Recommendations for Rebuilding my Mini Server

Question

Recommendations for Rebuilding my Mini Server

I recently upgraded my Mini to Mavericks Server, and ended up destroying the most crucial service on the machine: File Sharing. Ever since the upgrade, I’ve been plagued with permissions issues, destroyed Photoshop docs, and a complete disruption in our day-to-day workflow.

My plan is to completely wipe the machine and start from scratch. All attempts to fix the permissions and ACL’s have failed, so this is the next (hopefully) logical step. My hope is to outline my steps and see if any of you have any feedback.

Make certain Time Machine is up to date.
Detach all external drives.
Perform clean install from Mavericks USB stick.
Re-establish GoDaddy SSL certificate.
Create Groups and Users

Here’s where I start to get a bit confused. My biggest concern are the files that I have stored on our Promise Pegasus thunderbolt raid drive. This drive contains all the files and folders that we are having difficulty accessing. Is there something that I should do to the drive before I perform the clean install?

Also, if I continue to use ACL’s, then do I even need to add users and groups in the File Sharing settings?

Another weird thing we’ve found: Multiple listings of _www or World Wide Web server on select files and folders. I added _www to our web files, but now they all show multiple listings when I check the permissions. What would cause that?

I appreciate any and all help in advance.

Mac mini, OS X Server

Posted on Apr 23, 2014 3:17 PM

Reply

Answer 1

Best reply

Strontium90

Level 5

4,821 points

Apr 23, 2014 5:18 PM in response to Fidget Productions

If you install from scratch and you recreate your users, you will have all new GUID values for the accounts and groups. This will leave all your current files with orphaned GUID values.

If you want to clear all ACEs off the files, use this command (I will assume that your Pegasus is called Promise and the shared folder is called Data)

sudo chmod -N -R /Volumes/Promise/Data

See man chmod for full details. This will remove all ACL entries on all files and folders in the Data folder.

Now, as far as best practices. If you are building from scratch, always start with DNS. This is critical. Once DNS is established and the server knows its identity, then, and only then, create your Open Directory Master (or bind to AD depending on your environment). Once this is done, create or inherit your users and groups. Then set your ACLs based on groups only. Do not use individual users as you will then need to propogate each time you make a change. Oh and avoid SMB for the time being.

R-

Apple Consultants Network

Apple Professional Services

Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Reply

Answer 2

Apr 24, 2014 9:32 AM in response to Strontium90

R,

Thanks for your advice. If I clear the ACE's on the Pegasus, will it also reset or affect the POSIX permissions? From what I've read, Adobe Photoshop disregards ACL's and looks to POSIX. I may just need to change how my team accesses Photoshop docs.

Another question: In Server.app, if I enable "Show System Accounts" in Users or Groups, I see that there is both a user and a group for "_www". I need to give Apache access to our web files. Should I give the '_www' user access, or should I make '_www' a member of Group "World Wide Web Server" and give that group access?

Last, I am aware of the SMB connection issues. However, the SMB connection is forced when I connect through the finder, even though I deselected the Share over SMB in the Server app. Forcing the AFP connection (afp://...) through the Connect to Server function is hit or miss. Some of our team can connect and others cannot. Not sure what to do about that one.

Reply

Answer 3

Apr 24, 2014 2:21 PM in response to Fidget Productions

"Thanks for your advice. If I clear the ACE's on the Pegasus, will it also reset or affect the POSIX permissions? From what I've read, Adobe Photoshop disregards ACL's and looks to POSIX. I may just need to change how my team accesses Photoshop docs."

What version of Photoshop are you running? I have not had issues with ACLs since versions 5 or before. If you are using an older version, then you are correct, PS will ignore the ACL and rely on the POSIX group permissions. I recommend modifying the umask on the Mac systems to ensure that users are writing all files and folders with rw on the group. Customized umask can be implemented for the user level, protecting the OS from potential security concerns.

Another question: In Server.app, if I enable "Show System Accounts" in Users or Groups, I see that there is both a user and a group for "_www". I need to give Apache access to our web files. Should I give the '_www' user access, or should I make '_www' a member of Group "World Wide Web Server" and give that group access?

So you really should not need to explicitly define the www user for the files. Apache will be fine as long as the POSIX everyone bit is we to read. Standard umask should make this work fine. For example, if you look in the default site, the files are not owned by www not the www group:

-rw-r--r-- 1 root wheel 102749 Feb 18 17:10 Server.png

-rw-r--r-- 1 root wheel 7782 Feb 28 07:26 favicon.ico

-rw-r--r-- 1 root wheel 269 Feb 28 07:26 info.php

Yet they are served fine. The piece of importance is the final r-- on the files. POSIX is broken in to three chunks, the user, the group, and everyone else. So above, the user root has rw-, the group wheel has r-- and everyone else has r--. There should be no reason to explicitly define the www user unless you are attempting something I am not aware.

Last, I am aware of the SMB connection issues. However, the SMB connection is forced when I connect through the finder, even though I deselected the Share over SMB in the Server app. Forcing the AFP connection (afp://...) through the Connect to Server function is hit or miss. Some of our team can connect and others cannot. Not sure what to do about that one.

The recommended way is to use the Connect to Server dialog from the Finder. Using the sidebar is a Bonjour connection and is also, as you stated, defaulting to SMB. Remember, you can also customize your Shared Folder and disable SMB access to the share. At this time, AFP is faster, more reliable, and better supporting case and extended attributes and ACLs.

For the systems that are giving you fits, make sure your DNS is correct, then check in the user's home folder for extra .GlobalPreferences.plist files. These are not visible in the Finder so you will need to use Terminal:

ls -la ~/Library/Preferences

If you have a bunch of .GlobalPreferences files, get rid of the extras. This has been known to cause slow server connections.

R-

Apple Consultants Network

Apple Professional Services

Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Reply