How we set up multiple websites on OSX Server

BACKGROUND
After fiddling and futzing around for weeks (actually since last year) I've finally figured out how to set up multiple websites (virtual sites) using one port and one IP address. While there seems to be lots of discussion on this topic, it seems that the basic assumption is that one knows everything about websites, DNS and all that stuff, which I do not.

When our network was originally established the engineer set up a wiki and also configured webmail, so we had two sites, one secured for mail and the other open for Calendar and the wiki. We were not hosting any websites locally because our school website is hosted by a company in New England.

This year I wanted to set up websites for teachers and students. As great as the wiki is, there are some things it just can't do as well as a website. So I figured if I set up the sites teachers could link back and forth from one to the other. In addition kids could now start to use a real website instead of the cobbled together file mess I had when we ran a Windows network. Also iWeb is a much more accessible tool than FrontPage.

SERVER SIDE:
Snow Leopard Server - 10.6.4
There are two - actually three pieces if you want your iWeb clients to connect to the server: Server Side Web Services, DNS and, in my case, FTP.

================================================ SERVER SIDE - WEB SERVICES
If you haven't turned on Web services, you'll need to open Server Admin and do that. If you don't know how to set up web services - just reply and I'll step you through that as well.

Once web services are set up and turned on, you'll see it listed under your server’s name in the Server Admin sidebar. Click on "Web" and then click on the "Sites" tab at the top of page. This is where you list all your sites.

Click the plus button and enter the fully qualified name of your site, for example: "students.myschool.org". Don't use the defaults here (no name) - that's what got me in trouble before. BE SPECIFIC!

You'll be looking at the "General" tab (the other tabs, "Options", "Realms", etc. we'll deal with in a second).

On the "General Tab", the default IP address ("any") and port (80) is just fine. We'll run everything over port 80. (Apache figures all the virtual site stuff out - you don't need your rocket science degree for that.)

"Web Folder:" is important because this is how you'll "segment" your websites. While I would NEVER do this again, we have a solid state hard drive for the OS and a RAID array for our data files. IF you have that, make sure you do NOT use the default "Web Folder" because it will store all your files on your solid state drive. There may not be enough room, over time, on that drive. I've not experienced it yet, but it's my understanding that if the drive fills up, the server shuts down.

I store my web sites on a folder on the RAID array.

Everything else on that tab can be left as the default. (Just make sure that you have an "index.html" or "index.php" file in your web folder root, but iWeb will take care of that for you.)

I would put in your email address in the "Administrator Email:" field.

Under "Options" you really don't have to put anything. I've tested making websites with iWeb and it doesn't appear that anything needs to be checked.

Nothing needs to be entered in "Realms" as well from what I see working w/ iWeb.

The defaults in "Logging" are fine.

You can leave "Security" alone, but we do have a (self-issued) certificate listed for our webmail site.

"Aliases" is important. Under "Web Server Aliases" you enter how you want the site to respond to when users type in a URL in their web browsers.

When our web server was initially set up the engineer set up "wiki.myschool.org" on port 80 and "mail.myschool.org" on port 443. In the aliases section was nothing but a "*" (the wildcard character). That means, from what I can figure out, that the webserver will respond to these sites regardless of what is typed in the URL. (Well, something like that - point is, if you create OTHER websites, you'll NEVER get to them because the wildcard character in the "Aliases" section, in effect, grabs those web requests and redirects them to the sites that are already there.

In my case I deleted both of those wild card characters. For my "wiki.myschool.org" site, I entered "mail.myschool.org". That means if you type EITHER "wiki." or "mail.", go to the site that’s stored in the “Web Folder” we set up when those sites were created.

For "mail.myschool.org" I just DELETED the wildcard character. I wanted that site (since it was secured) only to respond to "mail." - nothing else. (You're not going to that secured site for any other reason than to get your mail.)

"Proxy" can be left blank. Have no idea what that does. As time permits I'll do some research and figure out what it's used for.

"Web Services" is if you want to provide any MORE services to this particular site. Most likely you'll want to uncheck all the boxes. For our "wiki." site, we have checked "Wikis", "Blogs", and "Calendar". For our "mail." site we have those checked PLUS "Mail".

