Hi Craig
To be honest I think its going to be a struggle. As I see it you have two options. Integrate OD with your existing AD network or set up a separate network divorced from the rest of the school network. However its worth trying a few things to see if its possible to get you up and running, you won’t lose anything as nothing is working anyway!
the active directory isnt a proxy server the school
has there own proxy.maidenerleg.wokingham.sch.uk
Every Macintosh Operating System has a Proxies tab in the Network Preferences Pane. You configure the WebProxy part of this with the same information as above. Make sure you have the correct port number and an authenticated account that is allowed to use the proxy server. You can use the same one for all of the mac clients as well as the server.
I can use a set up 20 free ip adresses on the network
if that helps i didnt want to set up dhcp incase it
messed up the windows network and started giving pcs
ip addresses.
Yes do this and make sure you assign all of the macs with fixed IP addresses that are within that range. Not switching on the DHCP Service on your mac server is a good idea as it would mess up the windows network.
they really need internet access really,
Once you have configured each mac client with the proxy server settings test them for internet connectivity. You should not have to put anything in the DNS Servers field, leave it blank. Turn your attention to the server and stop the DNS Service. Now configure the server to use the proxy server settings. Test for internet connectivity. Go back to the DNS Service and make sure it is configured correctly, when you are happy start the service and place the Server’s own IP address in the DNS servers field. Launch terminal and issue this command:
host macserver.maidenerlegh.sch.uk
you should see this returned
macserver.maidenerlegh.sch.uk has address 10.20.128.71
now issue:
host 10.20.128.71
you should see this returned
71.128.20.10.in-addr.arpa domain name pointer host10.20.128.71.in.addr.arpa.macserver.maidenerlegh.sch.uk
If you get this then DNS is resolving correctly. Test again for internet connectivity. Now demote the Server back to Standalone. You will lose any users already entered in the LDAP Directory node in WorkGroup Manager. I have a feeling you don’t have too many in there and that it would not be a big problem to key them in again.
Before we carry on a brief word regarding Kerberos as you asked this question:
so what does kerberos actually do and
how do i activate it I had a look at it and it
just confused me to put it simple
Kerberos was developed by MIT as a method of authentication that allows users to have just one account and password to access all server based services. You may have noticed that there are now passwords to logon to the computer as well as one for access to the internet and yet another one for Mail. . . you get the picture? Would it not be a good idea to have just one password? One that will give a user access to everything the user was allowed to have access too? Kerberos or Single Sign On (SSO) was developed to do just this. Its not perfect and does not allow for Legacy authentication methods, but its ideal for larger organizations such as schools. Kerberos is activated on promotion to Open Directory Master. Once this happens your server becomes the Kerberos Distribution Centre (KDC) concerning itself with handing out service tickets to authenticated users that exist in WorkGroup Manager. However your situation is complicated because you already have an existing KDC on the network. Your AD Server is one. Unless you plan properly having two KDCs on the same network and IP address range can cause all sorts of problems. It is possible to divorce Kerberos from OpenLDAP as Apple have implemented it, but in my experience its tricky. For the Active Directory, Kerberos is always on. If you want to know more consult the Open Directory Admin manual, or MITs website or just google it.
When you are ready and happy promote the Server to Open Directory Master. You should be able to create the default diradmin account. If everything has gone correctly you should see MACSERVER.MAIDENERLEGH.SCH.UK in the Kerberos Realm Field as well dc=macserver,dc=maidenerlegh,dc=sch,dc=uk in the search base field automatically filled in for you. When you go back to the Overview pane for Open Directory you may still see Kerberos as being Stopped. This is not surprising as the Windows Server is the active KDC on the network. However continue past this as PasswordServer may suffice. Launch WGM and authenticate to the /LDAPv3/127.0.0.1 node. You should see Directory Administrator (UID 1000) already there. Start populating with Users, just do one to begin with. Select Sharing and make sure the default Users folder is being shared. Select Network Mount, authenticate using diradmin and make sure Network Mounting is enabled for Users Home Folders. Apply changes. Go back to Users, select the user and then select home, you should now see the home folder diretory path, select this and click Create Home Now followed by Save. Navigate to the Users folder using the Finder to see if the folder has been created. You are almost there. Go back to your clients and add the OD Server’s IP address in the DNS Server’s field, now launch Directory Access and scrub the existing LDAPv3 setting there. Create a new configuration and use the OD Server’s IP address. Discovery should be fairly quick. Don’t provide any user names and passwords just continue past this point until the configuration has taken. Now log out and test using the created user in WGM by clicking Other.
all the machines are in one room yet there are other
machines on the switch there on i belive
As already mentioned it may be useful for you to have your own switch and router that will keep this network separate from the AD network. Ideally I would recommend this for you. There are some excellent companies not far from you who would do this for you. Apple Regent Street being one of them. Ideally you should be trying to supplement your Active Directory with Open Directory. However this would be too involved to go into in this forum. You should really be consulting with a professional who can come to your site and implement an effective strategy for you that will give you what you want.
Let us know how you get on. Good Luck!! – Tony
