Mac OS X Server Open Directory Administration For Version 10.5 Leopard Second Edition Apple Inc. © 2008 Apple Inc. All rights reserved. The owner or authorized user of a valid copy of Mac OS X Server software may reproduce this publication for the purpose of learning to use such software. No part of this publication may be reproduced or transmitted for commercial purposes, such as selling copies of this publication or for providing paid-for support services. Every effort has been made to make sure that the information in this manual is correct. Apple Inc., is not responsible for printing or clerical errors. Apple 1 Infinite Loop Cupertino CA 95014-2084 www.apple.com The Apple logo is a trademark of Apple Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, iCal, iChat, Leopard, Mac, Macintosh, QuickTime, Xgrid, and Xserve are trademarks of Apple Inc., registered in the U.S. and other countries. Finder is a trademark of Apple Inc. Adobe and PostScript are trademarks of Adobe Systems Incorporated. UNIX is a registered trademark of The Open Group. Other company and product names mentioned herein are trademarks of their respective companies. Mention of third-party products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the performance or use of these products. 019-1190/2008-02-25 3 Contents Preface 11 About This Guide 12 What’s New in Version 10.5 12 What’s in This Guide 14 Using This Guide 14 Using Onscreen Help 15 Mac OS X Server Administration Guides 16 Viewing PDF Guides on Screen 16 Printing PDF Guides 17 Getting Documentation Updates 17 Getting Additional Information Chapter 1 19 Directory Services With Open Directory 19 Benefits of Using Directory Services 20 Directory Services and Directory Domains 21 A Historical Perspective 21 Data Consolidation 23 Data Distribution 24 Uses of Directory Data 25 Access to Directory Services 25 Inside a Directory Domain 27 Structure of LDAP Directory Information 28 Local and Shared Directory Domains 28 About the Local Directory Domain 29 About Shared Directory Domains 30 Shared Data in Existing Directory Domains 30 SMB Services and Open Directory 31 Open Directory as a Primary Domain Controller 32 Open Directory as a BDC Chapter 2 33 Open Directory Search Policies 33 Search Policy Levels 33 Local Directory Domain Search Policy 34 Two-Level Search Policies 3 35 Multilevel Search Policies 36 Automatic Search Policies 38 Custom Search Policies 38 Search Policies for Authentication and Contacts Chapter 3 39 Open Directory Authentication 40 Password Types 40 Authentication and Authorization 41 Open Directory Passwords 41 Shadow Passwords 42 Crypt Passwords 42 Providing Secure Authentication for Windows Users 43 Offline Attacks on Passwords 44 Determining Which Authentication Option to Use 45 Password Policies 46 Single Sign-On Authentication 46 Kerberos Authentication 47 Breaking the Barriers to Kerberos Deployment 48 Single Sign-On Experience 48 Secure Authentication 49 Ready to Move Beyond Passwords 49 Multiplatform Authentication 49 Centralized Authentication 50 Kerberized Services 50 Configuring Services for Kerberos After Upgrading 51 Kerberos Principals and Realms 51 Kerberos Authentication Process 52 Open Directory Password Server and Shadow Password Authentication Methods 54 Disabling Open Directory Authentication Methods 55 Disabling Shadow Password Authentication Methods 56 Contents of the Open Directory Password Server Database 56 LDAP Bind Authentication Chapter 4 57 Open Directory Planning and Management Tools 58 General Planning Guidelines 61 Estimating Directory and Authentication Requirements 62 Identifying Servers for Hosting Shared Domains 62 Replicating Open Directory Services 63 Replica Sets 64 Cascading Replication 65 Planning the Upgrade of Multiple Open Directory Replicas 65 Load Balancing in Small, Medium, and Large Environments 66 Replication in a Multibuilding Campus 4 Contents 66 Using an Open Directory Master, Replica, or Relay With NAT 67 Open Directory Master and Replica Compatibility 67 Mixing Active Directory and Open Directory Master and Replica Services 69 Integrating With Existing Directory Domains 70 Integrating Without Schema Changes 70 Integrating With Schema Changes 70 Avoiding Kerberos Conflicts With Multiple Directories 72 Improving Performance and Redundancy 73 Open Directory Security 74 Service Access Control Lists (SACLs) 75 Tiered Administration 75 Tools for Managing Open Directory Services 76 Server Admin 77 Directory Utility 77 Workgroup Manager 78 Command-Line Tools Chapter 5 79 Setting Up Open Directory Services 79 Setup Overview 80 Before You Begin 81 Managing