yosemite open directory replica

Question

yosemite open directory replica

I'm trying to set up 3 mac mini's with clean install of OS X 10.10.2 and Server 4 and I need to have an Open Directory master on one and have replica's on the other two. All 3 systems have fully qualified hostnames (not .local) and freshly-created self-signed certificates.

If I try to replicate from the master I get the error message about the replica system not having a proper certificate. If I try to replicate from one of the slaves I just get an endlessly spinning disk and have to crash the system and re-boot.

Is there a definitive guide to setting up Open Directory replicas on Yosemite server?

OS X Yosemite (10.10), Server 4.0

Posted on Mar 5, 2015 1:41 AM

Reply

Answer 1

Best reply

Linc Davis

Level 10

209,547 points

Mar 5, 2015 7:43 AM in response to Richard Williams2

Please post the relevant log extracts, not a paraphrase.

Reply

Answer 2

Apr 7, 2015 5:24 AM in response to Linc Davis

This is what appears on the master when I try to set up a replica

Server is installed on 192.168.1.207 and remote administration is enabled.

Which logs do you need to see?

Reply

Answer 3

Apr 7, 2015 9:25 AM in response to Richard Williams2

As always different peoples setups may need different solutions but I can describe my working OD Master + OS Replica setup and you can see if that helps guide you.

I have a self-signed rootCA that I have created, using that I have then created individual server certificates for each server, the server certificates use the cn (Common Name) matching the fully-qualified-domainname of the server, so a server called odmaster.domain.com has a certificate with the common name of odmaster.domain.com and the replica server with a fqd of odreplica.domain.com has a certificate with a common name of odreplica.domain.com

When adding the certificate to each server I have to add the private key, the matching (public) certificate, and a copy of my self-signed rootCA certificate, this is a total of three items, two of which are different for each server. After adding these to the server I set the server to use the added server certificate for encrypting all services including of course Open Directory. Because both servers use and trust the same rootCA certificate they will 'trust' each other.

As is always the case you must have a correctly setup DNS setup with both forward and reverse records correctly setup. This is best tested by running the following command in Terminal.app

sudo changeip -checkhostname

Some people may use purchased server certificates and some people may use wildcard certificates, I did not use either of these.

Reply

Answer 4

Apr 11, 2015 9:15 AM in response to John Lockwood

John

Thanks for the info. I'm having a problem with these certificates. I've created a self-signed rootCA using Keychain Access. If I then create a certificate request in Server and try to sign it with my rootCA, I can't then import it back into Server or the My Certificates section of Root in Keychain Access. If the certificate isn't in My Certificates it doesn't showup in Server so I can't then associate it with OpenDirectory. Can you help me out by giving more info about the process of creating these certificates?

Reply

Answer 5

Apr 11, 2015 9:27 AM in response to Richard Williams2

I use XCA a free front-end for OpenSSL to create my CA and certificates, I don't bother with creating a signing request I just directly go to creating a certificate. I then as mentioned import the private key, public certificate and rootCA certificate.

Reply

Answer 6

Apr 13, 2015 7:26 AM in response to John Lockwood

I've finally managed to make progress. After some blood, a lot of sweat and a few tears I've created a valid self-signed CA using the Certificate Assistant. I then created a CSR for the first Mac Mini and used Create a Certificate for Someone Else to sign the CSR. The resulting certificate was transferred to the Server keychain and set against Open Directory in the Server app. I repeated the CSR and signing for Mac Mini's 2 & 3 and created a replica for OD on Mac Mini 1 on Mac Mini 2 & 3, remembering to add the CA certificate as well as the individual ones.

When signing the CSR, it was necessary to specifically say that the certificate was for SSL Server - saying 'Any' wasn't sufficient.

The Apple documentation doesn't really cover this process and I've only found out how to do this by reading other people's hints and trying it all out on non-production systems.

Reply