TweetFollow Us on Twitter

Mac OS X Server 10.4

Volume Number: 21 (2005)
Issue Number: 8
Column Tag: Programming

Patch Panel

Mac OS X Server 10.4: Part Two Of Our Overview Of Mac OS X 10.4 Server

by John C. Welch

Last time, we took a long look at Mac OS X 10.4 Server from the Server Admin point of view, and concentrated mainly on server setup, features, and some management. Now, we're going to look at Mac OS X 10.4 Server from the Workgroup Manager point of view, or the tools and new features that Mac OS X 10.4 Server provides so you can better manage your network.

Workgroup Manager

Workgroup Manager is the tool you use to manage your overall Mac OS X network. Where Server Admin works with one server at a time, and only servers, Workgroup Manager works with multiple servers, client machines and client users. It's the primary tool for:

  • Setting sharepoints and access policies for those sharepoints
  • Setting client machines and client machine groups, their access policies and preferences
  • Setting users and user groups, their access policies and preferences
  • Manual manipulation of Open Directory data

Workgroup Manager is also the way you handle directory data from multiple directory systems. If you have multiple systems defined via the Directory Access application, then Workgroup Manager can work with those systems.


Directory Access in Mac OS X 10.4.x

One important point here is that you don't have to run Workgroup Manager on the server your using it with. You can also run Directory Access against a remote Mac OS X Server box via the cmd-K option, and this allows for what is called "directory mode", accessed via the "View Directories" option, or cmd-D in Workgroup Manager. In directory mode, you run Workgroup Manager from a remote administration Mac, that can be bound, via Directory Access to different directory systems than the server you're managing. This allows, for example, an Open Directory Master to integrate data from Active Directory without having to be itself bound to Active Directory. This allows for a great deal of flexibility, although my personal experience with directory mode has been inconsistent.

This does bring to mind one annoyance with directory service handling in Mac OS X in general, and that is how dependent it is on search order. If the search order in Directory Access is incorrect, you're in a world of hurt. As well, from what I can tell, if you have two external directory systems defined, and you try to authenticate, and the first one can't authenticate you, the directory services code won't fall through to the next one, and you can't authenticate. This is just a little annoying.

However, when directory mode in Workgroup Manager is working, and you have your authentication paths set right, it's neat as heck to use.

New Features

Since this is an article about Mac OS X 10.4 Server, I'm obviously going to concentrate on the new features that are in Mac OS X 10.4 Server that relate to Workgroup Manager. This isn't really a Workgroup Manager review; I'm just using that product as a framework. One change has to do with the new "Directory Admin" user concept. This just allows you to set up a Server so that the local machine administrator is not, by default the directory administrator, and in fact, the local administrator account that you first set up is a NetInfo only account, not an LDAP account. A second new feature is the Search button in the Workgroup Manager toolbar that allows you to search the Open Directory database by a number of items, such as UserID, Real Name, Comment, etc. If you have thousands of records in your Open Directory domain, that's a right handy feature to have.

User Accounts

The first obvious changes are due to the ACLs in Mac OS X 10.4. The old 16-group limits are gone, and there's support for inherited groups. As I said in July's article on this, ACLs give you great power, but you have to be careful, especially if you're talking about combined Active Directory and Open Directory networks. Careless application of ACLs will create security holes the likes of which you've never seen. Setting up groups for a user is still the same, although there's a new option for seeing inherited groups. This is for ACL usage, since you can have explicit and inherited permissions and groups. Mail and Print setup hasn't changed, although with the improvements to Mac OS X 10.4 Server's print architecture, the existing features probably work much better.

A new feature in Mac OS X 10.4 Server's client management is the Info tab for user accounts. This allows you to directly enter personal information on a user such as name, address, IM handle, etc. This is not a requirement for the account to work, but is a convenience for those using Open Directory as a shared address book. You could do this in Mac OS X 10.3 Server, but you had to directly edit the directory information, and it didn't always work correctly.


