Problem with Workgroup Manager on Xserve

[dansymons]

Hi,

 

After a bit of help here!

 

I'm attempting to setup our new Apple Xserve and keep hitting the same problem. For some reason Workgroup Manager is not responding as it should! When I first launch the program it appears to do nothing, and then the whole systems stops responding. After about 5 minutes it wakes up again and the users are listed in the left hand column. Then, if I click on a user the system then hangs again and I have to wait before I can edit the user properties.

 

I've managed to narrow down the cause. It only seems to happen if AFP or SMB are running. If these services are disabled Workgroup Manager opens instantly and displays all the users.

 

I kinda need these services enabled.......

 

Any ideas? I'm stuck!

 

Thanks

Dan

[sammya]

Couple of questions,

 

is this server an OD master?

 

is there a DNS record configured for the server? check that forward and reverse lookups work.

 

What address are you connecting to when you open workgroup manager? the IP address, local host name or DNS address. WGM can be a bit funny if you don't use the DNS address.

[dansymons]

Hi there,

 

Yes the it is an OD master

 

DNS is working well, sudo changeip -checkhostname returns no errors.

 

WGM is connecting to 127.0.0.1 - it chose this address automatically the first time i'd run it.

 

Personally I don't think it's a DNS issue as WGM runs fine if AFP & SMB are disabled! Which I can't understand......

[sammya]

So, there are no error messages, just a slow down in WGM.

 

Are there any repeating messages in the system.log or AppleFileServices.log?

 

does this happen with AFP and SMB running or just 1 service?

[dansymons]

Yep. I get the coloured spinning disk each time I click on a username & have to wait for the server to respond before I can do anything!

 

There are no logs for AFP and nothing in the system log.

 

It happens with both services running or just one at a time.

[sammya]

not to bang on about DNS, but what is resolving the query? A windows server? or the Xserve?

 

Do you have a .local domain?

 

10.6 creates it's own DNS to resolve itself when you initially set it up. This can conflict with a .local

 

Can you post a screen grab of your DNS config from server admin - if any and also your network sys prefs?

[dansymons]

The xserve is configured to use it's own DNS. The server is named "appleserver.local".

 

I will post a screenshot of the DNS but do you know how to take a screenshot using a standard, non mac keyboard?

[HodgeHi]

i assume that you have more than mac clients than just the xserve. Try running the server admin tools on one of the clients. See if the same happens.

 

You may also wish to invest in a client for admin purposes if you don't already have one. This makes managing the clients using WGM a whole lot easier as i have had trouble managing print queues directly on the server itself.

 

I also think that this is a DNS issue. See what happens when you run the command:

 

Host fqdn.server.com

and:

host IP of server

 

These should come back with the correct results which are the same as the DNS entries. To be honest though if you have an AD DNS server, use this for your DNS as Apple's implementation can be troublesome.

 

Also is the Xserve only running as an Open Directory Master? Or has it been joined to an AD infrastructure also?

 

The screen grab: Windows key, Shift + 4, or alternatively use the grab utility found in the utils folder.

[dansymons]

Hi,

 

Please see the attached files regarding your previous post.

 

The Server is running as an OD Master on it's own, it is not joined to an AD domain.

 

Thanks for all your help.

Dan

[AntonioRocco]

Hi

 

@dansymons

 

Your DNS is wrong. You have nothing resembling a fully qualified domain name (FQDN). Your Machine (A) Record is appleserver.local. This is not an (A) Record. Simply a hostname consists of a name for your server eg: myserver or ns01 followed by a dot; a zone/domain name, eg: mydomain followed by a dot; finally the top level domain suffix, eg: .com, or .net, or .private, or .anything you like . . . but not .local. There should be a dot after the TLD as this signifies the Server as being authoritative for that domain. Basically NS and SOA Records are created. Post the result of:

 

host -a appleserver.local

 

Do you see anything that looks like this:

 

host -a edugeek.net

Trying "edugeek.net"

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33510

;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 2

 

;; QUESTION SECTION:

;edugeek.net. IN ANY

 

;; ANSWER SECTION:

edugeek.net. 172800 IN NS ns1.twisted4life.com.

edugeek.net. 172800 IN NS ns1.edugeek.net.

edugeek.net. 172800 IN NS ns2.edugeek.net.

 

;; AUTHORITY SECTION:

edugeek.net. 172800 IN NS ns2.edugeek.net.

edugeek.net. 172800 IN NS ns1.edugeek.net.

edugeek.net. 172800 IN NS ns1.twisted4life.com.

 

;; ADDITIONAL SECTION:

ns1.edugeek.net. 172800 IN A 78.46.90.218

ns2.edugeek.net. 172800 IN A 78.46.90.219

 

Compare the above with what you have

 

DNS on one level does not really care what you use for the .TLD. The Windows platform has been using .local to differentiate what exists for public and private domains for years. Nothing wrong with this although I'd always go for split DNS as it makes things look nicer when dealing with external services. No obfuscation that way. On the mac platform however .local is reserved for Bonjour/Rendezvous services. This can and does cause problems when considering LDAP. This is because the local KDC is reserving the use of this for itself. As you can appreciate this can cause authentication problems when trying to login using Network Accounts from a mac client in an OD (or AD) environment based around .local. Sometimes the mac gets confused about which KDC it's supposed to be getting its SGTs from. Itself or a remote Service Principal? Don't forget clients look locally first for account/authentication before looking elsewhere. Apple have improved matters regarding the use of .local since 10.5.4 but this is only for AD environments. Your is an OD environment. In an OD environment avoid the use of .local every time otherwise you're going to have major problems all the time.

 

On OSX Server Kerberos won't start if internal DNS Services are based around .local. in effect you don't get SSO and a fully working LDAP Service with all that that means. Open Directory on the mac platform consists of three separate components working together: PasswordServer, LDAP Server and MIT Kerberos. if any one of these has a problem you don't have Open Directory. On the server launch terminal and post the result of this command:

 

sudo serveradmin fullstatus dirserv

 

If this is 10.5 Server configured in Advanced Mode I'm guessing it will say: "STOPPED". If it does and depending on what stage you're at it may be easier/quicker to demote, sort out the DNS and re-promote afterwards? Everything apart from home directories is lost on demotion. Depending on how mature the LDAP database is this could be a good thing?

 

Antonio Rocco (ACSA)

Edited January 30, 2010 by AntonioRocco