Brett Grant

Q: Trying to understand HT203325: Don‘t log in to the server with a network user‘s account

This is a home network kind of questions.  Basically what I want to do is set up a unified environment with profiles.  I have a couple of iMacs, a couple of MacBooks, and some iPods, iPads, and iPhones.

 

I would like to run server on one of my iMacs, but this note from Apple indicates that I will have problems.  I don't have a machine that I can run as a dedicated server, I need all of the machines to be accessible by any user in Open Directory.

 

The more I read the note, the less I seem to understand.  Forgive me, I am not a professional IT person.  I have set up Apple servers quite a while back (10.4 & 10.5) and we had no issue with network users logging on at the actual server.

 

It used to be that the home directories were shared with either AFP or NFS.  I thought that I saw that they are now shared with AFP or SMB.  Is the note trying to say that if the server is mounting a share, that no other clients can mount and access a share until the server has unmounted it?  That seems to contradict the point of network sharing.

 

Is there anyway to overcome this issue?  I tried google, but I see a lot of posts that point to Apple's note, but not really any that help fix the issue.  Could I run Server on both iMacs, put OD on one, and share the home directories from the other?  I think that would make it so the home directory is never hosted on the same machine where authentication takes place.

 

Any clarification would be appreciated.

 

Thanks,

Brett

 

PS: My macs are fairly new, so I can update them all to 10.11.2 & I haven't bought Server, so I would get the latest and greatest for that, too.

Posted on Dec 16, 2015 12:33 PM

Close

Q: Trying to understand HT203325: Don‘t log in to the server with a network user‘s account

  • All replies
  • Helpful answers

  • by MrHoffman,

    MrHoffman MrHoffman Dec 16, 2015 12:56 PM in response to Brett Grant
    Level 6 (15,627 points)
    Mac OS X
    Dec 16, 2015 12:56 PM in response to Brett Grant

    Try it.   But I would not expect what you're trying to do will be reliable, and I would not recommend using a server as an interactive workstation — the two tasks are generally at cross-purposes.

     

    If you want shared file storage, activate that on OS X client, or install and use a NAS box.   There's no need for server, if network storage is the goal.

     

    Running a server means setting up DNS services locally, and a variety of other tasks.   It used to be possible to mostly get away without doing that, but 10.5 started to get flaky without local DNS services, and network authentication and security are now commonplace, and that doesn't work at all well without local DNS.

     

    Servers are also expected to be available all the time, and — as often happens — shared systems can be rather less stable as software is changed, the systems are shut down, or otherwise.

     

    NFS has been available on OS X for many years, and some folks have manually configured remote access via NFS.   It's much more common to see AFP and increasingly CIFS/SMB used, though.

     

    From HT203325: Users can be local as is typical of most OS X client configurations, or they can be what are known as network users — users with their login directory located elsewhere, and often with access and the same password across multiple systems.   If the users are configured as network users of the server, then don't allow those users to log directly into the server.   That — the server serving files and directories from itself back to itself — isn't reliable.  Not per that tech note, and not per what I've encountered.

  • by Brett Grant,

    Brett Grant Brett Grant Dec 16, 2015 3:51 PM in response to MrHoffman
    Level 1 (10 points)
    Dec 16, 2015 3:51 PM in response to MrHoffman

    Thank you for your quick response.  The server wouldn't be "used" like a workstation and a server at the same time.  In reality, the most that it would have to share is 4 user directories.  And we are not a video production house.  Probably the most intensive app that would be running would be iTunes or Word.  Maybe Word and Excel at the same time.

     

    I was looking for a little bit more control than just shared storage, although I do like shared storage for photos, iTunes, etc.  Do you think that there is a way to have the same log on credentials on all 4 machines without manually sync'ing them?  I looked at chronsync, and they don't recommend syncing the ~/Library files, I assume that some files are machine dependent.  Plus, I wanted to write some simple policies and push those out to all of the machines.

     

    I had this issue back with Mavericks, so I have the feeling that it hasn't been fixed.  It just seems very silly to me that this doesn't work, especially when it used to in Tiger and Leopard.

