Slashdot Mirror
Review - Mac OS X Server 10.3, Part 1
Sure, I can read. I can go to the Mac OS X Server web site and read all the documentation for things related to "standards-based management," "share printers and files," "n-tier" solutions. Yawn. I know all about this stuff, and I know I can do it already. If I am paying good money for this, it better have value I can't already get for free.
First Things First
Essentially, Mac OS X Server is the same thing as Mac OS X (a.k.a. Client). It's the same core OS, it has the same versioning (10.3.2 as of this writing), it runs the same programs. But Server comes with programs and tools and configurations geared toward being a server, rather than a user's workstation.
Server comes in two flavors: a 10-client version for $500, and an unlimited client version for $1000. The only difference between the two is that the 10-client version limits file and windows sharing to 10 simultaneous clients. You can have any number of users, but only 10 can connect to those services at the same time.
With that money, you also get 90 days of "up-and-running" support covering the software that ships with Server. So if you've read the frelling manual and still can't figure out why the firewall doesn't seem to be working, you can get some help. After 90 days, you can still get help -- including more advanced topics -- but it will cost you from $6,000 to $50,000.
Hardware
The Xserve, Apple's rack-mountable computer, comes with the unlimited client version of Server preinstalled; and really, Server is built with Xserve in mind. Server Monitor, included with Server, displays uptime, temperature, drives, power, network usage, fans, and security of Xserve boxes.
You can configure Xserve boxes automatically with Panther Server preinstalled. Design your configuration on one machine, set up an LDAP server and put it in the DHCP server settings, and add your configuration file to the LDAP server. Turn on the other servers for the first time, and each one will find the DHCP server, find the LDAP server, find the configuration file, and configure itself automatically. You can also put the configuration file on a USB key or somesuch, and the machines will configure themselves that way, too.
My test box is a dual G4/1.25 GHz Power Mac; it performs with nary a hiccup. If I had a large network or many users, I can imagine wanting more power: with a Power Mac or Xserve G5, I'd be able to take advantage of an OS that is optimized for the 64-bit CPU. For me, however, this would result in a depressingly, perpetually, low CPU load.
Initial Security Considerations
Out of the box, assuming no one has set up a rogue DHCP server on your network, Mac OS X Server is mostly secure: only SSH is on by default. As other services are turned on, more security concerns are created, because new security holes may be opened.
For the most part, the default configurations of the various services are secure, but that largely depends on your specific environment. Mac OS X Server is excellent at making advanced server configuration easier, but this ease of use comes with a price: you may be opening yourself up to attack. Mac users are often not used to the idea of making themselves vulnerable just by clicking checkboxes.
This may look like a Mac, and may be easy to use, but it is no substitute for having a real live sysadmin on hand to -- at the very least -- audit the security of the system. It'd be nice if Server included audit tools; I envision UI elements that warn you when you have conflicts, or when you've opened up a hole, or when you've violated predefined security policies. On the other hand, it would be more reliable to have a third-party system to do the audit, on basic principle. But that's so un-Mac-like.
Open
Tom Goguen, Director of Marketing for Mac OS X Server, says that Apple is 100% into using open standards and open source in the core operating system.
Mac OS X Server has always been largely based on open standards, but the Panther incarnation has gone even further. Gone are Apple's proprietary mail systems; they are replaced by postfix, mailman, and cyrus. Mostly gone is NetInfo; it is replaced by LDAP. Rendezvous, also an open system that others can plug into, is a bigger part of Server now: FTP, LPR, and web services are all announced via Rendezvous.
Of course, as always, Server -- just like Client -- is based on FreeBSD (now version 4.8, with some of 5.0 stirred in), and most of the Apple core OS itself is under the Apple Public Source License.
A Case for Case
New to Panther is case sensitivity in HFS+. For many years, Mac OS has used the HFS as its file system, which treated "Foo" and "foo" as the same file. Some years ago, HFS+ was introduced to overcome many of the limitations of HFS, but case sensitivity -- seen more as a usability feature than a limitation -- remained.
But in Unix, this certainly is a limitation for many people. "Makefile" vs. "makefile" and "head" vs. "HEAD" have caused many a headache for Mac OS X/Unix users. But now case sensitivity is a formatting option.
Because case insensitivity is still seen as a usability feature, this feature is not available by default on Client, although you could always connect your drive to a Server to format it. It is also possible, in theory, to format a drive with case sensitivity in Client using various tricks.
