OS X Home dirs not working properly

[HodgeHi]

Good morning,

 

I have been having numerous issues over the last 3 weeks or so. I would write it all down here but instead could i refer you to this thread where i have already done so:

 

Apple - Support - Discussions - AD Users auth Ok but cannot log into ...

 

Hope someone can help me here or even confirm that they are experiencing similar issues so i know i am not going insane.

 

Thanks,

Mark.

[DMcCoy]

What are the permissions on the root of the XRAID partition? I believe that you need other execute on it, along with the root of the sharepoints.

 

I've had issues with this in the past, and it's always been permission problems.

[HodgeHi]

So the root of the XRAID should be something like rwxr-xr-x?

 

I am completely unsure about how the permissions should be in all honesty. I had a fully working system before and now all hell has broken lose since i rebuilt the XRAID and finding information on the process to build a RAID array is near impossible to find i.e. do you use terminal with sudo or disk util under an admin account or should you use root's?

 

I managed to get it half-working at one point but finder took around 2-3 minutes to load. I think this also to do with permissions but things seem to work ok after everything loads. i gave the AD user posix permissions for their home dir and chmodded them to 700. Is this the norm?

 

Hope you can help and thanks for the info given already. I will check the permissions on the XRAID o Monday.

[Boon72]

having just finished doing the Apple server essentials course (and passing ) the trainer advised us not to use them together due to issues with the permissions. if your sharing for windows users then just use SMB as both will have access to the folders.

 

the first rwx is the owner the second the group and the third is for everyone else

[HodgeHi]

I have since re-installed Leopard server on a test bench mac mini. The version was 10.5.4. I went through the AD-OD paper as i have done before. I used an OS X 10.5.8 client, a server 2003 r2 server (installed natively on another mac-mini) and also an XP sp3 client (also installed natively on a mac-mini).

 

Now, the AD-OD paper used a share called homes$ on the AD Server and a share called homes on the OD Server, shared using AFP.

 

The outcome was that logging in was still slow compared to when i used 10.5.0 -10.5.7.

I also had some issues when trying to access the shares. Permissions related i think, and also when logging into the OS X Client for the first time, it keeps adding everyone deny ACLs to some of the folders. This never happened before.

 

I also found that i needed to start SMB service before i could change the home folder path in Server 2003 for he users. It does not say this in the AD-OD paper but i can't recall having an issue before?

 

So still at the starting line. I just need to test SMB now...

[HodgeHi]

So i tested SMB for the protocol to mount the home shares instead of AFP. I was presented with an error stating that the Home dir was deleted or access in denied. I checked to see what was happening and for some reason i had to authenticate to get access to the home dir. S it seems that kerberos isn't working for SMB but it does work for AFP?????

 

I think i'm about to jump off a bridge

[HodgeHi]

What are the permissions on the root of the XRAID partition? I believe that you need other execute on it, along with the root of the sharepoints.

 

I've had issues with this in the past, and it's always been permission problems.

 

Here's what i have after a re-format of the XRAID array:

 

OD_server:~ admin$ ls -la /Volumes/Data
total 2004192
drwxrwxr-x  13 admin  staff         510 Aug 24 11:01 .
drwxrwxrwt@  4 root   admin         136 Aug 24 12:44 ..
-rw-rw-r--@  1 admin  staff        6148 Aug 24 12:45 .DS_Store
d-wx-wx-wt   3 root   staff         102 Aug 24 12:44 .Trashes
drwx------   6 root   staff         204 Aug 24 12:44 .fseventsd
drwxrwxr-x+  9 admin  staff         306 Aug 19 11:19 ComputerImages
drwxr-xr-x@  4 admin  staff         136 Aug 17 17:08 DeployStudioServer_v1.0rc13
-rw-r--r--@  1 admin  staff  1026122687 Aug  5 17:53 MacOSXServerUpdCombo10.5.8.dmg
-rwxrwxrwx@  1 admin  staff        1055 Aug 17 17:03 Users.command
-rw-------   1 admin  staff         925 Aug 18 08:39 com.apple.desktop.plist
-rwx------@  1 admin  staff         272 Aug 21 13:05 re-create_userdir.sh
OD_server:~ admin$ 

[DMcCoy]

Where are the users home folders stored?

[HodgeHi]

They were in a folder called UserHomes. I will re-create the folder with share permissions and post those...

 

Last login: Mon Aug 24 13:57:56 on ttys000
OD_server:~ admin$ ls -la /Volumes/Data
total 3559008
drwxrwxr-x  16 admin  staff         612 Aug 24 14:56 .
drwxrwxrwt@  4 root   admin         136 Aug 24 14:54 ..
-rw-rw-r--@  1 admin  staff       12292 Aug 24 14:56 .DS_Store
drwx------   3 root   staff         102 Aug 24 13:04 .Spotlight-V100
d-wx-wx-wt   3 root   staff         102 Aug 24 12:44 .Trashes
drwx------   6 root   staff         204 Aug 24 12:44 .fseventsd
drwxrwxr-x+  9 admin  staff         306 Aug 19 11:19 ComputerImages
drwxr-xr-x@  4 admin  staff         136 Aug 17 17:08 DeployStudioServer_v1.0rc13
-rw-r--r--@  1 admin  staff  1026122687 Aug  5 17:53 MacOSXServerUpdCombo10.5.8.dmg
-rw-r--r--@  1 admin  staff   796055279 Aug 13 01:00 MacOSXUpdCombo10.5.8.dmg
[b]drwxrwxr-x   3 admin  staff         102 Aug 24 14:55 UserHomes[/b]
-rwxrwxrwx@  1 admin  staff        1055 Aug 17 17:03 Users.command
-rw-------   1 admin  staff         925 Aug 18 08:39 com.apple.desktop.plist
-rwx------@  1 admin  staff         272 Aug 21 13:05 re-create_userdir.sh
OD_server:~ admin$ 

 

This is the XRAID currently. The folder UserHomes is the shared folder for auto-mounting.

