or information about when to enable this feature , see the online help and Mac OS X Ser ver Resources w ebsite at www.
Chapter 7 Ongoing System Management 13 3 The follo wing sec tions give guidance regarding the types of changes will be necessary for a name or IP address change . Understanding Mac OS X Ser ver Names Three names are used b y Mac OS X S er ver: computer name, local hostname, and DNS name.
Y our network conguration might hav e other domains, computers, and record types that are impacted by a server ’ s IP address change (SR V records , f or instance). T hese other records should b e examined thoroughly after an y change to a ser ver ’ s IP address.
Chapter 7 Ongoing System Management 13 5 Changing the DNS name of the directory ser ver requires that all bound machines be rebound to the new directory name and address. If you have set up a Kerber os environment, the Kerb eros realm does not change when the hostname is changed.
VPN VPN ser vers allocate IP addre ss ranges to VPN clients and mediate DNS queries of VPN clients. Any of these can be a ec ted by a change to the VPN ser ver ’ s IP address or domain name. Additionally , the VPN server contains routing denitions based on IP addresses .
Chapter 7 Ongoing System Management 13 7 MySQL In general, MySQL is not a ected by changing an IP address or DNS name. However , none of the data in the databases is alter ed when the DNS name or IP address are changed. Y ou are responsible f or replacing reference s to the DNS name and address (if used) in your databases .
F or the most par t, changing the net work address or DNS name of a le server has no internal a ec t on le ser vices. T he le ser vice processes monitor network int er faces for changes and adapt as nece ssar y without administrator intervention.
Chapter 7 Ongoing System Management 13 9 IMAP and POP Dovecot, the IMAP and POP ser vice, loads the fully-qualied domain name at startup and conguration reload . After a change, Dovecot must be restarted or given a SIGHUP command , at a minimum).
Address Book Service Changing the IP address of an A ddress Book ser ver does not a ect new connections to the server; however , it can disconnect existing client connections. If you manually edited the BindHT TPP or ts or BindSSLPorts options in the carddavd .
Chapter 7 Ongoing System Management 141 Certicates for C ollaboration Ser vices AddressBook, iCal, and iChat ser vers that use SSL will need new cer ticates. Y ou might need regenerate or r epurchase the cer ticates. Use S er ver Admin t o imp or t the new certicates, then congure each service’ s new certicate.
T o change the IP address of the P odcast Producer comput er : 1 Stop the Xgrid job queue when empty (or stop and empty it). 2 Recongure DNS, Open Director y , DHCP , and other infrastructure ser vices. F or example, in DNS, change the A record IP address of the P odcast Producer server .
Chapter 7 Ongoing System Management 14 3 Software Update Ser vice  Xgrid  After Software Update changes the DNS name or IP address , a number of changes must be made by the clients. However , the following guidelines for the server should be follow ed.
Changing the IP Addr ess of a Ser ver Y ou can change the IP address of a server using the Network pane of System Pref erences or the networksetup tool. Do not turn o the primar y network interface and then turn it back on with a di erent address.
Chapter 7 Ongoing System Management 14 5 Y ou can use the scutil command-line tool to set the local hostname and local hostname. For more information, see the scutil man page. Do not use the changeip command-line tool to change computer name s, even though the tool is still av ailable.
Adding and Removing Services in Ser ver Admin Ser ver Admin can only show y ou the ser vices you are administering , hiding all other ser vice conguration panes un til needed. Before you can administer a service, it must be enabled for the specic server; then that ser vice appears under the ser ver name in the main Ser ver list.
Chapter 7 Ongoing System Management 14 7 Con trolling Access t o S er vices Y ou can use Ser ver Admin to congure which users and gr oups can use ser vices hosted by a server .
Using SSL for Remot e S er ver Administr ation Y ou can control the level of security of communications between Server Admin and remote servers by choosing Ser ver Admin > P references . By default, Ser ver Admin trea ts communications with remote servers as encrypted using SSL.
Chapter 7 Ongoing System Management 14 9 The follo wing is the File Sharing conguration pane in Server Admin. Tiered Administr ation Permissions In previous releases of Mac OS X Server , there were two classes of users: admin and everyone else.
Ser ver Admin update s to reect what operations are possible for a user’ s permissions. F or example, some ser vices are hidden or the Settings pane is dimmed when you can only monitor that service.