Setting it Up
My server is connected to my home network via a 100BaseT switch, to which is also connected a cable modem and an AirPort Extreme base station. My PowerBook G4/867 connects to the network via AirPort or the switch. My wife has an iBook G3/600, and I've got a PowerBook G3/400 in my stereo closet for playing MP3s. The PowerBook doesn't have internal AirPort, and instead is connected to another switch and another Extreme base station, configured to do WDS. I've also got the PS2 connected in there. Everything is running Panther Client (except for the PS2, last I checked).
Looking at the various services offered by Server, I can already see many things I want to set up: file sharing (Apple Filing Protocol, or AFP), DHCP for guests, DNS, FTP, SMTP, printing, and web. I have most of those already set up now, but I wouldn't mind if they were easier to configure and manage.
After surveying my situation, I installed Panther Server and took a look around.
The first thing I wanted to see was what my configuration options were. And lo, there in my Dock were not the expected iMovie, iTunes, iPhoto, and the like, but icons that a mouseover revealed to be representative of programs like Workgroup Manager, the aforementioned Server Monitor, and Server Admin.
Workgroup Manager uses a lot of terminology that is completely lost on me, and I am not managing any users, really. My wife doesn't need the file server -- we can exchange files via iChat, or I can copy them to her machine via scp -- and she keeps all her own files on her machine. We won't be using any print quotas. I do use Workgroup Manager to create some basic user accounts for friends, but I don't need any features more advanced than what is in Client.
Server Admin is what I want to sink my greedy little digits into. I opened it up, clicked the "add new server" button, typed in my server name ("Sweeney.local") and password, and started playing.
As I started looking around, I remembered that there was an extra CD in the distribution called Admin Tools. It allows you to install these tools on any Client machine, so you can manage the Server remotely. I want to go hang out in my La-Z-Boy while I configure my server, so I installed the tools on my PowerBook. Nifty.
Server Admin lists each machine and the services available to it, with an icon next to each describing its status. If you select a machine's name, you see several tabs: Overview, Logs, System, Graphs, Update, and Settings. Overview reports the system version, names, and dates. Under Logs, you can view the system log, watchdog log, etc. System reports what network interfaces and volumes are available. Graphs displays CPU and network use in pretty pictures. Update runs Software Update. Settings controls the system names, the date and time and timezone.
This is basic stuff, and each service is laid out in similar fashion. All of them have at least two tabs: Overview and Settings. Most also have a Logs tab. Some have other tabs like Connections, Graphs, Clients, Activity, Accounts, Queues, and Jobs.
The available services are AFP, Application Server, DHCP, DNS, Firewall, FTP, Mail, NAT, NetBoot, NFS, Open Directory, Print, QuickTime Streaming, VPN, Web, and Windows. Somewhat conspicuous in its absence, to me, is MySQL, which is included in Server, but doesn't have an interface in Server Admin.
Server Admin does have its problems. It will crash on occasion, but I see no evidence of my settings being corrupted, or any other lasting ill effects. Some of the lists are not sortable, though they appear to be: for example, the DNS zone listings are not sortable, even though clicking on the column headers indicate otherwise.
Also, it can be slow to update. This is understandable, but annoying. Logs don't refresh immediately, and when you hit reload, the wrong log is selected, instead of the current log being refreshed. When restarting services or viewing logs, I will sometimes use the command line tools, as they are more efficient; it would be nice if Server Admin would display the path to the log you are looking at, so you can easily find and tail it in a shell.
Sharing
Some of these services are available in a minimal form in Client, in Sharing under System Preferences: file sharing, Windows sharing, web, FTP, and printing. In Server, the Sharing preferences are still there, but contain only three items: Remote Login, Apple Remote Desktop, and Remote Apple Events. Remote Login is simple: it allows users to connect with ssh/scp, and can be turned on or off. The other two require, perhaps, a bit more explanation.
Apple Remote Desktop is a way for an admin to control client computers. Previously, the client was distributed only as part of the software package of the same name, but now the client is included with Panther. It is, of course, off by default, and once turned on, each machine must define what users have access to what resources (this can be done via the command line, too). I most commonly use ARD for controlling and viewing the screen of another computer, installing packages, and copying files.
Remote Apple Events has been in Mac OS for many years, since back in version 7-dot-something. It allows controlling "scriptable" Mac applications -- such as with AppleScript -- over the network. It used to run over AppleTalk, but now runs over plain old TCP/IP. Not many people make use of remote Apple events in my experience, but I use them often; for example, I have a Perl script that queries iTunes on a remote box, and sets the current track in iChat.