  • by Leopardus,Helpful

    Leopardus Leopardus Dec 17, 2015 6:42 PM in response to Brett Grant
    Level 4 (1,122 points)
    Desktops
    Dec 17, 2015 6:42 PM in response to Brett Grant

    We run a system at home, similar to what you want to setup. It consist of a Mini (2012), iMac (2013), two MBP's (2010,2012), 2 iPad's and iPhone and iPod Touch. The network is provided by a Time Capsule and two Airport Expresses. The system runs DNS, OD, caching, file sharing, mail, calendar, contacts and we use Profile Manager as the MDM. The Mini serves mainly as a media server with Tunespan across various drives. We have 4 users in our household.

    The Tech article states that you should avoid logging on to the server with a user account whose home directory is hosted on the server. This means that the home directory of that user should be hosted on another Mac. When doing that, the mounting and unmounting is not an issue, and the server serves all shares. Admittedly, we also don't do extensive Video at home, but we do simultaneously sometimes watch different things from the local net and or the internet without any problems.

    It is worth a try as MrHoffman indicated. It works for us.

     

    Leo

  • by MrHoffman,Solvedanswer

    MrHoffman MrHoffman Dec 17, 2015 7:09 AM in response to Brett Grant
    Level 6 (15,627 points)
    Mac OS X
    Dec 17, 2015 7:09 AM in response to Brett Grant

    In no particular order...


    Whether you are not IT or don't have familiarity with IT, you are on a path that means somebody locally will be providing IT.   OS X Server is easier to manage than many other servers, but it's still a server and still requires some knowledge of DNS and IP networking, certificates and some other tasks.


    What you're looking for will work, modulo network users logging into the server locally; self-serving.

     

    The OS X Server tools are wildly different from the era of Tiger and Leopard — I got away with quite a lot back then, in terms of the setups, and the tools allowed great flexibility.  The newer tools are far simpler, and the configurations far more constrained.  The security expectations are far higher now, too.   Both fortunately and unfortunately, the OS X Server tools have gotten vastly simpler starting at 10.7. The detailed manuals are only for the older tools — here's the old User Management manual, which discusses the background on what you're centrally interested in, including network users and Portable Home Directory users, etc.   (With recent OS X Server releases, the network and PHD users have effectively been merged, too.  Work Group Manager.app and Server Admin.app are gone.)   Keep scrolling through the servers and enterprise manuals for others for 10.6 manuals, and see the help text in Server.app for the current documentation. 

     

    The underlying software mechanisms are largely the same, the UI is much different, and much simpler.

     

    Shared credentials means OS X Server with Open Directory, or Windows Server with Microsoft Active Directory, or analogous.

     

    More than a few data files are not intended to be shared on OS X — the first storage engineers that I encountered that were offering controller-level storage replication and synchronization back in the 1980s got it wrong, and the current generation of storage folks are still getting it wrong to this day.  It's not an easy problem, and both the OS and the applications must to be involved in getting a consistent and correct copy of the application data.   Otherwise, you might get lucky, or you might get inconsistent data.  Apps that only work with one file can be somewhat easier to backup or to clone here, and apps that use a database — so long as the backup tools or the clone tools coordinate with the database — can usually be copied or cloned reliably.   But most storage controllers and more than a few clone tools do not communicate directly with nor work with database software.   This applies across approaches based on tools such as rsync, and to mechanisms built into higher-end storage controllers, and other such.    Which means that getting reliable copies is a tough problem.   This is also part of why folks often synch their home directories at logout.   But I digress.


    With local servers, you must set up DNS services locally, as attempts to reference ISP or public DNS won't work for hosts on a NAT.   With either OS X Server or Active Directory — or pretty much anything else similar — this means setting up one or more DNS servers on your local network.  DNS should be the first service established on a server, if there isn't another DNS infrastructure active for the local network — ISP and public DNS servers cannot provide this.   Don't skip this step, as the errors here tend to be pernicious.

     

    You're looking for a one-host all-in-one workstation-as-a-server configuration, and that's not what Apple intends for OS X Server.


  • by Brett Grant,

    Brett Grant Brett Grant Dec 17, 2015 6:42 PM in response to MrHoffman
    Level 1 (10 points)
    Dec 17, 2015 6:42 PM in response to MrHoffman

    I am going to mark MrHoffman's last post as answered.  I think that he brings up some good points, and I appreciate the time that he took to write it all up.  Leo also gives me some hope that it can be done.

     

    Thanks All.

    Brett