Apple Mac OS X Server Administrator's Manual

Administrator’s Guide For version 10.2.3 or later CC.0395.SUS4AdminGuideCvr 11/13/02 11:19 AM Page 1

© 2002 Apple Computer, Inc. All rights reserved. The owner or authorized user of a valid copy of Mac OS X Server software may reproduce this publication for the purpose of learning to use such software. No part of this publication may be reproduced or transmitted for commercial purposes, such as selling copies of this publication or for providing paid for support services. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, AppleScript, AppleShare, AppleTalk, ColorSync, FireWire, Keychain, Mac, Macintosh, Power Macintosh, QuickTime, Sherlock, and WebObjects are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, Extensions Manager, Finder, iMac, and Power Mac are trademarks of Apple Computer, Inc. Adobe and PostScript are trademarks of Adobe Systems Incorporated. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Netscape Navigator is a trademark of Netscape Communications Corporation. RealAudio is a trademark of Progressive Networks, Inc. © 1995–2001 The Apache Group. All rights reserved. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. 022-0395/11-20-02 LL0395.Book Page 2 Wednesday, November 20, 2002 11:44 AM

What’s Included in This Guide 13 Using This Guide 14 Setting Up Mac OS X Server for the First Time 15 Getting Help for Everyday Management Tasks 15 Getting Additional Information 15 1 Administering Your Server 17 Highlighting Key Features 17 Highlighting Individual Services 21 Highlighting Server Applications 30 Where to Find More Information 39 2 Directory Services 41 Storage for Data Needed by Mac OS X 42 A Historical Perspective 43 Uses of Directory Data 46 Inside a Directory Domain 47 Discovery of Network Services 48 Directory Domain Protocols 49 Local and Shared Directory Domains 50 Directory Domain Hierarchies 54 Search Policies for Directory Domain Hierarchies 58 Directory Domain Planning 61 Open Directory Password Server 63 LL0395.Book Page 3 Wednesday, November 20, 2002 11:44 AM

Setup Overview 68 Before You Begin 70 Setting Up an Open Directory Domain and Password Server 71 Configuring Open Directory Service Protocols 86 Setting Up Search Policies 87 Changing Basic LDAPv3 Settings 90 Configuring Access to Existing LDAPv3 Servers 91 Using an Active Directory Server 98 Accessing an Existing LDAPv2 Directory 100 Using NetInfo Domains 105 Using Berkeley Software Distribution (BSD) Configuration Files 110 Configuring Directory Access on a Remote Computer 114 Monitoring Directory Services 115 Backing Up and Restoring Directory Services Files 116 3 Users and Groups 117 How User Accounts Are Used 118 How Group Accounts Are Used 123 Kinds of Users and Groups 124 Setup Overview 128 Before You Begin 132 Administering User Accounts 134 Working With Basic Settings for Users 136 Working With Advanced Settings for Users 143 Working With Group Settings for Users 145 Working With Home Settings for Users 147 Working With Mail Settings for Users 147 Working With Print Settings for Users 149 Working With Managed Users 151 Defining a Guest User 151 Deleting a User Account 151 Disabling a User Account 152 Administering Home Directories 152 Administering Group Accounts 167 LL0395.Book Page 4 Wednesday, November 20, 2002 11:44 AM

Working With Folder Settings for Groups 172 Working With Group and Computer Preferences 175 Deleting a Group Account 175 Finding User and Group Accounts 176 Shortcuts for Working With Users and Groups 178 Editing Multiple Users Simultaneously 178 Using Presets 179 Importing and Exporting User and Group Information 181 Understanding Password Validation 193 Storing Passwords in User Accounts 198 Using a Password Server 200 Using Kerberos 205 Using LDAP Bind Authentication 208 Backing Up and Restoring Files 209 Supporting Client Computers 210 Solving Problems 210 4 Sharing 215 Setup Overview 218 Before You Begin 219 Setting Up Sharing 221 Managing Sharing 227 Supporting Client Computers 231 Solving Problems 231 5 File Services 233 Before You Begin 233 Setup Overview 235 Apple File Service 236 Windows Services 248 File Transfer Protocol (FTP) Service 256 Network File System (NFS) Service 268 Supporting Client Computers 272 LL0395.Book Page 5 Wednesday, November 20, 2002 11:44 AM

Where to Find More Information About File Services 278 6 Client Management: Mac OS X 279 The User Experience 280 Before You Begin 281 Designating Administrators 283 Setting Up User Accounts 283 Setting Up Group Accounts 284 Setting Up Computer Accounts 284 Managing Guest Computers 290 Working With Access Settings 291 Managing Portable Computers 293 How Workgroup Manager Works With System Preferences 294 Managing Preferences 295 Managing Applications Preferences 301 Managing Classic Preferences 304 Managing Dock Preferences 308 Managing Finder Preferences 311 Managing Internet Preferences 319 Managing Login Preferences 320 Managing Media Access Preferences 324 Managing Printing Preferences 327 Solving Problems 330 7 Print Service 335 Setup Overview 337 Before You Begin 339 Setting Up Print Service 339 Setting Up Print Quotas 342 Setting Up Printing on Client Computers 343 Managing Print Service 345 Managing Print Queues 346 Managing Print Jobs 349 Managing Print Quotas 352 LL0395.Book Page 6 Wednesday, November 20, 2002 11:44 AM

Solving Problems 354 8 Web Service 357 Before You Begin 358 Setting Up Web Service for the First Time 361 Managing Web Service 362 Managing Web Sites 369 WebMail 379 Setting Up Secure Sockets Layer (SSL) Service 383 Solving Problems 385 Installing and Viewing Web Modules 386 Where to Find More Information 389 9 Mail Service 391 Mail Service Protocols 392 How Mail Service Uses SSL 394 How Mail Service Uses DNS 394 Where Mail Is Stored 394 How User Account Settings Affect Mail Service 395 What Mail Service Can Do About Junk Mail 396 What Mail Service Doesn’t Do 398 Mail Service Configuration in the Local Directory 398 Overview of Mail Service Tools 398 Setup Overview 399 Overview of Ongoing Mail Service Management 401 Before You Begin 401 Working With General Settings for Mail Service 402 Working With Settings for Incoming Mail 405 Working With Settings for Incoming POP Mail 406 Working With Settings for Incoming IMAP Mail 407 Working With Settings for Outgoing Mail 410 Working With Settings for SMTP Mail 411 Working With the Mail Database 416 Working With Network Settings for Mail Service 419 LL0395.Book Page 7 Wednesday, November 20, 2002 11:44 AM

Working With Undeliverable Mail 425 Monitoring Mail Status 427 Supporting Mail Users 429 Performance Tuning 431 Backing Up and Restoring Mail Files 431 Where to Find More Information 432 10 Client Management: Mac OS 9 and OS 8 435 Before You Begin 438 Inside Macintosh Manager 442 Setting Up Mac OS 9 or Mac OS 8 Managed Clients 448 Logging In to Macintosh Manager as an Administrator 449 Importing User Accounts 450 Designating Administrators 455 Working With User Settings 457 Setting Up Workgroups 459 Using Items Settings 462 Using Privileges Settings 464 Sharing Information in Macintosh Manager 467 Using Volumes Settings 469 Using Printers Settings 471 Using Options Settings 474 Setting Up Computer Lists 476 Using Workgroup Settings for Computers 478 Using Control Settings 479 Using Computer Login Settings 484 Managing Portable Computers 486 Using Global Security Settings 487 Using Global CD-ROM Settings 490 Managing Preferences 491 Solving Problems 496 Where to Find More Information 499 LL0395.Book Page 8 Wednesday, November 20, 2002 11:44 AM

Before You Set Up DHCP Service 502 Setting Up DHCP Service for the First Time 503 Managing DHCP Service 505 Solving Problems 510 Where to Find More Information 510 12 NetBoot 511 Before You Set Up NetBoot 512 Inside NetBoot 516 Setup Overview 522 Setting Up NetBoot 525 Managing NetBoot 535 Load Balancing 537 Supporting Client Computers 538 Solving Problems 541 13 Network Install 543 Before You Set Up Network Install 544 Setup Overview 544 Setting Up Network Install 545 14 DNS Service 553 Before You Set Up DNS Service 554 Setting Up DNS Service for the First Time 555 Managing DNS Service 556 Inside DNS Service (Configuring BIND) 558 Setting Up a Private TCP/IP Network 561 Where to Find More Information 562 15 Firewall Service 563 Before You Set Up Firewall Service 565 Setting Up Firewall Service for the First Time 568 Managing Firewall Service 569 Port Reference 578 Solving Problems 581 LL0395.Book Page 9 Wednesday, November 20, 2002 11:44 AM

16 SLP DA Service 583 Before You Begin 583 Managing Service Location Protocol (SLP) Directory Agent (DA) Service 585 Where to Find More Information 588 17 Tools for Advanced Administrators 589 Terminal 590 Secure Shell (SSH) Command 591 dsimportexport 593 createhomedir 594 Log Rolling Scripts 594 diskspacemonitor 595 diskutil 596 installer 596 softwareupdate 600 systemsetup 600 networksetup 602 MySQL Manager 605 Simple Network Management Protocol (SNMP) Tools 605 diskKeyFinder 606 Enabling IP Failover 606 Using Disk Journaling 611 Setting Up SSL for Mail Service 614 Setting Up Authentication Manager 618 ldapsearch 620 Appendix A Data Requirements of Mac OS X Directory Services 621 User Data That Mac OS X Server Uses 622 Standard Attributes in User Records 623 Format of MailAttribute in User Records 629 Standard Attributes in Group Records 632 Standard Attributes in Computer Records 634 Standard Attributes in Computer List Records 635 LL0395.Book Page 10 Wednesday, November 20, 2002 11:44 AM

Standard Attributes in Config Records 637 Appendix B Integrating Mac OS X Directory Services With Active Directory 639 The Scenarios 639 Glossary 649 Index 659 LL0395.Book Page 11 Wednesday, November 20, 2002 11:44 AM

How to Use This Guide What’s Included in This Guide This guide consists primarily of chapters that tell you how to administer individual Mac OS X Server services: m Chapter 1, “Administering Your Server,” highlights the major characteristics of Mac OS X Server’s services and takes you on a tour of its administration applications. m Chapter 2, “Directory Services,” describes the services that Mac OS X computers use to find information about users, groups, and devices on your network. The Mac OS X directory services architecture is referred to as Open Directory. m Chapter 3, “Users and Groups,” covers user and group accounts, describing how to administer settings for server users and collections of users (groups), including Open Directory Password Server and other password authentication options. m Chapter 4, “Sharing,” tells you how to share folders, hard disks, and CDs among network users, as well as how to make them automatically visible after logging in to Mac OS X computers. m Chapter 5, “File Services,” describes the file services included in Mac OS X Server: Apple file service, Windows services, Network File System (NFS) service, and File Transfer Protocol (FTP) service. m Chapter 6, “Client Management: Mac OS X,” addresses client management for Mac OS X computer users. Client management lets you customize a user’s working environment and restrict a user’s access to network resources. m Chapter 7, “Print Service,” tells you how to share printers among users on Macintosh, Windows, and other computers. m Chapter 8, “Web Service,” describes how to set up and administer a Web server and host multiple Web sites on your server. m Chapter 9, “Mail Service,” describes how to set up and administer a mail server on your server. LL0395.Book Page 13 Wednesday, November 20, 2002 11:44 AM

Mac OS 8 and 9 computer users, describing how to use Macintosh Manager to manage their day-to-day working environments. m Chapter 11, “DHCP Service,” describes Dynamic Host Configuration Protocol (DHCP) service, which lets you dynamically allocate IP addresses to the computers used by server users. m Chapter 12, “NetBoot,” describes the application that lets Macintosh Mac OS 9 and X computers boot from server-based system disk images. m Chapter 13, “Network Install,” tells you how to use the centralized network software installation service that automates installing, restoring, and upgrading Macintosh computers on your network. m Chapter 14, “DNS Service,” describes Dynamic Name Service (DNS), a distributed database that maps IP addresses to domain names. m Chapter 15, “Firewall Service,” addresses how to protect your server by scanning incoming IP packets and rejecting or accepting them based on filters you create. m Chapter 16, “SLP DA Service,” describes Service Location Protocol Directory Assistant (SLP DA), which you can use to make devices on your network available to your users. m Chapter 17, “Tools for Advanced Administrators,” describes server applications, tools, and techniques intended for use by experienced server administrators. m Appendix A, “Data Requirements of Mac OS X Directory Services,” provides information you’ll need when you must map directory services information needed by Mac OS X to information your server will retrieve from another vendor’s server. m Appendix B, “Integrating Mac OS X Directory Services With Active Directory,” provides information about how Mac OS X Server can be set up to take advantage of Microsoft Active Directory information. m The Glossary defines terms you’ll encounter as you read this guide. Using This Guide Review the first chapter to acquaint yourself with the services and applications that Mac OS X Server provides. Then read any chapter that’s about a service you plan to provide to your users. Each service’s chapter includes an overview of how the service works, what it can do for you, strategies for using it, how to set it up for the first time, and how to administer it over time. Also take a look at any chapter that describes a service with which you’re unfamiliar. You may find that some of the services you haven’t used before can help you run your network more efficiently and improve performance for your users. LL0395.Book Page 14 Wednesday, November 20, 2002 11:44 AM

15 Most chapters end with a section called “Where to Find More Information.” This section points you to Web sites and other reference material containing more information about the service. Setting Up Mac OS X Server for the First Time If you haven’t installed and set up Mac OS X Server, do so now. m Refer to Getting Started With Mac OS X Server, the document that came with your software, for instructions on server installation and setup. For many environments, this document provides all the information you need to get your server up, running, and available for initial use. m Review Chapter 1, “Administering Your Server,” in this guide to determine which services you’d like to refine and expand, to identify new services you’d like to set up, and to learn about the server applications you’ll use during these activities. m Read specific chapters to learn how to continue setting up individual services. Pay particular attention to the information in these sections: “Setup Overview,” “Before You Begin,” and “Setting Up for the First Time.” Getting Help for Everyday Management Tasks If you want to change settings, monitor services, view service logs, or do any other day-to-day administration task, you can find step-by-step procedures by using the onscreen help available with server administration programs. While all the administration tasks are also documented in this guide, sometimes it’s more convenient to retrieve information in onscreen help form while using your server. Getting Additional Information In addition to this document, you’ll find information about Mac OS X Server m in Getting Started With Mac OS X Server, which tells you how to install and set up your server initially m in Upgrading to Mac OS X Server, which provides instructions for migrating data to Mac OS X Server from existing Macintosh computers m at www.apple.com/server m in onscreen help on your server m in Read Me files on your server CD LL0395.Book Page 15 Wednesday, November 20, 2002 11:44 AM

1 Administering Your Server Mac OS X Server is a powerful server platform that delivers a complete range of services to users on the Internet and local network: m You can connect users to one another, using services such as mail and file sharing. m You can share system resources, such as printers and computers—maximizing their availability as users move about and making sure that disk space and printer usage remain equitably shared. m You can host Internet services, such as Web sites and streaming video. m You can customize working environments—such as desktop resources and personal files—of networked users. This chapter is a tour of Mac OS X Server capabilities and administration. The chapter begins by pointing out some of Mac OS X Server’s key features. Then it summarizes the services you can set up to support the clients you want your server to host. Finally, it introduces the applications you use to set up and administer your server. Highlighting Key Features Mac OS X Server has a wide range of features that characterize it as easy to use, yet robust and high performing. Ease of Setup and Administration From the time you first unpack your server throughout its initial setup and deployment, its ease of use is apparent. Setup assistants quickly walk you through the process of making basic services initially available. While your network users take advantage of the initial file sharing, mail, Web, and other services, you can add on additional client support and manage day-to-day server operations using graphical administrative applications. From one administrator computer, you can set up and manage all the Mac OS X Servers on your network. LL0395.Book Page 17 Wednesday, November 20, 2002 11:44 AM

Open Directory Password Server to Kerberos or Lightweight Directory Access Protocol (LDAP). Password Server lets you implement password policies and supports a wide variety of client protocols. The Password Server is based on a standard known as SASL (Simple Authentication and Security Layer), so it can support a wide range of network user authentication protocols that are used by clients of Mac OS X Server services, such as mail and file servers, that need to authenticate users. Kerberos authentication is available for file services—Apple Filing Protocol (AFP) and File Transfer Protocol (FTP)—as well as for mail services (POP, IMAP, and SMTP). Networking Security External network communication requests can be controlled with built-in Internet Protocol (IP) firewall management. And data communications can be encrypted and authenticated with protocol-level data security provided with Secure Sockets Layer (SSL), Transport Layer Security (TLS), and Secure Shell (SSH). File and Printer Sharing File sharing offers flexible support for various native protocols as well as security and high availability: m It’s easy to share files with Macintosh, Windows, UNIX, Linux, and anonymous Internet clients. m You can control how much file space individual users consume by setting up mail and file quotas. Quotas limit the number of megabytes a user can use for mail or files. m Kerberos authentication is available for AFP and FTP file servers. m You can improve the security of NFS volumes by setting up share points on them that let users access them using the more secure AFP protocol. This feature is referred to as resharing NFS mounts. m AFP autoreconnect lets client computers keep Apple file servers mounted after long periods of inactivity or after sleep/wake cycles. Mac OS X Server printer sharing includes m the ability to set up print quotas. Print quotas can be set up for each user and each print queue, letting you limit the number of pages that can be printed during a particular period. m support for sharing printers among Mac OS 9 users (AppleTalk and LaserWriter 8 support), Mac OS X, Windows, and UNIX users LL0395.Book Page 18 Wednesday, November 20, 2002 11:44 AM