Workgroup Manager's Info Tab

The Windows settings for User accounts is unchanged, and the Inspector tab has only minor changes, such as showing the size of each entry in the user's record. One thing that hasn't changed from Mac OS X 10.3, and I really wish would, is the pane management in Workgroup Manager. You can't resize the panes in Workgroup Manager to show more info. You need to see the full Generated UID number? Changing the size of the window only increases the size of the account listing on the left. The data display on the right cannot be grown or shrunk depending on your needs, so get to scrolling. Shades of Windows 3.X! For a company that gets UI right far more than most, when they get it wrong, it's doubly frustrating.

Adding new users is unchanged, and still as kludgy as ever. Apple really needs to step up its sysadmin automation capabilities here. With regard to individual user preferences, there are a few updates here. The login prefs have some new features, such as "Add network home share point" and "Merge with user's items (Mac OS X 10.4 and later). The first one is how you make sure the user's network home share point always mounts. The second one, from what I can tell, is to merge the user's personal startup items and the ones you select for them so they all start up on login. I say, "from what I can tell", because this checkbox is pretty much undocumented. Apple's PDF and discussions group don't have anything on it, (at least not as of this writing, which is about a month before you read it) and searching the Apple Knowledge Base for that item gave me no results. Spotty documentation for a user is bad. Spotty sysadmin documentation is unacceptable. If they can take the time to code the function and the UI access for it, then Apple must take the time to document its basic function. Login Items is the only preference that you can manage for users or groups in the Workgroup Manager login preferences.

This gives me an opening to bring up a point about Workgroup Manager and the MCX (Managed Client OS X) here. There are three levels of management in MCX: User, Group, Machine. Most, but not all prefs can be set at all three levels. If you have contradictory settings, you may not get the results you want and you'll have great agony. You want to be very careful about setting the same preference on multiple levels, and do so as little as possible. Simple planning before you set will help here. Along these lines, Apple including a "Settings Check" function that would, if nothing else, highlight possible conflicts would be quite useful and very welcome.

The Media Access prefs haven't changed, but I wanted to point them out. If you have a need to limit how people can use removable media, this is an important setting. It allows you to lock down access to removable media at whatever level you require, with decent granularity. In today's SOX/GLB/HIPAA environment, being able to not allow copying of data to, or even from, removable media is an important feature, and I'm glad that Apple makes setting this up as easy as they do.

The Mobility setting is the biggest change to user management in OS X, and one that's been a long time in coming. With Mac OS X 10.3 Server, you could have "mobile" accounts, but all that did was deal with domain authentication. It did nothing for data synchronization. So, if you had a mobile account on one machine, and went to another machine, you didn't have any access to your home directory data on the first machine. Mobile accounts under Mac OS X 10.3 really only allowed you to log into the machine in situations where you were disconnected from the Open Directory network. In Mac OS X 10.4 Server, that's changed, and you now have (almost) full home directory synchronization. You can choose the items you want, or don't want to sync, and how. So, for example, you can have some directories sync on login and logout, (this would be the Windows Roaming Profile model), or have them sync in the background anywhere from once every 5 minutes to once an hour. You probably want to sync as little as possible to avoid network capacity problems. This means that if you have to switch machines a lot, you can have an almost uniform home directory setup, something that will be a major boon to mobile users, or schools, where a student may log into multiple machines throughout the day and then take a laptop home. There is one exception: Your home Library directory. That does not sync, even if you tell Workgroup Manager to sync it. This is primarily because you have some application and OS settings that use absolute hard coded paths that could break on different machines. Switching machines a lot will also make your ByHost preference management a lot more complicated. There is a workaround for this, at http://www.afp548.com/article.php? story=20050601101436323, but be warned, forcing that sync can cause problems, so be careful. However, even with that caveat, this is a feature that many have needed for a few years, and finally having it, even in this imperfect form, is a welcome change.


Portable Home Directory Sync setup

The Network preferences are a new feature, allowing administrators to set proxy preferences at the domain level, so that users can't bypass them. The Software Update prefs, also new in Mac OS X 10.4 Server, allow you to specify a local software update server you wish your users to use.

Group Accounts

At the group level, most of the account changes are wrapped around ACLs, so you can have groups within groups, etc. There are some other minor tweaks, like a group picture feature, and a comment for the group. Outside of preference features that don't exist at all in Mac OS X 10.3 Server, group preferences are unchanged.

