Previous 1 2 Next 16 Replies Latest reply: Mar 25, 2013 2:29 AM by Maximilian S. Maurer
VincensoXFIN Level 1 (40 points)

Just a few question about OD Replica. Lets say that I have one server setup with OD Master in building 1, and I want to get Mac Mini server to building 2 what is 20km away. They will be on the same network. What will happen with home directories if I use the Mac Mini in building 2 as OD Replica and setup other computers in building 2 to use that for login, will the mini copy the home directories to its own hard drive, or just share them from main server in building 1?

iMac 27"
  • VincensoXFIN Level 1 (40 points)
    I know it copies the account data, but please tell me does it or does it not copy the home directories?
  • Gordon Davisson Level 3 (520 points)
    It does not copy the home directories. Open Directory replication only replicates the account's LDAP and password data, not files and folders (such as the home folder).
  • VincensoXFIN Level 1 (40 points)
    Thank you, thats what I thought, but just wanted to be sure.

    Im building a system at work. We have OD master setup and it works just great in the main department. We have also computers in 2nd department 20km away, connected via 2/2mb connection, and this is just not working. I thought the mini would speed up the login process, but it doesn't. It's still a very needed in 2nd department, but it did not have the effect what I wanted.

    I believe the problem is with the home directories what it loads from our main server. Its taking forever. Everyone has like 1-10gb homes and it tries to get that with that 2mb connection.

    I guess I need to figure out something else. Any suggestions? My first thought was to just use a local accounts there, they would still be able the use all the services, but they lose all the mobility of a network account.
  • Gordon Davisson Level 3 (520 points)
    There are a number of options that may improve things; which is best will depend on how your users use their accounts.

    If you have some users that just work in the 2nd department, a good option would be to move their home folders to the 2nd department server. A mini isn't really ideal as a home folder server, but it's probably going to be faster than mounting the home over the 2Mb link. Setting this up is fairly easy: connect to the mini with Server Admin, make sure the /Users folder is shared, and set it to automount in your network domain (with the options set to AFP and Use for user home folders...). Make sure the AFP service is running on the Mini. Then, in Workgroup manager, select the users you want to move, select the Home tab, and then select the mini server's Users folder from the list (if it's not there, something went wrong; don't try to add it with the "+" button). You will probably also want to move the users' data over (this procedure hasn't actually moved the home folder contents, just where the user will look for it). When moving home folders, be sure to preserve file&folder ownership.

    Another option is to set up mobile accounts for your users. This keeps the user's home folder on the client computer, with an option to sync it with the one on the server. Depending on usage patterns, this may or may not be faster than accessing the home folder over the network. You set this up in Workgroup Manager -> Preferences -> Mobility.

    If you think either or both of these options would help, I'd recommend picking one or two users to test on, and try various options (moving to the mini, trying with and without mobility, different sync policies, etc) to see what works best before rolling this out to everyone.
  • VincensoXFIN Level 1 (40 points)
    Thank you Gordon for these great tips.

    I have made some troubleshooting now and yeah, it all comes down to the internet connection on the 2nd department. You gave me a really good idea about where to start.

    What would be the Open directory role in this case? I believe I cant do that kind of changes with replica? So is it another Master then on the mini? The people from 2nd department rarely come to 1st department, but it happens from time to time, that's why it would be good to have the accounts synced at least in some level. If I have 2 masters, it means that I have to upkeep both of them. Not that it's a big deal, since 2nd department has like 10 users tops, and main department has around 50 users to manage. It is an option.

    _At some point I thought about this kind of solution, don't know if i would work, but here it is:_
    I would use two separate directories in the departments, but I would have the 2nd department users for both directories. Then at night time, I would sync the home directories to 1st department, giving them like a fair possibility to work in both departments if needed with the latest files they have. Not having like a live sync, but daily. I don't know tho if you can sync homedirectories with "different" users. Even if the account user and password are the same, can the homes be synced or will there be an ownership issue?