19 Open Directory Services User and group information is used by your server to authenticate users and authorize their access to services and files. Information about other network resources is used by your server to make printers and other devices available to particular users. To access this information, the server retrieves it from centralized data repositories known as directory domains. The term for the services that locate and retrieve this data is directory services. The Mac OS X directory services architecture is referred to as Open Directory. It lets you store data in a way that best suits your environment. Mac OS X Server can host directory domains using Apple’s NetInfo and LDAP directory domains. Open Directory also lets you take advantage of information you have already set up in non-Apple directory domains—for example, LDAP or Active Directory servers or Berkeley Software Distribution (BSD) configuration files. Comprehensive Management of Macintosh Workgroups Workgroup management services let you simplify and control the environment that Macintosh client users experience. Mac OS X Server client management support helps you personalize the computing environment of Macintosh clients. You can set up Mac OS 8, 9, and X computers to have particular desktop environments and access to particular applications and network resources. You can design your Macintosh users’ experience as circumstances warrant. You can also use NetBoot and Network Install to automate the setup of software used by Macintosh client computers: m NetBoot lets Macintosh Mac OS 9 and X computers start up from a network-based system disk image, offering quick and easy configuration of department, classroom, and individual systems as well as Web and application servers throughout a network. When you update NetBoot images, all NetBooted computers have instant access to the new configuration. m Network Install is a centralized network software installation service. It lets you selectively and automatically install, restore, or upgrade network-based Macintosh systems anywhere in the organization. Mac OS X Server also lets you automatically configure the directory services you want Mac OS X clients to have access to. Automatic directory services configuration means that when a user logs in to a Mac OS X computer, the user’s directory service configuration is automatically downloaded from the network, setting up the user’s network access policies, preferences, and desktop configuration without the need to configure the client computer directly. LL0395.Book Page 19 Wednesday, November 20, 2002 11:44 AM

activity, monitoring and reclaiming disk space, automatically restarting malfunctioning services, and automatically restarting the server following a power failure. You can also configure IP failover. IP failover is a way to set up a standby server that will take over if the primary server fails. The standby server takes over the IP address of the failed server, which takes the IP address back when it is online again. IP failover is useful for DNS servers, Web servers hosting Web sites, media broadcast servers, and other servers that require minimal data replication. Extensive Internet and Web Services Powerful Internet and Web services are built into Mac OS X Server: m Apache, the most popular Web server, provides reliable, high-performance Web content delivery. Integrated into Apache is Web-Based Distributed Authoring and Versioning (WebDAV), which simplifies the Web publishing and content management environment. m If your Web sites contain static HTML files that are frequently requested, you can enable a performance cache to improve server performance. m Web services include a comprehensive assortment of open-source services—Ruby, Tomcat, MySQL, PHP, and Perl. m Mac OS X Server includes a high-performance Java virtual machine. m SSL support enables secure encryption and authentication for ecommerce Web sites and confidential materials. m QuickTime Streaming Server (QTSS) lets you stream both live and stored multimedia content on the Internet using industry-standard protocols. m Mail service lets you set up a mail server your network users can use to send and receive email. m WebMail service bundled with Mac OS X Server enables your users to access mail service via a Web browser. LL0395.Book Page 20 Wednesday, November 20, 2002 11:44 AM

21 Highlighting Individual Services This section highlights individual Mac OS X Server services and tells you where in this guide to find more information about them. Directory Services Directory services let you use a central data repository for user and network information your server needs to authenticate users and give them access to services. Information about users (such as their names, passwords, and preferences) as well as printers and other resources on the network is consolidated rather than distributed to each computer on the network, simplifying the administrator’s tasks of directory domain setup and maintenance. Open Directory On Mac OS X computers, the directory services are collectively referred to as Open Directory. Open Directory acts as an intermediary between directory domains that store information and Mac OS X processes that need the information. Open Directory supports a wide variety of directory domains, letting you store your directory information on Mac OS X Server or on a server you already have set up for this purpose: m You can define and manage information in directory domains that reside on Mac OS X Server. Open Directory supports both NetInfo and LDAPv3 protocols and gives you complete control over directory data creation and management. m Mac OS X Server can also retrieve directory data from LDAP and Active Directory servers and BSD configuration files you’ve already set up. Your server provides full read/write and SSL communications support for LDAPv3 directory domains. Chapter 2, “Directory Services,” provides complete information about all the Open Directory options, including instructions for how to create Mac OS X–resident directory domains and how to configure your server and your clients to access directory domains of all kinds. Chapter 3, “Users and Groups,” describes how to work with user and group accounts stored in Open Directory domains. Search Policies Before a user can log in to or connect with a Mac OS X client or server, he or she must enter a name and password associated with a user account that the computer can find. A Mac OS X computer can find user accounts that reside in a directory domain of the computer’s search policy. A search policy is a list of directory domains the computer searches when it needs configuration information. You can configure the search policy of Mac OS X computers on the computers themselves. You can automate Mac OS X client directory setup by using your server’s built-in DHCP Option 95 support. LL0395.Book Page 21 Wednesday, November 20, 2002 11:44 AM

computer. Password Validation Open Directory gives you several options for validating a user’s password: m You can use a value stored as a readable attribute in the user’s account. The account can be stored in a directory domain residing on Mac OS X Server or on another vendor’s directory server, such as an LDAP or Active Directory server. This option, referred to as the “basic” password validation strategy, is the simplest and fastest approach to password validation and offers the greatest opportunity for sharing user information for authentication with non-Apple servers. Basic password validation may not support clients that require certain network-secure authentication protocols, such as APOP. See “Storing Passwords in User Accounts” on page 198 for details about this strategy. m You can use a value stored in the Open Directory Password Server. This option, which supports a wide range of client authentication protocols, lets you set up user-specific password policies for users. For example, you can require a user to change his password periodically or use only passwords having more than a minimum number of characters. It is the recommended password validation option for Windows users. See “Open Directory Password Server” on page 63 for general Password Server concepts. See “Setting Up an Open Directory Domain and Password Server” on page 71 for setup instructions. See “Using a Password Server” on page 200 for information about how to manage Password Server settings for users. m You can use a Kerberos server. This scheme offers the opportunity to integrate into existing Kerberos environments. See “Using Kerberos” on page 205 for details. m You can use LDAP bind authentication with a non-Apple LDAPv3 directory server. This option, like Kerberos, offers a way to integrate your server into an existing authentication scheme. See “Using LDAP Bind Authentication” on page 208 for how to implement this option. LL0395.Book Page 22 Wednesday, November 20, 2002 11:44 AM

23 File Services Mac OS X Server makes it easy to share files using the native protocols of different kinds of client computers. Mac OS X Server includes four file services: m Apple file service, which uses the Apple Filing Protocol (AFP), lets you share resources with clients who use Macintosh or Macintosh-compatible operating systems. m Windows services use Server Message Block (SMB) protocol to let you share resources with clients who use Windows, and to provide name resolution service for Windows clients. m File Transfer Protocol (FTP) service lets you share files with anyone using FTP. m Network File System (NFS) service lets you share files and folders with users who have NFS client software (UNIX users). You can deploy network home directories for Mac OS X clients using AFP or NFS and for UNIX clients using NFS. With a network home directory, users can access their applications, documents, and individual settings regardless of the computer to which they log in. You can impose disk quotas on network home directories to regulate server disk usage for users with home directories. Sharing You share files among users by designating share points. A share point is a folder, hard disk (or hard disk partition), or CD that you make accessible over the network. It’s the point of access at the top level of a group of shared items. On Mac OS X computers, share points can be found in the /Network directory and by using the Finder’s Connect To Server command. On Mac OS 8 and 9 computers, users access share points using the Chooser. On Windows computers, users use Network Neighborhood. Chapter 4, “Sharing,” tells you how to set up and manage share points. Static file server listings can also be published in a non-Apple directory domain, making it easy for computers in your company that are not on your local network to discover and connect to Mac OS X Server. Apple File Service Apple Filing Protocol (AFP) allows Macintosh client users to connect to your server and access folders and files as if they were located on the user’s own computer. AFP offers m file sharing support for Macintosh clients over TCP/IP m autoreconnect support when a file server connection is interrupted m encrypted file sharing (AFP through SSH) m automatic creation of user home directories m Kerberos v5 authentication for Mac OS X v10.2 and later clients LL0395.Book Page 23 Wednesday, November 20, 2002 11:44 AM

m automatic disconnect of idle clients after a period of inactivity AFP also lets you reshare NFS mounts using AFP. This feature provides a way for clients not on the local network to access NFS volumes via a secure, authenticated AFP connection. It also lets Mac OS 9 clients access NFS file services on traditional UNIX networks. See “Apple File Service” on page 236 for details about AFP. Windows Services Windows services in Mac OS X Server provide four native services to Windows clients: m file service, which allows Windows clients to connect to Mac OS X Server using Server Message Block (SMB) protocol over TCP/IP m print service, which uses SMB to allow Windows clients to print to PostScript printers on the network m Windows Internet Naming Service (WINS), which allows clients across multiple subnets to perform name/address resolution m browsing, which allows clients to browse for available servers across subnets See “Windows Services” on page 248 for more information about Windows services. Network File System (NFS) Service NFS is the protocol used for file services on UNIX computers. The NFS term for sharing is export. You can export a shared item to a set of client computers or to “World.” Exporting an NFS volume to World means that anyone who can access your server can also access that volume. NFS does not support name/password authentication. It relies on client IP addresses to authenticate users and on client enforcement of privileges—not a secure approach in most networks. Therefore use NFS only if you are on a local area network (LAN) with trusted client computers or if you are in an environment that can’t use Apple file sharing or Windows file sharing. If you have Internet access and plan to export to World, your server should be behind a firewall. See “Network File System (NFS) Service” on page 268 for more information about NFS. File Transfer Protocol (FTP) FTP allows computers to transfer files over the Internet. Clients using any operating system that supports FTP can connect to your FTP file server and download files, depending on the permissions you set. Most Internet browsers and a number of freeware applications can be used to access your FTP server. LL0395.Book Page 24 Wednesday, November 20, 2002 11:44 AM

25 FTP service in Mac OS X Server supports Kerberos v5 authentication and, for most FTP clients, resuming of interrupted FTP file transfers. Mac OS X Server also supports dynamic file conversion, allowing users to request compressed or decompressed versions of information on the server. FTP is considered to be an insecure protocol, since user names and passwords are distributed across the Internet in clear text. Because of the security issues associated with FTP authentication, most FTP servers are used as Internet file distribution servers for anonymous FTP users. Mac OS X Server supports anonymous FTP and by default prevents anonymous FTP users from deleting files, renaming files, overwriting files, and changing file permissions. Explicit action must be taken by the server administrator to allow uploads from anonymous FTP users, and then only into a specific share point. See “File Transfer Protocol (FTP) Service” on page 256 for details about FTP. Print Service Print service in Mac OS X Server lets you share network and direct-connect printers among clients on your network. Print service also includes support for managing print queues, monitoring print jobs, logging, and using print quotas. Print service lets you m share printers with Mac OS 9 (PAP, LaserWriter 8), Mac OS X (IPP, LPR/LPD), Windows (SMB/CIFS), and UNIX (LPR/LPD) clients m share direct-connect USB printers with Mac OS X version 10.2 and later clients m connect to network printers using AppleTalk, LPR, and IPP and connect to direct-connect printers using USB m make printers visible using Open Directory directory domains m impose print quotas to limit printer usage See Chapter 7, “Print Service,” for information about print service. Web Service Web service in Mac OS X Server is based on Apache, an open-source HTTP Web server. A Web server responds to requests for HTML Web pages stored on your site. Open-source software allows anyone to view and modify the source code to make changes and improvements. Those features have led to Apache’s widespread use, making it the most popular Web server on the Internet today. Web service includes a high-performance, front-end cache that improves performance for Web sites that use static HTML pages. With this cache, static data doesn’t need to be accessed by the server each time it is requested. LL0395.Book Page 25 Wednesday, November 20, 2002 11:44 AM

(WebDAV). With WebDAV capability, your client users can check out Web pages, make changes, and then check the pages back in while the site is running. In addition, Mac OS X users can use a WebDAV-enabled Web server as if it were a file server. Web service’s Secure Sockets Layer (SSL) support enables secure encryption and authentication for ecommerce Web sites and confidential materials. An easy-to-use digital certificate provides non-forgeable proof of your Web site identity. Mac OS X Server offers extensive support for dynamic Web sites: m Web service supports Java Servlets, JavaServer Pages, MySQL, PHP, Perl, and UNIX and Mac CGI scripts. m Mac OS X Server also includes WebObjects deployment software. WebObjects offers a flexible and scalable way to develop and deploy ecommerce and other Internet applications. WebObjects applications can connect to multiple databases and dynamically generate HTML content. You can also purchase the WebObjects development tools if you want to create WebObjects applications. For more information and documentation on WebObjects, go to the WebObjects Web page: www.apple.com/webobjects See Chapter 8, “Web Service,” for details about Web service. Mail Service Mail services support the SMTP, POP, and IMAP protocols, allowing you to select a local or server-based mail storage solution for your users. With remote mail administration you can manage the message database from any IMAP client. Realtime Blackhole List support allows you to block messages from known spam sources. Support for single or dual IMAP/POP3 mail inboxes gives flexibility in mail retrieval; a user can have a POP mailbox for office use and an IMAP mailbox for mobile use. Automatic blind copying (BCC) on incoming mail from specified hosts lets you track email coming from specific sites. You can limit the amount of disk space a user consumes for mail messages. To protect email communication from eavesdroppers, mail service features SSL encryption of IMAP connections between the mail server and clients, SMTP AUTH authentication using LOGIN and PLAIN, and APOP and Kerberos v5 authentication for POP, IMAP, and SMTP clients. For complete information about mail services, see Chapter 9, “Mail Service.” Macintosh Workgroup Management Mac OS X Server provides work environment personalization for Mac OS 8, 9, and X computer users, ranging from preference management to operating system and application installation automation. LL0395.Book Page 26 Wednesday, November 20, 2002 11:44 AM

27 Client Management You can use Mac OS X Server to manage the work environments of Mac OS 8, 9, and X clients. Preferences you define for individual users, groups of users, and computers provide your Macintosh users with a consistent desktop, application, and network appearance regardless of the Macintosh computer to which they log in. To manage Mac OS 8 and 9 clients, you use Macintosh Manager, described in Chapter 10, “Client Management: Mac OS 9 and OS 8.” To manage Mac OS X clients, you use Workgroup Manager, as Chapter 6, “Client Management: Mac OS X,” describes. Mac OS X client management has several advantages: m You can take advantage of the directory services autoconfiguration capability to automatically set up the directory services used by Mac OS X client computers. m When you update user, group, and computer accounts, managed Mac OS X users inherit changes automatically. You update Mac OS 8 and 9 accounts independently, using Macintosh Manager. m You have more direct control over individual system preferences. m Network home directories and group directories can be mounted automatically at login. NetBoot NetBoot lets Macintosh clients boot from a system disk image located on Mac OS X Server instead of from the client computer’s disk drive. You can set up multiple NetBoot disk images, so you can boot clients into Mac OS 9 or X or even set up customized Macintosh environments for different groups of clients. NetBoot can simplify the administration and reduce the support normally associated with large-scale deployments of network-based Macintosh systems. NetBoot is ideal for an organization with a number of client computers that need to be identically configured. For example, NetBoot can be a powerful solution for a data center that needs multiple identically configured Web and application servers. NetBoot allows administrators to configure and update client computers instantly by simply updating a boot image stored on the server. Each image contains the operating system and application folders for all clients on the server. Any changes made on the server are automatically reflected on the clients when they reboot. Systems that are compromised or otherwise altered can be instantly restored simply by rebooting. See Chapter 12, “NetBoot,” for information about setting up and managing NetBoot. Network Install Network Install is a centrally managed installation service that allows administrators to selectively install, restore, or upgrade client computers. Installation images can contain the latest release of Mac OS X, a software update, site-licensed or custom applications, even configuration scripts: LL0395.Book Page 27 Wednesday, November 20, 2002 11:44 AM

software updates and custom software packages, restoring computer classrooms and labs, and reimaging desktop and portable computers. m You can define custom installation images for various departments in an organization, such as marketing, engineering, and sales. With Network Install you don’t need to insert multiple CDs to configure a system. All the installation files and packages reside on the server and are installed on the client computer at one time. Network Install also includes pre- and post-installation scripts you can use to invoke actions prior to or after the installation of a software package or system image. See Chapter 13, “Network Install,” for more information about Network Install. Network Services Mac OS X Server includes these network services for helping you manage Internet communications on your TCP/IP network: m Dynamic Host Configuration Protocol (DHCP) m Domain Name System (DNS) m IP firewall m Service Location Protocol Directory Agent (SLP DA) DHCP DHCP helps you administer and distribute IP addresses dynamically to client computers from your server. From a block of IP addresses that you define, your server locates an unused address and “leases” it to client computers as needed. DHCP is especially useful when an organization has more clients than IP addresses. IP addresses are assigned on an as-needed basis, and when they are not needed they are available for use by other clients. As you learned in “Search Policies” on page 21, you can automate the directory services setup of Mac OS X clients using your DHCP server’s Option 95 support. This option lets client computers learn about their directory settings from an LDAP server. Chapter 11, “DHCP Service,” provides information about your server’s DHCP capabilities. DNS DNS service lets users connect to a network resource, such as a Web or file server, by specifying a host name (such as server.apple.com) rather than an IP address (192.168.11.12). DNS is a distributed database that maps IP addresses to domain names. A server that provides DNS service keeps a list of names and the IP addresses associated with the names. When a computer needs to find the IP address for a name, it sends a message to the DNS server (also known as a name server). The name server looks up the IP address and sends it back to the computer. If the name server doesn’t have the IP address locally, it sends messages to other name servers on the Internet until the IP address is found. LL0395.Book Page 28 Wednesday, November 20, 2002 11:44 AM

