AFP548 Changing the world one server at a time.

OD, DNS, and LDAP Search base confussion

Home › Forums › OS X Server and Client Discussion › Open Directory › OD, DNS, and LDAP Search base confussion

  • This topic is empty.
Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • #366005
    Anonymous
    Guest

    Hello Everyone,
    I’m looking for some advice after a near crisis I experienced yesterday. I’ve cross posted this to the Apple Discussions, I hope that’s okay.

    I did an install and setup of an XServe G4 1.0Ghz running Mac OS X Server 10.4. right after 10.4 was released about a year ago. The hardware was older but the software setup was completely fresh and new (the server wasn’t really being utilized before).

    Now, when I look at the advice on setting up a 10.4 Server it recommends not doing anything through the Server Assistant Software, make sure you set up the server to handle DNS for itself and other local machines, then start to set up the services.

    When I set up the server I did not do anything with DNS because I figured since our DNS was handled by our ISP I didn’t need to worry about it. This server is our only Mac OS X Server and has been handling Open Directory, Network Users/Homes, AFP, and Netboot (just for NetInstall not for actual full Netbooting).

    The machine’s host name was set to servername, I was using servername.local to connect to the machine locally and when the Open Directory was set up the LDAP Search Base was automatically set to dc=servername,dc=local

    This server has been functioning relatively well for our 100 client computer school network but it has had it’s share of gremlins and I decided it was time to fix this and started to look at articles like this one about tuning your server:
    https://www.afp548.com/article.php?story=20060329213629494

    They all recommend making sure your DNS is set up correctly. So I decided to do this. I enabled DNS on the machine and set the hostname to servername.fakedomain.org. I set a client machine to resolve to the server IP address as it’s first DNS Server and the ISP’s for the Second and Third. Now I could correctly lookup the server by both forward and reverse via the client computer and Internet domains continued to resolve fine.

    The problems started when I was looking at the LDAP Search base and the fact that it had been set up as dc=servername,dc=local and not dc=servername,dc=fakedomain,dc=local and decided that this should be fixed.

    I archived the Open Directory database in Server Admin. Then I set the sever to be Standalone which deletes your database and set it back to Open Directory Master. I created the new LDAP database with the new default search base based on the new host name. When I tried to restore the old database it would fail (and I started to panic a little). The restore would still fail when i set the new LDAP to mirror the old. I tried to do a slapconfig -mergedb -f <archive-path> from the command line and it would hang up and not finish. Finally I had to set the server to be Standalone (and stop LDAP) and then do a slapconfig -restoredb <archive-path>. This restored the old database successfully.

    Now I have the server handling local DNS with a host-name of servername.fakedomain.org but a LDAP search path of dc=servername,dc=local

    Is this a problem? How can I change the search base without losing all of the other info in my OD database (User/Groups/Computer permissions and preferences)? What would be a good process for rebuilding things without losing the information? I would appreciate any insight or advice you might have. Thank You.

    #366046
    Anonymous
    Guest

    I have not been able to get my OD Master successfully authenticating users since I changed the ip address and upgraded to 10.4.6. Before, the users could go up to a client and login with no issues and their network homes would mount. Now. all they get is a shaking window. This is so frustrating.

    I ran sudo changeip with the new requirements Apple has stated for 10.4.6 and it came back saying updating such and such files. My clients even have been automatically updated via dhcp to look to the server, i.e. Directory Access is showing the new server name under the Authentication button. DNS works both forward and reverse. Lookupd had been flushed, etc.

    The users can successfully login to the server with their LDAP username and everything works. What on earth is missing? It should not be this difficult to change an ip address. I see nothing in the logs to give me pointers. Not even failed logins.

    Cheers
    – Mark
    montana at freeshell org

Viewing 2 posts - 1 through 2 (of 2 total)
  • You must be logged in to reply to this topic.