    The mobile accounts are a good idea aswel, I just need a few patient test subjects to work with when trying it out : )
  • Gordon Davisson Level 3 (520 points)
    I would leave the 2nd department mini a replica; there's no problem at all setting up automounted share points, setting home folders, etc on a replica (or even a "connected" server that's neither master nor replica) -- when you define an automount it asks for your directory administrator name and password, and uses that to connect to the master and make the necessary changes there.

    The advantage of this over two separate masters is that you don't have nearly as much work and complexity trying to keep your user setups in sync, syncing files, etc between the two locations; the disadvantage is that each user'd home folder is on one server or the other, so when users are visiting the "other" department, home folder access will be slow (although mobile accounts would mitigate this).
  • VincensoXFIN Level 1 (40 points)
    Okay, so, now I encountered some problems.

    I can't logn to Workgroup manager. It wont accept any login information I use. Same is for server preferences, it says that its not able to authenticate the credentials with Workgroup manager. Whats the deal here?

    There is nothing on the error log of Open Directory.

    Ok, as I write I realized that can this be DNS issue? The zone in our primary server is sibeliusopisto.internal. , and I used sibeliusopisto.janakkala. for this Mini server. When I login @ main server, I noticed the host is auto typed sibeliusopisto.local, and @ mini its sibeliusopisto-janakkala.local. Something wrong here?

    One other thing what came into my mind after the initial setup process, was that is it OK to use same root/admin username and password with 2 servers that are linked with OD ? Cos I did.
  • Gordon Davisson Level 3 (520 points)
    Using the same name & password on the two servers shouldn't be a problem unless it conflicts with the directory admin's name (by default this is diradmin/Directory Administrator). DNS is a much more likely source of trouble.

    First, check the full hostnames of the two servers by running the "hostname" Terminal command on each of them. Then, make sure both servers can look themselves and the other, both forward (name -> IP address) and reverse (IP number -> name). I'm not sure I understood what you said about the names of the two servers, but assuming their names are sibeliusopisto.internal (IP address and sibeliusopisto.janakkala (IP address, the test should look something like this:

    $ host sibeliusopisto.internal
    host sibeliusopisto.internal has address
    $ host domain name pointer sibeliusopisto.internal
    $ host sibeliusopisto.janakkala
    host sibeliusopisto.janakkala has address
    $ host domain name pointer sibeliusopisto.janakkala

    Again, run this test on both servers (and probably a client in each department as well, to make sure everyone else can find both servers). You should be getting full, consistent information everywhere, or else you're likely to run into trouble.

    Also, try running Workgroup Manager directly on the master server, and rather than putting anything into the Connect dialog, select Server > View Directories from the menu. Does that let you get into the server's directories?
  • VincensoXFIN Level 1 (40 points)
    Million thanks to you again Gordon!

    I ran some tests, and the hostnames are at main department sibeliusopisto.internal, and 2nd department sibeliusopisto.janakkala. The Main departments server DNS should be working properly, I get the following results with the Network Utility from both departments.

    ; <<>> DiG 9.6.0-APPLE-P2 <<>> -x +multiline +nocomments +nocmd +noquestion +nostats +search
    ;; global options: +cmd 10800 IN PTR sibeliusopisto.internal. 10800 IN NS sibeliusopisto.internal.
    sibeliusopisto.internal. 10800 IN A
    sibeliusopisto.internal. 10800 IN A

    But this is what I get in both departments about the sibeliusopisto.janakkala

    ; <<>> DiG 9.6.0-APPLE-P2 <<>> sibeliusopisto.janakkala +multiline +nocomments +nocmd +noquestion +nostats +search
    ;; global options: +cmd
    . 600 IN SOA (
    2011021400 ; serial
    1800 ; refresh (30 minutes)
    900 ; retry (15 minutes)
    604800 ; expire (1 week)
    86400 ; minimum (1 day)

    Ok, so it is wroooong. I was looking at the zones in both servers and I noticed something.

    Now I have 2 servers with both running own DNS, but I should only use one of them? If I add the 2nd server into A record in the primary zone on the main server, it can be resolved? Or ; If I add the main server into A record @ the 2nd departments DNS zone, will it work? Or should I recreate the same zone in the 2nd department server?

