31

With OpenSSH sftp client (which you seem to use), you can use: -R switch to increase request queue length (default is 64) -B switch to increase read/write request size (default is 32 KB) For a start, try to double both: sftp -R 128 -B 65536 user@host It probably does not matter much, which of them you increase. Increasing either should help to saturate ...


28

Based on Brian Armstrong's answer, here's something with a little more explanation and a correction. This handles the log created by postgres on OSX installed by Homebrew. Located at /etc/newsyslog.d/postgresql.conf: # logfilename [owner:group] mode count size(KB) when flags [/pid_file] [sig_num] /...


16

You can get logrotate via Homebrew. Here are my notes from setting this up. Install brew install logrotate Configure log rotation Log rotation config files are in /usr/local/etc/logrotate.d/ Edit config file. E.g. I wanted to rotate some "/var/log/tend_*.log" files I introduced: sudo vi /usr/local/etc/logrotate.d/tend.conf Contents: /var/log/tend_*....


9

Root is root, even on OS X Unix. That is why they disable it by default. A quick google has shown that your file could be potentially locked. If you go and issue the command: chflags nouchg /path/to/item and then try your file again: chmod g+w "PORe\logo.jpg" This should allow you then to change things on that file specifically. Make sure that your ...


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


4

Surely Apple haven't compiled Kerberos without any support for DES? Well, actually, it looks like they did in 10.10/Yosemite. And after the mess they made of Kerberos in 10.07/Lion... you have my sincere condolences. The functionality that krb5-weak.conf tries to achieve won't be needed on OS X from Yosemite (10.10) on forwards, since Yosemite's Kerberos ...


4

Do not host your own email. Especially on an OSX server. Period. I know this isn't the answer you want, but it is what you need to hear. Hosting email is incredibly challenging. Doing it yourself with either end up with you spending hours a week troubleshooting and fixing or it will end up with undelivered email, both incoming and outgoing. Instead of ...


4

Try looking for a <Directory /> section and make sure that any settings within that tag are restrictive. Also check if mod_userdir is enabled and configured. Look for tags like UserDir


4

(You mention "high latency" in the question title, but not in the body text. Have you measured the actual latency, and what are the results?) There's a patch to OpenSSH that explicitly improve throughput on a high-latency network link: HPN-SSH: (emphasis mine) SCP and the underlying SSH2 protocol implementation in OpenSSH is network performance limited ...


4

I'm trying to transfer a set of large files internationally using SFTP It hasn't been mentioned as an answer yet, but when transferring multiple files over a high-latency link, there's one really simple solution to get better performance: Transfer multiple files in parallel. And it is a solution that you even mentioned in your question. Use it. ...


3

You should be able to do this in the regular Server application interface, simply by entering the full domain name (e.g. "example.com") in the Host Name field. There are a few notes, though: Make sure the interface is in "Show All Records" mode (selectable from the "action" (gear icon) pop-up menu under the DNS Record list. Without this, it hides (and doesn'...


3

You can certainly do this, but unless you script it (see below) there's no single-step solution. The basic steps are going to be: Bind the Mac to AD. Delete the local account, but leave the home folder alone. This can be done from the command line with dscl, or in System Preferences -> Users & Groups (just be sure to select "Don't change the home folder"...


3

It's true that a pure layer 2 vpn setup would instantly enables the bonjour service without any other configurations. The difficulty is to find a layer 2 vpn, to install it and configure it. There are probably some proprietary solutions that enable this feature. To my knowledge there is only 1 good layer 2 vpn. It's open source and it's call openvpn. It does ...


3

From the ReadMe.txt in that folder: httpd_server_app.conf This is the primary configuration file read by Apache. Note that it differs from the httpd.conf distributed with Apache. It is specific to Server's Apache configuration, and takes the place of the desktop Apache configuration in /etc/apache2/httpd.conf. Certain directives are activated ...


3

Okay, turns out it's a "bug" in the latest version of Mac OS X Server. From what I was able to find, he IKE daemon racoon won't accept connections if the source port is not UDP 4500. Most connections that go through NAT will randomize the source port, which means it won't connect. The old version of the daemon doesn't have this restriction. Connections from ...


