Apple Mac OS X Server (version 10.2.3 or later) User Manual
Administrator’s guide
Table of contents
Document Outline
- Mac OS X Server Administrator's Guide
- Contents
- How to Use This Guide
- Administering Your Server
- Directory Services
- Storage for Data Needed by Mac OS X
- A Historical Perspective
- Uses of Directory Data
- Inside a Directory Domain
- Discovery of Network Services
- Directory Domain Protocols
- Local and Shared Directory Domains
- Directory Domain Hierarchies
- Search Policies for Directory Domain Hierarchies
- Directory Domain Planning
- Open Directory Password Server
- Overview of Directory Services Tools
- Setup Overview
- Before You Begin
- Setting Up an Open Directory Domain and Password Server
- Using Another Server’s Shared Directory Domain
- Hosting a Shared Directory Domain With a Password Server
- Hosting a Shared Directory Domain and Using an Existing Password Server
- Hosting a Shared Directory Domain With No Password Server
- Using a Non-Shared Local Directory Domain With a Password Server
- Using a Non-Shared Local Directory Domain and an Existing Password Server
- Using a Non-Shared Local Directory Domain With No Password Server
- Deleting a Shared Open Directory Domain
- Configuring Open Directory Service Protocols
- Setting Up Search Policies
- Changing Basic LDAPv3 Settings
- Configuring Access to Existing LDAPv3 Servers
- Creating an LDAPv3 Configuration
- Editing an LDAPv3 Configuration
- Duplicating an LDAPv3 Configuration
- Deleting an LDAPv3 Configuration
- Changing an LDAPv3 Configuration’s Connection Settings
- Configuring LDAPv3 Search Bases and Mappings
- Mapping Config Record Attributes for LDAPv3 Directory Domains
- Editing RFC 2307 Mapping to Enable Creating Users
- Populating LDAPv3 Domains With Data for MacOSX
- Using an Active Directory Server
- Accessing an Existing LDAPv2 Directory
- Using NetInfo Domains
- Using Berkeley Software Distribution (BSD) Configuration Files
- Configuring Directory Access on a Remote Computer
- Monitoring Directory Services
- Backing Up and Restoring Directory Services Files
- Users and Groups
- How User Accounts Are Used
- How Group Accounts Are Used
- Kinds of Users and Groups
- Setup Overview
- Step 1: Before you begin, do some planning
- Step 2: Set up directory domains in which user and group accounts will reside
- Step 3: Set up Open Directory Password Server
- Step 4: Configure server search policies so servers can find user and group accounts
- Step 5: Create users
- Step 6: Create groups
- Step 7: Set Up Client Computers
- Step 8: Review user and group account information as needed
- Step 9: Update users and groups as needed
- Step 10: Perform ongoing user and group account maintenance
- Before You Begin
- Administering User Accounts
- Working With Basic Settings for Users
- Working With Advanced Settings for Users
- Working With Group Settings for Users
- Working With Home Settings for Users
- Working With Mail Settings for Users
- Working With Print Settings for Users
- Working With Managed Users
- Defining a Guest User
- Deleting a User Account
- Disabling a User Account
- Administering Home Directories
- Types of Home Directories
- Distributing Home Directories Across Multiple Servers
- Defining No Home Directory
- Defining a Home Directory for Local Users
- Defining a Network Home Directory for AFP Access
- Defining a Network Home Directory for NFS Access
- Defining an Advanced Home Directory for AFP Access
- Defining an Advanced Home Directory for NFS Access
- Using createhomedir to Create Home Directories
- Setting Disk Quotas
- Defining Default Home Directories for New Users
- Moving Home Directories
- Deleting Home Directories
- Administering Group Accounts
- Working With Member Settings for Groups
- Working With Folder Settings for Groups
- Working With Group and Computer Preferences
- Deleting a Group Account
- Finding User and Group Accounts
- Shortcuts for Working With Users and Groups
- Editing Multiple Users Simultaneously
- Using Presets
- Importing and Exporting User and Group Information
- Understanding What You Can Import