Windows
I don't use Windows, and therefore can't really test the new Windows integration in Panther Server. But from what I can tell, Apple has added quite a few improvements. Samba has been updated to version 3, and the lists of Unix and Windows users can be united via Directory Services. But I confess to a crippling ignorance and apathy about this small corner of the computing world. Sorry.
To Be Continued
Tomorrow, I'll get into the details of setting up the services I use on my network.
I'd like to see your setup.
I'm getting an Xserve G5 soon and I haven't used OS X Server at all. Tell us about Netbooting. The idea intrigues me...I must know more about it.
What other things are fun to use with it? The Xserve will be running PHP/MySQL, I don't know much about Mac OS X Server so please let me know!
I ffropgaermgaeromgaegoSRAGKWgaer/.
(-1, Raw and Uncut is the only way to read)
I think Apple missed the boat not supporting these Macs with OS X. They make great little OS X workhorses.
It's either on the beat or off the beat, it's that easy.
I moderate therefore I rule!
--
So is there a client limit on regular OS X? (Client)
How many clients can connect to OS X Client? That would be interesting to know. Granted, the server version comes with tools, but what tools are really there that aren't available for free somewhere?
stuff |
As an engineer it's offensive to see limiters put into software for non technical reasons.
While you can easily do everything that Panther Server does on your linux box, what Panther excels in is integration. Specifically the binding together of OpenLDAP, Samba, Apache, Postfix, IMAP, POP, and CUPS with the OpenDirectory password server. OpenDirectory's password server is essentially a SASL password store that they've hacked all the programs mentioned to interact directly with it for all authentication. Think of it similarly to what pam does for linux. The nice thing about OpenDirectory is that a password change from any of these mechanisms (say via samba) then all of the password hashes in the database are automatically synced (even kerberos is synced). This makes for very slick administration of users all from one central console. In the past on Linux, it was not uncommon to have to hack together some scripts to syncronize ldap, samba, and kerberos authentication stores. Even in the best case right now, samba password hashes have to be kept in the ldap database along with either an md5 hash for unix logins, or a pointer to kerberos. With OpenDirectory, there are no passwords stored in ldap itself. Instead an Apple Password field points to the password database which can provide md5 challenges and responses, samba challenges, and general password verification.
Essentially OpenDirectory brings all the technologies together that we already use and make them into a service that competes very well with Active Directory or NDS.
Another bonus is that since OpenDirectory (all its parts including the SASL password database and patches to cups, samba, etc) is open source, we could build a complete OpenDirectory-compatible system on Linux. I plan to do this over the next year or so. Most likely there will have to be a pam module created, and some patches made to OpenLDAP, Samba, etc. But it's a very exciting example of how to put open source projects together and have them work really well.
You know, a lot of friends and colleagues have been laughing at me when I tell them that Mac is the new force to be reckoned with. I've been watching them for a little while now and ever since they integrated FreeBSD into their OS, they've taken on a new direction which seems a lot more proffitable.
Don't get me wrong, I still have my two Linux and two OpenBSD boxes at home along with the obligatory windows boxes for the wife, daughter and gaming.. but you know what? I'd love to get my hands on one of them OS X boxes..
If you don't think I'm right.. that's your opinion.. but I know if I had OS X experience, I might be able to get a job Here!
---
No matter how subtle the wizard, a knife in the shoulder blades will seriously cramp his style.
...I really do want to know why I should use this in a Win2K environment. My boss wouldn't care what I get as long as it does the job. What I want to know is: Can this server provide me with tools to form a good bridge between Windows, Apple, and Linux clients?
SAMBA 3, from what I read is GREAT, but it in no way yet compares to the ease of use of MS's Active Directory tools (at least in configuring Windows clients).
"...Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam..."
i just want to say that i enjoyed this review, and i'm looking forward to tomorrow's followup.
/. quality, i figured that i'd actually do the opposite for a change and congratulate the editors for a 'stuff that matters' moment... i thought this article was fun to read, and not just because i too am an osx/linux weenie.
in light of the fact that its so easy to complain about
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
To me, Workgroup Manager is the reason to buy OS X Server (assuming you are running a Mac OS X network with multiple users and OS X clients). It is a nice, zero effort way to manage multiple users and client computers - controlling who can use which client computers and which files/folders will follow them around from computer to computer.
