4,990 reputation
1615
bio website
location
age
visits member for 5 years, 7 months
seen 8 hours ago

Dec
19
comment How to enable DIGEST-MD5 SASL mechanism in Open Directory?
My password server log shows a WEBDAV-DIGEST authentication event when I log into the Wiki service; this conflicts with the Apple support doc you linked, but fits with the fact that your password server seems to support DIGEST-MD5 but not WEBDAV-DIGEST. WEBDAV-DIGEST and APOP both depend on the server knowing your actual password, so they require the RECOVERABLE "hash" (actually, encryption) type... and with pwpolicy no longer working for this, I'm not sure how to enable that. I'll do some more looking around, and see what I can come up with.
Dec
19
comment How to enable DIGEST-MD5 SASL mechanism in Open Directory?
@eggyal: Ok, I got ahold of a Yosemite OD server... and apparently they've changed it significantly in the new version. The ldapsearch also only lists GSSAPI and CRAM-MD5 on mine, but the wiki authenticates fine. So, if pwpolicy won't work so straight to the source: telnet 127.0.0.1 apple-sasl, then issue the command LIST. Mine replies with +OK (SASL "GSSAPI" "DIGEST-MD5" "WEBDAV-DIGEST" "DHX" "APOP" "CRAM-MD5" "MS-CHAPv2" "SMB-NTLMv2"). Also, check /Library/Logs/PasswordService/ApplePasswordServer.Server.log while trying to authenticate, and see what shows up there.
Dec
18
answered How to enable DIGEST-MD5 SASL mechanism in Open Directory?
Dec
11
comment New to bash - “Unexpected end of file”
Does the script have windows-style line breaks (carriage return followed by linefeed, rather than just linefeed)? If so, that'll prevent bash from recognizing then<cr> as a keyword and it'll search the rest of the file looking for then, not find it, and give this error.
Dec
10
comment OS X Mavericks (or Yosemite) on new VM in Vsphere?
You should understand that Apple is primarily a hardware company -- from their perspective OS X and OS X Server exist to encourage you to buy Mac computers (which is why they give OS X away and charge just $20 for Server). Allowing them to run on non-Apple hardware would completely defeat this purpose. I'd love to see Apple sell a generic-hardware-virtualizable-server license for, say, $1000 (which would completely make up for what they're not making on the hardware), but that's just not the way Apple thinks.
Nov
17
awarded  Caucus
Nov
10
revised Rsync through secure head-node on storage cluster
Added links...
Nov
9
answered Rsync through secure head-node on storage cluster
Nov
6
answered OS X Server VPN service starts httpd processes
Oct
22
comment Scripting command that can be executed on Macs to generate/remove (NOT SIMPLY BIND/UNBIND) those Macs as computer objects in Active Directory?
Yes, although it's been a while since I've used it...
Oct
21
comment Scripting command that can be executed on Macs to generate/remove (NOT SIMPLY BIND/UNBIND) those Macs as computer objects in Active Directory?
The standard binding command (dsconfig -add) should create a computer object if none exists. You need to troubleshoot why this is not happening, rather than looking for a different command.
Sep
20
comment Printer on OS X not printing across VPN subnets
Try using lpstat -v to see how the Mac is trying to connect to the printer. If it has a dnssd://<something>.local url, it's trying to use multicast DNS to locate the printer, and that may not be getting forwarded across the VPN.
Sep
9
awarded  Nice Answer
Aug
31
comment Making Private Domain Marriage Public Domain Name - Revisited
Another reason not to use .local: OS X (and anything else that uses multicast DNS per RFC6762) will resolve names ending in .local via mDNS instead of normal DNS. Recent versions of OS X have hacky workarounds that'll let them mostly work in .local AD domains... but only mostly. And OS X is getting more popular in corporate environments...
Aug
21
revised Constant prompts for credentials from one Mac Outlook 2011 client
Added note on 10.9 and the Local Items/iCloud keychain
Aug
3
answered Leveraging rsync for a local copy between two slow drives, benefits without a daemon
Jul
29
comment 10.9 Server DNS Server Having Intermittent Issues with Open Directory
I'm finding your dig results very weird -- dig doesn't do multicast DNS (aka Bonjour), so it shouldn't see .local names at all (unless you somehow have .local names defined in your DNS server?). Are you actually using dig, or something else? Also, what happens if you use dig and direct its queries to a specific server (dig ourodserver.ourdomain.org @serverIP)? Also, have you looked at the DNS logs on the OS X server?
Jul
22
comment Force DNS lookups through specific adapter on OS X?
If the DNS server you want to use is not on the ethernet interface's subnet, things get more complicated. In that case, the only idea I have is to create a manual routing table entry to sent to the DNS server over ethernet. Unfortunately, OS X does not have a good way to manage static routes...
Jul
22
comment Force DNS lookups through specific adapter on OS X?
Note that the settings for the primary service defines which DNS server(s) will be used, but do not control which interface DNS queries are sent over -- that's handled by OS X's normal routing algorithms. So if the DNS server is on the same subnet as your Mac's ethernet interface, you could put that DNS server in the Wi-Fi service's DNS tab, make the Wi-Fi interface primary (so its router setting will be used for non-local traffic), and the normal routing system will send DNS queries over the ethernet interface.
Jul
21
comment Force DNS lookups through specific adapter on OS X?
This won't work. OS X always uses the DNS servers from its primary network "service" (interface); if there aren't any, it doesn't resolve DNS (even if there are servers defined for other services). (Actually, there's an exception: if it can't ARP the router of the primary service, it sort of fails over and the DNS settings fail over as well...)