- Using Workgroup Manager to Import Users and Groups
- Using Workgroup Manager to Export Users and Groups
- Using dsimportexport to Import Users and Groups
- Using dsimportexport to Export Users and Groups
- Using XML Files Created With Mac OS X Server 10.1 or Earlier
- Using XML Files Created With AppleShare IP 6.3
- Using Character-Delimited Files
- Understanding Password Validation
- Storing Passwords in User Accounts
- Using a Password Server
- Setting Up a Password Server
- Assigning Administrator Rights for a Password Server
- Enabling the Use of a Password Server for a User
- Exporting and Importing Users With Password Server Passwords
- Resetting Passwords Before Discontinuing Use of a Password Server
- Making a Password Server More Secure
- Monitoring a Password Server
- Using Kerberos
- Using LDAP Bind Authentication
- Backing Up and Restoring Files
- Supporting Client Computers
- Solving Problems
- You Can’t Modify an Account Using Workgroup Manager
- A Password Server User’s Password Can’t Be Modified
- A User’s Password Can’t Be Changed to Password Server Validation
- A Password Server User Can’t Authenticate in NetInfo Manager
- Users Can’t Log In or Authenticate
- You Can’t Assign Server Administrator Privileges
- Disconnecting the Password Server Computer
- Users Can’t Access Their Home Directories
- Mac OS X User in Shared NetInfo Domain Can’t Log In
- Kerberos Users Can’t Authenticate
- Sharing
- Privileges
- Network Globe Contents
- Setup Overview
- Before You Begin
- Setting Up Sharing
- Setting Up Share Points for Managed Mac OS X Admin Users
- Creating Share Points and Setting Privileges
- Configuring Apple File Settings for a Share Point
- Configuring Windows File Settings for a Share Point
- Configuring FTP Settings for a Share Point
- Sharing (Exporting) Items Using Network File System (NFS)
- Automounting Share Points
- Resharing NFS Mounts as AFP Share Points
- Managing Sharing
- Turning Sharing Off
- Removing a Share Point
- Browsing Server Disks
- Viewing Share Points
- Copying Privileges to Enclosed Items
- Viewing Share Point Settings
- Changing Share Point Owner and Privilege Settings
- Changing the Protocols for a Share Point
- Deleting a Client from an NFS Export
- Creating a Drop Box
- Using Workgroup Manager With Mac OS X Server Version 10.1.5
- Supporting Client Computers
- Solving Problems
- File Services
- Before You Begin
- Setup Overview
- Apple File Service
- Windows Services
- File Transfer Protocol (FTP) Service
- Secure FTP Environment
- Before You Set Up FTP Service
- Setup Overview
- Step 1: Before You Begin
- Step 2: Configure FTP General settings
- Step 3: Configure FTP Access settings
- Step 4: Configure FTP Logging settings
- Step 5: Configure FTP Advanced settings
- Step 6: Create an “uploads” folder for FTP users (optional)
- Step 7: Create share points and share them using FTP
- Step 8: Start FTP service
- Setting Up File Transfer Protocol (FTP) Service
- Managing File Transfer Protocol (FTP) Service
- Network File System (NFS) Service
- Supporting Client Computers
- Solving Problems With File Services
- Where to Find More Information About File Services
- Client Management: Mac OS X
- The User Experience
- Before You Begin
- Designating Administrators
- Setting Up User Accounts
- Setting Up Group Accounts
- Setting Up Computer Accounts
- Creating a Computer Account
- Creating a Preset for Computer Accounts
- Using a Computer Accounts Preset
- Adding Computers to an Existing Computer Account
- Editing Information About a Computer
- Moving a Computer to a Different Computer Account
- Deleting Individual Computers From a Computer Account
- Deleting a Computer Account
- Searching for Computer Accounts
- Managing Guest Computers
- Working With Access Settings
- Managing Portable Computers
- How Workgroup Manager Works With System Preferences
- Managing Preferences
- About the Preferences Cache
- Updating the Managed Preferences Cache
- Emptying the Preference Cache Manually
- How Preference Management Works
- Preference Management Options
- Managing User Preferences
- Managing Group Preferences