29 You will use DNS if you use SMTP mail service or if you want to create subdomains within your primary domain. You will also use DNS if you are hosting multiple Web sites. If you don’t have an Internet service provider (ISP) who handles DNS for your network, you can set up a DNS server on your Mac OS X Server. You’ll find more information about DNS in Chapter 14, “DNS Service.” IP Firewall IP firewall service protects your server and the content you store on it from intruders. It provides a software firewall, scanning incoming IP packets and accepting or rejecting them based on filters you define. You can set up server-wide restrictions for packets from specific IP addresses. You can also restrict access to individual services—such as Web, mail, and FTP—by defining filters for the ports used by the services. See Chapter 15, “Firewall Service,” for more information about this service. SLP DA Service Location Protocol (SLP) provides structure to the services available on a network and gives users easy access to them. Anything that can be addressed using a URL can be a network service—for example, file servers and WebDAV servers. When a service is added to your network, the service uses SLP to register itself on the network; you don’t need to configure it manually. When a client computer needs to locate a network service, it uses SLP to look for services of that type. All registered services that match the client computer’s request are displayed for the user, who then can choose which one to use. SLP Directory Agent (DA) is an improvement on basic SLP, providing a centralized repository for registered network services. You can set up a DA to keep track of services for one or more scopes (groups of services). When a client computer looks for network services, the DA for the scope in which the client computer is connected responds with a list of available network services. Because a client computer only needs to look locally for services, network traffic is kept to a minimum and users can connect to network services more quickly. See Chapter 16, “SLP DA Service,” for information about this service. QuickTime Streaming Service QuickTime Streaming Server (QTSS) lets you stream multimedia in real time using the industry-standard RTSP/RTP protocols. QTSS supports MPEG-4, MP3, and QuickTime file formats. LL0395.Book Page 29 Wednesday, November 20, 2002 11:44 AM

Windows users, or relay streamed media to other streaming servers. You can provide unicast streaming, which sends one stream to each individual client, or multicast streaming, which sends the stream to a group of clients. For more information about QTSS, refer to the QuickTime Web site: www.apple.com/quicktime/products/qtss/ You can use QuickTime Broadcaster in conjunction with QTSS when you want to produce a live event. QuickTime Broadcaster allows you to stream live audio and video over the Internet. QuickTime Broadcaster meets the needs of both beginners and professionals by providing preset broadcast settings and the ability to create custom settings. Built on top of the QuickTime architecture, QuickTime Broadcaster enables you to produce a live event using most codecs that QuickTime supports. When teamed with QuickTime Streaming Server or Darwin Streaming Server, QuickTime Broadcaster can produce a live event for delivery to an audience of any size, from an individual to a large global audience. For information about QuickTime Broadcaster, go to this Web site and navigate to the QuickTime Broadcaster page: www.apple.com/quicktime/ Highlighting Server Applications This section introduces you to the applications, tools, and techniques you use to set up and administer your Mac OS X Server. The following table summarizes them and tells you where to find more information about them. Application, tool, or technique Use to For more information, see Server Assistant Initialize services page 33 Open Directory Assistant Create or set up access to existing NetInfo and LDAPv3 directory domains and create and configure Password Servers page 33 Directory Access Configure access to data in existing directory domains and define a search policy page 34 Workgroup Manager Administer accounts, manage share points, and administer client management for Mac OS X users page 34 LL0395.Book Page 30 Wednesday, November 20, 2002 11:44 AM

31 Server Settings Configure file, print, mail, Web, NetBoot, and network services page 35 Server Status Monitor services page 36 Macintosh Manager Administer client management for Mac OS 8 and 9 users page 37 NetBoot administration tools Manage NetBoot disk images page 37 PackageMaker Create Network Install installation packages page 37 Server Monitor Review information about Xserve hardware page 37 Streaming Server Admin Set up and manage QuickTime Streaming Server (QTSS) page 38 Terminal Run command-line tools page 590 Secure Shell (SSH) Use Terminal to run command-line tools for remote servers securely page 591 dsimportexport Import and export user and group accounts using XML or text files page 593 createhomedir Create AFP or NFS home directories page 594 log rolling scripts Periodically roll, compress, and delete server log files page 594 diskspacemonitor Monitor percentage-full disk thresholds and execute scripts that generate email alerts and reclaim disk space when thresholds are reached page 595 diskutil Manage Mac OS X Server disks and volumes remotely page 596 installer Install software packages remotely page 596 softwareupdate Find new versions of software and install them remotely on a server page 600 systemsetup Configure system preferences on a remote server page 600 Application, tool, or technique Use to For more information, see LL0395.Book Page 31 Wednesday, November 20, 2002 11:44 AM

network hardware port on a remote server page 602 MySQL Manager Manage the version of MySQL that is installed with Mac OS X Server page 605 Simple Network Management Protocol (SNMP) administration tools Monitor your server using the SNMP interface page 605 diskKeyFinder Verify the physical location of a remote headless server volume that you want to manage page 606 Enabling IP failover Set up a standby server that takes over if the primary server fails page 606 Using disk journaling Help protect the integrity of HFS+ disks on Mac OS X computers page 611 Setting up SSL for mail service Configure mail service to provide Secure Sockets Layer (SSL) connections automatically page 614 Authentication Manager Continue to use Authentication Manager after migrating from Mac OS X Server version 10.1 page 618 ldapsearch Search for entries in an LDAP directory domain page 620 Application, tool, or technique Use to For more information, see LL0395.Book Page 32 Wednesday, November 20, 2002 11:44 AM

33 Administering a Server From Different Computers You can use the server applications to manage the local server or to manage a remote server, including headless servers. You can also manage Mac OS X Servers remotely from an administrator computer. An administrator computer is a Mac OS X computer onto which you have installed the server applications from the disc named Mac OS X Server Administration Tools. The following sections give you more information about some of the applications in the table above, including instructions for using them to manage a remote server. The remaining applications and tools are for use by experienced server administrators; see Chapter 17, “Tools for Advanced Administrators,” for information about them. Server Assistant Server Assistant is the application you use to perform initial service setup of a Mac OS X Server. You can use Server Assistant the first time you set up a local or remote Mac OS X Server. See Getting Started With Mac OS X Server for instructions. Open Directory Assistant Use Open Directory Assistant to create shared server–resident NetInfo or LDAPv3 directory domains, set up Password Servers, and configure access to shared domains and Password Servers. You can run Open Directory Assistant immediately after running Server Assistant, or you can run it later, as many times as you like. Administrator computer Mac OS X Servers LL0395.Book Page 33 Wednesday, November 20, 2002 11:44 AM

use the application, see Chapter 2, “Directory Services.” Directory Access Directory Access is the primary application for setting up a Mac OS X computer’s connections with directory domains as well as defining the computer’s search path. Unlike Open Directory Assistant, Directory Access does not create directory domains. It m configures connections with existing domains m enables or disables service discovery protocols (AppleTalk, Rendezvous, SLP, and SMB) m enables or disables directory protocols (LDAPv2, LDAPv3, NetInfo, and BSD configuration files) In addition, Directory Access is available on both Mac OS X Servers and Mac OS X client computers, whereas Open Directory Assistant is available only on servers. You’ll find Directory Access in /Applications/Utilities/. For information about how to use it, see Chapter 2, “Directory Services.” Workgroup Manager You use Workgroup Manager to administer user, group, and computer accounts; manage share points; and administer client management for Mac OS X users. For information about using Workgroup Manager to administer user and group accounts, see Chapter 3, “Users and Groups.” For information about using it to administer computer accounts and client management settings, see Chapter 6, “Client Management: Mac OS X,” and Chapter 10, “Client Management: Mac OS 9 and OS 8.” Chapter 4, “Sharing,” describes how to use Workgroup Manager to manage share points. Opening and Authenticating in Workgroup Manager Workgroup Manager is installed in /Applications/Utilities/ when you install your server or set up an administrator computer. To open Workgroup Manager, click the Workgroup Manager icon in the Dock of Mac OS X Server or in the toolbar of Server Status: m To open Workgroup Manager on the server you are using without authenticating, choose View Directories from the Server menu. You will have read-only access to information displayed in Workgroup Manager. To make changes, click the lock icon to authenticate as an administrator. This approach is most useful when you are administering different servers and working with different directory domains. m To authenticate as an administrator for a particular server, enter the server’s IP address or DNS name in the login window, or click Browse to choose from a list of servers. Specify the user name and password for an administrator of the server, then click Connect. Use this approach when you will be working most of the time with a particular server. LL0395.Book Page 34 Wednesday, November 20, 2002 11:44 AM

35 Major Workgroup Manager Tasks After login, the user account window appears, with lists of user, group, and computer accounts in the server’s local directory domain. Here is how to get started with the major tasks you’ll be performing with this application: m To administer user, group, or computer accounts, click the Accounts icon in the toolbar. See Chapter 3, “Users and Groups,” for information about user and group accounts and Chapter 6, “Client Management: Mac OS X,” for information about computer accounts. m To work with preferences for managed users, groups, or computers, click the Preferences icon in the toolbar. See Chapter 6, “Client Management: Mac OS X,” for instructions. m To work with share points, click the Sharing icon in the toolbar. See Chapter 4, “Sharing,” for instructions. m To work with accounts in different directory domains at the same time, open multiple Workgroup Manager windows by choosing New Workgroup Manager Window from the Server menu. m To open Server Status so you can monitor the status of a particular server, click the Status icon in the toolbar. See “Server Status” on page 36 for information about the Server Status application. m To open Server Settings so you can work with a server’s file, print, mail, Web, NetBoot, and network settings, choose Configure Services from the Server menu. See “Server Settings” on page 35 for information about the Server Settings application. m To control the way Workgroup Manager lists users and groups, whether it should use SSL transactions, and other behaviors, choose Preferences from the Workgroup Manager menu. m To customize the toolbar, choose Customize Toolbar from the View menu. m To refresh the information displayed, click the Refresh button. m To retrieve online information, use the Help menu. It provides help for server administrators about Workgroup Manager as well as other Mac OS X Server topics. Server Settings You use Server Settings to administer file, print, mail, Web, NetBoot, and network services on a server. Server Settings is installed in /Applications/Utilities/ when you install your server or set up an administrator computer. To open Server Settings, click the Server Settings icon in the Dock of Mac OS X Server or choose Configure Services from the Server menu in Workgroup Manager. To select a server to work with, enter its IP address or DNS name in the login window, or click Browse to choose from a list of servers. Specify the user name and password for an administrator, then click Connect. LL0395.Book Page 35 Wednesday, November 20, 2002 11:44 AM

you work with individual services: m For administering file and print services, select the File & Print tab to access modules. m For administering mail and Web service, select the Internet tab to access modules. m For administering IP Firewall, DHCP, NetBoot, DNS, and SLP DA services, select the Network tab to access modules. m To retrieve online information, use the Help menu. It provides help for server administrators about Server Settings as well as other Mac OS X Server topics. Server Settings is not compatible with versions of Mac OS X Server earlier than version 10.2. Server Status You use Server Status to monitor the services running on Mac OS X Servers. Server Status is installed in /Applications/Utilities/ when you install your server or set up an administrative computer. To open Server Status, click the Server Status icon in the Dock of Mac OS X Server or the Status icon in Workgroup Manager. To select a server to monitor, click the Connect button in the Server Status toolbar. Enter the IP address or DNS name of the server you want to monitor in the login window, or click Browse to choose from a list of servers. Specify the user name and password for an administrator, then click Connect. Select items in the Devices & Services list to monitor specific servers and services running on the servers: m To review general status information for a particular server, select the server name. m To review status information for a particular service running on a server, click the disclosure triangle next to the server name to see a list of its services. Then select the service of interest. m To add a server to the Devices & Services list, click Connect in the toolbar and log in to the server. The next time you open Server Status, any server you have added is displayed in the Devices & Services list and can be monitored again by selecting a server in the list. If a server in the list appears grey, double-click the server or click the Reconnect button in the toolbar to log in again. Check the Add to Keychain option while you log in to enable autoreconnect the next time you open Server Status. m To remove a server from the Devices & Services list, select the server, click the Disconnect button in the toolbar, and choose Remove From List from the Server menu. m To control the way Server Status lists servers and services, how often status data is refreshed, and other behaviors, choose Preferences from the Server Status menu. You can also click the Refresh button to refresh status information for all the services for each server listed in the Devices & Services list. LL0395.Book Page 36 Wednesday, November 20, 2002 11:44 AM

37 m To customize the Server Status toolbar, choose Customize Toolbar from the View menu. m To retrieve online information, use the Help menu. It provides help for server administrators about Server Status as well as other Mac OS X Server topics. Macintosh Manager You use Macintosh Manager to administer client management for Mac OS 8 and 9 client computers. You can use it locally (at the server) or remotely (from a Mac OS 9 or X computer on the same network as your Mac OS X Server). Open Macintosh Manager by clicking its icon in the Dock. Log in using a server, Macintosh Manager, or workgroup administrator user name and password. As a server administrator, you automatically have global administrator privileges for Macintosh Manager. See Chapter 10, “Client Management: Mac OS 9 and OS 8,” for more information. NetBoot Administration Tools There are several applications you use to administer NetBoot: m NetBoot Desktop Admin lets you modify Mac OS 9 images. m Network Image Utility lets you create and modify Mac OS X images. m The DHCP/NetBoot module of Server Settings lets you save NetBoot images. See Chapter 12, “NetBoot,” for information about these tools. Network Install Administration Application You use PackageMaker to create Network Install packages. See Chapter 13, “Network Install,” for information about this application. Server Monitor You use Server Monitor to monitor Xserve hardware and trigger email notifications when circumstances warrant attention. Server Monitor shows you information about the installed operating system, drives, power supply, enclosure and processor temperature, cooling blowers, security, and network. Server Monitor is installed in /Applications/Utilities/ when you install your server or set up an administrator computer. To open Server Monitor, click the Server Monitor icon in the Dock or double-click /Applications/Utilities/Server Monitor. Use the application to monitor local or remote Xserve servers: m To specify the Xserve server to monitor, click Add Server, identify the server of interest, and enter user name and password information for an administrator of the server. m Use the “Update every” pop-up menu to specify how often you want to refresh data. LL0395.Book Page 37 Wednesday, November 20, 2002 11:44 AM

you want to monitor. The Merge Items button lets you consolidate lists into one. m The system identifier lights on the front and back of an Xserve server light when service is required. Use Server Monitor to understand why the lights are on. You can also turn the lights on to identify a particular Xserve server in a rack of servers by selecting the server and clicking “system identifier light on” on the Info tab. m You can set Server Monitor to notify you by email when an Xserve server’s status changes. For each server, you set up the conditions that you want notification about. The email message can come from Server Monitor or from the server. m Server Monitor keeps logs of Server Monitor activity for each Xserve server. (The logs do not include system activity on the server.) The log shows, for example, the times Server Monitor attempted to contact the server, and whether a connection was successful. The log also shows server status changes. You can also use Server Monitor to get an Apple System Profiler report on a remote server. Streaming Server Admin To set up and manage QTSS, you use the Web-based Streaming Server Admin program. Streaming Server Admin lets you easily create and serve playlists, customize general settings, monitor connected users, view log files, manage user and bandwidth usage, and relay a stream from one server to another for scalability. To use Streaming Server Admin: 1 From Mac OS X Server, click the Streaming Server Admin icon in the Dock, then go to step 3. Alternatively, from a server with QTSS installed, open a Web browser. You can also use a Web browser from a remote Mac OS X computer. 2 Enter the URL for your Streaming Server Admin. For example, http://myserver.com:1220. Replace “myserver.com” with the name of your Streaming Server computer. The port number is 1220. 3 The first time you run Streaming Server Admin, the Setup Assistant prompts you for your QTSS user name and password. To display onscreen help information about using Streaming Server Admin, setting up secure administration (SSL), and setting up your server to stream hinted media, click the question mark button in the application. Information about QTSS is also available at the QuickTime Web site: www.apple.com/quicktime/products/qtss/ LL0395.Book Page 38 Wednesday, November 20, 2002 11:44 AM