Interesting.. I got 287/224/126. I wonder whats different about our boxes. I've got everything updated, as well.
having spent half the day yesterday working on getting 10.3 server with Open Directory/PDC mojo working on a brand new xserve, let me just say that Apple does not have 10.3 server configuring itself correctly at all. 1. DNS is not turned on or preconfigured with a minimally working zone file. 2. Kerberos isn't set up or on. And if it isn't set up, Open Directory wont work. Oops, did I mention that DNS isn't on either? That will also prevent Kerberos and OD from working. 3. The LDAP db that gets set up is buggered from the start because of 1 and 2. 4. Because of 1, 2 and 3, forget getting the Windows PDC stuff working. A nice Apple server tech sent me a loooong handwritten doc on what needed to be changed to get it all to work, which it did after I followed it. But, out of the box, even after those nice configuration wizard screens, it just isn't set up correctly. Amazing.
I have been a Linux user for about 10 years (when I first got Slackware over a 1200 baud modem) and until recently I was using a super-cheap Linux box to run Java server side stuff for my little NLP software business.
I switched over to using an old G4 Mac for running web services about 4 months ago. It is a little too early to tell, but I seem to be spending less time taking care of the G4 server (approxametely 1 hour a month - and I think that I used to spend 2 or 3 hours a month messing with my Linux server).
Anyway, a life for old Macs :-)
-Mark
Peace
I looked at the XServe for a NAS solution but couldn't find any information on things such as snapshots. Is it there? Coming?
``Remote Apple Events has been in Mac OS for many years, since back in version 7-dot-something. It allows controlling "scriptable" Mac applications -- such as with AppleScript -- over the network. It used to run over AppleTalk, but now runs over plain old TCP/IP. Not many people make use of remote Apple events in my experience, but I use them often; for example, I have a Perl script that queries iTunes on a remote box, and sets the current track in iChat.''
Does this mean that, on macs, you can
1. Script GUI apps
2. Script them over the network
? That gives the traditional unices a run for their money, I should think...
Please correct me if I got my facts wrong.
When I had both machines in place I ran into an issue where I had to rebuild the main one, so I transferred the data to the secondary server and planned to swap them. I changed their settings and IP addresses ... and all of the user accounts on the primary file server disappeared.
This was odd.
I Googled for it and came up with the answer: if you set up a password server on 10.2 Server you can't change the machine's IP address. This has to do with how Apple built the LDAP system that manages passwords, so it's a requirement if you want Windows file sharing (Samba in disguise) enabled. Which I did.
I called Apple tech support and they confirmed it: if I wanted to do Windows file sharing, I needed to set up a "password server" (LDAP). And if I set up a password server, I couldn't change the IP address of the machine. Ever. If I did, the users and groups would vanish into thin air. I asked if I could back up the user and group databases and then upload them again ... and they said no. Not without stripping the passwords out. So I'd have to have my users reset their passwords.
I was stunned. The inability to back up user account information, complete with passwords, and to change the IP address is ridiculous, and not the mark of a true, flexible server OS. So right now I'm migrating them to PPC Linux with Samba. I know 10.3 Server probably addresses these issues, but Linux is just simpler. Heck, all I have to do with Linux/Samba is replicate the passwd, group, shadow and smbpasswd files between the machines. Instant mirror servers. And it'll just work.
Besides, tar and mt will give me better control over tape backups than Retrospect did. Retrospect was always propting me for tapes of a particular set, and rejecting tapes that were from the wrong set. I don't give a pair of fetid dingo's kidneys about backup sets. On Linux, it's just "See that tape drive? Put the data there, and shut up about it." And it does. And it's good.
End of rant.
Well, I admin an XServe in a mixed Mac/Win32 environment, we've got the XServe pulling accounts out of the AD and serving them up to the Macs in a 'native' fashion. The XServe is also streaming over 7000 files from the AV department, running LPD print queues for ALL the network printers, and doing whatevr else I feel like making it do.
As for the 'lickable' GUI, I never really have to see it, there's a problem if you're looking at your server's desktop a lot. And honestly, doing all that it does, the CPU load rarely hits 3%, do I really give a flying shit if the GUI sucks a few cycles off the top? Nope. The GUI doesn't slow things down when it's not being used, after all.
And for what we use it for, it really is the best solution out there.
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails
Yes, and KDE 2.x and 3.x have it too in the form of dcop. dcop is a command-line tool that allows one access to an exported set of functions in any given KDE program. dcop bindings are available for many languages and dcop itself can be used in conjunction with the shell to script events. And yes, it even works on the network, with encryption if I add another pipe (wow, the magic of UNIX).