- Managing Computer Preferences
- Editing Preferences for Multiple Records
- Disabling Management for Specific Preferences
- Managing Applications Preferences
- Managing Classic Preferences
- Classic Startup Preferences
- Making Classic Start Up After a User Logs In
- Choosing a Classic System Folder
- Classic Advanced Preferences
- Allowing Special Actions During Restart
- Keeping Control Panels Secure
- Preventing Access to the Chooser and Network Browser
- Making Apple Menu Items Available in Classic
- Adjusting Classic Sleep Settings
- Managing Dock Preferences
- Managing Finder Preferences
- Finder Preferences
- Keeping Disks and Servers From Appearing on the User’s Desktop
- Controlling the Behavior of Finder Windows
- Making File Extensions Visible
- Selecting the User Environment
- Hiding the Alert Message When a User Empties the Trash
- Finder Commands Preferences
- Controlling User Access to an iDisk
- Controlling User Access to Remote Servers
- Controlling User Access to Folders
- Preventing Users From Ejecting Disks
- Hiding the Burn Disc Command in the Finder
- Removing Restart and Shut Down Commands From the Apple Menu
- Finder Views Preferences
- Adjusting the Appearance and Arrangement of Desktop Items
- Adjusting the Appearance of Finder Window Contents
- Managing Internet Preferences
- Managing Login Preferences
- Managing Media Access Preferences
- Managing Printing Preferences
- Solving Problems
- I Can’t Enforce Default Web Settings
- I Can’t Enforce Default Mail Settings
- Users Don’t See a List of Workgroups at Login
- Users Cannot Open Files
- Users Cannot Add Printers to a Printer List
- Login Items Added by a User Do Not Open
- Items Placed in the Dock by a User are Missing
- New: Users See a Question Mark in the Dock
- Users See a Message About an Unexpected Error
- Print Service
- Web Service
- Before You Begin
- Setting Up Web Service for the First Time
- Managing Web Service
- Starting or Stopping Web Service
- Starting Web Service Automatically
- Modifying MIME Mappings
- Setting Up Persistent Connections for Web Service
- Limiting Simultaneous Connections for Web Service
- Setting Up Proxy Caching for Web Service
- Blocking Web Sites From Your Web Server Cache
- Enabling SSL for Web Service
- Setting Up the SSL Log for a Web Server
- Setting Up WebDAV for a Web Server
- Starting Tomcat
- Viewing Web Service Status Overview
- Viewing Detailed Web Service Status
- Viewing Logs of Web Service Activity
- Setting Up Multiple IP Addresses for a Port
- Managing Web Sites
- Setting Up the Documents Folder for Your Web Site
- Changing the Default Web Folder for a Site
- Enabling a Web Site on a Server
- Setting the Default Page for a Web Site
- Changing the Access Port for a Web Site
- Improving Performance of Static Web Sites
- Enabling Access and Error Logs for a Web Site
- Setting Up Directory Listing for a Web Site
- Connecting to Your Web Site
- Enabling WebDAV
- Setting Access for WebDAV-Enabled Sites
- Enabling a Common Gateway Interface (CGI) Script
- Enabling Server Side Includes (SSI)
- Monitoring Web Sites
- Setting Server Responses to MIME Types
- Enabling SSL
- Enabling PHP
- WebMail
- Setting Up Secure Sockets Layer (SSL) Service
- Solving Problems
- Installing and Viewing Web Modules
- Where to Find More Information
- Mail Service
- Mail Service Protocols
- How Mail Service Uses SSL
- How Mail Service Uses DNS
- Where Mail Is Stored
- How User Account Settings Affect Mail Service
- What Mail Service Can Do About Junk Mail
- What Mail Service Doesn’t Do
- Mail Service Configuration in the Local Directory
- Overview of Mail Service Tools
- Setup Overview
- Step 1: Before you begin, do some planning
- Step 2: Set up MX records
- Step 3: Start mail service
- Step 4: Configure incoming mail service
- Step 5: Configure outgoing mail service
- Step 6: Configure additional settings for mail service
- Step 7: Set up accounts for mail users
- Step 8: Create a postmaster account
- Step 9: Set up each user’s mail client software
- Overview of Ongoing Mail Service Management
- Before You Begin
- Working With General Settings for Mail Service