39 Where to Find More Information Regardless of your server administration experience, you may want to take advantage of the wide range of Apple customer training courses. To learn more, go to train.apple.com If You’re New to Server and Network Management If you want to learn more about Mac OS X Server, see the Mac OS X Server Web site: www.apple.com/macosx/server/ Online discussion groups can put you in touch with your peers. Many of the problems you encounter may already have been solved by other server administrators. To find the lists available through Apple, see the following site: www.lists.apple.com The AppleCare support site’s discussion boards are an additional source of information: www.info.apple.com/ Consider obtaining some of these reference materials. They contain background information, explanations of basic concepts, and ideas for getting the most out of your network. m Teach Yourself Networking Visually, by Paul Whitehead and Ruth Maran (IDG Books Worldwide, 1998). m Internet and Intranet Engineering, by Daniel Minoli (McGraw-Hill, 1997). In addition, NetworkMagazine.com offers a number of online tutorials on its Web site: www.networkmagazine.com If You’re an Experienced Server Administrator If you’re already familiar with network administration and you’ve used Mac OS X Server, Linux, UNIX, or a similar operating system, you may find these additional references useful. m A variety of books from O’Reilly & Associates cover topics applicable to Mac OS X Server, such as Internet Core Protocols: The Definitive Reference, DNS and BIND, and TCP/IP Network Administration. For more advanced information, see Apache: The Definitive Guide, Writing Apache Modules with Perl and C, Web Performance Tuning, and Web Security & Commerce, also published by O’Reilly and Associates. See the O’Reilly & Associates Web site: www.ora.com m See the Apache Web site for detailed information about Apache: www.apache.org/ LL0395.Book Page 39 Wednesday, November 20, 2002 11:44 AM

2 Directory Services Directory services provide a central repository for information about the systems, applications, and users in an organization. In education and enterprise environments, directory services are the ideal way to manage users and computing resources. Organizations with as few as 10 people can benefit by deploying directory services. Directory services can be doubly beneficial. They centralize system and network administration, and they simplify a user’s experience on the network. With directory services, information about all the users—such as their names, passwords, and preferences—as well as printers and other resources on a network can be maintained in a single location rather than on each computer on the network. Using directory services can reduce the system administrator’s user management burden. In addition, users can log in to any authorized computer on the network. Anywhere a user logs in, the user’s personal Desktop appears, customized for the user’s individual preferences. The user always has access to personal files and can easily locate and use authorized network resources. Apple has built an open, extensible directory services architecture, called Open Directory, into Mac OS X and Mac OS X Server. A Mac OS X Server or Mac OS X client computer can use Open Directory to retrieve authoritative information about users and network resources from a variety of sources: m directory domains on the computer itself and on other Mac OS X Servers m directory domains on other servers, including LDAP directory domains and Active Directory domains on non-Apple servers m BSD configuration files located on the computer itself m network services, such as file servers, that make themselves known with the Rendezvous, AppleTalk, SLP, or SMB service discovery protocols Mac OS 9 and Mac OS 8 managed clients also use Open Directory to retrieve some user information. For more information, see “How Macintosh Manager Works With Directory Services” on page 444 in Chapter 10, “Client Management: Mac OS 9 and OS 8.” LL0395.Book Page 41 Wednesday, November 20, 2002 11:44 AM

Server can securely store and validate the passwords of users who want to log in to client computers on your network or use other network resources that require authentication. A Password Server can also enforce such policies as password expiration and minimum length. Significantly, a Password Server is the best means of authenticating Windows computer users for file service, print service, and other Windows services in Mac OS X Server. Even if you don’t plan to offer Windows services or enforce password policies now, you should set up a Password Server now. Having a Password Server already set up will simplify deploying Windows services or enforcing password policies in the future. If you have more than one Mac OS X Server, in most cases you need only set up a Password Server on one of them—usually on the first one you set up. (Although you can set up a Password Server later, doing so means resetting the passwords of all user accounts that have been created. Resetting passwords can involve much time-consuming interaction with users.) To understand the information in this chapter, you should be comfortable with Mac OS X. You do not need advanced network administrator or UNIX experience to use directory services provided by Mac OS X Servers. If you want to integrate LDAP directories from other servers, you need to be familiar with LDAP. If you want to integrate Active Directory servers, you need to be familiar with Active Directory and LDAP. You need to be comfortable with UNIX if you want to integrate BSD configuration files. Storage for Data Needed by Mac OS X Directory services act as an intermediary between directory domains, which store information about users and resources, and the application and system software processes that want to use the information. A directory domain stores information in a specialized database that is optimized to handle a great many requests for information and to find and retrieve information quickly. Information may be stored in one directory domain or in several related directory domains. Printers Groups Servers Users Processes Mounts Directory domains Directory services LL0395.Book Page 42 Wednesday, November 20, 2002 11:44 AM

a directory domain. For example, when you set up a user account, the application that you use to do this has directory services store information about the user in a directory domain. m On a computer with Mac OS X version 10.2, you use the My Account pane or the Accounts pane of System Preferences to set up user accounts that are valid only on the one computer. m On a computer with Mac OS X Server version 10.2, you use the Accounts module of Workgroup Manager to set up user accounts that are valid on all Mac OS X computers on your network. You can specify additional user attributes in a network user account, such as the location of the user’s home directory. Whether you use Workgroup Manager or System Preferences to create a user account, the user information is stored in a directory domain. When someone attempts to log in to a Mac OS X computer, the login process uses Mac OS X directory services—Open Directory—to validate the user name and password. A Historical Perspective Like Mac OS X, Open Directory has a UNIX heritage. Open Directory provides access to administrative data that UNIX systems have generally kept in configuration files, which require much painstaking work to maintain. (Some UNIX systems still rely on configuration files.) Open Directory consolidates the data and distributes it for ease of access and maintenance. Directory domain Directory services Accounts Accounts LL0395.Book Page 43 Wednesday, November 20, 2002 11:44 AM

in the /etc directory. This scheme requires each UNIX computer to have its own set of files, and processes that are running on a UNIX computer read its files when they need administrative information. If you’re experienced with UNIX, you probably know about the files in the /etc directory—group, hosts, hosts.eq, passwd, and so forth. For example, a UNIX process that needs a user’s password consults the /etc/passwd file. The /etc/passwd file contains a record for each user account. A UNIX process that needs group information consults the /etc/group file. Open Directory consolidates administrative information, simplifying the interactions between processes and the administrative data they create and use. UNIX processes /etc/ passwd /etc/ hosts /etc/ group Mac OS X processes Directory services LL0395.Book Page 44 Wednesday, November 20, 2002 11:44 AM

Directory gets the data for them. If a process needs the location of a user’s home directory, the process simply has Open Directory retrieve the information. Open Directory finds the requested information and then returns it, insulating the process from the details of how the information is stored. If you set up Open Directory to access administrative data in several directory domains, Open Directory automatically consults them as needed. Some of the data stored in a directory domain is identical to data stored in UNIX configuration files. For example, the authentication attributes, home directory location, real name, user ID, and group ID—all stored in the user records of a directory domain—have corresponding entries in the standard /etc/passwd file. However, a directory domain stores much additional data to support functions that are unique to Mac OS X, such as support for managed clients and Apple Filing Protocol (AFP) directories. Data Distribution Another characteristic of UNIX configuration files is that the administrative data they contain is available only to the computer on which they are stored. Each computer has its own UNIX configuration files. With UNIX configuration files, each computer that someone wants to use must have that person’s user account settings stored on it, and each computer must store the account settings for every person who may want to use the computer. To set up a computer’s network settings, the administrator needs to go to the computer and directly enter the IP address and other information that identifies the computer on the network. Similarly, when user or network information needs to be changed in UNIX configuration files, the administrator must make the changes on the computer where the files reside. Some changes, such as network settings, require the administrator to make the same changes on multiple computers. This approach becomes unwieldy as networks grow in size and complexity. Directory domain Mac OS X processes Directory domain Directory services LL0395.Book Page 45 Wednesday, November 20, 2002 11:44 AM

domain that can be managed by a system administrator from one location. Open Directory lets you distribute the information so that it is visible on a network to the computers that need it and the administrator who manages it: Uses of Directory Data Open Directory makes it possible to consolidate and maintain network information easily in a directory domain, but this information has value only if application and system software processes running on network computers actually access the information. The real power of Open Directory is not that it provides directory services, but the fact that Mac OS X software accesses data through Open Directory. Here are some of the ways in which Mac OS X system and application software use directory data: m Authentication. As mentioned already, the Accounts module of Workgroup Manager or the Accounts pane of System Preferences creates user records in a directory domain, and these records are used to authenticate users who log in to Mac OS X computers. When a user specifies a name and a password in the Mac OS X login window, the login process asks Open Directory for the user record that corresponds to the name that the user specified. Open Directory finds the user record in a directory domain and retrieves the record. Directory services System administrator Users Directory domain LL0395.Book Page 46 Wednesday, November 20, 2002 11:44 AM

Mac OS X uses another data item from the user record—the user ID (UID)—to determine the user’s access privileges for a file or folder that the user wants to access. When a user accesses a folder or file, the file system compares this user’s UID to the UID assigned to the folder or file. If the UIDs are the same, the file system grants owner privileges (usually read and write privileges) to the user. If the UIDs are different, the user doesn’t get owner privileges. m Home directories. Each user record in a directory domain stores the location of the user’s home directory, which is also known as the user’s home folder. This is where the user keeps personal files, folders, and preferences. A user’s home directory can be located on a particular computer that the user always uses or on a network file server. m Automount share points. Share points can be configured to automount (appear automatically) in the /Network folder (the Network globe) in the Finder windows of client computers. Information about these automount share points is stored in a directory domain. Share points are folders, disks, or disk partitions that you have made accessible over the network. m Mail account settings. Each user’s record in a directory domain specifies whether the user has mail service, which mail protocols to use, how to present incoming mail, whether to alert the user when mail arrives, and more. m Resource usage. Disk, print, and mail quotas can be stored in each user record of a directory domain. m Managed client information. A user’s personal preference settings, as well as preset preferences that affect the user, are stored in a directory domain. m Group management. In addition to user records, a directory domain also stores group records. Each group record affects all users who are in the group. Information in group records specifies preferences settings for group members. Group records also determine access to files, folders, and computers. Inside a Directory Domain Information in a directory domain is organized into record types, which are specific categories of records, such as users, computers, and mounts. For each record type, a directory domain may contain any number of records. Each record is a collection of attributes, and each attribute has one or more values. If you think of each record type as a spreadsheet that contains a category of information, then records are like the rows of the spreadsheet, attributes are like spreadsheet columns, and each spreadsheet cell contains one or more values. LL0395.Book Page 47 Wednesday, November 20, 2002 11:44 AM

you are creating a user record (a record of the user’s record type). The settings that you configure for the user—short name, full name, home directory location, and so on—become values of attributes in the user record. The user record and the values of its attributes reside in a directory domain. Discovery of Network Services Open Directory can provide more than administrative data from directories. Open Directory can also provide information about services that are available on the network. For example, Open Directory can provide information about file servers that are currently available. Information about file servers and other services tends to change much more frequently than information about users. Therefore, information about network services typically isn’t stored in directory domains. Instead, information about file servers and other network servers is discovered as the need arises. Open Directory can discover network services that make their existence and whereabouts known. Services make themselves known by means of standard protocols. Open Directory supports the following service discovery protocols: m Rendezvous, the Apple protocol that uses multicast DNS m AppleTalk, the legacy Mac OS protocol for file services m Service Location Protocol (SLP), an open standard for discovering file and print services m Server Message Block (SMB), the protocol used by Microsoft Windows Directory services File server File server LL0395.Book Page 48 Wednesday, November 20, 2002 11:44 AM

discovery protocols and from directory domains. To accomplish this, Open Directory simply asks all its sources of information for the type of information requested by a Mac OS X process. The sources that have the requested type of information provide it to Open Directory, which collects all the provided information and hands it over to the Mac OS X process that requested it. For example, if Open Directory requests information about file servers, the file servers on the network respond via service discovery protocols with their information. A directory domain that contains relatively static information about some file servers also responds to the request. Open Directory collects the information from the service discovery protocols and the directory domains. When Open Directory requests information about a user, service discovery protocols don’t respond because they don’t have user information. (Theoretically, AppleTalk, Rendezvous, SMB, and SLP could provide user information, but in practice they don’t have any user information to provide.) The user information that Open Directory collects comes from whatever sources have it—from directory domains. Directory Domain Protocols Administrative data needed by directory services is stored on Mac OS X Servers in Open Directory databases. An Open Directory database is one type of directory domain. Open Directory can use either of two protocols to store and retrieve directory data: Directory services File server File server Directory domain LL0395.Book Page 49 Wednesday, November 20, 2002 11:44 AM

mixed environments m NetInfo, the Apple directory services protocol for Mac OS X The directory services of Mac OS X version 10.2—Open Directory—can also store and retrieve administrative data that resides in existing directory domains on other servers. Open Directory can read and write data in the following domains: m Shared NetInfo domains on other Mac OS X computers (servers or clients) m OpenLDAP directories on various UNIX servers m Active Directory domains on Windows servers m Other LDAPv3-compliant directories that are configured to allow remote administration and read and write access In addition, Open Directory can retrieve but not store administrative data in the following domains: m BSD configuration files located on the Mac OS X Server m LDAPv2 domains and read-only LDAPv3 domains on other servers Local and Shared Directory Domains Where you store your server’s user information and other administrative data is determined by whether the data needs to be shared. Local Data Every Mac OS X computer has a local directory domain. A local domain’s administrative data is visible only to applications and system software running on the computer where the domain resides. It is the first domain consulted when a user logs in or performs some other operation that requires data stored in a directory domain. When the user logs in to a Mac OS X computer, Open Directory searches the computer’s local directory domain for the user’s record. If the local directory domain contains the user’s record (and the user typed the correct password), the login process proceeds and the user gets access to the computer. Local domain Local domain Log in to Mac OS X Connect to Mac OS X Server LL0395.Book Page 50 Wednesday, November 20, 2002 11:44 AM

server on a computer running Mac OS X Server. In this case, Open Directory on the server searches for the user’s record in the server’s local directory domain. If the server’s local directory domain has a record for the user (and the user types the correct password), the server grants the user access to the file services. When you first set up a Mac OS X computer, its local directory domain is automatically created and populated with records. For example, a user record is created for the user who performed the installation. It contains the user name and password entered during setup, as well as other information, such as a unique ID for the user and the location of the user’s home directory. Shared Data While Open Directory on any Mac OS X computer can store administrative data in the computer’s local directory domain, the real power of Open Directory is that it lets multiple Mac OS X computers share administrative data by storing the data in shared directory domains. When a computer is configured to use a shared domain, any administrative data in the shared domain is also visible to applications and system software running on that computer. If Open Directory does not find a user’s record in the local domain of a Mac OS X computer, Open Directory automatically searches for the user’s record in any shared domains to which the computer has access. In the following example, the user can access both computers because the shared domain accessible from both computers contains a record for the user. Shared domains generally reside on Mac OS X Servers because servers are equipped with the tools, such as Workgroup Manager and Server Settings, that facilitate managing network resources and network users. Shared domain Local domain Local domain Log in to Mac OS X Connect to Mac OS X Server LL0395.Book Page 51 Wednesday, November 20, 2002 11:44 AM

setting up printer records in a shared domain accessed by those computers. For example, graphic artists in a company might need to access color printers, while copy center personnel need to use high-speed laser printers. Rather than configuring printer access for each computer individually, you could use the Print module of Server Settings to add printers to two shared domains: Graphics and Repro. Printers visible in the Print Center of graphic artists’ computers would be those in the Graphics domain, while printers in the Repro domain would be visible to computers used by copy center personnel. Printers that have records in shared domains appear in the Directory Services printer list in Print Center. Repro domain Graphics domain Graphic artists Copy center personnel LL0395.Book Page 52 Wednesday, November 20, 2002 11:44 AM

as personnel forms, may need to be shared by all employees. You could make a folder of those forms available to everybody by setting up a share point for the folder in another shared domain that all computers can access. The shared domain at the top of a hierarchy of directory domains is sometimes called the root domain. Repro domain Company domain Graphics domain Graphic artists Copy center personnel LL0395.Book Page 53 Wednesday, November 20, 2002 11:44 AM

Some organizations—such as universities and worldwide corporations—maintain user information and other administrative data in directory domains on UNIX or Windows servers. Open Directory can be configured to search these non-Apple domains as well as shared Open Directory domains of Mac OS X Servers. When a user logs in to a computer on your network, Open Directory still searches for the user in the computer’s local domain and in shared domains on Mac OS X Servers. But if the user is not found and Open Directory has been configured to search an LDAP domain on a UNIX server, Open Directory consults the LDAP domain for information about the user. Directory Domain Hierarchies Local and shared domains are organized into hierarchies, tree-like topologies that have a shared domain at the top and local domains at the bottom of the tree. A hierarchy can be as simple as a local domain and a shared domain, or it can contain more shared domains. Mac OS 9 user Mac OS X user Windows user Mac OS X Server Local domain Shared domain LDAP server 2 1 3 LL0395.Book Page 54 Wednesday, November 20, 2002 11:44 AM

Here’s a scenario in which a two-level hierarchy might be used: Each department (English, Math, Science) has its own computer. The students in each department are defined as users in the local domain of that department’s computer. All three of these local domains have the same shared domain, in which all the instructors are defined. Instructors, as members of the shared domain, can use services on all the departmental computers. The members of each local domain can use only services on the server where their local domain resides. Shared directory domain Local directory domain Local domain on English department’s computer Local domain on Math department’s computer Local domain on Science department’s computer Shared domain LL0395.Book Page 55 Wednesday, November 20, 2002 11:44 AM

Mac OS X Server accessible from the local domain’s computer. In this example, the shared domain can reside on any server accessible from the departmental servers. It can reside on one of the departmental servers or—as shown here—on an entirely different server on the network: When an instructor logs in to any of the three departmental servers and cannot be found in the local domain, the server searches the shared domain. In this example, there is only one shared domain, but in more complex hierarchies, there may be many shared domains. Faculty Mac OS X Server English department’s computer Math department’s computer Local domain Shared domain Local domain Science department’s computer Local domain Local domain LL0395.Book Page 56 Wednesday, November 20, 2002 11:44 AM