I would create a separate "Web Folder" for each of your sites. I don't know if that's a requirement but for housekeeping purposes, I would keep the sites separated. And I SUSPECT that it's "best practice" to separate your wiki from your other websites.

SERVER SIDE - DNS
OK...now you have to make your site reachable and the only way to do that is to set up DNS so that folks don't need to type in the IP address of your web server. You need to set up DNS inside your network and, if you want folks in the outside world to reach your website, you'll need to set up an external DNS as well. I'm going to cover INTERNAL DNS - if you don't know how to set up EXTERNAL DNS - reply or email me and I'll post those instructions.

Most likely you have already created Zones for you network...all you really need to do is create "Aliases" so that when you type "students.myschool.org" your web browser will know that site resides on IP address XXX.XXX.XXX.XXX.

If you've set up Zones then you already have a "Machine" setting that translates your server’s name to an IP address and vice versa.

All you need to do is create an "Alias" (CNAME) record for, in this case, "students". You’ll see the choices for types of records when you click the "Add Record" button.

There are only two fields to configure for a record: "Alias Name" - in this case "students" and "Destination" - in this case "servername.myschool.org". (You've already entered a machine record that says "servername" = 192.168.1.x.)

That's it for Internal DNS.

SERVER SIDE - FTP
Now you have to get iWeb to communicate with the webserver.

There are only three ways iWeb will communicate with webservers: MobileMe, Local Folder and FTP Server.

Local Folder is really only practical if you want to host a website on a laptop (I was blown away initially when I found out that all Macs had a built-in web server - how neat is that?). I think there are some very cool things teachers could do with configuration, and, of course, you wouldn't need to set up any web services on the web server, but that's for another discussion. You need to set up FTP services on the web server.

Turn on and enable FTP on your webserver.

You can leave the defaults for "General", "Messages" and "Logging". "Advanced" is the only thing you want to set. I set "Authenticated Users See:" to "Home Folder Only". I set the "FTP Root" to the same root folder in which I plan to store my web sites (/VOLUMES/RAID Array/WebServer/Documents). This setting sets that folder only to be accessible via FTP.

I would suggest returning to your DNS settings and adding one more "Alias". Set "ftp." to point to your webserver. Why? So folks can edit their sites from home (see below).

CAVEAT: If you are running FTP on other servers, make sure that the settings here do not conflict with the settings on the other servers. For example, I'm running FTP on my file server so that my scanners can communicate with it. However, I configure my FTP settings by machine name and NOT "ftp.myschool.org".

================================================
CLIENT SIDE - CONFIGURING iWEB
Now you have to configure iWeb so that it will communicate with your server.

Click on the "Site" icon so that "Site Publishing Settings" appears.

Publishing:
"Publish to:" = "FTP Server"
You can set the "Site name:" and "Contact email:" to whatever you want. But see below!

FTP Server Settings:
"Server address"=ftp.myschool.org (you could also enter in servername.myschool.org or the IP address. However, if you want folks to be able to work on the site from home, you will need to configure external DNS for that. If you use the IP address, you're out of luck for remote access to the site. (You can do it but it's beyond the scope of this discussion.)

"Username" & "Password" should be your user's network login credentials.

"Directory/Path" - this is important. Remember, you set your "FTP Root" to be "/VOLUMES/RAID Array/WebServer/Documents". If you leave this field blank then the website will be dumped into this folder. If you are only setting up one site, that may be OK. However I wanted to set up a "students" site folder, a "faculty" site folder and a separate site for our literary magazine.

THEREFORE: I have, in my ..../Documents folder (on the server), a "students" folder, a "faculty" folder, and a "litmag" folder.

SO...in my "Directory/Path:" field, I have "/faculty". That means the full path to this website is "ftp root/faculty" or "/VOLUMES/RAID Array/WebServer/Documents/faculty" (You don't need a trailing "/" character. iWeb will automatically append the folder for you user depending on what you entered in "Site Name:" in the "Publishing" area.

Website URL:
This is the root website depending on whether it is "students" or "faculty". Since iWeb will append the site name to this root website, I accomplished what I hoped to accomplish in this post ( http://discussions.apple.com/message.jspa?messageID=12288561#12288561).

