Apple - Support - Most Recent - Mac OS X Server

About Server Admin Tools 10.6.2

Thu, 19 Nov 2009 21:07:57 GMT

Server Admin Tools 10.6.2 contain remote administration tools, documentation, and utilities that you can install on a Mac other than your server. This version requires Mac OS X v10.6.2 and is required to administer Mac OS X Server version 10.6.2 remotely. The Server Admin Tools 10.6.2 are available as an automatic Software Update for Macs running Mac OS X v10.6.2 with version 10.6 or later of the Server Admin Tools already installed, and as a manual download from Apple Support Downloads. Important: If you have moved any of the Server Admin Tools out of their original locations (inside /Applications/Server/), the update may continue to appear in Software Update even after you have installed it. Return the Server Admin Tools to their original location before using Software Update, or remove any duplicate copies of the Server Admin Tools.

Mac OS X Server v10.6: Software updates not visible to clients if they aren't completely downloaded

Thu, 19 Nov 2009 20:21:04 GMT

The Mac OS X Server v10.6 Software Update service will not enable software updates that aren't completely downloaded, or updates where the stored status of the update is incomplete. This issue can be caused by an interrupted download or if there are communications issues between the local network and the Apple Software Update servers. Server Admin shows an exclamation point next to the update and the update cannot be enabled via Server Admin. You may see messages such as the following in the /var/log/swupd/swupd_syncd_log: (time stamp) suserver.example.com swupd_syncd[12345] : ignored invalid download request for product zzz061-4047, current state = PleaseMirror Note: "zzz061-4047" in the message above is the product-id of the update that will need to corrected by the resolution procedure below.

Apple security updates

Wed, 11 Nov 2009 21:04:41 GMT

This document outlines security updates for Apple products. For the protection of our customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website. Important: This document describes updates and releases for January 15, 2008 and later, such as Security Update 2008-001. For information about earlier security updates, see these documents: Apple security updates (25-Jan-2005 to 21-Dec-2007) Apple security updates (03-Oct-2003 to 11-Jan-2005) Apple security updates (August, 2003 and earlier) Obtaining Mac OS X Information about obtaining Mac OS X (client) can be found here. Information about obtaining Mac OS X Server can be found here. Software updates for Mac OS X are available via: Software Update preferences Apple Downloads Apple Product Security PGP Key For information, see "How to use the Apple Product Security PGP Key".

Mac OS X Server v10.6: Push Notification Server and supported applications

Tue, 10 Nov 2009 19:52:44 GMT

The Push Notification service in Mac OS X Server v10.6 supports sending Push Notifications to Mac OS X v10.6 (client) iCal and Mail applications. Additionally, the service can be configured to provide Push Notifications to third-party applications which use the ServerNotification framework.

Mac OS X Server v10.5, 10.6: Enabling iCal server access for users of Active Directory or third-party LDAP servers

Tue, 10 Nov 2009 17:35:55 GMT

In Mac OS X Server v10.5 and 10.6, the iCal server uses the MD5 Digest authentication method by default. This does not allow Active directory users to log into the iCal server using their Active Directory credentials. It is strongly recommended that Kerberos be configured for Active Directory users. For customers who require a non-Kerberos solution to support Active Directory users, cleartext authentication can be enabled for the iCal service, as described below. For customers who choose to use cleartext authentication, Apple recommends the use of SSL to provide a more secure environment.

About the Mac OS X Server v10.6.2 Update

Mon, 09 Nov 2009 21:15:25 GMT

This software updates Mac OS X Server v10.6 or v10.6.1 to v10.6.2.

Mac OS X Server v10.6: Enabling a SSL chained certificate for mail services

Mon, 09 Nov 2009 21:15:04 GMT

When enabling SSL for POP and IMAP on a Mac OS X v10.6 Mail Server, SSL encryption may not work if the server uses a chained certificate. The steps below explain how to enable the ssl_ca_file key for SSL.