Chapter 7 Ongoing System Management 151 The follo wing topics describe general W or kgroup Manager usage. Instructions for conducting specic administration tasks are a vailable in Workgroup Manager help and the Mac OS X Ser ver Resources w ebsite at www.
The follo wing is a sample user record conguration pane in Workgroup Manager: Initially , accoun ts listed are those stored in the last directory node of the ser ver ’ s search path. When you use other Workgroup Manager windows , such as Pr eference s, click Accounts in the t oolbar to return to the account window .
Chapter 7 Ongoing System Management 15 3 Dening Managed Pref erences T o work with managed preferences f or user accounts, group accounts, or computer lists, click the Preference s icon in the W or kgroup Manager toolbar .
W orking with Direc tory Data T o work with raw director y data, use Workgroup Manager’ s Inspector . The follo wing is the record Inspector pane in Workgroup Manager: T o display the inspector: 1 Choose Workgroup Manager > P references . 2 Enable “Show ‘ All Records’ tab and inspector ” and click OK.
Chapter 7 Ongoing System Management 15 5 Ser vice Conguration A ssistants Ser ver Admin has congura tion assistants to guide you through setting up services that require more setup than a single c onguration pane. The assistants present you with all conguration panes nece ssar y to fully enable a ser vice.
Address Book Service File type L oc ation Conguration les /etc/cardav d/cardavd.plist Data /Library/AddressBookSer ver/Documents/ iCal Service File type L oc ation Conguration les /etc/caldavd/calda vd.
Chapter 7 Ongoing System Management 15 7 Mail—Amavisd File type L oc ation Conguration les /etc/amavisd .conf Data: (default locations) /var/amavis/ Mail—Clam A V File type L oc ation Conguration les /etc/clamav .
Notications File type L oc ation Conguration les /etc/emond.d/ /etc/emond.d/rule s/ /Library/Keychains/System.keychain OpenDirector y Ser vice The entire Open Directory conguration can be saved with the ar chive feature. Filetype Location Conguration les /etc/openldap/slapd.
Chapter 7 Ongoing System Management 15 9 W eb Ser vice File type L oc ation Conguration les /etc/apache2/* (for Apache 2.2) /etc/httpd/* (for Apache 1 .3) /etc/webperfcache/* /Library/Keychains/System.keychain Data: (default locations) /Librar y/WebServer/Documents/ /Library/Logs/WebServer/* /Library/Logs/Migration/webcongmigrator .
Some single points of failure include: Computer syst em  Hard disk  P ower supply  Although it is almost impossible to eliminate all single points of failur e, you should minimize them as much as possible. For example , using a backup comput er and a le storage pool for Mac OS X Server eliminates the computer as a single point of failur e.
Chapter 7 Ongoing System Management 161 Using Backup P ower In the architecture of a server solution, power is a single point of failure. I f power goes out, your servers go down without warning. T o preven t a sudden disruption in ser vices, consider adding a backup source of pow er .
The automa tic restar t options are: Â Restart automatically after a power failure . The power management unit automatically starts up the ser ver after a power failure .
Chapter 7 Ongoing System Management 16 3 Link Aggr egation Although not common, the failure of a switch, cable, or net work interface card can cause your server to become unav ailable. T o eliminate these single points of failure , you can use link aggregation or trunking.
About the Link Aggr egation Control P rotocol (LA CP) IEEE 802.3ad Link Aggregation dene s a protocol called Link Aggregation C ontrol Prot ocol (LACP) that is used by Mac OS X Ser ver to aggregate (c ombine) multiple por ts into a link aggregat e (a vir tual por t) that can be used for TCP and UDP connections.
Chapter 7 Ongoing System Management 16 5 Computer t o Switch In this scenario shown in the following illustr ation, y ou connec t your server to a switch congured for 802.
F or example, you can connect two links to the master switch and the remaining links to the backup switch. As long as the master switch is active , the backup switch remains inactive. I f the master switch fails, the backup switch takes over transparen tly .
Chapter 7 Ongoing System Management 16 7 The interface name bond <num> assigned by the system is di erent from the name you give to the link aggr egate por t conguration. The interface name is for use at the command line, but the por t conguration name is for use in the Network pane of System P references .
Load Balancing One factor that can cause services to become unav ailable is ser ver overload. A ser ver has limited resourc es and can ser vice a limited number of requests simultaneously . If the ser ver gets overloaded , it slows down and can eventually crash.
