OS X Server best practices
Hello All,
I am new to the OS X server side and generally macs too (used the clients for about a year but not the technical side). I have used and supported the Windows Server and clients for about a year and am now beginning to get to grips with the whole aspect of the management of the network through Microsoft Servers.
What i would like to know is probably pretty basic stuff, but i feel i need to understand this to get a good foundation to build my OS X installation on.
The overall outcome will be an integration of OS X into a predominantly Windows 2003 Domain. The clients will be intel imacs dual-booting XP and OS X 10.4.8 since we are an educational facility we need the XP to support the non-apple applications that were purchased in the past. Currently XP is running on the imacs until we can manage the OS X client-side on the network. XP has been joined to the AD and is running fine.
The installation of the OS X Server 10.4.8 has been started but that's as far as it has got. This is where i could do with a little help to understand the process...
Under Server 2003 when creating an active directory you run the dcpromo and then it asks you for the FQDN and since the machine name was given previous to the promotion to domain controller it uses this to finish the FQDN. for example, server1 becomes server1.example.com.
Is this the same process when configuring the FQDN of the Open directory Server?
I have been doing it this way: Computername = server,1 Hostname = server1, and when promoting to Open Directory Master i use the example.com. If the OD is hosting its own dns then i enter the example.com as the domain name with the computer record of server1. This obviously then resolves to server1example.com.
But you can also set the computer name as the fully qualified domain name during the server setup, i.e. computername = server1.example.com and then set the hostname as just server. Is this Wrong?
When the active directory is hosting the dns records i create the forward lookup as server1 (which creates the pointer automatically) and then dns finishes the FQDN. This is the method i have followed, since it will be integrating into the AD. Is this right?
When i come to set the machine as open directory master it asks for the kerberos realm name. What should this be set to. For instance, is it correct to leave as default (SERVER1.EXAMPLE.COM) or is it set to the domain name (EXAMPLE.COM). I think this is the area where i am having problems when joining the AD since i cannot get a ticket from the AD domain. Is this the right process?
I am currently reading through the OD services manual and the AD-OD interagiton and the Leveraging the OD server? docs but i cannot see where the basic information is found. It may sound silly but i like to know the basics so i know that these are correct and are not the reasons behind future problems.
I have installed and bound my OS X server to AD and have continued to kerberise the services but it fails when used from the os x clients as per the AD-OD intergration paper. I checked the edu.mit file and the SMB.conf but to be honest i don't know what i'm looking for when i'm in there since i don't know what the realm supposed to be set to on installation. Should it be the kerberos realm of the AD eg EXAMPLE.COM or the realm of the OS X server SERVER1.EXAMPLE.COM/EXAMPLE.COM. The latter is obviously the same so how can the servers tell that the realms are different?
I have checked the kerebros tickets on the AD domain and each domain controller has a ticket (the OS X server is not listed) but the kerberos.app shows on the OS X server that it does not have any. Is this correct. I have run the klist -ke and see a lot of kerberos entries but they point to server1.example.com@example.com. Is this again correct. One thing to mention though is that the SMB service is NOT listed. Is this supposed to be listed, i assume it is?
Sorry for all of the questions but it would put my mind to rest and then allow me to get on with the rest of my duties. Thanks in advance for any help or light that anyone can shed on my woes.
Once these are resolved i can then get around to asking even more questions. Lol