Ask AFP548 November 14, 2008 at 8:27 am

Open Directory Across Four Locations?

I have to set up the IT infrastructure for a company that has 4 different offices.  Two of the sites have Apple based clients and the other two have windows based clients.  All of the servers are Xserves.  I hope to set up a single Open Directory structure that can handle Mail, a Corporate Intranet Site, a Corporate Website, Home Folders (for both the OSX and Windows laptops/desktops), Job Folders, and Backup for all of these.  There will be roughly 75 users at the HQ, and less than 20 users at each of the 3 satellite offices.

Our current equipment includes 2 or more Xserves at every location
(plus Xserve RAIDs at the main office), 55 iMacs / Mac Pros, 13 MacBook
Pros / Airs, 30 Windows Desktops, and 7 Windows Laptops.  Our network
infrastructure is gigabit at all of the locations.

each office has it’s own Open Directory master and separate fileservers
for Job Folders and Home Folders.  The Corporate office hosts the mail,
websites, and backup for all offices.

Any help or advice for creating this infrastructure in a secure and reliable way would be greatly appreciated!

No Comments

  • As a small OS X server admin out in the boonies of New Mexico, I would love to see the set up notes for an environment like this.

    Troy in Portales, New Mexico.

  • vampyreapocalyps

    Your main problem is going to be the lack of storage for home directories at each location save the main. My suggestion: network accounts with local home folders for non-mobile users at every location save the main. This still allows you to administer users and groups but eliminates the problem of not enough available and fast network storage. You must train your users to save IMPORTANT DATA on the servers/shares or it won’t be backed up.

    To address the mobile accounts, 3 words: rsync over SSH. Store ONLY MOBILE ACCOUNTS on the satellite servers (which need to be ODRs, btw), and have them rsync these home folders over SSH nightly to the RAID. This provides redundancy and eases backups since they don’t have to backup over the network.

    The rest is easy, but first ask yourself a few questions. 1) Is each location behind its own firewall or is there a corporate firewall in front of the entire network? Obviously this will be vastly simpler if there is a single corporate firewall. However even if each location has its own you can do this with VPN tunnels.

    For the rest, I pretty much agree with the other comments here. I think Apple might have one or two articles about deployments of this level of complexity.

Leave a reply

You must be logged in to post a comment.