Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

pts Author

Level 1

16 points

Open directory doesn't work

I want to use open directory on my university lab network. The server (10.8) is not in the same room as the clients (also 10.8). Each computer (server and clients) have their own external FQDN's and associated IP addresses. I turned on Open Directory using server.app on my sever. I then go to a client and do: system preferences>users and groups>login options>Network account server: Join>open directory utility. From there I do File>connect. When I type in the FQDN of the server, along with an admin account name and password, I get the following message:

Can't connect to server

Directory Services may not be installed on the remote server, they may be turned off, or the URL may have been entered incorrectly

None of this is true, unless "Directory Services" means something other than Open Directory. So what am I missing here?

Also, I notice that when, on the server, I select Open Directory in server.app, the on-off slide icon slides on as it appears (as it if was off until I selected Open Directory). This behavior doesn't happen with any other service on server.app.

Any ideas?

Posted on Aug 18, 2012 1:20 PM

35 replies

Aug 20, 2012 5:58 PM in response to pts

Yep, I said 'by default' and meant it: not that you can't. You have to change to serve All Clients in the drop down window in DNS settings, but it just seemed bad advice given your reticence to gain a basic understanding of how os x server works.

I suggested VPN to solve your problems because, a. You don't want to look at logs, you don't want to read the Hoffman labs os x DNS primer "because it looks like a bit of a slog", and most importantly to give you some security of access rather than opening your server up to the rest of the university, although im sure there are no hacker undergrads there......... You just want things to work like the advertising, which I guess is fair enough but as everyone points out, the software really DOES work as advertised. You just want to do something which doesn't fit in the "push button" box.

Having your clients connect via VPN ticks the "push button" box, but stop telling everyone here how you've been mislead by paying $20 for a pretty powerful bit of software and get on with implementing some of the myriad advice you've been given, and I'm sure you'll find everyone still more than helpful.

pts Author

Level 1

16 points

Aug 20, 2012 6:12 PM in response to JaimeMagiera

"I should add that even if Server.app were preventing you from providing DNS to other nets, the change to DNS configuration files is literally a 2 minute process."

So it takes only 2 minutes to edit the config files, but you can't list which config files those are to actually help me out??

And why is it that after repeated requests, you can't even begin to explain what I'd be looking for in the logs?? Are there some key words I should be looking for? Lines that would indicate what my server's problem is? Really, what are you doing on this list?? Just looking for people to berate who don't know as much as you?

I'm wondering, since you seem to be taking it personally that server.app isn't working as Apple advertised, and you can't get yourself to provide useful suggestions, whether you perhaps work for Apple? You certainly don't seem to have any clue about what would be helpful advice to someone in my position. Really, if you don't want to help someone with my level of knowledge, that's perfectly your perogative. Just don't pretend that you are actually providing help

pts Author

Level 1

16 points

Aug 20, 2012 6:31 PM in response to redshift82r

"You have to change to serve All Clients in the drop down window in DNS settings, but it just seemed bad advice given your reticence to gain a basic understanding of how os x server works"

First, I already tried that, but it has no effect on my problem. I lay awake at night dreaming that it would be so simple. External computers told to use my server for DNS hang, until I change to a DNS server the University provides.

Second, you (unlike JaimeMagiera) have actually given me useful things to try, and have helped me through your comments understand a bit better what might be going on. If I had a true reticence to gain a basic understanding of how os x server works, I wouldn't be here at all. The reason for places like this is for people to help troubleshoot problems for other users. Hints like "look in the log" are not helpful without additional comments about what kinds of things (even vaguely) to look for. Error messages? What? So when you say "You don't want to look at logs", you are not correct. What I don't want to do is look at logs without an idea about what to look for. If the only advice you can give is "look at the logs", then really, that is no better than saying "Go look for something in that haystack over there - and by the way, I won't tell you are trying to find"

Third, when you say: "the software really DOES work as advertised", this is only a vague half-truth. It works (maybe - have not evidence of this yet) only if you happen to be trying a particular configuration that Apple expects. This is exactly why I'm here: I'm trying to figure out what that configuration is that Apple expects.