Open Directory also supports multilevel domain hierarchies. Complex networks with large numbers of users may find this kind of organization useful, although it’s much more complex to administer. In this scenario, an instructor defined in the Campus domain can use Mac OS X computers on which any of the local domains reside. A student defined in the Students domain can log in to any Mac OS X computers that are below the Graduates domain or Undergraduates domain. A directory domain hierarchy affects which Mac OS X computers can see particular administrative data. The “subtrees” of the hierarchy essentially hide information from other subtrees in the hierarchy. In the education example, computers using the subtree that includes the Graduates domain do not have access to records in the Undergraduates domain. But records in the Campus domain are visible to any computer. Directory domain visibility depends on the computer, not the user. So when a user logs in to a different computer, administrative data from different directory domains may be visible to that computer. In the education scenario described here, an undergraduate can log in to a graduate student’s computer if the undergraduate’s user record resides in the Students domain. But the devices that are defined in the Undergraduates domain are not visible unless they are also defined in the Graduates, Students, or Campus domain. Employees domain Students domain Campus domain Undergraduates domain Graduates domain Faculty domain Local domains on Mac OS X clients or servers LL0395.Book Page 57 Wednesday, November 20, 2002 11:44 AM

which to publish administrative data. The higher the administrative data resides in a directory domain hierarchy, the fewer places it needs to be changed as users and system resources change. Probably the most important aspect of directory services for administrators is planning directory domains and hierarchies. These should reflect the resources you want to share, the users you want to share them among, and even the way you want to manage your directory data. Search Policies for Directory Domain Hierarchies Each Mac OS X computer has a search policy that specifies the order in which Open Directory searches directory domains. A search policy, also known as a search path, is simply a list of directory domains. On a Mac OS X computer, Open Directory goes down this list of directory domains whenever an application or system software running on the computer needs administrative data. The list of directory domains defines the computer’s search policy. The search policy effectively establishes the computer’s place in the hierarchy. A computer’s local directory domain is always first on the list. It may be followed by shared Open Directory domains on Mac OS X Servers and LDAP domains on other servers. It may also include a set of BSD configuration files that are on the computer. For example, when someone tries to log in to a Mac OS X computer, Open Directory searches the computer’s local domain for the user’s record. The local directory domain is always first on a computer’s search policy. Graduates domain Local domain Is the user defined here? LL0395.Book Page 58 Wednesday, November 20, 2002 11:44 AM

directory domain in the search policy. If the second directory domain also does not contain the user’s record, Open Directory searches the remaining directory domains in the search policy one by one until it searches the last shared domain. The Automatic Search Policy Initially, every computer with Mac OS X version 10.2 is set to use an automatic search policy. It consists of three parts, two of which are optional: m local directory domain m shared NetInfo domains (optional) m shared LDAPv3 domains (optional) A computer’s automatic search policy always begins with the computer’s local directory domain. Graduates domain Local domain Is the user defined here? No Is the user defined here? Campus domain Students domain Graduates domain Local domain No No No LL0395.Book Page 59 Wednesday, November 20, 2002 11:44 AM

computer’s local domain may be bound to a shared NetInfo domain, which may in turn be bound to another shared NetInfo domain, and so on. The NetInfo binding, if any, constitutes the second part of the automatic search policy. See “Configuring NetInfo Binding” on page 106 for additional information. The third and final part of a computer’s automatic search policy consists of shared LDAPv3 domains. They are included only if the computer uses a DHCP service that’s configured to supply the addresses of one or more LDAPv3 servers. The DHCP service of Mac OS X Server can supply LDAPv3 servers. See “Setting the LDAP Server for DHCP Clients” on page 505 in Chapter 11, “DHCP Service.” A computer’s automatic search policy may change if the computer is moved to a part of the network served by a different DHCP service. When the user logs in at the new location, the computer connects to the new DHCP service. The new DHCP service may change the NetInfo binding and may supply a list of LDAPv3 servers different from the list supplied by the DHCP service at the former location. Custom Search Policies If you don’t want a Mac OS X version 10.2 computer—server or client—to use the automatic search policy supplied by DHCP, you can define a custom search policy for the computer. In this scenario, a custom search policy specifies that LDAP Server 1 be consulted when a user record or other administrative data cannot be found in the directory domains of the automatic search policy. The custom search policy also specifies that if the user information or other administrative data is not found on the LDAP server, a shared Open Directory domain named “Campus” is searched. Students domain Graduates domain Local domain LDAP Server 1 Campus domain LL0395.Book Page 60 Wednesday, November 20, 2002 11:44 AM

Keeping information in shared directory domains gives you more control over your network, allows more users access to the information, and makes maintaining the information easier for you. But the amount of control and convenience depends on the effort you put into planning your shared domains. The goal of directory domain planning is to design the simplest hierarchy of shared domains that gives your Mac OS X users easy access to the network resources they need and minimizes the time you spend maintaining user records and other administrative data. When planning directory domains, you need to consider which Mac OS Server will host a Password Server. This topic is covered later, in “Open Directory Password Server” on page 63. General Planning Guidelines If you do not need to share user and resource information among multiple Mac OS X computers, there is very little directory domain planning necessary. Everything can be accessed from local directory domains. Just ensure that all individuals who need to use a particular Mac OS X computer are defined as users in the local directory domain on the computer. If you want to share information among Mac OS X computers, you need to set up at least one shared domain. A hierarchy this simple may be completely adequate when all your network computer users share the same resources, such as printers and share points for home directories, applications, and so forth. Local domain Local domain Log in to Mac OS X Connect to Mac OS X Server Shared domain Local domain Local domain Log in to Mac OS X Connect to Mac OS X Server LL0395.Book Page 61 Wednesday, November 20, 2002 11:44 AM

Controlling Data Accessibility Hierarchies that contain several shared domains let you make directory information visible only to subsets of a network’s computers. In the foregoing example hierarchy, the administrator can tailor the users and resources visible to the community of Mac OS X computers by distributing directory information among six shared domains. If you want all computers to have access to certain administrative data, you store that data in the shared domain at the top of your hierarchy, where all computers can access it. To make some data accessible only to a subset of computers, you store it in a shared domain that only those computers can access. You might want to set up multiple shared directory domains to support computers used by specific groups within an organization. For example, you might want to make share points containing programming applications and files visible only to engineering computers. On the other hand, you might give technical writers access to share points that store publishing software and document files. If you want all employees to have access to one another’s home directory, you store mount records for all home directories in the topmost shared domain. Simplifying Changes to Data in Directory Domains If you need more than one shared directory domain, you should organize your hierarchy of shared domains to minimize the number of places data has to change over time. You should also devise a plan that addresses how you want to manage such ongoing events as m new users joining and leaving your organization m file servers being added, enhanced, or replaced m printers being moved among locations Under- graduates domain Graduates domain Faculty domain Employees domain Students domain Campus domain LL0395.Book Page 62 Wednesday, November 20, 2002 11:44 AM

so you don’t have to change or add information in multiple domains. In the education hierarchy example, all students may have user records in the Students domain and all employees may have accounts in the Employees domain. As undergraduate students leave or become graduate students, or as employees are hired or retire, the administrator can make adjustments to user information simply by editing one domain. If you have a widespread or complex hierarchy of directory domains in a network that is managed by several administrators, you need to devise strategies to minimize conflicts. For example, you can predefine ranges of user IDs (UIDs) to avoid inadvertent file access. (For more information, see “Defining User IDs” on page 141 in Chapter 3, “Users and Groups.”) Identifying Computers for Hosting Shared Domains If you need more than one shared domain, you need to identify the computers on which shared domains should reside. Shared domains affect many users, so they should reside on Mac OS X Servers that have the following characteristics: m restricted physical access m limited network access m equipped with high-availability technologies, such as uninterruptible power supplies You should select computers that will not be replaced frequently and that have adequate capacity for growing directory domains. While you can move a shared domain after it has been set up, you may need to reconfigure the search policies of computers that bind to the shared domain so that their login hierarchies remain intact. Open Directory Password Server Besides providing directory services on Mac OS X Servers and other Mac OS X computers, Open Directory can also provide authentication services. An Open Directory Password Server can store and validate user passwords for login and other network services that require authentication. A Password Server supports basic authentication as well as authentication methods that protect the privacy of a password during transmission on the network. A Password Server lets you set up specific password policies for each user, such as automatic password expiration and minimum password length. LL0395.Book Page 63 Wednesday, November 20, 2002 11:44 AM

grant access to a user, computer, or program. Usually, access requires two tests: authentication and authorization. For authentication, the requester must prove identity, usually by providing a password. For authorization, the server determines what privileges the authorized requester has to access a specific resource (for example, by determining whether a user is the owner of a particular file). Your Mac OS X Server can host a Password Server, or it can get authentication services from a Password Server hosted by another Mac OS X Server. If you have multiple Mac OS X Servers, one of them can host a Password Server for all the others to use. In this case, you should set up the Mac OS X Server that will host a Password Server and then set up the other Mac OS X Servers to use the existing Password Server. Each Open Directory domain can be associated with one Password Server or no Password Server. This association happens automatically when the domain is set up with the Open Directory Assistant application. An Open Directory domain and its associated Password Server can be located on the same server, or the Password Server can be on a different server. More than one Open Directory domain can be associated with a single Password Server. Authentication With a Password Server When a user’s account is configured to use a Password Server, the user’s password is not stored in a directory domain. Instead, the directory domain stores a unique password ID assigned to the user by the Password Server. To authenticate a user, directory services pass the user’s password ID to the Password Server. The Password Server uses the password ID to find the user’s actual password and any associated password policy. For example, the Password Server may locate a user’s password but discover that it has expired. If the user is logging in, the login window asks the user to replace the expired password. Then the Password Server can authenticate the user. A Password Server can’t authenticate a user during login on a computer with Mac OS X version 10.1 or earlier. You’ll find more information about configuring user accounts to use a Password Server in “Understanding Password Validation” on page 193 of Chapter 3, “Users and Groups.” Important A Password Server is the best means of authenticating Windows computer users who want to access the Windows services of Mac OS X Server. You should set up a Password Server when you first set up a Mac OS X Server on your network so that you are prepared to start Windows services now or in the future. If you wait to set up a Password Server until after you have created user accounts, you will have to reset the passwords of the user accounts. Resetting passwords can be time consuming and can confuse users. LL0395.Book Page 64 Wednesday, November 20, 2002 11:44 AM

A Password Server supports many different methods of authenticating users for login and other network services, including CRAM-MD5, APOP, SMB-NT, SMB-LAN Manager, DHX, and Digest-MD5. A Password Server is able to support a wide range of authentication methods because it is based on the Simple Authentication and Security Layer (SASL) standard. One reason Password Server supports many different authentication methods is that each service that requires authentication uses some authentication methods but not others. File service uses one set of authentication methods, Web service uses another set of methods, mail service uses another set, and so on. Some authentication methods are more secure than others. The more secure methods use tougher algorithms to encode the authentication information that they transmit between client and server. The more secure authentication methods also store passwords in a form that can’t be recovered from the server. You can enable or disable some authentication methods individually when you set up a Password Server. Other authentication methods are always enabled. The goal of your authentication settings should be to provide maximum convenience to authorized users while keeping unauthorized users from gaining access to the server. When deciding which authentication methods to enable, consider the following: m What balance do I want between ease of access and security? m What types of hardware and software will the server’s clients use? m Is my server in a physically secure location? Choosing the right authentication methods is very important. Choosing the wrong methods can prevent authorized users from accessing the server, or even allow unauthorized access. Basic information about each method is provided on the following pages. This information is not a substitute for a thorough knowledge of authentication methods and how they affect security and ease of access. CRAM-MD5 Authentication Method CRAM-MD5 is used by many email programs and by some LDAP software. It encodes passwords when they are sent over the network, and stores them in a scrambled form on the server. It offers good security during network transmission. A malicious user may be able to obtain passwords by gaining access to the server and decoding the password file, although doing this would be very difficult. If CRAM-MD5 is disabled, some e-mail programs will transmit passwords over the network in plain text format, which is a significant security risk. If you use your server for SMTP or IMAP e-mail, you should probably enable CRAM-MD5. LL0395.Book Page 65 Wednesday, November 20, 2002 11:44 AM

APOP is used by many email programs. It encodes passwords when they are sent over the network, and stores them in a recoverable form on the server. It offers good security during network transmission. A malicious user may be able to obtain passwords by gaining access to the server and decoding the password file, although doing this would be very difficult. If APOP is disabled, some e-mail programs will transmit passwords over the network in plain text format, which is a significant security risk. If you use your server for POP e-mail, you should probably enable APOP. SMB-NT Manager Authentication Method SMB-NT authentication is required by default for some Microsoft Windows computers to connect to the Mac OS X Server for Windows services. It is sometimes called Windows Secure Password Exchange (NT). It encodes passwords when they are sent over the network, and stores them in a scrambled form on the server. A malicious user may be able to obtain passwords by gaining access to the server and decoding the password file, although doing this would be very difficult. If SMB-NT authentication is disabled, each individual Windows client system must be configured to work with the server. If you want Windows users to be able to easily share files on your system, you should enable SMB-NT authentication. SMB-LAN Manager Authentication Method SMB-LAN Manager authentication is required by default for some Microsoft Windows systems to connect to the Mac OS X SMB Server. It is sometimes called Windows Secure Password Exchange (LAN Manager). It encodes passwords when they are sent over the network, and stores them in a scrambled form on the server. A malicious user may be able to obtain passwords by gaining access to the server and decoding the password file, although doing this would be very difficult. If SMB-LAN Manager authentication is disabled, each individual Windows client system must be configured to work with the server. If you want Windows users to be able to easily share files on your system, you should enable SMB-LAN Manager authentication. DHX Authentication Method Diffie-Hellman Exchange (DHX) is used by Mac OS X Server file service and some other Apple Filing Protocol (AFP) file servers. DHX strongly encodes passwords when they are sent over the network. DHX is always enabled. Mac OS 8.1–8.6 client computers must have their AppleShare Client software upgraded to use DHX. m Mac OS 8.1–8.6 client computers with a PowerPC processor should use AppleShare Client version 3.8.8. m Mac OS 8.1–8.5 clients with a 680X0 processor should use AppleShare Client version 3.8.7. LL0395.Book Page 66 Wednesday, November 20, 2002 11:44 AM

during startup should use AppleShare Client version 3.8.3. Digest-MD5 Authentication Method Digest-MD5 is used by the Mac OS X login window, many email programs, and some LDAP software. This authentication method encodes passwords when they are sent over the network, and stores them in a scrambled form on the server. It offers good security during network transmission. Although very difficult, a malicious user may be able to obtain passwords by gaining access to the server and decoding the password file. Digest-MD5 is always enabled. Password Server Database The Password Server maintains a record for each user that includes the following: m Password ID, a 128-bit value assigned when the password is created. The value includes a key for finding a user’s Password Services record. m The password, stored in recoverable or hashed form. The form depends on the network authentication methods enabled for the Password Server (using Open Directory Assistant). If APOP is enabled, the Password Server stores a recoverable (encrypted) password. If APOP is disabled, only hashes of the passwords are stored. m The user’s short name, for use in Password Server log messages viewable in Server Status. m Password policy data. Password Server Security The Password Server stores passwords, but never allows passwords to be read. Passwords can only be set and verified. Malicious users who want to gain access to your server must try to log in over the network. Invalid password instances, logged by the Password Server, can alert you to such attempts. Using a Password Server offers flexible and secure password validation, but you need to make sure that the server on which a Password Server runs is secure: m Since the load on a Password Server is not particularly high, you can have several (or even all) of your Open Directory server domains share a single Password Server. m Set up IP firewall service so nothing is accepted from unknown ports. Password Server uses TCP port 106. m Make sure that the Password Server’s computer is located in a physically secure location, and don’t connect a keyboard or monitor to it. m Equip the server with an uninterruptible power supply. m If possible, set up a Password Server on a server that is not used for any other activity. This deployment is optimal but not required. LL0395.Book Page 67 Wednesday, November 20, 2002 11:44 AM

Password Server goes down, password validation cannot occur. Therefore, backing up the Password Server is important. Overview of Directory Services Tools The following applications help you set up and manage directory domains and Password Servers. m Open Directory Assistant. Use to create and configure shared or standalone Open Directory domains (NetInfo or LDAPv3) and to set up Open Directory Password Servers. Located in /Applications/Utilities. m Directory Access. Use to enable or disable individual directory service protocols; define a search policy; configure connections to existing LDAPv3, LDAPv2, and NetInfo domains; and configure data mapping for LDAPv3 and LDAPv2 domains. Located in /Applications/Utilities. m Server Status. Use to monitor directory services and view directory services logs. Located in /Applications/Utilities. Experts can also use the following applications to manage directory domains: m Property List Editor. Use to add BSD configuration files that you want Open Directory to access for administrative data, and change the mapping of the data in each BSD configuration file to specific Mac OS X record types and attributes. Located in /Developer/ Applications if you have installed the Developer Tools software. Also located on the Mac OS X Server installation disc named “Administration Tools” at path “NetBoot, Network Install/Image Manipulation.” m NetInfo Manager. Use to view and change records, attributes, and values in an Open Directory domain (LDAPv3 or NetInfo) or in a NetInfo domain; manage a NetInfo hierarchy; and back up and restore a NetInfo domain. Located in /Applications/Utilities. m Terminal. Open to use UNIX command-line tools that manage NetInfo domains. Located in /Applications/Utilities. Setup Overview Here is a summary of the major tasks you perform to set up and maintain directory services. See the pages indicated for detailed information about each task. Step 1: Before you begin, do some planning See “Before You Begin” on page 70 for a list of items to think about before you start configuring directory domains and a Password Server. LL0395.Book Page 68 Wednesday, November 20, 2002 11:44 AM