Faculty sites will be @ http://faculty.myschool.org/username. Students @ http://students.myschool.org/username. PERFECT!

iWeb is such a GREAT tool - NOW the kids can start using it!

I want to reiterate that this works for our school but it should work for you as well. There may be better ways to do this but it works for us.

Hope this has been helpful and you won't have to spend weeks trying to figure this all out by yourself!

MacBook Pro

Posted on Sep 21, 2010 9:36 AM

Reply
7 replies

Sep 25, 2010 8:20 PM in response to tcsadmin

I really like your post, as I am a professor trying to do the same sort of thing for my students.

A couple of question, are you able to limit the size of the folders for your students?

How do your prevent students from being able to access other students folders?

I was reading that using a blank disk image was the best way to limit folder size quotas, but I cant seem to get that to work using WebDav (your can read files, but can not edit the image for some reason).

When I setup FTP, it seemed to allow everyone access to folders, since the root was the folder that held all websites. I am just looking for a way to set the sites up, but limit total file size and secure the folders. Any help/clarification would be greatly appreciated.

Sep 25, 2010 8:32 PM in response to cmctrack

One caveat I forgot to mention, I need students to be able to access various folders. A student may have there own portfolio website, along with working on a couple of different sites for various projects they are on. So I can not just limit access to a home folder, since they may be working on several different folders, which I have set access by the groups in Open Directory

Sep 26, 2010 10:22 AM in response to cmctrack

No, I don't plan to limit folder size. That server has about 1.5 TB of space, so, at least initially, that should be OK. I do not plan to have them post movies to the site, but use embedded players from Vimeo & YouTube. I'll also be removing folders at the end of the school year.

I'm also not too concerned about unauthorized folder access. The folders are not shared, and if I HAVE to I can set permissions on the individual folders after they are created by iWeb. Alternatively, you could set up user folders ahead of time and set permissions that way. I just like the way iWeb does that for you.

I haven't figured out WebDav yet and can't figure what it's good for. iWeb seems to upload files just fine without it and I'm all for keeping things simple.

Check out page 65 in the File Server Administration manual. ( http://images.apple.com/server/macosx/docs/FileServer_Adminv10.6.pdf)

It LOOKS like you can set a disk quota for a group on a share point via the command line. But I'm not sure - that's what frustrates me about the documentation. In one section it talks about home folder only. So I don't know if you create a share point on your webserver (e.g. .../Webserver/Documents) and then use the command line to set a disk quota.

OR

If you have to set up a separate partition/volume and set the quotas on the volume in Server Admin. And I'm not sure you can do that on an existing volume without trashing what's already there.

This is where trial and error comes in and that's why I document everything I do so I know what works. I'm half way thinking about taking an extra mac-mini and installing an extra copy of OSX Server on it and playing around with it. That's how I figured this whole mess out in the first place by using an extra server I had.

When I set up FTP I set it up for the /Webserver/Documents folder only so that shouldn't allow access to anything else.

Hope that helps.

Oct 4, 2010 2:58 PM in response to tcsadmin

Wow, thanks for taking the time to check that out. I've been badgering apple for some good documentation on this and in the end they gave me the link to this post. Well done sir! You're now figuring things out for apple... However, I'm trying to get the site (which works now internally) out into the real world - and I could do with a hand configuring the DNS to expose it. Any chance you might be able to help apple out again (and myself too, fumbling around as I am)?

Oct 6, 2010 8:46 AM in response to 80srosstopher

OK...here's how we did it.

To get access to the website you created from outside your network there are a couple of steps.

First, you have to have a STATIC IP address from your ISP. If you have a T1 circuit, no problem...you usually get a couple of static IPs you can use. However, if you have a cable modem circuit, most likely you have a dynamic IP address which changes when you connect to the internet. Usually a static IP will cost a bit more because the ISP has to go through a couple of steps to set it up for you. But once you have the address, you now have a way for folks outside your network to connect with you.

(I’m also assuming that you use a router of some sort through which traffic flows out to the internet and that you aren’t using connection sharing or something like that.)