- Working With Settings for Incoming Mail
- Working With Settings for Incoming POP Mail
- Working With Settings for Incoming IMAP Mail
- Working With Settings for Outgoing Mail
- Working With Settings for SMTP Mail
- Working With the Mail Database
- Working With Network Settings for Mail Service
- Limiting Junk Mail
- Working With Undeliverable Mail
- Monitoring Mail Status
- Supporting Mail Users
- Performance Tuning
- Backing Up and Restoring Mail Files
- Where to Find More Information
- Client Management: Mac OS 9 and OS 8
- The User Experience
- Before You Begin
- Step 1: Make sure computers meet minimum requirements
- Step 2: Install Macintosh Manager administrator software
- Step 3: Set up client computers
- Using Update Packages
- Choosing a Language for Macintosh Manager Servers and Clients
- Changing the Apple File Service Language Script
- Step 4: Make sure you’ve set up users and their home directories
- Inside Macintosh Manager
- Setting Up Mac OS 9 or Mac OS 8 Managed Clients
- Step 1: Make sure Macintosh Manager services are available
- Step 2: Log in to Macintosh Manager Admin as an administrator
- Step 3: Import user accounts
- Step 4: Designate a Macintosh Manager administrator
- Step 5: Designate workgroup administrators
- Step 6: Create workgroups for users
- Step 7: Create computer lists
- Step 8: Select global settings and set up managed preferences folders
- Logging In to Macintosh Manager as an Administrator
- Importing User Accounts
- Applying User Settings With a Template
- Importing All Users
- Importing One or More Users
- Collecting User Information in a Text File
- Importing a List of Users From a Text File
- Finding Specific Imported Users
- Providing Quick Access to Unimported Users
- Providing Access to Unimported Mac OS X Server Users
- Setting Up a Guest User Account
- Designating Administrators
- Working With User Settings
- Setting Up Workgroups
- Using Items Settings
- Using Privileges Settings
- Protecting the System Folder and Applications Folder
- Protecting the User’s Desktop
- Preventing Applications From Altering Files
- Preventing Access to FireWire Disks
- Allowing Users to Play Audio CDs
- Allowing Users to Take Screen Shots
- Allowing Users to Open Applications From a Disk
- Setting Access Privileges for Removable Media
- Setting Access Privileges for Menu Items
- Sharing Information in Macintosh Manager
- Using Volumes Settings
- Using Printers Settings
- Using Options Settings
- Setting Up Computer Lists
- Using Workgroup Settings for Computers
- Using Control Settings
- Disconnecting Computers Automatically to Minimize Network Traffic
- Setting the Computer Clock Using the Server Clock
- Using a Specific Hard Disk Name
- Creating Email Addresses for Managed Users
- Using Security Settings for Computers
- Keeping Computers Secure If a User Forgets to Log Out
- Allowing Access to All CDs and DVDs
- Allowing Access to Specific CDs or DVDs
- Choosing Computer Security Settings for Applications
- Allowing Specific Applications to Be Opened by Other Applications
- Allowing Users to Work Offline
- Switching to a Different Macintosh Manager Server
- Allowing Users to Force-Quit Applications
- Allowing Users to Disable Extensions
- Using Computer Login Settings
- Managing Portable Computers
- Using Global Security Settings
- Using Global CD-ROM Settings
- Managing Preferences
- Solving Problems
- I’ve Forgotten My Administrator Password
- Administrators Can’t Get to the Finder After Logging In
- Generic Icons Appear in the Items Pane
- Selecting “Local User” in the Multiple Users Control Panel Doesn’t Work
- Some Printers Don’t Appear in the Available Printers List
- Users Can’t Log In to the Macintosh Manager Server
- Users Can’t Log In as “Guest” on Japanese-Language Computers
- A Client Computer Can’t Connect to the Server
- The Server Doesn’t Appear in the AppleTalk List
- The User’s Computer Freezes
- Users Can’t Access Their Home Directories
- Users Can’t Access Shared Files
- Shared Workgroup Documents Don’t Appear in a Panels Environment
- Applications Don’t Work Properly or Don’t Open