I'm also trying to figure out what sort of tweaks I might be able to make to get my "unconventional" configuration to work. So when JaimeMagiera says I could get it working in 2 minutes, but purposely refuses to even give a hint about what needs to be done -- not even to name the files that I could look at to point me in the right direction -- I think I'm well within my rights to call foul.

Sep 7, 2012 11:29 AM in response to pts

PTS, I've provided you help throughout this entire thread.

1). Have you tested the querying with the "host" command? No, you haven't.

2). Have you looked at the DNS logs to verify the service is running and fielding queries (local or otherwise)? No, you haven't

3). Did you make any attempt to read up on DNS as a service, such as reading online documentation or purchasing the aforemented book? No, you haven't.

4). In terms of OpenDirectoy, did you put the OD service into debugging mode and view the logs to see if it is accepting connections and if there are any problems? Did you try using ldapsearch? No, you haven't.

5). Did you post the logs from either service, after I offered to help you understand them? No, you haven't.

I haven't told you what to look for in the logs because there are many things that could be going on in the logs. It's not like you can go to a particular line and be "voilà!". You have to actually read them and spend some time understanding what the contents mean. That means web searches, websites, books, etc. This actually highlights the greater issue here... You refuse to do anything that involves *understanding* the service in question, or the server overall. I'm not going to tell you how to just "fix it", becuase that really doesn't "fix it" in the big picture. You really need to explain what you're trying to do and to understand what is going on in regards to those desires - particularly in terms of DNS - to be successful at managing a server. Server.app *does* work as advertised. It's designed to manage a small-to-mid workgroup server on a network. If you understood networking and DNS, you would understand why their "expected" configurations for Server.app make perfect sense for what it is advertised for. The fact that you're putting me down and attacking me, instead of following the suggestions provided to you, comes off as a defense mechanism. Well, quite frankly, it won't work here. I've been a contributing member of the OS X Server community since the first version was released over 12 years ago. You'll be hard pressed to find anyone who says I don't contribute. What I don't do is coddle people who think they are entitled to something. You aren't entitled to anything. People, myself included, have been very generous with their time. I understand you may be frustrated, but that gives you absolutely no right to put me down. It's rude, unprofessional and does not build anyone's confidence in your ability to troubleshoot.

Aug 20, 2012 7:06 PM in response to JaimeMagiera

... and no, I do not work for Apple. Your conspiracy theories belong in the pile with Alex Jones and chemtrails people.

pts Author

Level 1

16 points

Aug 20, 2012 7:39 PM in response to JaimeMagiera

Do you really not understand how your comments are not helpful to someone in my position?

"1). Have you tested the querying with the "host" command?"

I'm assuming this refers to your earlier post:

amber:~ jaimelm$ host amber

amber.geo.lsa.umich.edu has address 141.211.108.5

amber:~ jaimelm$ host node2.sensoryresearch.net 166.90.246.130

Using domain server:

Name: 166.90.246.130

Address: 166.90.246.130#53

Aliases:

node2.sensoryresearch.net has address 63.208.160.186

What exactly does this mean? Is this command done on your server, or your client? How do I read the results here? How is this proof of anything? I'm really, truly trying to understand. You need to realize this doesn't provide help. Maybe to people who are system admins, but not to me. If you can't explain what this is, where it is applied, and how to interpret the results, then it doesn't help.

"2). Have you looked at the DNS logs to verify the service is running and fielding queries (local or otherwise)?"

What would the logs say if the service was running? What would it say if it was fielding queries locally, vs. externally?

"3). Did you make any attempt to read up on DNS as a service, such as reading online documentation or purchasing the aforemented book?"

Yes I have. So far, I haven't found anything that seems to discuss my situation. Do you have a specific chapter (e.g., in the hidden Apple software advance admin for 10.8) that would cover my situation?