Sun Fire 15K Server
18 Processor/Memory Boards
72 1.2-GHz UltraSPARC III Cu Processors
8-MB ECC External Cache per Processor
288-GB Memory
2 System Controllers
6 Power Supplies
4 Fan Trays
1 PCI I/O Assemblies
1 Quad FastEthernet PCI Adapter
1 Dual Port LVD SCSI/Dual FastEthernet PCI Adapter
1 Sun StorEdge S1 Disk Array
1 External Expansion Rack
Solaris 9 Operating System Media Kit
Server Installation Service for up to 18 Domains
List Price: $2,661,730.00
Xserve G5
Dual 2GHz PowerPC G5
8GB DDR400 ECC SDRAM - 8x1GB
750GB ADM (3x250GB Serial ATA)
CD-ROM
Fibre Channel PCI card - (lower slot)
Xserve RAID 3500G/14x250G/2x2GB FC
Mac OS X Server, Unlimited License
Subtotal $21,498.00
x 36 (72 G5 CPUs, 288 GB RAM, 126 TB FC RAID storage)
= $ 774,000.00
Just matching number of processors and RAM, that's $2.7 M vs. $0.7 M. Are they fully equivalent? No. Does the G5 at almost a quarter of the price look very attractive? Hell yes. Consider spending the same amount of money on G5s. You'll get 140 of the G5s. Substitute cluster nodes and you can get a whole gross with change left over.
The potato it is uninformed.
True. But the Xserve + Xserve RAID + Mac OS X Server is a compelling SMB solution which plays "nicer" with much bigger systems (which are typically UNIX) than your typical Windows x86 setup.
36 2x machines is not gonna do what 1 64 CPU machine will do.
- with Solaris 9's containers, I can partition up a lot of that big machine into controllable sub machines. SGI does this the best, but Solaris A (5.A?? 10 for marketing weenies) takes it steps further - mostly to match some of the LPAR stuff that IBM offers).
- SATA is simply serial ATA. It's not SCSI.
- Ever run a large Oracle|Sybase database (the main purpose for most monster Sun boxes) across 36 machines? Me neither. I *do* have it on V1280s, however.
-
Sun's also good for many many PCI busses. Not slots but independant busses.
Now I'll concur that at the <= 4CPU end, Sun doesn't really offer much. And if SGI weren't tanking for the previous 5 and next 10 years, they'd likely be doing it better (MIPS is whithering, but pluging 6 4x machines together the its craylink to make it into 1 single 24x machine is cost effective scaling.On that note, you can drop cost and boost performance buy using a nice Baydel RAID array rather than anything from Sun (I don't buy Kawasaki brand tires; I don't buy Sun brand RAID)
We can also mention the switched backplanes that expedite processors reaching RAM banks directly - not a shared bus and other things that make this a different class of computer.
With Sun, you start with a 32 way machine populated with 4 CPUs and by the time you grow, oh! those 900MHz ultra 3's aren't going to work with our newer 1200MHz chips.
As much as I hate AIX, the Power5 machines are SWEET at the high end.
But this crowd is about 1-4 way machines. Sun offers no reasonable 1Us (V120: 700Mhz Ultra 2 CPUs? with no cache to speak of? Cmon. My abay Wait, looking at Sun they have a 2*1GHz V240 Ultra3 box for "only" $6k. Add a RAID box and you can compete with the $4 DL380g3 (at 3GHz, but only 32bit :).
But Sun ships with apache 1.3.12 and other never updated Open Source Tools...
First I like the report and wait for part 2 (3??). /etc.
To sum up a reply to a lot of the posts here, you should compare an X-Serve with SUN or IBM boxes and the respective OS, or even Windows Server (whatever it may be called at the time of this writing). The X-Serve with unlimited User license out of the box gives the aforementioned systems a run for the money, verbatim.
About a year ago I gave the system a shot and installed Oracle 9i R2 and QuickTime Streaming Server to see how the box performs. I didn't manage to get the CPU load over 60 % while doing three audio streams, users connected to the fileshares (Mac and Windows) and running Oracle with load. The setup was painless and I switched between GUI and CLI to see if it makes a difference. The only thing I could really complain about, but that holds true to some Linux distros as well, is the fact that some GUI tools mess up the config files in
BTW: I'm a Unix SysAdmin for 17 years by now and went through *NIX systems some of you might not even heard of.
my 2 cents