About Security Update 2009-006 / Mac OS X v10.6.2

Mon, 09 Nov 2009 21:10:41 GMT

This document describes the security content of Security Update 2009-006 / Mac OS X v10.6.2, which can be downloaded and installed via Software Update preferences, or from Apple Downloads. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website. For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key." Where possible, CVE IDs are used to reference the vulnerabilities for further information. To learn about other Security Updates, see "Apple Security Updates."

Managed Client: How to disable Exposé and Spaces

Mon, 09 Nov 2009 21:10:21 GMT

Learn how to prevent access to Exposé and Spaces for managed users in Mac OS X v10.6.2 and later. A "locally-managed client" referenced below is a client managed via Parental Controls settings in the Accounts preference pane; a "network-managed client" is one managed via Workgroup Manager.

Mac OS X Server v10.6: Home folder volume may unmount after Network User logs in to Home folder server via SSH

Mon, 09 Nov 2009 21:10:03 GMT

Volumes containing network Home folders may become unmounted if network users log in to the home directory server via SSH. This may affect Home folder availability on workstations for network users.

Mac OS X Server: Can't use Bluetooth devices with Server Assistant

Mon, 09 Nov 2009 20:21:38 GMT

When setting up a Mac OS X Server system locally, you may not be able to pair a Bluetooth keyboard or mouse with the server while Server Assistant is running.

Mac OS X v10.6: Using Keychain Access to search directory services for certificates

Mon, 09 Nov 2009 20:05:50 GMT

In this advanced article, learn how Keychain Access can be configured to search directory service nodes for published certificates in Mac OS X v10.6 and later. If your organization uses digital certificates for email signing or encryption, and publishes user certificates to a directory repository such as Active Directory or Open Directory, you can use this feature for automatic lookups of email recipient certificates. Note: This feature requires that the Mac OS X v10.6 client already be configured to use a directory service such as Open Directory, and that a keychain certificate issued by your organization's certificate authority has been added.

Mac OS X versions (builds) included with Intel-based Macs

Thu, 05 Nov 2009 21:54:14 GMT

Learn which versions of Mac OS X ship with Intel-based Macs. If you have a PowerPC-based Mac, see Mac OS: Versions, builds included with PowerPC Macs (since 1998) instead. Important: Do not use a Mac OS X version earlier than the one included with the computer.

Mac OS X v10.5: "GSSAPI Error: Unspecified GSS failure" when accessing Active Directory resources that use Kerberos

Thu, 05 Nov 2009 19:32:11 GMT

When attempting to access a resource in Active Directory via Kerberos authentication, authentication may not work. The following may appear in the logs when this happens: DirectoryService[26]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Requested effective lifetime is negative or too short).

Mac OS X Server v10.5 and v10.6: Apple FTP Server supports IPv4 connections

Thu, 05 Nov 2009 19:30:21 GMT

The Apple FTP server in Mac OS X Server v10.5 and v10.6 can accept both IPv4 and IPv6 connections. However, when an IPv6 connection is made, issuing commands such as ls or cd in the ftp session will produce these (or similar) alerts: 502 'LPSV': command not understood. 502 'LPRT' 6,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,11,2,168,192': command not understood. 425 Can't build data connection: Address family not supported by protocol family. This may also occur when using "localhost" to initiate an ftp session (ftp username@localhost) on the ftp server itself, even if IPv6 has been disabled on Network interfaces.

Mac OS X Server v10.6: Rosetta required for directory service migration from PowerPC-based Mac

Thu, 05 Nov 2009 16:11:51 GMT

To migrate the directory service from a PowerPC-based Mac to Mac OS X Server v10.6, Rosetta needs to be installed. Some tools require Rosetta to properly migrate the data.

