Q: Trying to understand HT203325: Don‘t log in to the server with a network user‘s account
This is a home network kind of questions. Basically what I want to do is set up a unified environment with profiles. I have a couple of iMacs, a couple of MacBooks, and some iPods, iPads, and iPhones.
I would like to run server on one of my iMacs, but this note from Apple indicates that I will have problems. I don't have a machine that I can run as a dedicated server, I need all of the machines to be accessible by any user in Open Directory.
The more I read the note, the less I seem to understand. Forgive me, I am not a professional IT person. I have set up Apple servers quite a while back (10.4 & 10.5) and we had no issue with network users logging on at the actual server.
It used to be that the home directories were shared with either AFP or NFS. I thought that I saw that they are now shared with AFP or SMB. Is the note trying to say that if the server is mounting a share, that no other clients can mount and access a share until the server has unmounted it? That seems to contradict the point of network sharing.
Is there anyway to overcome this issue? I tried google, but I see a lot of posts that point to Apple's note, but not really any that help fix the issue. Could I run Server on both iMacs, put OD on one, and share the home directories from the other? I think that would make it so the home directory is never hosted on the same machine where authentication takes place.
Any clarification would be appreciated.
Thanks,
Brett
PS: My macs are fairly new, so I can update them all to 10.11.2 & I haven't bought Server, so I would get the latest and greatest for that, too.
Posted on Dec 16, 2015 12:33 PM
In no particular order...
Whether you are not IT or don't have familiarity with IT, you are on a path that means some locally will be providing IT. OS X Server is easier to manage than many other servers, but it's still a server and still requires some knowledge of DNS and IP networking, certificates and some other tasks.
What you're looking for will work, modulo network users logging into the server locally; self-serving.
The OS X Server tools are wildly different from the era of Tiger and Leopard — I got away with quite a lot back then, in terms of the setups, and the tools allowed great flexibility. The newer tools are far simpler, and the configurations far more constrained. The security expectations are far higher now, too. Both fortunately and unfortunately, the OS X Server tools have gotten vastly simpler starting at 10.7. The detailed manuals are only for the older tools — here's the old User Management manual, which discusses the background on what you're centrally interested in, including network users and Portable Home Directory users, etc. (With recent OS X Server releases, the network and PHD users have effectively been merged, too. Work Group Manager.app and Server Admin.app are gone.) Keep scrolling through the servers and enterprise manuals for others for 10.6 manuals, and see the help text in Server.app for the current documentation.
The underlying software mechanisms are largely the same, the UI is much different, and much simpler.
Shared credentials means OS X Server with Open Directory, or Windows Server with Microsoft Active Directory, or analogous.
More than a few data files are not intended to be shared on OS X — the first storage engineers that I encountered that were offering controller-level storage replication and synchronization back in the 1980s got it wrong, and the current generation of storage folks are still getting it wrong to this day. It's not an easy problem, and both the OS and the applications must to be involved in getting a consistent and correct copy of the application data. Otherwise, you might get lucky, or you might get inconsistent data. Apps that only work with one file can be somewhat easier to backup or to clone here, and apps that use a database — so long as the backup tools or the clone tools coordinate with the database — can usually be copied or cloned reliably. But most storage controllers and more than a few clone tools do not communicate directly with nor work with database software. This applies across approaches based on tools such as rsync, and to mechanisms built into higher-end storage controllers, and other such. Which means that getting reliable copies is a tough problem. This is also part of why folks often synch their home directories at logout. But I digress.
With local servers, you must set up DNS services locally, as attempts to reference ISP or public DNS won't work for hosts on a NAT. With either OS X Server or Active Directory — or pretty much anything else similar — this means setting up one or more DNS servers on your local network. DNS should be the first service established on a server, if there isn't another DNS infrastructure active for the local network — ISP and public DNS servers cannot provide this. Don't skip this step, as the errors here tend to be pernicious.
You're looking for a one-host all-in-one workstation-as-a-server configuration, and that's not what Apple intends for OS X Server.
Posted on Dec 17, 2015 7:09 AM