[DMcCoy]

This is the XRAID currently. The folder UserHomes is the shared folder for auto-mounting.

 

How are the folders for students arranged, and where are the sharepoints.

 

Are you using AD for user accounts, and do AD users only have one home folder that is the one on the mac server? Are you using augmented records in OD?

[HodgeHi]

The sharepoints are on the OD which is the UserHomes folder. I was going to use the UserHomes folder to store both the Staff and Pupils as opposed to last year where i had a separate share point for staff and pupils. I started experiencing the issue that you mentioned in another thread where if a student logged on and then off, a member of staff (mounting a different share-point) could not log on until the system was restarted.

 

I thought doing it this way would alleviate the problem since they were all in one location. We only have around 250 users in total.

 

We are using AD for users accounts and the way i am setting it up is to have the Home dirs stored on the OS X Server, with Active directory redirecting the XP docs into the Home dir docs on the OS X Server thus merging to 2 together.

 

Their XP profiles are stored on the AD Server, mandatory for Pupils and roaming for Staff. This is how i had it last year. The only issue i had with this was AFP losing files

Edited August 24, 2009 by HodgeHi
spelling

[DMcCoy]

Create a new test sharepoint on the normal server drive. Alter a user to use this sharepoint for their home folder, you will need to create the folder and assign full control by hand for the moment.

 

Have the share as

 

Users/TestUser

 

or something similar with just one level below the home folder. For now set the owner of the folder as the AD users, and set full control for owner, acls can be later.

[HodgeHi]

I have tried creating an OD User and created a sharepoint for his home dir on the os drive. I set the share up so everyone had read/write access and full control over the share. I propagated the permissions and created the users home folder. I logged in and still finder took an age to load.

[DMcCoy]

There are several issues.

 

The AD users folder need to be create manually

The Unix permissions need to be set on the folder

The AD ACLs need to be set on the folder.

 

Try these settings with a test user:

 

mkdir /Volumes/RAID/Shares/Users/Students/04/test04
chmod +a "DOMAIN\test04 allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" /Volumes/RAID/Shares/Users/Students/04/test04
cp -r /System/Library/User\ Template//English.lproj/ /Volumes/RAID/Shares/Users/Students/04/test04/
chown -R test04:administrator /Volumes/RAID/Shares/Users/Students/04/test04/
chmod -R ug+rwx /Volumes/RAID/Shares/Users/Students/04/test04/

 

The DOMAIN\user may have to be done as [email protected] in 10.5.

 

You can probably skip copying the default profile, 10.5 is less prone to crashing without the default folders.

[HodgeHi]

@DMcCoy

 

I haven't tried your commands yet, but i did run my own script to create the AD users' Home Dirs. This is what i used:

 

#!/bin/bash
# userlist.sh

#Exporting the Usernames

dscl /Active\ Directory/All\ Domains -list /Users UniqueID| awk '{print $1","$2}' > $PWD/Users.txt

#Setting UIDs variable as the list of names in the Users.txt
UIDs=$PWD/users.txt

#Change the HomeDir variable to the location of the Users Home Dirs.
HomeDir=/Volumes/DATA/UserHomes/

#Create the User Home Dir location folder
#sudo mkdir $HomeDir

#Creating the name variable with the names from the users.txt file (UIDs variable)
for name in $(awk 'BEGIN{FS=","}{print $1}' < "$UIDs" )

#for name in $(awk 'BEGIN{FS=","}{print $1}' < "$UIDs" )
# Field separator = :    ^^^^^^
# Print first field              ^^^^^^^^
# Get input from password file               ^^^^^^^^^^^^^^^^^

#Run through the users.txt creating the home directories for each user
do
sudo mkdir $HomeDir/$name
sudo cp -R ~/Desktop/English.lproj/ $HomeDir/$name

#chown each Home Dir to the users who owns it
sudo chown -R $name $HomeDir/$name
sudo chmod -R 700 $HomeDir/$name

 let "n += 1"
done 

sudo rm -R /Volumes/Data/UserHomes/guest
sudo rm -R /Volumes/Data/UserHomes/krbtgt
sudo rm -R /Volumes/Data/UserHomes/support_*
sudo rm -R /Volumes/Data/UserHomes/administrator
sudo rm -R $PWD/users.txt

exit 0

 

It's a bit rough but better than nothing since i know diddly squat about scripts

 

Could you see this presenting any issues with regards to permissions?

[HodgeHi]

So i have managed to resolve my logging in issue. I was trying to resolve an issue with iWork taking an age to start and thought it to be perhaps a filtering issue. I found this not to be the case since another site was using the same proxy address and software with ni issues. I thought maybe firewall issue...

 

It turns out that it was neither.

 

I used my router's IP for the forwarding DNS server in the AD. Although the Internet was working and DNS working fine internally, it was causing issues with iWork not being able to resolve properly. Once the Forwarding DNS Server was corrected iWork worked fine.

 

Strangely though my login problem also disappeared. I'm not too sure why a forwarding DNS IP would cause problems with an internal logging lookup and client logging in but there you go. All seems Ok and pretty quick now again.

 

Thanks for your help everyone. Most appreciated.