Mac OS X Server v10.5: Mail Server and ClamAV may not start with Security Update 005-2009 installed

Mon, 02 Nov 2009 17:59:32 GMT

After installing the Security Update 005-2009 in Mac OS X Server v10.5, Mail Server and ClamAV may not start up. These messages may appear the system.log: org.clamav.freshclam6111 com.apple.console Notice ERROR: Incorrect argument format for option --checks (-c) com.apple.launchd[1] com.apple.console Warning (org.clamav.freshclam6112) Exited with exit code: 1 com.apple.launchd[1] com.apple.console Warning (org.clamav.freshclam) Throttling respawn: Will start in 10 seconds

Mac OS X v10.5, v10.6: Ping may lose some packets due to configuration

Mon, 02 Nov 2009 17:58:40 GMT

In this advanced article, learn what you can do if the Terminal command ping -f displays a packet loss when pinging a computer that is running Mac OS X v10.5.6, 10.5.7, 10.5.8, or Mac OS X v10.6, or later.

Mac OS X Server v10.6: Software Update Service may not reach Apple through proxy server

Mon, 02 Nov 2009 17:57:40 GMT

In Mac OS X Server v10.6, the Software Update service may not be able to download the catalog or update files from Apple's public Software Update servers if your server is behind a HTTP proxy. If your server is behind a HTTP proxy server and Server Admin does not list any available updates, check the /var/log/swupd/swupd_syncd.log for the following messages: Fri Oct 23 15:30:18 server.example.com swupd_syncd[31893] : ========== Sync Started ========== Fri Oct 23 15:30:18 server.example.com swupd_syncd[31893] : Unable to retrieve catalog(s) from the Apple server Fri Oct 23 15:30:18 server.example.com swupd_syncd[31893] : Sync Complete If you see these messages in the log file, use the following solution to allow the Software Update service to download the catalog and update files.

Mac OS X Server v10.4 or later: Requirements for Software Update Service

Wed, 28 Oct 2009 22:06:52 GMT

Mac OS X Server 10.4 or later allows you to configure a software update server, which lets you conserve your Internet bandwidth. Workstations on your network can download and install Apple software updates from a local server instead of Apple's public Software Update service.

Mac OS X Server: Don't log in to the server with a network user's account

Wed, 28 Oct 2009 22:04:54 GMT

If a user with a network home directory cannot log in at a client computer, make sure that no one is logging in at the server itself with a network user's account.

Enabling advanced logging for radiusd in Mac OS X Server v10.5 and 10.6

Wed, 28 Oct 2009 22:03:45 GMT

You can change the logging level of a RADIUS server via the command line.

Mac OS X Server v10.6: Using SSL for Server Admin Connections

Wed, 28 Oct 2009 22:02:46 GMT

Server Admin provides a method for securing communications between the Server Admin application and the servermgrd process running on Mac OS X Server. In order to use an SSL connection, you must first configure the Mac OS X Server com.apple.servermgrd identity preference in Keychain Access to use a trusted certificate. This can be achieved by either changing the trust on the self-signed com.apple.servermgrd certificate that is assigned to the com.apple.servermgrd identity preference by default, or by changing the com.apple.servermgrd identity preference to point to an existing trusted certificate.

Mac OS X Server v10.5: OpenLDAP service may become enabled when binding to Directory Services

Thu, 22 Oct 2009 22:13:17 GMT

The OpenLDAP service may become enabled when binding a Mac OS X Server to another Directory Service. This service does not need to run on Mac OS X Servers that are not Open Directory Masters or Replicas. You can determine if this service gets started by reviewing the system.log for the following messages: Oct 15 10:26:16 server com.apple.launchd[1] (org.openldap.slapd): Throttling respawn: Will start in 10 seconds Oct 15 10:26:26 server com.apple.launchd[1] (org.openldap.slapd[14101]): Exited with exit code: 1 You can review the system.log with the Console utility, located in /Applications/Utilities. Once Console is opened, click the "Show Log List" button in the Toolbar and select system.log from the list.