Maybe you haven't read all the posts I've made about what I'm trying to do. Here is a review:

I have 1 server and 3 clients. All have FQDN's All have no troubles with ssh, web access, apf, vnc to each other. I want to run OD on the server. I turned OD on, created a master, on the server (using server.app). I then went to clients and tried to bind them to the server's OD. I only get an incomprehensible 2100 error (googling gives me nothing I could find of help about that error message). I post a message here detailing my problem. I get told it is because DNS is not running on my server. I use server.app to turn DNS on. It (server.app) claims it is on, but it doesn't seem to be respoding (as I've outlined) to my clients.

"4). In terms of OpenDirectoy, did you put the OD service into debugging mode and view the logs to see if it is accepting connections and if there are any problems? Did you try using ldapsearch?"

What would it say if it was accepting connections? Can you give me even a vague idea? And what would I be looking for with ldapsearch?

"5). Did you post the logs from either service, after I offered to help you understand them?"

No, I didn't. You got me here. I must have missed your offer to help read them. For this I apologize. Do you want the whole logs?

Aug 20, 2012 9:42 PM in response to pts

pts,

you really need to tone it down dude, lets see if we can actualy get this back to a helpful level, eh.

Most of what I know , I have learnt through reading the support posts of people like Jaime and following their advice, not dissing them.

If you are serious about trying to understand and co-operate with suggestions, then lets see you respond to the following without commentary. Its hard to get a handle on how much you do or don't know, so lets start from basic principals.

Most of your work is going to be done on the "Command Line Interface" via the "Terminal" application. When people like Jaime ask you the result of the "host" or the "snagglefax" command WITHOUT specifying , say "In Server.app", they mean: "enter this command at the CLI in Terminal" SO:

1. From the Applications Folder , select Utilities Folder and then open Terminal.app

2. It will respond with a funny little prompt like:

mylabs-server: ~ ptsadmin$

Most people shorthand the command line interface when asking you to enter a command by preceding it with a "$" sign

Here is another tip - type "man host" and this will tell you what the command actually does. Typing "man less"

will tell you all the navigation commands to use while you are in "man" , but type b for back, f for forward and q for quit at the : prompt and you can't go wrong.

So Step 3.

3. Enter this command from your cli

$ sudo changeip -checkhostname

Password: (enter your password)

Primary address = xx.xx.xx.xx

Current HostName = my-server.mydomain.com

DNS HostName = my-server.mydomain.com

The names match. There is nothing to change.

dirserv:success = "success"

The above changeip command is the equivalent of typing:

$ host my-server

my-server.mydomain.com has address 10.0.5.80

$ host 10.0.5.80

80.5.0.10.in-addr.arpa domain name pointer my-server.mydomain.com.

It shows that dns forward and reverse entries are correct.

So, If that is set up OK, please confirm step 4 is correct.

4. $ sudo serveradmin settings dns:forwarders:_array_index:0 = "xx.yy.zz.aa" where xx.yy.zz.aa is the address of the universities dns server

Now you are going to look at the dns log while you attempt a connection from one of the clients.

5. Confirm that the network setup for one of your clients is set up to point to the tcp ip address of myserver.mydomain.com and that the search domain is set to myserver.mydomain.com

try using safari on the remote machine and do a google search for something. Then come back or ssh in to your server and:

5. $ tail /library/logs/named.log

This will print out the end of your named.log (dns)

and report back with the output and results to date.

gracoat

Level 3

673 points

Aug 21, 2012 7:33 AM in response to redshift82r

PTS... I believe there's much more going on with your server than you're aware. The fact is, even though OS X server is supposed to be totally simple and made so that you don't need an IT department, it's based on systems that people spend A LOT of money learning how to operate. DNS, Directory Services, Apache, Postgre SQL to name a few.

If you aren't understanding what your server is or isn't doing, and you can't find techy type documentation, but really want to learn, then take a class!

Exitcertified has many campuses around the US and Canada. Lynda.com has a great online classroom thing where you can pick the specific topic to learn about and watch that particular lesson.

