1

I'm trying to troubleshoot an OS X OD issue and I'm having a hard time finding anything concrete about just how data flows between clients and server.

Specifically, I'd love to know what exactly happens when a password is changed by a user in the System Preferences.

It would be wonderful to find some concrete information about specific firewall ports and directions that data moves.

Improve this question

1 Answer 1

Reset to default
2

Not sure how much Apple has changed things from a typical LDAP/Kerberos setup. In LDAP, a password change would involve TCP client:highport -> server:389 (or the LDAPS equivalent port, or possibly UDP if they've adopted the LDAP-via-UDP thing like ActiveDirectory does). In Kerberos the password change should be made to the kpasswd (464) port on the admin_server listed in the krb*.conf for the realm in question.

I'd probably be looking at WireShark for traffic involving the OpenDirectory server during a password change, regardless.

Improve this answer
2
  • Thanks so much. I have been reviewing Wireshark captures and firewall logs and ultimately I'm just trying to make sure that I'm not missing something. Are there any steps that would involve server -> client other than immediate response to the ones you lists?
    – Chris
    Sep 16, 2015 at 23:34
  • Servers usually don't chat to clients because firewalls (they used to, back in the days of active FTP, and no firewalls), and instead the client will typically establish a connection with the server (and then stateful firewalls allow the return packets back). You may also need to run WireShark on both the client and server, in the event there's some load balancer or something in between the two that's lying.
    – thrig
    Sep 16, 2015 at 23:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .