192 | Apple 10.6 specification

preparing 64 private keys 59 public keys 59 renewing 71 requesting 63, 64, 65 root 66 self-signed 61, 65 Server Admin 62, 148 services using 71 web service 137 wiki services 137

changip tool 145

chat service. See iChat service ClamAV 139

clients certificates 70

client-side logging 187 core dump information 179 group accounts 153 intermediate trust 62 NetBoot 27

See also users command-line tools backup tools 36

certificates 62, 70 daemon control 169

disk image installation 87, 88 disk space monitoring 173 erasing disks 99

identity changes 145 installing server software 104 partitioning disks 95, 98 permission considerations 150 restoration tools 36

server administration 48 startup disk changes 103

computer lists 151, 153 computer name 132, 133, 144 computers, administrator 83, 124, 125 computer-to-computer network 164 computer-to-switch network 165 computer-to-switch-pair network 165 concatenated RAID set 96 configuration

advanced 18 authentication 57 automatic 116, 118

connecting to network 109, 164, 165 DHCP 82

directory connection 112 Ethernet 109 interactive 113 introduction 18, 108 link aggregation 166 Open Directory 110, 112, 123 postponing 108

saving setup data 116, 118 server infrastructure 30 server types 18 services 122, 123, 155 settings overview 109 SSL 148

standalone server 110 types of 108

Console 173

core dump server 178, 179, 180

CSR (Certificate Signing Request) 63, 64, 65, 68

D

daemons, overview 169

Darwin (core operating system) 23 Date & Time preferences 132 debugging, server problem 171, 186, 187 df tool 173

DHCP (Dynamic Host Configuration Protocol)

service 30, 82, 134

digital signature 148

directories. See directory services, domains, folders directory services

directory domains 20, 111, 154 logs 186

planning of 26, 30

See also Open Directory disk images

encrypting 56

installing with 27, 47, 86, 91 Disk Utility 56, 95, 97, 99 disks

command-line management of 173 erasing free space 99 installation preparation 93 mirroring 96

monitoring tools 173 partitions 86, 94, 95, 97, 99 quotas 27

See also RAID diskspacemonitor tool 174 diskutil tool 95, 98, 99 ditto tool 36

DMZ, network 52

DNS (Domain Name System) service 30, 82, 133, 134, 144

documentation 13, 14, 15 Domain Name System. See DNS domains, directory 20, 111, 154

See also Open Directory drives. See disks

du tool 174

DVDs, installation 85, 100

Dynamic Host Configuration Protocol. See DHCP

192

Index

Image 192

Apple 10.6 manual 192

Contents

Mac OS X Server 019-1410/2009-08-15 Contents Administration Tools Enhancing Security Installation and Deployment Initial Server Setup Ongoing System Management Monitoring Your System Push Notification Server Index Contents About This Guide What’s in This Guide Using Onscreen Help To see the most recent server help topics Document Road Map Getting Started Preface About This Guide Getting Documentation Updates Getting Additional Information System Requirements for Installing Mac OS X Server Standards What’s New in Mac OS X Server ÂÂ iCal Server What’s New in Server Admin Understanding Server Configuration Methods Snmp NFS Supported Standards Radius System Overview and Supported Standards System Overview and Supported Standards Mac OS X Server’s Unix Heritage Planning Server Usage Determining Your Server Needs Determining Whether to Upgrade or Migrate Setting Up a Planning Team Identifying Servers to Set Up Determining Services to Host on Each Server Planning Server Usage Defining a Migration Strategy Migrating from WindowsDefining an Integration Strategy Defining Server Setup Infrastructure Requirements Defining Physical Infrastructure Requirements Setting up basic server infrastructure Minimizing the Need to Relocate Servers After Setup Defining Backup and Restore PoliciesMaking Sure Required Server Hardware Is Available Understanding Backup and Restore Policies Understanding Backup Types Understanding Backup Scheduling Understanding Restores Other Backup Policy Considerations Defining a Backup Verification Mechanism Command-Line Backup and Restoration Tools Understanding Time Machine as a Server Backup Tool ÂÂ Remote Access Settings ÂÂ Software Update ÂÂ Wiki ÂÂ Xgrid Server Admin Opening and Authenticating in Server Admin Server Admin Interface M N Customizing the Server Admin Environment Server Assistant Server Assistant is used for Server Preferences Workgroup Manager Workgroup Manager Interface Server Monitor Customizing the Workgroup Manager Environment For additional information, see Server Monitor Help ICal Service Utility ICal Service Utility Interface System Image Management Media Streaming Management Command-Line Tools RAID AdminServer Status Widget Xgrid Admin Podcast Capture, Composer, and Producer Apple Remote Desktop Enhancing Security About Physical Security About Network Security Firewalls and Packet FiltersNetwork DMZ VLANs MAC Filtering Transport Encryption Payload Encryption About File Security File and Folder PermissionsAbout File Encryption About Authentication and Authorization Secure Delete You have several options for authenticating users ÂÂ Secure Shell SSH Single Sign-On About Certificates, SSL, and Public Key Infrastructure Public and Private Keys Certificates About Certificate Authorities CAs About Identities About Self-Signed CertificatesAbout Intermediate Trust Certificate Manager in Server Admin To configure clients to trust a certificateFrom the command line Enhancing Security Readying Certificates Creating a Self-Signed Certificate Requesting a Certificate from a Certificate AuthorityTo create a self-signed certificate To request a signed certificate Creating a Certificate Authority To create a CA Enhancing Security Using a CA to Create a Certificate for Someone Else Importing a Certificate IdentityTo create a certificate for someone else To import an existing OpenSSL style certificate Managing Certificates Editing a Certificate Distributing a CA Public Certificate to Clients Deleting a CertificateTo distribute your certificate to your clients To delete a certificate Using Certificates Renewing an Expiring CertificateReplacing an Existing Certificate To renew an expiring certificate Key-Based SSH Login To do this, run the following commands in TerminalSSH and SSH Keys Generating a Key Pair for SSH Key-Based SSH with Scripting Sample Administration Level Security Setting Administration Level Privileges Service Level Security Setting Sacl PermissionsTo set Sacl permissions for a service Security Best Practices Password Guidelines Creating Complex Passwords Installation Overview Confirm you meet the requirements Gather your information Set up the environment Start up the computer from an installation disk Start the installer Prepare the target disk Set Up Services Gathering the Information You Need Setting Up Network Services About the Server Install DiscConnecting to the Directory During Installation SSH During Installation Preparing an Administrator Computer Mac OS X Server Install DiscAdministration Tools CD About Starting Up for Installation To install Mac OS X Server v10.6 administration toolsBefore Starting Up Starting Up from the Install DVD To start up the computer with the installation discStarting Up from an Alternate Partition Create a restorable image of the Install DVD Restore the image to the alternate partitionTo create an image of the Install DVD Prepare the disks and partitions on the target computer To restore the image to a free volume Remotely Accessing the Install DVD To access the computer with Server Assistant To access the computer with VNC To access the computer using Screen SharingTo access the computer with SSH Identifying Remote Servers When Installing Mac OS X Server Identify the target server Starting Up from a NetBoot Environment Preparing Disks for Installing Mac OS X Server Create a NetInstall image from the Install DVD Start up the computer from the NetBoot server To create a NetInstall image from the Install DVD Choosing a File System ÂÂ Mac OS Extended Journaled, Case-Sensitive aka Hfsx About Hard Disk Partitioning To partition a disk using Disk Utility Partitioning a Disk So the command is About Creating a RAID Set To create a RAID set using Disk Utility You cannot create a RAID set from the startup disk Diskutil createRAID mirror setName format device device Installing Server Software Interactively For example Installing Locally from the Installation Disc To install server software locally Installing Remotely with Server Assistant To install on a remote server by using Server Assistant Installing Remotely with Screen Sharing and VNC Changing a Remote Computer’s Startup Disk To change a remote computer’s startup disk To use installer to install server software 105 Installing Multiple Servers Most Efficient Methods of InstallationMore Interactive Methods of Installation How to Keep Current Upgrading a Computer from Mac OS X to Mac OS X Server Postponing Server Setup Following Installation To postpone setting up Mac OS X ServerInformation You Need Connecting to the Network During Initial Server Setup Configuring Servers with Multiple Ethernet PortsAbout Settings Established During Initial Server Setup Specifying Initial Open Directory Usage ÂÂ Create Users and Groups Not Changing Directory Usage When Upgrading ÂÂ Configure ManuallyÂÂ Import Users and Groups Setting Up a Server as a Standalone Server Binding a Server to Multiple Directory Servers Setting up Servers Interactively To interactively connect to an additional directory server To set up servers interactively Select the target servers from the configuration list Using Automatic Server Setup Creating and Saving Setup Data To create a setup data file Using Encryption with Setup Data Files How a Server Searches for Saved Setup Data Files Setting Up Servers Automatically Using Data Saved in a File To use setup data from a file remotely Create the saved setup folder on the remote serverRestart the remote server To set the server serial number Handling Setup Errors Setting Up Services Adding Services to the Server ViewTo change services to administer From the command-line Setting Up Open Directory Setting Up User ManagementSetting Up All Other Services To set up a user account Computers You Can Use to Administer a Server Setting Up an Administrator Computer Using a Non-Mac OS X Computer for Administration Insert the Mac OS X Server Admin Tools CD Using the Administration Tools Working with Pre-v10.6 Computers from v10.6 Servers Ports Used for Administration Ports Open By Default Server Admin Basics Adding and Removing Servers in Server Admin Grouping Servers Using Smart Groups Grouping Servers ManuallyTo create a server group Working with Settings for a Specific Server To create a server smart group Toolbar button Shows 132 ÂÂ Directory Service ÂÂ Firewall ÂÂ Mobile Access ÂÂ NetBootUnderstanding Mac OS X Server Names Directory Service and Kerberos Dhcp Mobile Access Proxy Services NetBootFirewall ÂÂ MySQL Web Certificates for Web and Wiki Services MySQLWiki 138 Certificates for Mail Services ÂÂ Certificates for collaboration servicesImap and POP Mailing List Address Book Service ICal ServiceIChat Service Certificates for Collaboration Services To change the IP address of the Podcast Producer computer To change the DNS name of the Podcast Producer computer Software Update Server PrintPush Notification Xgrid Changing the Server’s DNS Name After Setup Changing the IP Address of a ServerChanging the Server’s Computer Name and the Local Hostname To change the DNS name Administering Services From the command lineTo change computer name and local hostname Adding and Removing Services in Server Admin Importing and Exporting Service SettingsTo add or remove a service in Server Admin To export service settings Controlling Access to Services To configure service access SACLs Using SSL for Remote Server Administration Managing Sharing Tiered Administration Permissions Defining Administrative Permissions Workgroup Manager BasicsTo assign permissions Administering Accounts Opening and Authenticating in Workgroup ManagerWorking with Users and Groups 152 Defining Managed Preferences Working with Directory Data To display the inspector Service Configuration Assistants Critical Configuration and Data FilesAssistants are available for the following services General Firewall Service Mail ServiceIChat Server Mail-POP/IMAP Server Dovecot MySQL Service NAT Service OpenDirectory Service NotificationsQuickTime Streaming Server Tomcat App Server Improving Service Availability Web ServiceEliminating Single Points of Failure Wiki and Blog Server Using Xserve for High Availability Setting Up Your Server for Automatic Restart Using Backup PowerUsing UPS with Xserve Following is the Energy Saver panel of System Preferences To enable automatic restart Ensuring Proper Operational ConditionsProviding Open Directory Replication Automatic restart options are Link Aggregation About the Link Aggregation Control Protocol Lacp Link Aggregation Scenarios Computer to Switch Setting Up Link Aggregation in Mac OS X Server To create a link aggregate Monitoring Link Aggregation Status To monitor the status of a link aggregate Load Balancing Using launchd for Daemon Control ÂÂ mDNSresponder local network service discovery processDaemon Overview Viewing Running Daemons 170 Planning a Monitoring Policy Planning Monitoring Response Using with Server Status Widget Using Server MonitorTo configure the Server Status widget Using RAID Admin for Server Monitoring Using Console for Server MonitoringUsing Disk Monitoring Tools Using Network Monitoring Tools Using Server Status Notification in Server Admin Monitoring Server Status Overviews Using Server AdminTo set a notification To see a status overview for one server Using Remote Kernel Core Dumps Following shows a sample Overview pane for a single server 177 Setting Up a Core Dump Server Setting up a core dump server Setting Up a Core Dump Client Setting up a core dump clientRestart the computer for the settings to take effect Configuring Common Core Dump Options About Simple Network Management Protocol Snmp Configuring snmpd To enable SnmpEnabling Snmp reporting To enable and configure Snmp Customize data Restart snmpd to take changes About Notification and Event Monitoring Daemons Additional Information about SnmpTools to Use with Snmp There are two main notification daemons syslogd and emond Logging Syslog Directory Service Debug Logging Syslog Configuration FileOpen Directory Logging To start debugging at startup To enable client-side logging Additional Monitoring AidsAFP Logging To run slapd in debugging mode Push Notification Server About Push Notification Server To enable Push Notification Starting and Stopping Push Notification Changing a Service’s Push Notification Server Click Save, then restart the serviceTo change the existing push notification server Index 192 193 194 195 196 197