Computer Accounts

This section has received more than a little work in Mac OS X 10.4 Server. In the Access tab, you have Mac OS X 10.4 - only options for Local - Only accounts picking workgroups from the list of groups allowed to access the machines in a computer list, and that computer administrators can disable management.

However, the specific machine information for Macs in a Computer List has grown by quite a bit. In Mac OS X 10.3 Server, about all you could do was set the computer list for a given machine, give it a name for use in Workgroup Manager, and a comment. In Mac OS X 10.4 Server, there are some new features here that work with the managed Network views. (I'll be getting to those later). So you can specify what Network view a machine can use, and the URLs that can be used to reach the computer based on what services it offers that you want used. So you can specify AFP, SMB, etc. When we go over managed Network views, you'll see how powerful this can be.

In the preferences, again, there aren't many changes that aren't Mac OS X 10.4 specific. The Login preferences are a little different for machines, in that you not only have features that only apply to the computer level, but you can now specify login and logout scripts that run instead of, or in addition to Login/LogoutHook scripts. This is a powerful, and potentially dangerous feature, so it only works if you enable this feature for root's loginwindow defaults AND you are using trusted binding to an Open Directory domain. This makes sense, as without that precaution, you could create a rogue server that would run 'bad' scripts on Macs that you shouldn't have control over. That would be A Bad Thing. And scripts have to be 30KB in size or smaller.

All Records

This (optional) tab hasn't changed in any noticeable way for Mac OS X 10.4 Server, and while that's good from a familiarity point of view, it perpetuates one of the worst design decisions ever made, and that is the decision to hide the structure of the directory from the humans. With almost any other Directory Service, such as Active Directory, you can see the tree view of the directory, and easily manipulate the data directly. So you can drag and drop items between OUs, groups, containers, etc. Workgroup Manager still doesn't allow you to do this, which is a shame, because even with Mac OS X 10.4 Server's rudimentary OU support, being able to handle those objects easily would make directory setup and administration far easier. I get that a lot of K-12 administrators don't want or need this kind of feature, but almost every other segment does want and need it. In the Enterprise Space, Workgroup Manager is one of the weakest directory management tools on the market, and things like this are a big part of it. Apple needs to, at least for Leopard; preferable well before, let the administrators who need this ability have access to it via Apple's own tools. Otherwise, you'll never be able to really scale Open Directory past a relatively smallish size.

Managed Network Views

This is a brand new feature for Mac OS X 10.4 Server, accessed, by clicking the Network button in Workgroup Manager, and in the short version, allows you to manage what your users see when they click on the Network icon in the Mac OS X 10.4 Finder. One of the problems with the Network view in Mac OS X 10.3 is that restricting what any Mac saw was quite hard, even effectively impossible. With Mac OS X 10.4 and Mac OS X 10.4 Server, you can now manage what neighborhoods and what machines any given client in an Open Directory domain can see. If you have a small network, this is not a big issue for you. If you have a few thousand clients on multiple subnets, this is a real help in controlling spurious browsing and its associated traffic.

There are three main kinds of views:

Named View: This is a network view that is visible only on those computers that you explicitly allow access for.

Default View: This is used for managed computers if there's no Named View.

Public View: This is used in lieu of the other two. If there's no Public View, but there is a Default View, that's used instead.

Within a Network View, you can have one or more of the following objects:

Network Neighborhood: This is a collection, (with a name stolen right from Windows, yeah, both sides do that), which can contain any of the three object types listed here. So it can contain individual computers, other Neighborhoods, or dynamic lists. It's a catchall that you can use as a root container type.

Computer: This is well, a computer. Specifically, it's a computer that Workgroup Manager knows about. You can add computers directly to a View, or to a Neighborhood. This allows you to better partition your browsing traffic, so you could, for example, have a Named View called "Directory Servers" and have only your Open Directory primaries and replicas listed there, and another Named View called "File Servers" which could contain Neighborhoods like "SMB Servers", "AFP Servers", etc.