    This maybe sound stupid, but yeah. Im not an expert at this. Don't want to make any changes yet, I fear that I might lose connection and since Im 20km away I would need to get there to fix it.

    Any help appreciated.

    Thank you
  • Gordon Davisson Level 3 (520 points)
    I'll need some more info to make real recommendations here. First, Why are there two A records for sibeliusopisto.internal?
    VincensoXFIN wrote:
    ; <<>> DiG 9.6.0-APPLE-P2 <<>> -x +multiline +nocomments +nocmd +noquestion +nostats +search
    ;; global options: +cmd 10800 IN PTR sibeliusopisto.internal. 10800 IN NS sibeliusopisto.internal.
    sibeliusopisto.internal. 10800 IN A
    sibeliusopisto.internal. 10800 IN A

    Is one of those really the address for sibeliusopisto.janakkala? The only time you should have multiple A records for the same DNS name is when that server has multiple IP addresses (i.e. several network interfaces), or you're doing something like DNS-based load balancing (which you to not want on an OD master).

    Second, what normally provides DNS service at the two departments? Are there existing DNS servers, or is it just the OS X servers providing DNS? If there are multiple servers, you need to do some extra work to keep them all consistent, or you'll get weird results depending on which server happens to get queried...

    Third, tell me about the network & routing setup between the two departments. Are they both using private (e.g. 172.16-31.x.x) addresses? What address ranges are used at each department? Can they reach each other's private addresses, e.g. by something like a VPN connection?

    Finally, what're the IP addresses and configured hostnames (i.e. what does it print when you run the "hostname" command) of the two servers (so I can include them in recommendations)?
  • VincensoXFIN Level 1 (40 points)
    Thank you again!

    (First of all, Im speaking about Music Institute, my workplace)

    The sibeliusopisto.internal (the main server), shares it's services into two networks. 172.17.6.x and 172.17.144.x. The reason for this was that our management uses different network than our teachers with other institutes / companies (also working in the same bulding) management departments. The 144 network is like a private network for management, and 6 less private for all teachers. We have most of our client machines at 6 network, our management has like 6 computers at 144 network.

    The sibeliusopisto.internal (the main server) is setup to run DNS in the 6 network and its running at our main department building (big business facility). I think there is no other DNS inside this subnet (Except the Mini at 2nd department, but I guess this service has to be disabled for this thing to work). 144 network has another DNS, maintained by another institute.

    Inside our main building we have gigabit internal cables, and 100/100mb connection. This is setup by our ISP into the building, I have only worked here for a short time, so I dont know all the technical details. But all our floors have these network cabins, with network switches and these (dont know the right word here) boards with network sockets and cables coming in from every room in the floor, this is where I cant define what room and what socket has incoming connection.

    The 6 network is connected to both departments via WAN, so its only 172.17.6.x in 2nd department, and is our main network, since most of the clients are in this network. In this 2nd department building (20km away from our main department), I now have the Mini running. The connection between the two departments is 2/2mb at the moment, but just got order from the boss today to get it to 4/4mb.

    The mini is running at, hostname sibeliusopisto.janakkala .
    The main Mac Pro server at, hostname sibeliusopisto.internal .

    If I were not specific enough, please ask more and I try to answer.
  • Gordon Davisson Level 3 (520 points)
    Thanks for the info; I'm still a little confused about the setup, but you've given me enough info to start making recommendations. Since there's another DNS in the 144 network (run by the other department), I'd try to get together with them and make sure you're both serving consistent information: either make the entries you need in their DNS and have all of your computers use their server, or if you want to run your own DNS server make sure they have all of your entries AND you have all of theirs. As long as the routing is set up properly, there should be no problem with computers in the .6 network using a DNS server in the .144 network.

    As for what entries are needed, you need at least the forward and reverse entries for both servers:
    sibeliusopisto.internal. A
    sibeliusopisto.janakkala. A PTR sibeliusopisto.internal. PTR sibeliusopisto.janakkala.

    (note: how these are organized into zones is actually somewhat arbitrary, as long as all of the right records are there.)