Lastly, it seems to me that the initial setup of your server may have gone awry. Where and how is nearly impossible to diagnose without actually sitting in front of your server and sifting through the log files. What you said about looking for "something" in the haystack with no idea of what that somethis is, is true. However people with experience really don't know what they're looking for either. That said... The experience factor comes into play. An experienced techy would be able to look at those log files and recognize lines of report that look "off".

My hope is that you'll read this and understand that maybe this problem is out of your ball park. I suggest that you take your router and your server, put it in a box and make an appointment to bring it down to an apple genius. Or perhaps get in touch with another Educator that has experience with apple server product. You'll truley need to have someone look at it if you can't figure out what the problem actually is. At least that way, you'll be able to look over that persons shoulder and gain some valued knowledge. Next time the problem happens, you'll recognize it and be able to help the next person to come along!

-Graham

Aug 27, 2012 12:34 PM in response to pts

pts:

> I turned on Open Directory using server.app on my sever. I then go to a client and do: system preferences>users and groups>login options>Network account server: Join>open directory utility. From there I do File>connect. When I type in the FQDN of the server, along with an admin account name and password, I get the following message:

Can't connect to server

If you have not gotten this working as expected make sure:

- that you're running Open Directory on your server

- that you have 'allow remote administration using server' checkbox enabled

- that you connect to your server as Directory Administrator user

So, what did you want to accomplish by connected to your server in proxy mode via Directory Utility?

iToaster

Level 3

739 points

Aug 27, 2012 7:06 PM in response to David Kurtz2

still no luck pts??

Sep 7, 2012 9:19 AM in response to pts

I'm in the same situation that pts! I admit that my knowledge is zero ... but I had a mac mini with lion server, and server.app automatically did its job ... I updated to the ML server and the service could not start the same way!

Sep 7, 2012 9:21 AM in response to sergiofromfatima

Have you put OpenDirectory into debug mode to see what the error is?

Sep 7, 2012 11:48 AM in response to JaimeMagiera

07-Sep-2012 19:33:30.435 exiting

07-Sep-2012 19:33:30.900 zone 0.0.127.in-addr.arpa/IN/com.apple.ServerAdmin.DNS.public: loaded serial 1997022700

07-Sep-2012 19:33:30.900 zone 1.168.192.in-addr.arpa/IN/com.apple.ServerAdmin.DNS.public: loaded serial 2012090713

07-Sep-2012 19:33:30.901 zone localhost/IN/com.apple.ServerAdmin.DNS.public: loaded serial 42

07-Sep-2012 19:33:30.901 zone org/IN/com.apple.ServerAdmin.DNS.public: loaded serial 2012090713

07-Sep-2012 19:33:30.901 managed-keys-zone ./IN/com.apple.ServerAdmin.DNS.public: loading from master file 7f737fd4dc4fec34dd276a5842ba8a5370c4a8ddba94a5002e26b5e8d7122d44.mkeys failed: file not found

07-Sep-2012 19:33:30.901 managed-keys-zone ./IN/com.apple.ServerAdmin.DNS.public: loaded serial 0

07-Sep-2012 19:33:30.902 running

07-Sep-2012 19:33:30.902 zone 1.168.192.in-addr.arpa/IN/com.apple.ServerAdmin.DNS.public: sending notifies (serial 2012090713)

07-Sep-2012 19:33:30.902 zone org/IN/com.apple.ServerAdmin.DNS.public: sending notifies (serial 2012090713)

Sep 7, 2012 11:54 AM in response to JaimeMagiera

inuvem:~ admin$ sudo changeip -checkhostname

Password:

Primary address = 192.168.1.65

Current HostName = inuvem.org

DNS HostName = inuvem.org

The names match. There is nothing to change.

dirserv:success = "success"

inuvem:~ admin$ host inuvem.org

inuvem.org has address 192.168.1.65

Sep 7, 2012 12:02 PM in response to sergiofromfatima

Do you mean the DNS or the OpenDirectory service doesn't start properly? What is the actual manifestation of the problem? (users can't login?)

Open directory doesn't work