Open Directory on a Remote Server 81 Turning Open Directory On 81 Setting Up a Standalone Directory Service 83 Setting Up an Open Directory Master 85 Instructing Users How to Log In 85 Setting Up a Primary Domain Controller 86 Setting Up Windows Vista for Domain Login 87 Setting Up Windows XP for Domain Login 87 Setting Up Windows 2000 for Domain Login 88 Setting Up an Open Directory Replica 90 Creating Multiple Replicas of an Open Directory Master 91 Setting Up Open Directory Relays for Cascading Replication 91 Setting Up a Server as a BDC 92 Setting Up Open Directory Failover 93 Setting Up a Connection to a Directory Server 94 Setting Up a Server as a Mac OS X Server PDC Domain Member 95 Setting Up a Server as an Active Directory Domain Member 97 Setting Up Single Sign-On Kerberos Authentication 98 Setting Up an Open Directory Kerberos Realm 99 Starting Kerberos After Setting Up an Open Directory Master 100 Delegating Authority to Join an Open Directory Kerberos Realm 102 Joining a Server to a Kerberos Realm Contents 5 Chapter 6 103 Managing User Authentication 104 Composing a Password 104 Changing a User’s Password 105 Resetting the Passwords of Multiple Users 106 Changing a User’s Password Type 106 Changing the Password Type to Open Directory 108 Changing the Password Type to Crypt Password 108 Changing the Password Type to Shadow Password 109 Enabling Single Sign-On Kerberos Authentication for a User 109 Changing the Global Password Policy 110 Setting Password Policies for Individual Users 111 Selecting Authentication Methods for Shadow Password Users 112 Selecting Authentication Methods for Open Directory Passwords 113 Assigning Administrator Rights for Open Directory Authentication 114 Keeping the Primary Administrator’s Passwords in Sync 114 Enabling LDAP Bind Authentication for a User 115 Setting Passwords of Exported or Imported Users 115 Migrating Passwords From Mac OS X Server v10.1 or Earlier Chapter 7 117 Managing Directory Clients 117 Connecting Clients to Directory Servers 117 About Directory Server Connections 118 Automated Client Configuration 119 Adding an Active Directory Server Connection 119 Adding an Open Directory Server Connection 120 Removing a Directory Server Connection 120 Editing a Directory Server Connection 121 Monitoring Directory Server Connections 121 Managing the Root User Account 121 Enabling the Root User Account 122 Changing the Root User Account Password Chapter 8 123 Advanced Directory Client Settings 123 About Advanced Directory Services Settings 124 Setting Up Directory Utility on a Remote Server 124 Configuring Mount Records for a Computer’s Local Directory Domain 124 Adding a Mount Record to the Local Directory Domain 125 Removing a Mount Record From the Local Directory Domain 126 Editing a Mount Record in the Local Directory Domain 126 Using Advanced Search Policy Settings 127 Defining Automatic Search Policies 128 Defining Custom Search Policies 129 Defining Local Directory Search Policies 6 Contents 129 Waiting for a Search Policy Change to Take Effect 129 Protecting Computers From a Malicious DHCP Server 130 Using Advanced Directory Services Settings 130 Enabling or Disabling Active Directory Service 131 Enabling or Disabling LDAP Directory Services 131 Using Advanced LDAP Service Settings 132 Accessing LDAP Directories in Mail and Address Book 132 Enabling or Disabling Use of a DHCP-Supplied LDAP Directory 133 Showing or Hiding Configurations for LDAP Servers 134 Configuring Access to an LDAP Directory 136 Configuring Access to an LDAP Directory Manually 138 Changing a Configuration for Accessing an LDAP Directory 139 Duplicating a Configuration for Accessing an LDAP Directory 141 Deleting a Configuration for Accessing an LDAP Directory 142 Changing the Connection Settings for an LDAP Directory 143 Changing the Security Policy for an LDAP Connection 144 Configuring LDAP Searches and Mappings 147 Setting Up Trusted Binding for an LDAP Directory 148 Stopping Trusted Binding With an LDAP Directory 148 Changing the Open/Close Timeout for an LDAP Connection 149 Changing the Query Timeout for an LDAP Connection 149 Changing the Rebind-Try Delay Time for an LDAP Connection 150 Changing the Idle Timeout for an LDAP Connection 150 Forcing Read-Only LDAPv2 Access 150 Ignoring LDAP Server Referrals 151 Authenticating an LDAP Connection 151 Changing the Password Used for Authenticating an LDAP Connection 152 Mapping Config Record Attributes for LDAP Directories 152 Editing RFC 2307 Mapping to Enable Creating Users 153 Preparing a Read-Only LDAP Directory for Mac OS X 153 Populating LDAP Directories With Data for Mac