    How does the main server come to have the address -- is this the second ethernet port, or something like that? If so, I'm not sure of the best way to handle it. Adding more forward and reverse records is probably good, but I haven't tried running an OD master this way so I can't be sure it'll work right:
    sibeliusopisto.internal. A PTR sibeliusopisto.internal.

    Another thing I'm a little confused by is that the 172.17.6.x network seems to be split between your two two departments, even though they're connected by a WAN link -- normally, a link like that would be a routed connection, so the networks at the two ends would need separate network addresses. Do you know enough about the setup to clarify?

    Now, as to how to straighten out the current mess: I'm pretty sure you'll need to switch the current replica back to standalone, but that may not entirely undo the mess it made when it replicated without proper DNS (note: do not simply shut the replica down, use Server Admin to explicitly change its role to "Standalone"). If the master doesn't start working after the replica is demoted, additional cleanup may be needed; one option would be to Server Admin to archive the master's data, then switch it to standalone (wiping out its network account database), re-promote it to master, and then restore the archive. If you haven't invested too much in the master's account setup yet, the best option might be to demote everything to standalone, then start over.

    I'd also recommend rethinking your domain names; in general, you're better off using a consistent domain suffix with different prefixes for the various computers; having two computers with the same "first name" (sibeliusopisto) may actually be part of the problem. The master's name cannot be easily changes (unless you destroy the OD master and start over), but changing the mini's name is reasonably easy (as long as it's not set up as a replica at the time). Set up the DNS for its new name, then use the command "sudo changeip sibeliusopisto.janakkala newname.internal" to switch the server's own idea of what its name is.
  • VincensoXFIN Level 1 (40 points)
    Thank you for the response once again Gordon. It's really good that I get some help with this.

    Just to make sure first, I have configured all our machines in the 144 network to use our server as primary DNS server @ The 6 and 144 networks are configured to server with two ethernet ports. One for 6 and one for 144. So far, I have managed to get the OD system to work pretty much the same in both networks and with same settings and services (You can use same account information from both networks and login, no problem).

    Gordon Davisson wrote:
    Another thing I'm a little confused by is that the 172.17.6.x network seems to be split between your two two departments, even though they're connected by a WAN link -- normally, a link like that would be a routed connection, so the networks at the two ends would need separate network addresses. Do you know enough about the setup to clarify?

    I'm afraid that my knowledge about how this was setup is not enough. All I can say, is that when I approached the ISP with this, they explained to me that this can be done, that the 172.17.6.x network is the same in both departments. But for instance, I cannot see any main departments computers in "Shared" tab in finder @ second department, and vise versa. But, the Remote Desktop still can search the network and find all computers from both departments in the same 172.17.6.x network, and I can connect our machines to the main server from 2nd department. Does this help at all?

    I was actually thinking that the DNS name would be a problem. I need to change that. I don't want to change the main server, so I just reinstall the whole mini server. Need to order external cd drive i guess.

    So, to make sure what you suggested:
    1) I add the sibeliusopisto.janakala (new name janakkala.internal or something) in the main servers DNS as an A record with its IP
    2) (You didn't suggest this but) Re-install the mini server with proper settings this time
    3) Setup the janakkala.internal to use our sibeliusopisto.internal as DNS?
    4) Setup client machines at 2nd department to use sibeliusopisto.internal as DNS (Information there leads to janakkala.internal)

    (Do I have to enable any DNS service at janakkala.internal then? If the records are made in the sibeliusopisto.internal, does the mini server need a DNS service running?)

    5) Setup the replica in the janakkala.internal when DNS is tested and working
    6) Setup clients to use janakkala.internal as network account server
    7) Make the configurations for the 2nd department users (move the home folders in the mini etc we spoke earlier)

    Thank you again Gordon. This is really stressful for me 'cos I'm afraid that I'm the only one here who has some kind of understanding of Macs, or even mac servers. Studied the Snow Leopard Server setup from , pretty helpful but it doesn't cover everything.

    Thank you for your help
  • VincensoXFIN Level 1 (40 points)
    Found a solution that fixed this situation
Previous 1 2 Next