Create shared directory domains on the Mac OS X Servers that you want to host them, and set up an Open Directory Password Server on a Mac OS X Server that hosts a shared directory domain. If you will be setting up more than one Mac OS X Server, start by setting up the Mac OS X Server that will have the Password Server. Next, set up other Mac OS X Servers that will host shared directory domains. Then set up any Mac OS X Servers that will not host shared directory domains. For instructions, see “Setting Up an Open Directory Domain and Password Server” on page 71 Step 3: Set up access to directory domains on other servers If some of your user information and other administrative data will not reside in Open Directory domains, you must make sure your Mac OS X Servers and Mac OS X client computers are able to access the other directory domains. For instructions, see the following sections of this chapter: m “Configuring Access to Existing LDAPv3 Servers” on page 91 m “Using an Active Directory Server” on page 98 m “Accessing an Existing LDAPv2 Directory” on page 100 m “Using NetInfo Domains” on page 105 m “Using Berkeley Software Distribution (BSD) Configuration Files” on page 110 Step 4: Implement search policies Set up search policies so that all Mac OS X client computers have access to the shared directory domains they need. Note that if all computers have Mac OS X version 10.2 and can use the automatic search policy, there is nothing to set up. Otherwise, see “Setting Up Search Policies” on page 87 for instructions. If your network includes computers with Mac OS X versions earlier than 10.2, configure the local domain on each of them so that it binds to a shared NetInfo domain. For instructions, see “Using NetInfo Domains” on page 105. Step 5: Configure Open Directory service protocols (optional) You may want to disable some of the protocols that Open Directory uses to access directory domains and to discover network services. For instructions, see “Configuring Open Directory Service Protocols” on page 86. LL0395.Book Page 69 Wednesday, November 20, 2002 11:44 AM

Before setting up directory services for the first time: m Understand why clients need directory data, as discussed in the first several sections of this chapter. m Assess your server access requirements. Identify which users need to access your Mac OS X Servers. Users whose information can be managed most easily on a server should be defined in a shared Open Directory domain on a Mac OS X Server. Some of these users may instead be defined in Active Directory domains or LDAP domains on other servers. These concepts are discussed in “Local and Shared Directory Domains” on page 50 and “Directory Domain Hierarchies” on page 54. m Understand search policies, as described in “Search Policies for Directory Domain Hierarchies” on page 58. m Design the hierarchy of shared directory domains. Determine whether user information should be stored in a local directory domain or in a directory domain that can be shared among servers. Design your directory domain hierarchy, identifying the shared and local domains you want to use, the servers on which the shared domains should reside, and the relationships between shared domains. In general, try to limit the number of users associated with any directory domain to no more than 10,000. “Directory Domain Planning” on page 61 provides some guidelines that will help you decide what your directory domain hierarchy should look like. m Assess your authentication needs. Decide whether to use an Open Directory Password Server. Keep in mind that you must have a Password Server to enforce password policies or to authenticate Windows computer users for Windows services in a Mac OS X Server. Decide which Mac OS X Server will host the Password Server. These concepts are discussed in “Open Directory Password Server” on page 63. m Consider the best equipment and location for your servers. Choose computers and locations that are reliable and accessible. If possible, use a dedicated Mac OS X Server for directory services. Make the server physically secure. It shouldn’t have a keyboard or monitor, especially if it hosts a Password Server. m Pick server administrators very carefully. Give only trusted people administrator passwords. Have as few administrators as possible. Don’t delegate administrator access for minor tasks, such as changing settings in a user record. LL0395.Book Page 70 Wednesday, November 20, 2002 11:44 AM

computers use it. Setting Up an Open Directory Domain and Password Server You must thoughtfully decide how to set up Open Directory domains and a Password Server before you set up user accounts and have your Mac OS X Server provide services to users. To decide how to set up Open Directory domains and a Password Server, ask yourself the following questions. Q: Do you want your network users to be able to log in from more than one computer? Do you want to manage user and group accounts centrally? Do you want to manage user and group preference settings centrally? A: If you answer yes to any of these questions, you must use a shared directory domain. If no, then user and groups accounts will have to be managed separately on each network computer. Q: Will your network have more than one server? A: If yes, you almost certainly need a shared directory domain. Set up the server that will host the shared domain before setting up the other servers, which will use the shared domain hosted by the first server. Q: Will Windows computer users need to connect to any Mac OS X Server on your network, either now or in the future? Will you want to enforce policies such as password expiration or minimum password length? Will you need multiple authentication methods? A: Unless you can answer emphatically and irrevocably no to all these questions, you need to set up a Password Server. If your network will have more than one Mac OS X Server, you can set up a Password Server on the first Mac OS X Server. Then you can configure the other Mac OS X Servers to use the one Password Server. You can use the Open Directory Assistant application to set up how a Mac OS X Server works with directory information and a Password Server. Open Directory Assistant runs automatically as part of the installation and setup process of Mac OS X Server. Subsequently you can open Open Directory Assistant from the Finder. If you create user accounts without a Password Server and later reconfigure to host or use a Password Server, you will have to reset the user passwords to use the Password Server. Important If you are discontinuing use of a Password Server, first change the password validation strategy of the Password Server administrator to basic so that the administrator can continue to log in to Mac OS X Server. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 71 Wednesday, November 20, 2002 11:44 AM

Server: 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. For Password, enter the password for the user name you entered. 3 Follow the self-guided steps for configuring the server’s use of a directory domain and a Password Server. For detailed instructions on using Open Directory Assistant to set up specific directory domain and Password Server configurations, see the next nine topics. Using Another Server’s Shared Directory Domain Using the Open Directory Assistant application, you can set up a Mac OS X Server to get directory information and authentication information from an existing system. The Mac OS X Server gets directory information from a shared Open Directory domain hosted by another server. This other server’s configuration determines the source of authentication information. This other server may provide authentication information from a Password Server, get authentication information from yet another system’s Password Server, or use passwords from user records in the shared Open Directory domain. To configure a server to get directory services from an existing system 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. Important If you are changing a Mac OS X Server to no longer use or host a Password Server, first change the password validation strategy of the Password Server administrator to basic. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. Doing so ensures that these users can continue to log in to Mac OS X Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 72 Wednesday, November 20, 2002 11:44 AM

3 Click the right arrow to get to the Location step, and then select the setting that indicates the server is at its permanent network location. If a server is in a temporary location, you can’t configure the server to get directory services from another server. 4 Advance to the Directory Use step, and then select the option “The server will get directory information from an existing system.” 5 Go to the Configure step, where you specify how to access another Mac OS X Server’s directory domain. If you choose to access the directory using NetInfo, you must select one or more protocols that your server can use to find another server’s NetInfo domain. If you select Broadcast, your server scans your network for NetInfo servers. (With the broadcast protocol, your server and the NetInfo server must be on the same subnet or on a network that is configured for IP broadcast forwarding. In addition, the NetInfo Server Tag must be “network” and the NetInfo server must have a machine record for your server. For more information, see “Adding a Machine Record to a Parent NetInfo Domain” on page 107.) If you select DHCP, your server gets the address and tag of a NetInfo server from DHCP service. (DHCP service must be configured to supply a NetInfo server’s address and tag. For instructions, see “Setting NetInfo Options for a Subnet” on page 508 in Chapter 11, “DHCP Service.”) If you select Static IP Address, you must enter the IP address and tag of the server whose NetInfo domain you want your server to use. If you select more than one access protocol, your server attempts to find a NetInfo server by using the selected protocols in this order: static, DHCP, broadcast. Don’t select the static or broadcast protocol if it isn’t supported on the network, or the server may pause while trying to use the unsupported protocol to find a NetInfo server. If you choose to access the directory using Apple LDAP, you must specify how your server finds an LDAP server. If you select DHCP, your server gets the connection information for an LDAP server from DHCP service. (DHCP service must be configured to supply an LDAP server’s address. For instructions, see “Setting the LDAP Server for DHCP Clients” on page 505.) LL0395.Book Page 73 Wednesday, November 20, 2002 11:44 AM

Mac OS X Server whose LDAP domain you want your server to use. You must also enter a search base, which is a set of text items that tell your server where to look for directory information on the LDAP server. Regardless of these settings, you can also specify whether your server connects securely to the LDAP server by using a Secure Sockets Layer (SSL) connection, and whether to use a custom or standard networking port for the LDAP connection. Note: If you choose Apple LDAP but specify connection information for a non-Apple LDAP server, the mapping information for this LDAP server must be stored on the LDAP server and the server must supply the mappings to its clients. All Apple LDAP servers store their mappings and supply the mappings to their clients. Instructions for configuring other LDAP servers to do this are included in “Configuring LDAPv3 Search Bases and Mappings” on page 94. If you choose to access the directory using Advanced Method, you must use the Directory Access application to configure access to another server’s directory domain. For instructions, see “Configuring Access to Existing LDAPv3 Servers” on page 91, “Using an Active Directory Server” on page 98, or “Accessing an Existing LDAPv2 Directory” on page 100. 6 Advance to the Finish Up step, review its configuration summary, and click Go Ahead to apply the displayed settings. If you want to change any of the settings in the configuration summary, click the left arrow. Keep clicking the left arrow until you get back to the step where you can make the desired change. After changing the setting, click the right arrow until you get to the Finish Up step again. 7 Click Restart or Directory Access, whichever button appears after Open Directory Assistant changes the server’s directory services configuration. The Restart button appears if you chose Apple LDAP or NetInfo in step 5. The Directory Access button appears if you chose Advanced Method in step 5. Clicking this button quits Open Directory Assistant and opens the Directory Access application, which you must now use to configure access to another server’s directory domain. For instructions, see “Configuring Access to Existing LDAPv3 Servers” on page 91, “Using an Active Directory Server” on page 98, or “Accessing an Existing LDAPv2 Directory” on page 100. LL0395.Book Page 74 Wednesday, November 20, 2002 11:44 AM

Using the Open Directory Assistant application, you can set up a Mac OS X Server to provide directory information and authentication information to other systems. The Mac OS X Server provides directory information by hosting a shared Open Directory domain. In addition, the server provides authentication information by hosting a Password Server. Other computers, including Mac OS X Servers and Mac OS X clients, can be set up to access the shared directory domain via LDAP and NetInfo. (LDAP access is optional.) Other Mac OS X Servers can also be set up to use the Password Server. If your Mac OS X Server currently gets directory information from another server and you change to providing directory information to other computers, user records and other information that is stored in the other server’s shared directory domain will no longer be available. The user records and other information will still exist in the other shared directory domain, but your Mac OS X Server will not access it. To configure a server to host a shared Open Directory domain with a Password Server: 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. This user account will become an administrator of the Password Server. For Password, enter the password for the user name you entered. 3 Click the right arrow to get to the Location step, and then select the setting that indicates the server is at its permanent network location. If a server is in a temporary location, you can’t configure the server to provide directory services to other computers. 4 Advance to the Directory Use step, and then select the option “The server will provide directory information to other computers.” Important If you are changing a Mac OS X Server to no longer use an existing Password Server, first change the password validation strategy of the Password Server administrator to basic. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. Doing so ensures that these users can continue to log in to Mac OS X Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 75 Wednesday, November 20, 2002 11:44 AM

shared Open Directory domain. Other computers can always access the server’s shared domain via NetInfo. Select “Enable LDAP support on this server” if you want other computers to be able to access the server’s shared domain via LDAP as well. 6 Advance to the first Security step and select “Password and authentication information will be provided to other systems.” 7 Advance to the next Security step. Open Directory Assistant displays the short name of the user account that will become an administrator of the Password Server. This user account is the one you used to authenticate when you started Open Directory Assistant. You can make additional Password Server administrators by selecting the option “User can administer this directory domain” in the Basic pane of Workgroup Manager. For instructions, see “Assigning Administrator Rights for a Directory Domain” on page 142 of Chapter 3, “Users and Groups.” 8 Go to the next Security step and select the authentication methods that you want the Password Server to support. SMB-NT is required for some Windows computers to get Windows services in Mac OS X Server. SMB-LAN Manager is required for some Windows computers to get Windows services in Mac OS X Server. CRAM-MD5 can be used for IMAP mail service by Mac OS X Server and users’ mail client software. CRAM-MD5 is also used by some LDAP software. APOP can be used for POP mail service by Mac OS X Server and users’ mail client software. In addition to the listed authentication methods, Password Server always supports the following methods: DHX and Digest-MD5. You’ll find more information about the different authentication methods in “Password Server Authentication Methods” on page 65. 9 In the onscreen Finish Up step, click Go Ahead to configure the server with the displayed settings. After configuring a Mac OS X Server to host an Open Directory domain, you can configure other Mac OS X computers to access the domain. Use the Directory Access application on each other Mac OS X computer or use Directory Access on the server to configure other Mac OS X computers remotely. For instructions, see “Setting Up Search Policies” on page 87 through “Configuring Directory Access on a Remote Computer” on page 114. LL0395.Book Page 76 Wednesday, November 20, 2002 11:44 AM

Server Using the Open Directory Assistant application, you can set up a Mac OS X Server to provide directory information to other systems while it obtains authentication information from another system. The Mac OS X Server provides directory information by hosting a shared Open Directory domain. This server obtains authentication information from another server’s Password Server. Other computers, including Mac OS X Servers and Mac OS X clients, can access the shared directory domain via LDAP and NetInfo. (LDAP access is optional.) If your Mac OS X Server currently gets directory services from another server and you change to providing directory services to other computers, user records and other information that is stored in the other server’s shared directory domain will no longer be available. The user records and other information will still exist in the other shared directory domain, but your Mac OS X Server will not access it. To configure a server to host a shared Open Directory domain and use an existing Password Server: 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. This user account will become an administrator of the existing Password Server. For Password, enter the password for the user name you entered. 3 Click the right arrow to get to the Location step, and then select the setting that indicates the server is at its permanent network location. If a server is in a temporary location, you can’t configure the server to provide directory services to other computers. 4 Advance to the Directory Use step, and then select the option “The server will provide directory information to other computers.” Important If you are changing a Mac OS X Server to no longer host a Password Server, first change the password validation strategy of the Password Server administrator to basic. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. Doing so ensures that these users can continue to log in to Mac OS X Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 77 Wednesday, November 20, 2002 11:44 AM

shared Open Directory domain. Other computers can always access the server’s shared domain via NetInfo. Select “Enable LDAP support on this server” if you want other computers to be able to access the server’s shared domain via LDAP as well. 6 Advance to the first Security step and select “Password and authentication information will be obtained from another system.” 7 Go to the next Security step and enter the connection and authentication information for the Password Server host. For Address, enter the DNS name or IP address of the Mac OS X Server whose Password Server server you want to use. For User Name, enter the user name of an administrator of the Password Server. This administrator is a domain administrator for the directory domain with which the Password Server is associated, and the administrator’s password is validated using that Password Server. For more information on Password Server administrators, see “Assigning Administrator Rights for a Password Server” on page 201 of Chapter 3, “Users and Groups.” For Password, enter the password for the user name you entered. 8 In the next Security step, Open Directory Assistant displays the short name of the user account that will become an administrator of the Password Server. This user account is the one you used to authenticate when you started Open Directory Assistant. You can make additional Password Server administrators by selecting the option “User can administer this directory domain” in the Basic pane of Workgroup Manager. For instructions, see “Assigning Administrator Rights for a Directory Domain” on page 142 of Chapter 3, “Users and Groups.” 9 In the onscreen Finish Up step, click Go Ahead to configure the server with the displayed settings. Hosting a Shared Directory Domain With No Password Server Using the Open Directory Assistant application, you can set up a Mac OS X Server to provide directory information to other computers while it stores and accesses authentication information locally in user records. The Mac OS X Server provides directory services by hosting a shared Open Directory domain. This server obtains authentication information directly from user records, without using a Password Server. Other computers, including Mac OS X Servers and Mac OS X clients, can access the shared directory domain via LDAP and NetInfo. (LDAP access is optional.) LL0395.Book Page 78 Wednesday, November 20, 2002 11:44 AM