Dynamic List: This is a collection of resources that is created on the fly when you access it in the Finder. Unlike the other two, you can only create a dynamic list from existing network structures, as seen below:


Dynamic View selection

Dynamic Lists are useful when you want to limit browsing and already have service discovery structures in place. Note that you can neither manually add nor remove items from a Dynamic List. You can however, put a Dynamic List in a Neighborhood and manage access in that fashion.

Once you have created your view types and the objects they contain, you can now manage their visibility, by either having the various views add to the unmanaged Finder Network Views, or replacing the standard Finder Network view entirely. This is a powerful tool if you need to limit access to various computers on your network, such as not allowing random access to the accounting servers, etc. It is also a good way to ensure that every computer isn't trying to browse entire network structures that they may have no need for. Limiting this kind of traffic helps enhance overall network performance, not just for the administrators, but for the users as well. If a user only needs access to four file servers, making them wait while an unmanaged browser view enumerates 150 machines is a waste of their time, not to mention bandwidth.

Sharing

ACLs are, again, the main source of changes here. In the All tab, you have the option to enable ACLs on a given volume. Note that this can only be done at the volume level, and outside of Workgroup Manager, you can only do this via fsaclctl. Once that's done, you can then apply ACLs to specific folders and files within that volume at your discretion. This can be done outside of any sharing you may implement for a folder, and unlike sharing you can set ACLs on files too. Remember that I've been saying be careful with ACLs a lot? This is why:


Workgroup Manager ACL settings dialog

ACLs give you a lot of capabilities, but setting them willy-nilly, and not watching how you set groups within groups, or tracking who is in what group for which ACL entry will, not can, but will cause you problems. One benefit of Apple's implementation is that if you do get into trouble you can, as a last resort, turn ACLs off and start over again. I know Windows Admins who would love to do that, because they accidently created an ACL for a folder that not only keeps everyone out, but won't even let them delete it without reformatting the drive or other very drastic action.

I don't want to scare you away from ACLs, but you need to give them a lot of respect. As the disclaimer says, not intended for amateurs.

Outside of ACLs, sharing hasn't changed much. There's some improvement to the strict locking for SMB shares, (Note: You should only enable oplocks on shares that will only be touched by Windows clients.), but from the Workgroup Manager point of view, sharing's pretty much the same as it was in Mac OS X 10.3 Server, you just have juicy ACL goodness.

Conclusion

That's it for part two of this series. It's quite a bit shorter than the Server Admin part was, but then Server Admin is the basis for most of what Workgroup Manager does, so there's not as much change to talk about. The final part of this series will show up next month, and cover, well, everything else.

Bibliography and References

As with the first article in this series, almost everything in this article can be found in Apple's Server Documentation, at http://www.apple.com/server/documentation/. What little isn't there, I pried from the ridiculously busy brains of people like Schoun Regan of I.T. Instruction, Michael Bartosh of 4am Media, and Joel Rennich of AFP548.com. Schoun and Michael are the authors of the two best books on Mac OS X Server available, the Visual Quickstart Guide to Mac OS X Server, and Essential Mac OS X Server Administration, respectively. Buy them both, they're great books. If you read any of my columns and don't regularly read AFP548.com, then you're missing out on a fantastic resource. All three of these guys, Schoun, Michael, and Joel are Apple Trainers too, a great reason to take the Apple courses if you haven't yet. Those courses are taught by the best folks in the Mac market, and well worth their cost.


John Welch jwelch@bynkii.com is an IT Staff Member for Kansas City Life Insurance, a Technical Strategist for Provar, (http://www.provar.com/) and the Chief Know-It-All for TackyShirt, http://www.tackyshirt.com/. He has over fifteen years of experience at making Macs work with other computer systems. John specializes in figuring out ways in which to make the Mac do what nobody thinks it can, showing that the Mac is a superior administrative platform, and teaching others how to use it in interesting, if sometimes frightening ways. He also does things that don't involve computertry on occasion, or at least that's the rumor. w

 
AAPL
$98.14
Apple Inc.
+0.47
MSFT
$44.19
Microsoft Corpora
-0.31
GOOG
$589.10
Google Inc.
+0.08

MacTech Search:
Community Search:

