Scribd Logo
Upload

Welcome to Scribd!

  • 61 views

    Apple Actc1010 2 3 User - Accounts

    Uploaded by

    Javier
    This document discusses user accounts and groups in OS X Server. It describes two types of user accounts: local users unique to an individual machine and local network users stored in a centralized directory. It also covers creating, disabling, and deleting user accounts, as well as importing bulk accounts from a file. Password policies that can be enforced on users are explained. The document also discusses creating and populating groups, applying access controls to services, and troubleshooting Kerberos authentication issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Apple Actc1010 2 3 User - Accounts

    Uploaded by

    Javier
    61 views2 pages
    This document discusses user accounts and groups in OS X Server. It describes two types of user accounts: local users unique to an individual machine and local network users stored in a centralized directory. It also covers creating, disabling, and deleting user accounts, as well as importing bulk accounts from a file. Password policies that can be enforced on users are explained. The document also discusses creating and populating groups, applying access controls to services, and troubleshooting Kerberos authentication issues.

    Original Title

    apple-actc1010-2-3-user_accounts

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses user accounts and groups in OS X Server. It describes two types of user accounts: local users unique to an individual machine and local network users stored in a centralized directory. It also covers creating, disabling, and deleting user accounts, as well as importing bulk accounts from a file. Password policies that can be enforced on users are explained. The document also discusses creating and populating groups, applying access controls to services, and troubleshooting Kerberos authentication issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    61 views2 pages

    Apple Actc1010 2 3 User - Accounts

    Uploaded by

    Javier
    This document discusses user accounts and groups in OS X Server. It describes two types of user accounts: local users unique to an individual machine and local network users stored in a centralized directory. It also covers creating, disabling, and deleting user accounts, as well as importing bulk accounts from a file. Password policies that can be enforced on users are explained. The document also discusses creating and populating groups, applying access controls to services, and troubleshooting Kerberos authentication issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 2

    OS X Server Essentials 10.10 - 2.

    0 Configuring Accounts
    2.3 User Accounts
    User Accounts

    Two primary types of user accounts


    1. Local Users
    Unique to an individual machine
    Not recognized/honored by any other system
    Managed with Users & Groups system preference
    2. Local Network Users
    Stored in a centralized directory service
    Shared/honored by any other system bound to the directory
    Managed with Server App
    Creating an account
    Server App -> Users -> +
    Type
    Local User
    Local Network User
    Full Name
    Displayed throughout the OS when a user name is requested by software
    Account Name
    Used by the underlying BSD system
    The true username
    Can contain:
    a-z
    A-Z
    0-9
    . (Period)
    _ (Underscore)
    - (Hyphen)
    E-mail Addresses
    Password
    Password assistant is available
    Allow user to administer this server
    Permits using the Server App to control the server
    Home Folder
    Local Only
    Standard user folder created on the server
    Not synchronized between clients
    None - Services Only
    No user profile is created
    User is unable to logon locally to the server
    User is only permitted to access services via the network
    Limit disk usage to...
    Only available if the user has a home folder
    Applies a quota limiting their usage
    Keywords
    Tags that assist with filtering the user list
    Notes
    Any additional comments you may have
    NOTE: To customize service access, ctrl-click the user and choose "Edit Access to Services"
    Disabling an account
    1. Server App -> Users -> Select user
    2. Gear -> Edit User
    3. Uncheck Login
    Deleting an account
    Server App -> Users -> Select user -> -
    Bulk import user accounts
    Server App -> Manage -> Import Accounts from File
    Mavericks Server Admin: Create a file to import users or groups
    Yosemite documentation has not been updated
    Expects a particular format inside a text file
    [Import File Example][]
    Password Policies

    Allows enforcing password requirements on users


    Does not apply to administrators
    To set:
    1. Server App -> Users -> Local Network Users
    2. Gear -> Edit Password Policy
    Settings
    Disable login...
    On a specific date
    After using it for X days
    After inactive for X days
    After user makes X failed attempts
    Password must...
    Differ from account name
    Contain at least one letter
    Contain both uppercase and lowercase letters
    Contain at least one numeric character
    Contain a character that isn't a letter or number
    Be reset on first user login
    Contain at least X characters
    Differ from last X passwords used
    Be reset every X days/weeks/months
    Note: Make sure you choose "Local Network Users" in the drop down box
    Local Users have their own password policy
    Groups

    Allows combining multiple users into a single entity for ease of administration
    Permissions can be assigned in-bulk instead of on a per-user basis
    Can also be used as e-mail distribution groups
    Creating Groups
    Option #1: Import the groups similar to user accounts
    Option #2: Manually create them
    Server App -> Groups -> +
    Select Local Network Groups in the drop down to ensure you are creating Open Directory groups
    Populating groups with members
    Option #1: Edit the group and add in the users
    Option #2: Edit the user and add in the groups
    Groups can be nested
    Example:
    Sales People
    NA Sales
    SA Sales
    EU Sales
    Access Control

    ACLs can be applied to the Server App services


    Controls which users are allowed to access each service
    Can be applied to users or groups
    Generally we want groups, as individual assignment is a huge administrative burden
    Control-Click a user or group and choose Edit Access to Services
    Troubleshooting

    Common issues with Kerberos authentication


    Incorrect DNS configuration
    Client is unable to find server
    Verify DNS servers in network configuration
    Verify search domains
    Incorrect time
    Time differences in excess of 5 minutes trigger a packet retransmit warning in Kerberos
    Results in failed authentication
    Check the clocks
    Check the time-zone
    Use an NTP server (Date & Time preferences)
    Kerberos disabled for a service
    sudo serveradmin settings calendar:Authentication:Kerberos:Enabled = yes
    sudo serveradmin stop calendar
    sudo serveradmin start calendar
    Incorrect user account settings
    Verify the ACL on the user
    Verify the user is a Local Network User
    Verify user is not disabled
    You can examine the Kerberos ticket
    In terminal, use klist
    Useful for seeing which server you authenticated against
    Also shows the date/time the TGT was issued and when it expires

    Import File Example


    User Accounts
    0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 3 RecordName Password RealName dmustaine:password123:Dave Mustaine dellefson:password123:David Ellefson nmenza:password123:Nick Menza mfriedman:password123:Marty Friedman

    Groups
    0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Groups 3 RecordName Password GroupMembership the-band2:password123:dmustaine,dellefson,nmenza,mfriedman

    You might also like