Mac OS X Server v10.6: Password Server not running on Open Directory replica after upgrade or migration

Tue, 20 Oct 2009 18:24:05 GMT

After upgrading or migrating an Open Directory Replica to Mac OS X Server v10.6 Snow Leopard, the Password Service may not start. Server Admin may report one of the following messages in the Overview tab of the Open Directory service pane: On the Open Directory replica, "Password Server is: Stopped". On the Open Directory master Server Admin reports "ERROR PasswordService - NotFound" next to the IP address of the replica.

Mac OS X Server: How to make a hidden directory a share point

Tue, 20 Oct 2009 18:22:36 GMT

Server Manager and Workgroup Manager will not display hidden directories, such as /usr/local/ or /opt. To set a hidden directory as a share point, use the "sharing" command in Terminal.

Mac OS X v10.4 and later: How to prevent .DS_Store file creation over network connections

Fri, 16 Oct 2009 18:49:31 GMT

This is an advanced article that contains information about preventing .DS_Store file creation over network connections.

Open Directory: Enabling SSL for Open Directory with Replicas

Wed, 14 Oct 2009 22:17:27 GMT

Secure Sockets Layer (SSL) can be enabled to provide encrypted communications between an Open Directory Master, Replica, and the computers that access the LDAP directory domain. SSL uses a digital certificate to provide a certified identity for the servers. You can use a self-signed certificate or a certificate obtained from a certificate authority.

Mac OS X Server v10.6: Authentication methods for Podcast Producer

Wed, 14 Oct 2009 18:34:40 GMT

The Podcast Producer service can support different methods of authentication depending on the version of Mac OS X Server. This article explains how to enable or disable specific authentication methods in different versions of Mac OS X Server v10.6. For information about Podcast Producer authentication methods in Mac OS X Server v10.5, see this article.

Mac OS X Server v10.6: Enabling CGI support

Mon, 12 Oct 2009 16:10:31 GMT

When you enable CGI Execution for a website via Server Admin, files with the extension ".cgi" can be executed within the site's document directory only. Learn how to allow the files to be run from the CGI-Executables directory.

Mac OS X Server v10.6: AFP client compatibility

Mon, 12 Oct 2009 16:09:31 GMT

If you attempt to establish an AFP (Apple Filing Protocol) connection to Mac OS X Server v10.6 from a computer running Mac OS X v10.2.x or earlier, a generic "An error occured" message may appear.

Mac OS X Server 10.5, 10.6: Enabling wiki access for Active Directory or third-party LDAP server users

Tue, 06 Oct 2009 21:45:28 GMT

When using a Mac OS X Wiki Server that is bound to Active Directory, some configuration may be required in order to allow users to authenticate using their Active Directory credentials. This is required because, by default, the wiki server uses CRAM-MD5 authentication, which is not supported by the Active Directory connector. Third-party LDAP servers that are accessed via the LDAPv3 plugin may require the same configuration changes.

Mac OS X Server v10.6: Do not use Migration Assistant with Mac OS X Server v10.6

Mon, 05 Oct 2009 15:18:28 GMT

Mac OS X Server v10.6 does not include Migration Assistant. Migration Assistant is intended for use on client Macs only; it is not intended to be used to migrate from a previous Mac OS X Server installation to Mac OS X Server v10.6.

Mac OS X Server: Setting up Managed Preferences for Print Server queues

Fri, 02 Oct 2009 16:12:01 GMT

If you are using Managed Preferences to define a list of printers for users, and you are using the Mac OS X Server Print Service to host print queues on the same server, follow these steps to ensure that the managed users print to the Print Service queues. This article applies to Mac OS X Server v10.4 and later.

Mac OS X Server v10.6: Configuring the Mail service so Mailman can support virtual domains

Fri, 02 Oct 2009 16:09:49 GMT

Follow these steps to configure Mail service's mailing list to utilize postfix-style virtual domains.

Mac OS X Server v10.5, 10.6: Preventing DDNS registration for multiple interfaces

Fri, 02 Oct 2009 16:08:33 GMT

When connecting Mac OS X Server v10.5 or later to networks that implement dynamic DNS (DDNS), including Microsoft Active Directory networks, Mac OS X Server may register each configured network interface address in DNS. For multi-homed servers, this may cause confusion and prevent clients from connecting to the server.