Software Updates via MacUpdate

Bartender 1.2.20 - Organize your menu ba...
Bartender lets you organize your menu bar apps. Features: Lets you tidy your menu bar apps how you want. See your menu bar apps when you want. Hide the apps you need to run, but do not need to... Read more
TotalFinder 1.6.2 - Adds tabs, hotkeys,...
TotalFinder is a universally acclaimed navigational companion for your Mac. Enhance your Mac's Finder with features so smart and convenient, you won't believe you ever lived without them. Tab-based... Read more
Vienna 3.0.0 RC 2 :be5265e: - RSS and At...
Vienna is a freeware and Open-Source RSS/Atom newsreader with article storage and management via a SQLite database, written in Objective-C and Cocoa, for the OS X operating system. It provides... Read more
VLC Media Player 2.1.5 - Popular multime...
VLC Media Player is a highly portable multimedia player for various audio and video formats (MPEG-1, MPEG-2, MPEG-4, DivX, MP3, OGG, ...) as well as DVDs, VCDs, and various streaming protocols. It... Read more
Default Folder X 4.6.7 - Enhances Open a...
Default Folder X attaches a toolbar to the right side of the Open and Save dialogs in any OS X-native application. The toolbar gives you fast access to various folders and commands. You just click... Read more
TinkerTool 5.3 - Expanded preference set...
TinkerTool is an application that gives you access to additional preference settings Apple has built into Mac OS X. This allows to activate hidden features in the operating system and in some of the... Read more
Audio Hijack Pro 2.11.0 - Record and enh...
Audio Hijack Pro drastically changes the way you use audio on your computer, giving you the freedom to listen to audio when you want and how you want. Record and enhance any audio with Audio Hijack... Read more
Intermission 1.1.1 - Pause and rewind li...
Intermission allows you to pause and rewind live audio from any application on your Mac. Intermission will buffer up to 3 hours of audio, allowing users to skip through any assortment of audio... Read more
Autopano Giga 3.6 - Stitch multiple imag...
Autopano Giga allows you to stitch 2, 20, or 2,000 images. Version 3.0 integrates impressive new features that will definitely make you adopt Autopano Pro or Autopano Giga: Choose between 9... Read more
Airfoil 4.8.7 - Send audio from any app...
Airfoil allows you to send any audio to AirPort Express units, Apple TVs, and even other Macs and PCs, all in sync! It's your audio - everywhere. With Airfoil you can take audio from any... Read more

Latest Forum Discussions

See All

Marvel Contest of Champions Announced at...
Marvel Contest of Champions Announced at Comic-Con Posted by Jennifer Allen on July 28th, 2014 [ permalink ] Announced over the weekend at San Diego Comic-Con was the fairly exciting looking Marvel Contest of Champions. | Read more »
Teenage Mutant Ninja Turtles Review
Teenage Mutant Ninja Turtles Review By Jennifer Allen on July 28th, 2014 Our Rating: :: DULL SWIPINGUniversal App - Designed for iPhone and iPad The pizza power is weak when it comes to this Teenage Mutant Ninja Turtles game.   | Read more »
Exploration Focused Puzzle Game Beatbudd...
Exploration Focused Puzzle Game Beatbuddy Set to Make Transition from PC to iOS this September Posted by Jennifer Allen on July 28th, 2014 [ permalink ] | Read more »
PlanetHD
PlanetHD By Nadia Oxford on July 28th, 2014 Our Rating: :: SPACE MADNESSUniversal App - Designed for iPhone and iPad PlanetHD will keep players busy for a while, though its unpredictable physics are a handful to deal with.   | Read more »
This Week at 148Apps: July 21-25, 2014
Another Week of Expert App Reviews   At 148Apps, we help you sort through the great ocean of apps to find the ones we think you’ll like and the ones you’ll need. Our top picks become Editor’s Choice, our stamp of approval for apps with that little... | Read more »
Reddme for iPhone - The Reddit Client (...
Reddme for iPhone - The Reddit Client 1.0 Device: iOS iPhone Category: News Price: $.99, Version: 1.0 (iTunes) Description: Reddme for iPhone is an iOS 7-optimized Reddit client that offers a refreshing new way to experience Reddit... | Read more »
Jacob Jones and the Bigfoot Mystery : Ep...
Jacob Jones and the Bigfoot Mystery : Episode 2 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: Jacob Jones is back in Episode 2 of one of Apples 'Best of 2013' games and an App Store... | Read more »
New Trailer For Outcast Odyssey, A New K...
New Trailer For Outcast Odyssey, A New Kind of Card Battler Posted by Jennifer Allen on July 25th, 2014 [ permalink ] Out this Fall is a new kind of card battle game: Outcast Odyssey. | Read more »
Hay Day – Tip, Tricks, Strategies, and C...
Recently got into Supercell’s other huge hit, Hay Day and could do with some advice on what to do? We’ve got you covered with some helpful trips and tricks to bear in mind! Ticking Along One of the key things to keep in mind while building up that... | Read more »
Monster Head Review
Monster Head Review By Nadia Oxford on July 25th, 2014 Our Rating: :: FEEDING TIMEUniversal App - Designed for iPhone and iPad Racking up a high score with Monster Head is trickier than it first appears. The appeal wears out fairly... | Read more »

Price Scanner via MacPrices.net

13-inch 2.5GHz MacBook Pro on sale for $1099,...
Best Buy has the 13″ 2.5GHz MacBook Pro available for $1099.99 on their online store. Choose free shipping or free instant local store pickup (if available). Their price is $100 off MSRP. Price is... Read more
Roundup of Apple refurbished MacBook Pros, th...
The Apple Store has Apple Certified Refurbished 13″ and 15″ MacBook Pros available for up to $400 off the cost of new models. Apple’s one-year warranty is standard, and shipping is free. Their prices... Read more
Record Mac Shipments In Q2/14 Confound Analys...
A Seeking Alpha Trefis commentary notes that Apple’s fiscal Q3 2014 results released July 22, beat market predictions on earnings, although revenues were slightly lower than anticipated. Apple’s Mac’... Read more
Intel To Launch Core M Silicon For Use In Not...
Digitimes’ Monica Chen and Joseph Tsai, report that Intel will launch 14nm-based Core M series processors specifically for use in fanless notebook/tablet 2-in-1 models in Q4 2014, with many models to... Read more
Apple’s 2014 Back to School promotion: $100 g...
 Apple’s 2014 Back to School promotion includes a free $100 App Store Gift Card with the purchase of any new Mac (Mac mini excluded), or a $50 Gift Card with the purchase of an iPad or iPhone,... Read more
iMacs on sale for $150 off MSRP, $250 off for...
Best Buy has iMacs on sale for up to $160 off MSRP for a limited time. Choose free home shipping or free instant local store pickup (if available). Prices are valid for online orders only, in-store... Read more
Mac minis on sale for $100 off MSRP, starting...
Best Buy has Mac minis on sale for $100 off MSRP. Choose free shipping or free instant local store pickup. Prices are for online orders only, in-store prices may vary: 2.5GHz Mac mini: $499.99 2.3GHz... Read more
Global Tablet Market Grows 11% in Q2/14 Notwi...
Worldwide tablet sales grew 11.0 percent year over year in the second quarter of 2014, with shipments reaching 49.3 million units according to preliminary data from the International Data Corporation... Read more
New iPhone 6 Models to Have Staggered Release...
Digitimes’ Cage Chao and Steve Shen report that according to unnamed sources in Apple’s upstream iPhone supply chain, the new 5.5-inch iPhone will be released several months later than the new 4.7-... Read more
New iOS App Helps People Feel Good About thei...
Mobile shoppers looking for big savings at their favorite stores can turn to the Goodshop app, a new iOS app with the latest coupons and deals at more than 5,000 online stores. In addition to being a... Read more

Jobs Board

*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
Sr. Product Leader, *Apple* Store Apps - Ap...
**Job Summary** Imagine what you could do here. At Apple , great ideas have a way of becoming great products, services, and customer experiences very quickly. Bring Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
WW Sales Program Manager, *Apple* Online St...
**Job Summary** Imagine what you could do here. At Apple , great ideas have a way of becoming great products, services, and customer experiences very quickly. Bring Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.