Server to host or use a Password Server, you will have to reset the user passwords to use the Password Server. If your Mac OS X Server currently gets directory services from another server and you change to providing directory services to other computers, user records and other information that is stored in the other server’s shared directory domain will no longer be available. The user records and other information will still exist in the other shared directory domain, but your Mac OS X Server will not access it. To configure a server to host a shared Open Directory domain with no Password Server: 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. For Password, enter the password for the user name you entered. 3 Click the right arrow to get to the Location step, and then select the setting that indicates the server is at its permanent network location. If a server is in a temporary location, you can’t configure the server to provide directory services to other computers. 4 Advance to the Directory Use step, and then select the option “The server will provide directory information to other computers.” 5 Go to the Configure step, where you specify how other computers can access the server’s shared Open Directory domain. Other computers can always access the server’s shared domain via NetInfo. Select “Enable LDAP support on this server” if you want other computers to be able to access the server’s shared domain via LDAP as well. Important If you are changing a Mac OS X Server to no longer use or host a Password Server, first change the password validation strategy of the Password Server administrator to basic. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. Doing so ensures that these users can continue to log in to Mac OS X Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 79 Wednesday, November 20, 2002 11:44 AM

stored and accessed locally in user records.” 7 In the onscreen Finish Up step, click Go Ahead to configure the server with the displayed settings. Using a Non-Shared Local Directory Domain With a Password Server Using the Open Directory Assistant application, you can set up a Mac OS X Server to use only its local directory domain, while the server provides authentication information to other systems. The Mac OS X Server provides authentication information by hosting a Password Server. The server does not provide directory information to other computers or get directory information from an existing system. (The local directory domain cannot be shared.) If your Mac OS X Server currently gets directory information from another server and you change to getting directory information only from the local directory domain, user records and other information that is stored in the other server’s shared directory domain will no longer be available. The user records and other information will still exist in the other shared directory domain, but your Mac OS X Server will not access them. To configure a server to use only its own non-shared local directory domain with a Password Server: 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. This user account will become an administrator of the Password Server. For Password, enter the password for the user name you entered. 3 Click the right arrow to get to the Location step, and then select the setting that indicates the server is at its permanent network location. If a server is in a temporary location, you can’t configure the server to provide authentication information to other systems. Important If you are changing a Mac OS X Server to no longer use an existing Password Server, first change the password validation strategy of the Password Server administrator to basic. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. Doing so ensures that these users can continue to log in to Mac OS X Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 80 Wednesday, November 20, 2002 11:44 AM

shared local directory.” 5 Go to the first Security step and select “Password and authentication information will be provided to other systems.” 6 Advance to the next Security step. Open Directory Assistant displays the short name of the user account that will become an administrator of the Password Server. This user account is the one you used to authenticate when you started Open Directory Assistant. You can make additional Password Server administrators by selecting the option “User can administer this directory domain” in the Basic pane of Workgroup Manager. For instructions, see “Assigning Administrator Rights for a Directory Domain” on page 142 of Chapter 3, “Users and Groups.” 7 Go to the next Security step and select the authentication methods that you want the Password Server to support. SMB-NT is required for some Windows computers to get Windows services in Mac OS X Server. SMB-LAN Manager is required for some Windows computers to get Windows services in Mac OS X Server. CRAM-MD5 can be used for IMAP mail service by Mac OS X Server and users’ mail client software. CRAM-MD5 is also used by some LDAP software. APOP can be used for POP mail service by Mac OS X Server and users’ mail client software. In addition to the listed authentication methods, Password Server always supports the following methods: DHX and Digest-MD5. You’ll find more information about the different authentication methods in “Password Server Authentication Methods” on page 65. 8 In the onscreen Finish Up step, click Go Ahead to configure the server with the displayed settings. Using a Non-Shared Local Directory Domain and an Existing Password Server Using the Open Directory Assistant application, you can set up a Mac OS X Server to use only its local directory domain, while it obtains authentication information from another system. This server obtains authentication information from another server’s Password Server. The server does not provide directory information to other computers or get directory information from an existing system. (The local directory domain cannot be shared.) LL0395.Book Page 81 Wednesday, November 20, 2002 11:44 AM

change to getting directory information only from the local directory domain, user records and other information that is stored in the other server’s shared directory domain will no longer be available. The user records and other information will still exist in the other shared directory domain, but your Mac OS X Server will not access them. To configure a server to use only its own non-shared local directory domain with a Password Server: 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. This user account will become an administrator of the existing Password Server. For Password, enter the password for the user name you entered. 3 Click the right arrow to get to the Location step, and then select the setting that indicates the server is at its permanent network location. If a server is in a temporary location, you can’t configure the server to get authentication information from an existing Password Server. 4 Advance to the Directory Use step, and then select the option “The server will use a non- shared local directory.” 5 Advance to the first Security step and select “Password and authentication information will be obtained from another system.” 6 Go to the next Security step and enter the connection and authentication information for the Password Server host. For Address, enter the DNS name or IP address of the Mac OS X Server whose Password Server server you want to use. Important If you are changing a Mac OS X Server to no longer host a Password Server, first change the password validation strategy of the Password Server administrator to basic. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. Doing so ensures that these users can continue to log in to Mac OS X Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 82 Wednesday, November 20, 2002 11:44 AM

administrator is a domain administrator for the directory domain with which the Password Server is associated, and the administrator’s password is validated using that Password Server. For more information on Password Server administrators, see “Assigning Administrator Rights for a Password Server” on page 201 of Chapter 3, “Users and Groups.” For Password, enter the password for the user name you entered. 7 In the next Security step, Open Directory Assistant displays the short name of the user account that will become an administrator of the Password Server. This user account is the one you used to authenticate when you started Open Directory Assistant. You can make additional Password Server administrators by selecting the option “User can administer this directory domain” in the Basic pane of Workgroup Manager. For instructions, see “Assigning Administrator Rights for a Directory Domain” on page 142 of Chapter 3, “Users and Groups.” 8 In the onscreen Finish Up step, click Go Ahead to configure the server with the displayed settings. Using a Non-Shared Local Directory Domain With No Password Server Using the Open Directory Assistant application, you can set up a Mac OS X Server to use only its local directory domain while it stores and accesses authentication information locally in user records. This server obtains authentication information directly from user records, without using a Password Server. The server does not provide directory information to other computers or get directory information from an existing system. (The local directory domain cannot be shared.) If you create user accounts without a Password Server and later reconfigure your Mac OS X Server to host or use a Password Server, you will have to reset the user passwords to use the Password Server. If your Mac OS X Server currently gets directory information from another server and you change to getting directory information only from the local directory domain, user records and other information that is stored in the other server’s shared directory domain will no longer be available. The user records and other information will still exist in the other shared directory domain, but your Mac OS X Server will not access them. Important If you are changing a Mac OS X Server to no longer use or host a Password Server, first change the password validation strategy of the Password Server administrator to basic. You should also make the same change to any ordinary users whose passwords are validated using the Password Server. Doing so ensures that these users can continue to log in to Mac OS X Server. For instructions, see “Resetting Passwords Before Discontinuing Use of a Password Server” on page 203 of Chapter 3, “Users and Groups.” LL0395.Book Page 83 Wednesday, November 20, 2002 11:44 AM

with no Password Server: 1 Open the Open Directory Assistant application. It is located in the /Applications/Utilities folder. 2 Enter the connection and authentication information for the Mac OS X Server that you want to configure, then click Connect. For Address, enter the DNS name or IP address of the server that you want to configure. For User Name, enter the user name of an administrator on the server. For Password, enter the password for the user name you entered. 3 Click the right arrow to get to the Location step and select the setting that describes the server’s current IP address and subnet. A server can use its non-shared local directory domain with no Password Server whether the server is using a permanent or a temporary IP address and subnet. 4 Click the right arrow and go to step 7 if you specified that the server is using a temporary IP address and subnet, or continue with the next step if you specified that the server is using a permanent IP address and subnet. 5 Advance to the Directory Use step, and then select the option “The server will use a non- shared local directory.” 6 Advance to the Security step and select “Password and authentication information will be stored and accessed locally in user records.” 7 In the onscreen Finish Up step, click Go Ahead to configure the server with the displayed settings. Deleting a Shared Open Directory Domain Deleting a shared Open Directory domain should be a last resort, and should be done only after setting up a replacement directory domain on another server. All servers and client computers that are configured to use the directory domain being deleted must be reconfigured to use another directory domain. Instead of deleting a shared Open Directory domain, you can reconfigure a server to use only its non-shared local directory domain or get directory information from another server. Either of these changes will stop the server from using the shared directory domain, but the shared directory domain and the information it contains will remain on the server. The decommissioned directory domain can be reactivated by using the Directory Access application to bind the server’s local, non-shared directory domain to the decommissioned directory domain. For instructions, see “Configuring NetInfo Binding” on page 106. LL0395.Book Page 84 Wednesday, November 20, 2002 11:44 AM

domain, you can delete it by using Open Directory Assistant. To delete a shared directory domain hosted by a Mac OS X Server: 1 As a replacement for the directory domain to be deleted, set up a shared Open Directory domain on another Mac OS X Server. 2 Create or import user and group accounts, set up share points, and set managed preferences in the replacement Open Directory domain. For instructions, see Chapter 3, “Users and Groups,” Chapter 4, “Sharing,” and Chapter 6, “Client Management: Mac OS X.” 3 Reconfigure servers and client computers to use the replacement directory domain. Make sure servers and clients are not using NetInfo binding with the old directory domain. For instructions, see “Using NetInfo Domains” on page 105. If the old directory domain is part of an automatic search policy supplied by DHCP, change the DHCP service to supply another directory domain instead. For instructions, see “Setting the LDAP Server for DHCP Clients” on page 505 and “Setting NetInfo Options for a Subnet” on page 508 in Chapter 11, “DHCP Service.” 4 Migrate users to their accounts in the replacement directory domain. 5 When you are certain that the old directory domain is not being used in any way and you will never need the information it contains, you can delete it. 6 Start Open Directory Assistant. 7 Enter the connection and authentication information for the Mac OS X Server that hosts the shared domain you want to delete, then click Connect. For Address, enter the DNS name or IP address of the server. For User Name, enter the user name of an administrator on the server. For Password, enter the password for the user name you entered. 8 Choose Delete Hosted Domain from the Domain menu. 9 Go through Open Directory Assistant to configure the server to use another server’s shared directory domain or to use only the server’s local, non-shared directory domain. For instructions, see “Using Another Server’s Shared Directory Domain” on page 72; “Using a Non-Shared Local Directory Domain With a Password Server” on page 80; “Using a Non- Shared Local Directory Domain and an Existing Password Server” on page 81; or “Using a Non-Shared Local Directory Domain With No Password Server” on page 83. Warning When you delete a directory domain, all user account information and other administrative data that it contains is lost. LL0395.Book Page 85 Wednesday, November 20, 2002 11:44 AM

Open Directory uses many protocols to access administrative data in directory domains and discover services on the network. You can enable or disable each of the protocols individually by using the Directory Access application. The protocols include m AppleTalk, the legacy Mac OS protocol for file and print services. AppleTalk is configured automatically. m BSD Configuration Files, the original method still used by some organizations for accessing administrative data on UNIX computers. For instructions on configuring it, see “Using Berkeley Software Distribution (BSD) Configuration Files” on page 110. m Lightweight Directory Access Protocol version 2 (LDAPv2), an open standard that Open Directory can use to access (read-only) directory domains on a variety of servers. For instructions on configuring it, see “Accessing an Existing LDAPv2 Directory” on page 100. m LDAPv3, a newer version of the popular directory services protocol, which Open Directory uses to access (read and write) data in Open Directory domains on computers and servers with Mac OS X version 10.2, Active Directory domains on Windows servers, and directory domains on various other servers. For instructions on configuring it, see “Changing Basic LDAPv3 Settings” on page 90, “Configuring Access to Existing LDAPv3 Servers” on page 91, and “Using an Active Directory Server” on page 98. m NetInfo, an Apple directory services protocol that Open Directory can use to access (read and write) data in directory domains on all Mac OS X computers. For instructions on configuring it, see “Using NetInfo Domains” on page 105. m Rendezvous, an Apple protocol for discovering file, print, and other services on Internet Protocol (IP) networks. Rendezvous is configured automatically. m Service Location Protocol (SLP), an open standard for discovering file and print services on IP networks. SLP is configured automatically. m Server Message Block (SMB), a protocol used by Microsoft Windows for file and print services. For instructions on configuring it, see “Configuring SMB Service Discovery” on page 87. If you disable a protocol on a computer, Open Directory does not use it for directory access or service discovery on the computer. Other network services may still use the protocol, however. For example, if you disable the AppleTalk protocol, Open Directory does not use it to discover file servers, but you can still connect to an AppleTalk file server if you know its URL. To enable or disable protocols used by Open Directory: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Click the checkbox next to the protocol that you want to enable or disable. LL0395.Book Page 86 Wednesday, November 20, 2002 11:44 AM

You can configure how Mac OS X uses the Server Message Block (SMB) protocol to discover Windows file servers on the network. You can use the Directory Access application to specify the following: m the Windows workgroup that the Macintosh is in m a Windows Internet Name Service (WINS) server on the network To configure discovery of Windows SMB file servers: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select SMB in the list of services, then click Configure. 4 In the Workgroup field, type a workgroup name or select one from the drop-down list. The drop-down list includes the names of Windows workgroups that other computers on the network belong to. 5 Enter the DNS name or IP address of a WINS server that provides NetBIOS name resolution for the network. A WINS Server resolves Windows computer names to IP addresses on a network with routers and multiple subnets. If the network does not have a WINS server, leave the WINS Server field blank. 6 Click OK. Setting Up Search Policies This section describes how to configure the search policy that Open Directory uses when it retrieves authentication information and other administrative data from directory domains. The search policy can also include protocols for discovering services on the network, such as file and print services. A Mac OS X computer—server or client—actually has more than one search policy. The authentication search policy is used to find authentication information and most other administrative data. The contacts search policy is used by mail, address book, personal information manager, and similar applications to locate name, address, and other contact information. LL0395.Book Page 87 Wednesday, November 20, 2002 11:44 AM

computer by using the Directory Access application. You can use the same application to configure the computer’s contacts search policy. (The Open Directory Assistant application also configures the authentication search policy of a Mac OS X Server, but does not offer as many options as Directory Access.) You can configure the search policy of the computer on which you are running Directory Assistant as follows: m Use the automatic search policy—shared NetInfo domains, list of LDAP servers supplied by DHCP, or both. m Define a custom search policy for the computer if it needs to search additional directory servers, BSD configuration files, or service discovery protocols. m Use only the computer’s local directory domain. Using the Automatic Search Policy You can configure a Mac OS X computer to use the automatic search policy. This is the default configuration. You can configure a computer to use the automatic search policy by using the Directory Access application on the computer. The automatic search policy always includes the local directory domain. The automatic search policy also includes shared NetInfo domains to which the computer is bound and shared LDAPv3 domains supplied by DHCP. The shared NetInfo domains are optional, as are the shared LDAPv3 domains. For more information, see “Using NetInfo Domains” on page 105 and “Setting the LDAP Server for DHCP Clients” on page 505. To use the automatic search policy supplied by DHCP: 1 In Directory Access, click the Authentication tab or the Contacts tab. Click Authentication to configure the search policy used for authentication and most other administrative data. Click Contacts to configure the search policy used for contact information in some mail, address book, and personal information manager applications. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Choose Automatic from the Search pop-up menu, then click Apply. Defining a Custom Search Policy You can configure a Mac OS X computer to search specific Open Directory servers, LDAP servers, NetInfo domains, BSD configuration files, or directory service protocols in addition to the servers in the automatic search policy. You define a custom search policy with the Directory Access application on the computer that you want to configure. LL0395.Book Page 88 Wednesday, November 20, 2002 11:44 AM

Directory servers, NetInfo domains, and BSD configuration files that you want to add to the search policy. For instructions, see the subsequent sections of this chapter. To define a custom search policy for the computer: 1 In Directory Access, click the Authentication tab or the Contacts tab. Click Authentication to configure the search policy used for authentication and most other administrative data. Click Contacts to configure the search policy used for contact information in some mail, address book, and personal information manager applications. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Choose “Custom path” from the Search pop-up menu. 4 Click Add. 5 Select from the list of available directories and click Add. To add multiple directories, select more than one and click Add. 6 Change the order of the listed directory domains as needed, and remove listed directory domains that you don’t want in the search policy. Move a listed directory domain by dragging it up or down. Remove a listed directory domain by selecting it and clicking Remove. 7 Click Apply. Using a Local Directory Search Policy If you want to limit the access that a computer has to authentication information and other administrative data, you can restrict the computer’s authentication search policy to the local directory domain. If you do this, users without local accounts on the computer will be unable to log in or authenticate for any services it provides. You can configure a computer to use only its local directory domain by using the Directory Access application on the computer. To restrict a computer to its local directory domain: 1 In Directory Access, click the Authentication tab or the Contacts tab. Click Authentication to configure the search policy used for authentication and most other administrative data. Click Contacts to configure the search policy used for contact information in some mail, address book, and personal information manager applications. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Choose “Local directory” from the Search pop-up menu, then click Apply. LL0395.Book Page 89 Wednesday, November 20, 2002 11:44 AM