Mac OS X Server v10.5 or later: Windows Vista clients may be unable to join a hosted PDC

Wed, 30 Sep 2009 18:59:51 GMT

Microsoft Windows Vista clients may be unable to join a PDC hosted on Mac OS X Server v10.5 or later. Windows Vista may be configured with a local security policy which does not include an authentication protocol that is required by Mac OS X Server v10.5 and later. Windows Vista clients may receive an alert similar to this when trying to bind to the Mac OS X Server PDC: "Your computer could not be joined to the domain because the following error has occurred: Logon failure: unknown user name or bad password."

Mac OS X Server: Spotlight may not find all files on a mounted file share if there are nested share points

Wed, 30 Sep 2009 17:32:57 GMT

If Spotlight indexing is enabled on share points that are nested inside each other, Spotlight searches performed on client Macs may give inconsistent results.

Mac OS X Server v10.5, v10.6: How to cascade Software Update Servers from a central Software Update Server

Wed, 30 Sep 2009 17:31:00 GMT

This article explains how to cascade Software Update Servers from a central Software Update Server, to reduce the amount of traffic that goes to the Apple Software Update servers via the Internet.

Mac OS X Server v10.5: Setting correct Ethernet address in machine record for iCal server on a server with bonded interface

Wed, 16 Sep 2009 21:01:10 GMT

If the server uses a bonded interface, iCal Server may not start because it cannot find a suitable virtual host.

Mac OS X Server: Cannot authenticate to SMB shares when bound to Windows Server 2008 Active Directory

Wed, 16 Sep 2009 21:00:08 GMT

Users connecting from clients not bound to Active Directory may be unable to authenticate to SMB shares hosted on a Mac OS X Server that is bound to Active Directory containing Windows Server 2008 domain controllers.

Mac OS X Server v10.5 or later: How to limit the amount of tasks an Xgrid Agent takes

Tue, 15 Sep 2009 21:12:29 GMT

By default, if an Xgrid Agent is configured to accept tasks, it will accept one task per core. If the computer is used for other purposes, it may be desirable to reduce the number of tasks the Agent will take.

Mac OS X Server v10.6: Microsoft Outlook clients may not be able to send mail

Tue, 15 Sep 2009 21:09:07 GMT

Users who use Microsoft Outlook as their email client and who connect to an email server running on Mac OS X Server v10.6 may not be able to send mail. The following (or similar) alert is returned to Outlook clients: The message could not be sent because one of the receipients was rejected by the server. The rejected email address was "recipient@example.com" is subject "example", account: "mail.example.com" , server "mail.example.com", protocol: SMTP, server response: "504 5.5.2 < hostname > : Helo command rejected: need fully qualified host name", port: 25, secure (SSL): no, server error: 504, error number: 0x800CCC79.

Xsan 2.2: After changing the Primary MDC, "Incorrect search policy" appears in Xsan Admin for Xsan 2.1.1 or earlier clients

Mon, 14 Sep 2009 17:33:06 GMT

With Xsan 2.2 or later you can change the role of another controller to the Primary MDC. If the metadata controllers are providing Open Directory services, using this feature will also move the Open Directory Master to the new Primary MDC. Xsan clients running Xsan 2.2 or later will automatically update their Directory Service bindings to the new Open Directory Master. However, Xsan clients running Xsan 2.1.1 or earlier will not automatically update their Directory Service bindings, and will appear with an "Incorrect search policy" in Xsan Admin.

Mac OS X Server v10.6, Xsan 2.2: How to enable SSL on a mail cluster

Mon, 14 Sep 2009 17:31:46 GMT

Learn how to enable SSL on a mail cluster using Xsan. These instructions supplement, but do not replace, the "Securing Mail Service with SSL" section of the Mail Service Administration guide.