3

I am not sure how this works with newer OS X server variants, but at least up to 10.6 this was correct. They were using a special password server that had an encrypted database of passwords in various hash formats that could be queried by all types of services (some of them specifically modified to do this, e.g. Apples Samba server) but it was impossible to ...


3

The answer is similar to the one you linked to. In the file /System/Library/LaunchDaemons/ssh.plist, you need to edit the Listeners item. The IP address can be specified with they key SockNodeName. When you're done, the Listeners part of the file should look something like this: <key>Listeners</key> <dict> <key>...


3

No, you can't do this with DNS, IPtables or the hosts file. You'd need to point those domains to a proxy, or something that has knowledge of what you want done, which will in turn re-direct the clients to the "right" place.


3

You could try and enable compression, and see if that helps. From man sftp: -C Enables compression (via ssh's -C flag). And from man ssh: -C Requests compression of all data (including stdin, stdout, stderr, and data for forwarded X11, TCP and UNIX-domain connections). The compression algorithm is the same used by gzip(1), and the “level” ...


3

Speed up sftp transfers Assuming your issues are network tuning and/or throttling per TCP connection, take a look at sftp using the lftp mirror subsystem Network tuning on each end is a much bigger topic and would require a lot of back and forth, pushing the topic outside of the scope of ServerFault. For individual connections, the compression mentioned ...


3

I was able to get this working by setting up a bonded set on macOS with the following command: # First get your network interfaces: $ networksetup -listallhardwareports # Then create the bond with the appropriate ports: $ networksetup -createBond BondName en1 en2 en7 I then manually assign an IP + subnet via System Preferences -> Network (ie, 192.168.10....


3

In TLS the term “untrusted” is not the same as “not encrypted“. As you can see from the subsequent cipher and key strength in your log the communication is encrypted. In TLS the trust relates to how to verify that the certificates used actually belong to the entity that presents them. You can still use a certificate when you don’t verify it or when ...


2

ldapsearch -x \ -b "cn=<your group name>,ou=group,dc=<your org>,dc=com" \ -H ldaps://<ldap server>:<port> This works very well.


2

Useful links: https://github.com/kholia/OSX-KVM https://github.com/foxlet/macOS-Simple-KVM https://github.com/munki/macadmin-scripts Mojave: #!/usr/bin/env bash #=========================================================================== # Works only with the official image available in the Mac App Store. # Make sure you download the official installer ...


2

To follow along your question's line of thinking, check your modem/router configuration. You need to make sure that WAN->LAN ports are open for both TCP and UDP. Warning: this may be a real pain to configure and maintain! It looks like you have VPN configured and working. I'd suggest continuing down that line unless you want to spend a bunch more time ...


2

S-1-5-88- is the NFS base RID S-1-5-88-1-1029 is User ID 1029 S-1-5-88-2-100 is Group ID 100 S-1-5-88-3-16832 is the access mode (octal 40700) S-1-5-21- is the domain, which the client is apparently not a part of. Try joining the windows client to the domain to get the SID for S-1-5-21 resolved. The S-1-5-88 can't be mapped since W7/...


2

3 options come to mind. Talk to the building management. I suspect this won't go far and still leaves you with little control. Get your own internet feed. May also be hard, but hopefully not. Set up a site to site VPN between your office internet and another external host or VPS. The third option may actually be the easiest to accomplish. If you fire up ...


2

Open Directory has an LDAP backend so you would use something like simplesamlphp with LDAP to get what you want. However, some big caveats. If you’re happy with your Windows Server experience there are very few compelling reason to switch to OS X and Open Directory. Apple has put a lot of work into making OS X a good Active Directory client. For a broad ...


2

The standard Mac configuration management tool is Casper: http://www.jamfsoftware.com/products/casper-suite/ An open-source alternative is Munki: https://code.google.com/p/munki/


2

There are several options, depending on what resources you have available: If you have the OS install DVD, you can boot from that (insert the DVD, then either hold the "C" key at startup, or hold Option key and select the DVD in the startup manager). There's a "Utilities" menu in the installer that'll let you run Disk Utility, which can either create a disk ...


Only top voted, non community-wiki answers of a minimum length are eligible