Chapter 7 Ongoing System Management 16 9 Daemon Over view By the time a user logs in to a Mac OS X system, a number of processes are running . Many of these proce sses are k nown as daemons. A daemon is a back ground process that provides a service to users.
The launchctl utility is the command-line tool used to control la unchd. It can: Load and unload daemons  Start and stop launchd controlled jobs  Get system utilization statistics for la unchd and.
17 1 E ective monitoring allows you t o detec t potential problems before the y occur and gives you early warning when they occur . Detecting potential problems allows you t o tak e steps to resolv e them before they impact ser ver availability of your servers.
Several factors can be considered for a monit oring response: What are relev ant response methods? In other wor ds, how will the response take  place? What is the time to re sponse? Wha t is an acce.
Chapter 8 Monitoring Y our System 17 3 A green status indicator sho ws the component is OK, a yellow status indicator notes a warning, and a red status indicator notes an error . Ser ver Monitor works for Xserves only . F or more information about Ser ver Monitor , choose Ser ver Monitor Help from Server Monitor ’ s Help menu.
df -Hl Filesystem Size Used Avail Capacity Mounted on /dev/disk0s9 40G 38G 2.1G 95% / In this example, the hard disk is almost full with only 2. 1 GB left. This t ells you that you should act immediately to free s pace on your hard disk before it lls up and causes problems f or your users.
Chapter 8 Monitoring Y our System 17 5 If you detect an unusual number of requests coming from the same sourc e, use Fir ewall ser vice to block trac from that source . F or more information about tcpdump, see the corresponding man page . Consider using Ruby , P er l, shell scripts, or AppleScript to automate the monit or ing  process.
The follo wing shows a sample O ver view pane for a single server . This overview shows basic hardware , operating system versions, ac tive services, and graphs of CPU history , network throughput histor y , and disk space. Use the m serveradmin XML web interface.
Chapter 8 Monitoring Y our System 17 7 When a server ker nel panics it abruptly halts all normal system operations. Usually , a kernel process named panic() outputs an error message to the console and st ores debugging information in non volitile memor y to be written to a crash log le upon restarting the computer .
Setting Up a Core Dump Server Y ou can use any Mac OS X v1 0.5 or later comput er to be a core dump ser ver that ts the following criteria. T he core dump ser ver must: Have a static IP addr ess. Â Be IPv4 network-accessible to all clients using UDP port 1 069 .
Chapter 8 Monitoring Y our System 17 9 Setting Up a Core Dump Clien t A core dump client sends its kernel panic debug information to the c ore dump ser ver address specied in its NVRAM settings. The information is transmitt ed at the time of the panic, so before restarting the computer , allow some time for the data to be sent to the server .
Conguring C ommon Core Dump Options By default, core dumps happen using UDP port 1 069 ov er the built-in Ethernet (en0) interface, and the resulting les are st ored in /PanicDumps on the cor e dump ser ver .
Chapter 8 Monitoring Y our System 181 SNMPv2 is the default access pr otocol and the default read-only community string is “public.” Enabling SNMP reporting SNMP access isn ’t enabled by default on Mac OS X Server . T o use SNMP tools to poll your Mac OS X Ser ver for data, you must congure and then enable the service.
T o enable and congure SNMP: Use the /usr/bin/snmpconf command , which tak es you through a basic text-based m setup assistant for c ongur ing the community name and saves the info in the conguration le. The snmp cong le is located in /usr/shar e/snmp/snmpd.
Chapter 8 Monitoring Y our System 18 3 Step 3: Collect SNMP information from the host T o get the SNMP-available information y ou added, execute this command from a host m that has SNMP tools installed: /usr/bin/snmpget -c public <hostname> system.
There are two main notica tion daemons: syslogd and emond. Â syslogd: The syslogd daemon is a standard UNIX method of monitoring systems. It logs messages in accordance with the settings found in /et c/syslog.
Chapter 8 Monitoring Y our System 18 5 Logging Mac OS X Ser ver maintains standard UNIX log les and Apple-s pecic process logs. Logs f or the OS can b e found in: /var/log  /Library/Logs  ~/Library/Logs  Each process is re sponsible for its own logs, the log level, and verbosit y .