You can use the Directory Access application to change basic settings for accessing LDAPv3 servers, including the shared Open Directory domains of Mac OS X Servers: m Enable or disable use of LDAPv3 servers supplied by DHCP. m Reveal an intermediate level of LDAPv3 information and options. The Open Directory Assistant application also configures use of LDAPv3 servers supplied by DHCP, but does not offer as many options as Directory Access. Enabling or Disabling Use of DHCP-Supplied LDAPv3 Servers Your Mac OS X computer can automatically access LDAPv3 servers via DHCP. This automatic access requires that the DHCP service be configured to supply an LDAPv3 server on request. You can enable or disable this method of accessing an LDAPv3 server for each network location that is defined in the Network pane of System Preferences. To enable or disable automatic access to an LDAPv3 server: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 From the Location pop-up menu, choose the network location that you want to affect, or use Automatic. 5 Click the checkbox to enable or disable use of the LDAPv3 server supplied by DHCP. If you disable this setting, this computer doesn’t use any LDAPv3 servers supplied by DHCP. However, the computer may automatically access shared NetInfo domains. See “Using NetInfo Domains” on page 105 for more information. If you enable this setting, the DHCP service should be configured to supply one or more LDAPv3 server addresses. For instructions, see “Setting the LDAP Server for DHCP Clients” on page 505 in Chapter 11, “DHCP Service.” Showing or Hiding Available LDAPv3 Configurations You can show or hide a list of available LDAPv3 server configurations. When you show the list, you see and can change some settings for each LDAPv3 configuration. To show or hide the available LDAPv3 configurations: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. LL0395.Book Page 90 Wednesday, November 20, 2002 11:44 AM

use Automatic. 5 Click Show Options or Hide Options. Configuring Access to Existing LDAPv3 Servers On a Mac OS X computer that is not configured to access an LDAPv3 server automatically via DHCP, you can manually configure access to one or more LDAPv3 servers. You can do the following: m Create server configurations and enable or disable them individually. For instructions, see “Creating an LDAPv3 Configuration” on page 91. m Edit the settings of a server configuration. For instructions, see “Editing an LDAPv3 Configuration” on page 92. m Duplicate a configuration. For instructions, see “Duplicating an LDAPv3 Configuration” on page 93. m Delete a configuration. For instructions, see “Deleting an LDAPv3 Configuration” on page 93. m Change the connection settings for an LDAPv3 configuration. For instructions, see “Changing an LDAPv3 Configuration’s Connection Settings” on page 94. m Define custom mappings of Mac OS X record types and attributes to LDAPv3 record types, search bases, and attributes. For instructions, see “Configuring LDAPv3 Search Bases and Mappings” on page 94; “Mapping Config Record Attributes for LDAPv3 Directory Domains” on page 97; and “Editing RFC 2307 Mapping to Enable Creating Users” on page 97. m Populate LDAPv3 directory domains with records and data. For instructions, see “Populating LDAPv3 Domains With Data for Mac OS X” on page 98. Creating an LDAPv3 Configuration You can use Directory Access to create a configuration for an LDAPv3 server. To create an LDAPv3 server configuration: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Click New and enter a name for the configuration. 6 Press Tab and enter the LDAPv3 server’s DNS name or IP address. LL0395.Book Page 91 Wednesday, November 20, 2002 11:44 AM

or choose From Server. Before you can use Workgroup Manager to create users on a non-Apple LDAPv3 server that uses RFC 2307 (UNIX) mappings, you must edit the mapping of the Users record type. For instructions, see “Editing RFC 2307 Mapping to Enable Creating Users” on page 97. 8 Enter the search base for your LDAPv3 server and click OK. If you chose a template in step 7, you must enter a search base, or the LDAPv3 server will not function. If you chose From Server in step 7, you may be able to leave the search base blank and have the LDAPv3 server function. In this case, Open Directory will look for the search base at the first level of the LDAPv3 server. 9 Select the SSL checkbox if you want Open Directory to use Secure Sockets Layer (SSL) for connections with the LDAPv3 server. After creating a new server configuration, you should add the server to an automatic search policy supplied by a DHCP server or to a custom search policy. A computer can access an LDAP server only if the server is included in the computer’s search policy, either automatic or custom. For more information, see “Setting Up Search Policies” on page 87 and “Setting the LDAP Server for DHCP Clients” on page 505 of Chapter 11, “DHCP Service.” Editing an LDAPv3 Configuration You can use Directory Access to change the settings of an LDAPv3 server configuration. To edit an LDAPv3 server configuration: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Change any of the settings displayed in the list of server configurations. Click an Enable checkbox to activate or deactivate a server. To change a configuration name, double-click it in the list. To change a server name or IP address, double-click it in the list. Choose a mapping template from the pop-up menu. Click the SSL checkbox to enable or disable Secure Sockets Layer (SSL) connections. LL0395.Book Page 92 Wednesday, November 20, 2002 11:44 AM

You can use Directory Access to duplicate an LDAPv3 server configuration. After duplicating a configuration, you can change its settings. To duplicate an LDAPv3 server configuration: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Select a server configuration in the list, then click Duplicate. 6 Change any of the duplicate configuration’s settings. Click an Enable checkbox to activate or deactivate a server. To change a configuration name, double-click it in the list. To change a server name or IP address, double-click it in the list. Choose a mapping template from the pop-up menu. Click the SSL checkbox to enable or disable Secure Sockets Layer (SSL) connections. After duplicating a server configuration, you should add the duplicate to an automatic search policy supplied by a DHCP server or to a custom search policy. A computer can access an LDAP server only if the server is included in the computer’s search policy, either automatic or custom. For more information, see “Setting Up Search Policies” on page 87 and “Setting the LDAP Server for DHCP Clients” on page 505 of Chapter 11, “DHCP Service.” Deleting an LDAPv3 Configuration You can use Directory Access to delete an LDAPv3 server configuration. To delete an LDAPv3 server configuration: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Select a server configuration in the list, then click Delete. LL0395.Book Page 93 Wednesday, November 20, 2002 11:44 AM

You can use Directory Access to change the connection settings for an LDAPv3 server configuration. To change the connection settings of an LDAPv3 server configuration: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Select a server configuration in the list, then click Edit. 6 Click the Connection tab and change any of the settings. Configuration Name identifies this configuration in the list of LDAPv3 configurations. (You can also change the name directly in the list of LDAPv3 configurations.) Server Name or IP Address specifies the server’s DNS name or its IP address. (You can also change this directly in the list of LDAPv3 configurations.) “Open/close times out in” specifies the number of seconds that Open Directory waits before cancelling an attempt to connect to the LDAPv3 server. “Connection times out in” specifies the number of seconds that Open Directory allows an idle or unresponsive connection to remain open. “Use authentication when connecting” determines whether Open Directory authenticates itself as a user of the LDAPv3 server by supplying the Distinguished Name and Password when connecting to the server. “Encrypt using SSL” determines whether Open Directory encrypts communications with the LDAPv3 server by using Secure Sockets Layer (SSL) connection. (You can also change this setting directly in the list of LDAPv3 configurations.) “Use custom port” specifies a port number other than the standard port for LDAPv3 connections (389 without SSL or 636 with SSL). Configuring LDAPv3 Search Bases and Mappings Each LDAPv3 configuration that you create specifies where data needed by Mac OS X resides on the LDAPv3 server. You can edit the LDAPv3 search base for each Mac OS X record type. You can edit the mapping of each Mac OS X record type to one or more LDAPv3 object classes. For each record type, you can also edit the mapping of Mac OS X data types, or attributes, to LDAPv3 attributes. You edit search bases and mappings with the Directory Access application. LL0395.Book Page 94 Wednesday, November 20, 2002 11:44 AM

has separate LDAPv3 mappings for each record type. For detailed specifications of record types and attributes required by Mac OS X, see Appendix A, “Data Requirements of Mac OS X Directory Services.” To edit the search bases and mappings for an LDAPv3 server: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Select a server configuration in the list, then click Edit. 6 Click the Search & Mappings tab. 7 Select the mappings that you want to use as a starting point, if any. Click “Read from Server” to edit the mappings currently stored in the LDAPv3 server whose configuration you are editing. Click the “Access this LDAPv3 server using” pop-up menu, choose a mapping template to use its mappings as a starting point, or choose Custom to begin with no predefined mappings. 8 Add record types and change their search bases as needed. To add record types, click the Add button below the Record Types and Attributes list. In the sheet that appears, select Record Types, select one or more record types from the list, and then click OK. To change the search base of a record type, select it in the Record Types and Attributes List. Then click the “Search base” field and edit the search base. To remove a record type, select it in the Record Types and Attributes List and click Delete. To add a mapping for a record type, select the record type in the Record Types and Attributes List. Then click the Add button below “Map to __ items in list” and enter the name of an object class from the LDAPv3 domain. To add another LDAPv3 object class, you can press Return and enter the name of the object class. Specify whether to use all or any of the listed LDAPv3 object classes by using the pop-up menu above the list. Important When mapping Mac OS X user attributes to a read/write LDAPv3 directory domain (an LDAPv3 domain that is not read-only), the LDAPv3 attribute mapped to RealName must not be the same as the first attribute in a list of LDAPv3 attributes mapped to RecordName. For example, the cn attribute must not be the first attribute mapped to RecordName if cn is also mapped to RealName. If the LDAPv3 attribute mapped to RealName is the same as the first attribute mapped RecordName, problems will occur when you try to edit the full (long) name or the first short name in Workgroup Manager. LL0395.Book Page 95 Wednesday, November 20, 2002 11:44 AM

Attributes List. Then double-click the LDAPv3 object class that you want to change in the “Map to __ items in list” and edit it. Specify whether to use all or any of the listed LDAPv3 object classes by using the pop-up menu above the list. To remove a mapping for a record type, select the record type in the Record Types and Attributes List. Then click the LDAPv3 object class that you want to remove from the “Map to __ items in list” and click the Delete button below “Map to __ items in list.” 9 Add attributes and change their mappings as needed. To add attributes to a record type, select the record type in the Record Types and Attributes List. Then click the Add button below the Record Types and Attributes list. In the sheet that appears, select Attribute Types, select one or more attribute types, and then click OK. To add a mapping for an attribute, select the attribute in the Record Types and Attributes List. Then click the Add button below “Map to __ items in list” and enter the name of an attribute type from the LDAPv3 domain. To add another LDAPv3 attribute type, you can press Return and enter the name of the attribute type. To change a mapping for an attribute, select the attribute in the Record Types and Attributes List. Then double-click the item that you want to change in the “Map to __ items in list” and edit the item name. To remove a mapping for an attribute, select the attribute in the Record Types and Attributes List. Then click the item that you want to remove from the “Map to __ items in list” and click the Delete button below “Map to __ items in list.” To change the order of attributes displayed in the list on the right, remove all of the listed attributes and then add them again in the order that you want them listed. 10 Click Write to Server if you want to store the mappings on the LDAPv3 server so that it can supply them automatically to its clients. You must enter a search base to store the mappings, a distinguished name of an administrator (for example, cn=admin,dc=example,dc=com) and a password. If you are writing mappings to an Open Directory LDAP server, the correct search base is “cn=config, ” (where is the server’s search base suffix, such as “dc=example,dc=com”). The LDAPv3 server supplies its mappings to clients that are configured to use an automatic search policy. For instructions on configuring the client search policy, see “Setting Up Search Policies” on page 87. The LDAPv3 server also supplies its mappings to clients that have been configured manually to get mappings from the server. For instructions on configuring client access to the server, see “Creating an LDAPv3 Configuration” on page 91 through “Changing an LDAPv3 Configuration’s Connection Settings” on page 94. LL0395.Book Page 96 Wednesday, November 20, 2002 11:44 AM

If you want to store information for managed Mac OS X users in an LDAPv3 directory domain, make sure you map the following attributes of the Config record type: RealName and DataStamp. If you do not map these attributes, the following error message will be displayed when you use Workgroup Manager to change a user record that resides in the LDAPv3 directory domain: The attribute with name “dsRecTypeStandard:config” is not mapped. You can ignore this message if you are not using Mac OS X client management, which depends on the Config record type’s RealName and DataStamp attributes for a cache. Editing RFC 2307 Mapping to Enable Creating Users Before you can use Workgroup Manager to create users on a non-Apple LDAPv3 server that uses RFC 2307 (UNIX) mappings, you must edit the mapping of the Users record type. You do this with the Directory Access application. To enable creating user records on an LDAPv3 server with RFC 2307 mappings: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Select the RFC 2307 server configuration in the list, then click Edit. 6 Click the Search & Mappings tab. 7 Select Users in the list on the left. By default, “Map to __ items in list” is set to Any and the list on the right includes posixAccount, inetOrgPerson, and shadowAccount. 8 Change “Map to __ items in list” to All and change the list on the right to the exact set of LDAPv3 object classes to which you want the Users record type mapped. For example, you may want to delete shadowAccount from the list so that Users maps to only posixAccount and inetOrgPerson. Or you may want Users to map to account, posixAccount, and shadowAccount. To change an item on the list, double-click it. To add an item to the list, click Add. To delete the selected item from the list, click Delete. To change the order of listed items, drag items up or down in the list. LL0395.Book Page 97 Wednesday, November 20, 2002 11:44 AM

UNIX tool ldapsearch in a Terminal window. The following example would display the object classes for a user record whose cn attribute is “Leonardo da Vinci:” ldapsearch -x -h ldapserver.example.com -b "dc=example, dc=com" 'cn=Leonardo da Vinci' objectClass The output displayed for this example command could be something similar to the following: # Leonardo da Vinci, example.com dn: cn=Leonardo da Vinci, dc=example, dc=com objectClass: inetOrgPerson objectClass: posixAccount Populating LDAPv3 Domains With Data for Mac OS X After configuring LDAPv3 directory domains and setting up their data mapping, you can populate them with records and data for Mac OS X. For directory domains that allow remote administration (read/write access), use the Workgroup Manager application as follows: m Identify share points and shared domains that you want to mount automatically in a user’s /Network directory (the Network globe in Finder windows). Use the Sharing module of Workgroup Manager. For instructions, see Chapter 4, “Sharing.” m Define user records and group records and configure their settings. Use the Accounts module of Workgroup Manager. For instructions, see Chapter 3, “Users and Groups.” m Define lists of computers that have the same preference settings and are available to the same users and groups. Use the Computers module of Workgroup Manager. For instructions, see Chapter 6, “Client Management: Mac OS X.” In all cases, use the At pop-up menu in Workgroup Manager to choose the LDAPv3 directory domain. If the LDAPv3 domain is not listed in the At pop-up menu, choose Other from this menu to select the LDAPv3 domain. Note: To add records and data to a read-only LDAPv3 domain, you must use tools on the server that hosts the LDAPv3 domain. Using an Active Directory Server Your Mac OS X Server, like any computer with Mac OS X version 10.2, can use Open Directory to access an Active Directory domain hosted by a Microsoft Windows server. This section explains how to configure your Mac OS X Server and client Mac OS X computers to access an Active Directory server. This section also explains how to use your Mac OS X Server to populate the Active Directory domain with records and data. LL0395.Book Page 98 Wednesday, November 20, 2002 11:44 AM

can also change the connection settings and customize the mappings of an Active Directory server configuration. The procedures for all these tasks are the same for Active Directory servers as for LDAPv3 servers. For instructions, see “Configuring Access to Existing LDAPv3 Servers” on page 91. Creating an Active Directory Server Configuration You can use Directory Access to create a configuration for an Active Directory server. To create an Active Directory server configuration: 1 In Directory Access, click the Services tab. 2 If the lock icon is locked, click it and type the name and password of a server administrator. 3 Select LDAPv3 in the list of services, then click Configure. 4 If the list of server configurations is hidden, click Show Options. 5 Click New and enter a name for the configuration. 6 Press Tab and enter the Active Directory server’s DNS name or IP address. 7 Click the pop-up menu next to the DNS name or IP address and choose Active Directory. 8 Enter the search base for your Active Directory server, then click OK. 9 Select the SSL checkbox if you want Open Directory to use Secure Sockets Layer (SSL) for connections with the Active Directory server. After creating a new Active Directory server configuration, you should add the server to an automatic search policy supplied by a DHCP server or to a custom search policy. A computer can access an Active Directory server only if the server is included in the computer’s search policy, either automatic or custom. For more information, see “Setting Up Search Policies” on page 87 and “Setting the LDAP Server for DHCP Clients” on page 505 of Chapter 11, “DHCP Service.” Important Open Directory uses the LDAPv3 protocol, not Microsoft’s proprietary Active Directory Services Interface (ADSI), to connect to Microsoft’s Active Directory. This chapter does not explain how to configure Active Directory on a Windows server for LDAPv3 read/ write access. If you need assistance, consult an individual with Windows and Active Directory expertise, refer to the documentation for these products, or go to the product support center for your Windows server at the Microsoft Web site: www.microsoft.com/support/ LL0395.Book Page 99 Wednesday, November 20, 2002 11:44 AM

If you want a Mac OS X computer to get administrative data from an Active Directory server, the data must exist on the Active Directory server in the format required by Mac OS X. You may need to add, modify, or reorganize data on the Active Directory server. You must make the necessary modifications by using tools on the Active Directory server. To set up an Active Directory server for Mac OS X directory services: 1 Go to the Active Directory server and configure it to support LDAPv3-based authentication and password checking. 2 Modify the Active Directory object classes and attributes as necessary to provide the data needed by Mac OS X. Appendix B, “Integrating Mac OS X Directory Services With Active Directory,” describes two scenarios for using an Active Directory domain with Mac OS X Server. For detailed specifications of the data required by Mac OS X directory services, see Appendix A, “Data Requirements of Mac OS X Directory Services.” Populating Active Directory Domains With Data for Mac OS X After creating an Active Directory server configuration and setting it up for Mac OS X directory services, you can populate it with records and data for Mac OS X. If the Active Directory server allows remote administration (read/write access), use the Workgroup Manager application and the Server Settings applications as follows: m Identify share points and shared domains that you want to mount automatically in a user’s /Network directory (the Network globe in Finder windows). Use the Sharing module of Workgroup Manager. For instructions, see Chapter 4, “Sharing.” m Define user records and group records and configure their settings. Use the Accounts module of Workgroup Manager. For instructions, see Chapter 3, “Users and Groups.” m Define lists of computers that have the same preference settings and are available to the same users and groups. Use the Computers module of Workgroup Manager. For instructions, see Chapter 6, “Client Management: Mac OS X.” Note: To add records and data to a read-only Active Directory server, you must use tools on the Windows server. Accessing an Existing LDAPv2 Directory You can configure a Mac OS X computer to retrieve administrative data from one or more LDAPv2 servers. For each LDAPv2 server that you want the computer to access, you generally do the following: m Prepare the LDAPv2 server data. For instructions, see “Setting Up an LDAPv2 Server” on page 101. LL0395.Book Page 100 Wednesday, November 20, 2002 11:44 AM