- Users Can’t Drag and Drop Between Applications
- Users Can’t Open Files From a Web Page
- Sometimes the Right Application Doesn’t Open for Users
- Where to Find More Information
- DHCP Service
- Before You Set Up DHCP Service
- Setting Up DHCP Service for the First Time
- Managing DHCP Service
- Starting and Stopping DHCP Service
- Setting the Default DNS Server for DHCP Clients
- Setting the LDAP Server for DHCP Clients
- Setting Up Logs for DHCP Service
- Deleting Subnets From DHCP Service
- Changing Lease Times for Subnet Address Ranges
- Monitoring DHCP Client Computers
- Creating Subnets in DHCP Service
- Changing Subnet Settings in DHCP Service
- Setting DNS Options for a Subnet
- Setting NetInfo Options for a Subnet
- Disabling Subnets Temporarily
- Viewing DHCP and NetBoot Client Lists
- Viewing DHCP Log Entries
- Solving Problems
- Where to Find More Information
- NetBoot
- Before You Set Up NetBoot
- Inside NetBoot
- Setup Overview
- Step 1: Evaluate and update your network, servers, and client computers as necessary
- Step 2: Create disk images for client computers
- Step 3: Set up DHCP
- Step 4: Configure and turn on the NetBoot service
- Step 5: Set up Ethernet address filtering (optional)
- Step 6: Test your NetBoot setup
- Step 7: Set up all client computers to use NetBoot
- Setting Up NetBoot
- Creating a Mac OS X Disk Image
- Installing Classic on a Mac OS X Disk Image
- Updating an Existing Mac OS X NetBoot Disk Image
- Creating a Mac OS X NetBoot Image From an Existing System
- Installing a Mac OS 9 Disk Image
- Modifying a Mac OS 9 Disk Image
- Specifying the Default NetBoot Disk Image
- Compressing Images to Save Server Disk Space
- Configuring NetBoot on Your Server
- Starting NetBoot on Your Server
- Enabling NetBoot Disk Images
- Setting Up Multiple Disk Images
- Managing NetBoot
- Load Balancing
- Supporting Client Computers
- Solving Problems
- Network Install
- Before You Set Up Network Install
- Setup Overview
- Setting Up Network Install
- Creating a Network Install Disk Image
- Enabling an Installer Disk Image
- Unlocking an Image
- About Packages
- Creating Packages
- Adding Packages to an OS Install Image
- Adding Packages to a Custom Package Install Image
- Installing Mac OS Updates
- Automating Installation of an OS Image
- Automating Installation of a Custom Package Install Image
- About the minstallconfig.xml File
- Selecting a Network Install Image (From a Mac OS X client)
- DNS Service
- Firewall Service
- Before You Set Up Firewall Service
- Setting Up Firewall Service for the First Time
- Managing Firewall Service
- Starting and Stopping Firewall Service
- Setting Firewall Service to Start Automatically
- Editing IP Filters
- Creating an IP Filter
- Searching for IP Filters
- Viewing the Firewall Log
- Configuring Firewall Service
- Setting Up Logs for Firewall Service
- Viewing Denied Packets
- Filtering UDP Ports in Firewall Service
- Blocking Multicast Services in Firewall Service
- Allowing NetInfo Access to Certain IP Addresses
- Changing the Any Port (Default) Filter
- Preventing Denial-of-Service Attacks
- Creating IP Filter Rules Using ipfw
- Port Reference
- Solving Problems
- Where to Find More Information
- SLP DA Service
- Tools for Advanced Administrators
- Terminal
- Secure Shell (SSH) Command
- dsimportexport
- createhomedir
- Log Rolling Scripts
- diskspacemonitor
- diskutil
- installer
- softwareupdate
- systemsetup
- networksetup
- MySQL Manager
- Simple Network Management Protocol (SNMP) Tools
- diskKeyFinder
- Enabling IP Failover
- Using Disk Journaling
- Setting Up SSL for Mail Service
- Setting Up Authentication Manager
- ldapsearch
- Data Requirements of Mac OS X Directory Services
- User Data That Mac OS X Server Uses
- Standard Attributes in User Records
- Format of MailAttribute in User Records
- Standard Attributes in Group Records
- Standard Attributes in Computer Records
- Standard Attributes in Computer List Records
- Standard Attributes in Mount Records
- Standard Attributes in Config Records
- Integrating Mac OS X Directory Services With Active Directory
- Glossary
- Index