Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In OS X Lion Server, when I create admin users via the workgroup manager, they are allowed to log in remotely via ssh and they get email served by dovecot. However, if I remove the option "user can administrate this server" in workgroup manager, they can no longer receive email and they get rejected by ssh. Why is that?

share|improve this question

Maybe should you have a look to Service ACL (SACL => Server Admin / Access) You can download Server Admin Tools 10.7 at

share|improve this answer
Hmm. Access to mail is not restricted there, for me. But for SSH it was. So this explains the failure to login thru SSH, but not thru IMAP. – Niko Schwarz Jul 6 '12 at 17:09
What's logged in /private/var/log, system.log, mail.log ? Try a unsucessfull connexion, have a timestamp, and look at Console, or logs for instance. Can be related to permissions, or to your OpenDirectory... – Florian Bidabe Jul 8 '12 at 11:15
up vote 0 down vote accepted

The problem was workgroup manager. While it didn't display the account as inactive, it was in fact inactive. The solution was to turn the account to inactive in workgroup manager, click away a myriad error messages, quit workgroup manager (that was important), start workgroup manager again, set the account to active again. Then things worked.

I could see that the account was inactive in the system log.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.