The next thing you need to do is have your new static IP address associated with the server on which you are hosting your website. You've probably already done that if your website works inside your network. However, you've associated a private ip (192.168.x.x, etc.) to your web server. That doesn't mean anything to folks on the outside because private IP addresses are just that - private - folks can't access them. (I won't get into VPN because that's a whole other topic.)

The way you associate your new static IP address to your web server is through some sort of dns application from your ISP. For example, we use TierraNet to manage our external DNS information. They have a web interface control panel that is very similar to the DNS interface for XServer. You can create CNAME records (aliases - other ways that folks can access your servers).

Basically you create an "A" (CNAME) record with a fully qualified domain name (e.g. webserver.myschool.org) and point it to your public IP address (XXX.XXX.XXX.XXX) which you just got from your ISP. It's going to take a while (24-48 hours) for this change to take effect. BTW, you can create as many “A” records as you want. For example mail.myschool.com and wiki.myschool.com could point to the same place.

You want to make sure that the fully qualified domain name you enter in the external dns utility matches the name you used when you created your internal dns records on your XServer.

OK...so now folks can get to your domain - but, remember, you have a private network IP scheme between them and you. You now have to tell your router that when web traffic arrives, allow it inside the network and direct it to your web server.

Let's say your public IP address is 205.100.112.50 and your web server is 192.168.0.5.

You have to create, in your router’s "Security Zone" (router companies call them different things) a couple of rules. Usually the first rule is: "Let everything inside the network get out to the web." You've probably already done that if folks inside the network can reach the internet.

You then have to tell the router to allow web traffic (port 80) into your network AND redirect that traffic to 192.168.0.5.

We use AdTran routers and they have a web interface which allows you to write "rules" affecting public and private traffic. Public is folks outside the network, private is folks inside.

AdTran calls them "Security Zones" and you modify those zones with policies.

So my "Policy" would say, in the above example, redirect traffic from my public IP (205.100.112.50) -> to my web server -> (192.168.0.5).

THEN you have to modify this policy with what AdTran calls "Traffic Selectors". You've said, OK, you can get in, but WHAT can get in?

The "Traffic Selector" is written to say: "Permit" "TCP" traffic from 205.100.112.50 only through Port 80. (That's the port that web traffic goes over. If you wanted a secure website, you'd add another traffic selector that opens port 443, for example.)

I'll tell you I'm no genius when it comes to this. I called AdTran and had them configure my router for me. I told them what I wanted done, they remoted into the router and configured it. But then I could go to the web interface and see what they did and then added rules later on when I wanted, for example, to get access to the network via Apple Remote Desktop or VPN into the network on my iPad.

I'd bet that your router has a maintenance agreement that includes this service and if it doesn't it should have.

I did find that I still had issues when I tried to set this up originally and it had to do with the ORDER of the policies. I can’t remember exactly what the issue was, but, effectively one of the policies highjacked traffic before the policy that I wanted got triggered. Simply moving them around in the list fixed that issue. So if you have this set up but still can’t access the site, check the order of your rules.

I don’t know if that helps or not, but I try to think about this stuff conceptually and then get someone to help me with the details. I work with this stuff so infrequently that I forgot how I did something 6 months or a year ago. I’m in the process of creating a wiki for the school which documents all this stuff, but that’s a major undertaking.

Cheers,
John

Oct 29, 2010 3:21 PM in response to tcsadmin

Thank you for such a great post. My main question though is regarding how you had set up the websites to work. You said you ended up with a students.myschool.org and and faculty.myschool.org yet I did not see how you had created the two different ones.

When I just go with one site, I add a folder to Documents within /library/webserver/documents but that always requires me to log in on that site.

If I don't add any folders at all (which is what I want to do) iWeb naturally wants to replace the basic apple wiki provided (which I can't lose as it hosts our podcast producer). But when I try adding a /faculty to the directory line in iWeb and create that folder in the correct place, it says that it can now complete the process.

If I go with creating a site through lets say server preferences and then it uploads to the server admin, I can never determine what the actually website link will end up being. I feel like I'm missing one aspect here.

Any thoughts would be helpful.
zillioxj@atc.edu

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How we set up multiple websites on OSX Server

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.