Syslog C onguration File The Syslog congura tion le can be found at /etc/syslog.c onf. Each line has the following f ormat: <facility>.<loglevel> <path to logle> Replace <facility> with the process name writing to the log.
Chapter 8 Monitoring Y our System 18 7 T o run slapd in debugging mode: 1 Stop and remov e slapd from launchd’ s watch list: launchctl unload /System/Library/LaunchDaemons/org.
18 8 Pr ovide increased ser ver re sponsiveness to clien ts and reduce server load with Push Notication Server . Mac OS X Ser ver v1 0.6 uses an XMPP P ubsub architecture for the Push Notication Ser ver .
Chapter 9 Push Notication Server 18 9 Star ting and Stopping P ush Notication When you start push notication on a ser ver , the service broadcasts its av ailabilit y on the local network to other services that suppor t it.
Changing a Ser vice’ s Push Notication Ser ver If push notication is congured on the server , it is listed in the location on the ser vice ’ s settings pane. If another computer on the subnet is congured as a push notication server , it appears in the ser vice’ s setting pane.
A access ACLs 5 5 , 75 IMAP 13 9 IP address restrictions 5 2 Keychain Access Utility 66 LDAP 2 1 , 58 Mac address 5 3 , 90 remote installation 84 , 88 , 90 , 10 1 , 10 2 SACLs 7 5 user 13 2 , 14 7 See also permissions accounts.
19 2 Index preparing 64 private keys 59 public keys 59 renewing 7 1 requesting 63 , 64 , 65 root 66 self-signed 6 1 , 65 Ser ver Admin 62 , 14 8 services using 7 1 web service 13 7 wiki ser vices 13 7 changip tool 14 5 chat service.
Index 19 3 E email. See mail ser vice emond daemon 18 4 encryption 54 , 5 5 , 59 , 11 8 See also SSL Ethereal packet sning tool 17 5 Ethernet 5 3 , 10 9 , 16 6 exporting ser vice settings 14 6 Extensible Messaging and Presence P rotocol.
19 4 Index server 14 4 static 82 See also identity IPv6 addressing 22 J journaling, le system 93 junk mail screening 13 9 K Kerberos 2 1 , 57 , 58 , 13 4 kernel panic 17 6 , 17 8 , 17 9 , 18 0 key-.
Index 19 5 See also Open Director y OpenCL 1 8 OpenLDAP 2 1 OpenSSL 54 operating environmen t requirements 16 2 P P ack ageMaker 47 packets, data, lt er ing of 52 partitions, disk 86 , 94 , 95 , 97.
19 6 Index Ser ver Admin access control 14 7 as administration tool 12 8 authentication 3 8 certicates 62 , 14 8 conguration methods 1 8 customizing 40 notication system 17 5 opening 38 overview 1 1 , 1 8 , 38 , 39 server status 17 5 service management 14 6 system imaging 47 Ser ver Assistant 4 1 , 10 1 , 10 8 , 15 5 Ser ver Message Block.
Index 19 7 U UDP (User Datagram P rotocol) 52 , 18 0 UNIX 23 updating software 10 7 upgrading from previous server versions 25 , 28 saved setup data 11 7 vs. migration 25 , 28 UPS (uninterruptible power supply) 16 1 user accounts group 15 3 managed preference s 15 3 management of 15 1 mobile 13 2 setup 12 3 See also users User Datagram P rotocol.
An important point after buying a device Apple 10.6 (or even before the purchase) is to read its user manual. We should do this for several simple reasons:
If you have not bought Apple 10.6 yet, this is a good time to familiarize yourself with the basic data on the product. First of all view first pages of the manual, you can find above. You should find there the most important technical data Apple 10.6 - thus you can check whether the hardware meets your expectations. When delving into next pages of the user manual, Apple 10.6 you will learn all the available features of the product, as well as information on its operation. The information that you get Apple 10.6 will certainly help you make a decision on the purchase.
If you already are a holder of Apple 10.6, but have not read the manual yet, you should do it for the reasons described above. You will learn then if you properly used the available features, and whether you have not made any mistakes, which can shorten the lifetime Apple 10.6.
However, one of the most important roles played by the user manual is to help in solving problems with Apple 10.6. Almost always you will find there Troubleshooting, which are the most frequently occurring failures and malfunctions of the device Apple 10.6 along with tips on how to solve them. Even if you fail to solve the problem, the manual will show you a further procedure – contact to the customer service center or the nearest service center
