Mac Os X Server Essentials 10.7

Front 1

What are the minimum hardware requirements for installing OS X Lion Server?

Back 1

The minimum requirements are:
• Mac with an Intel Core 2 Duo, Core i3, Core i5, Core i7, or
Xeon processor
• 2 GB of RAM (more for high-demand servers running multiple services)
• 10 GB of available disk space

Front 2

What tool do you use to configure Lion Server if you have an unconfigured Lion Server?

Back 2

You use the Server app to configure an unconfigured Lion Server.

Front 3

If you’re installing Lion Server on a Mac with Lion, what’s one configuration step you should take first?

Back 3

You should configure your Mac with Lion to use a manually assigned IPv4 address.

Front 4

What are three kinds of names associated with your Lion Server, and what are they used for?

Back 4

You can use the Server app to configure these three names:
• Computer Name: What appears in the Finder sidebar if your server offers file-sharing services.
• Bonjour name: Appended with .local and is used for services discovery.
• DNS host name: Computers and devices can access services offered by your Lion Server by using its DNS host name, even if they’re not on its local network, as long as the host name corresponds with an IPv4 address that is reachable and not blocked by firewalls.

Front 5

How can you install the Server app on an administrator computer?

Back 5

You can use the Mac App Store to download the Server app to an administrator computer, or just copy the Server app to an administrator computer.

Front 6

What are three ways to keep Lion Server up to date with software?

Back 6

You can:
• Log in to your Lion Server, and from the Apple menu, choose Software Update
• Use the Alerts section of the Server app to install available software updates
• Click Server Updates in the toolbar of Server Admin, select the update(s) to install, and then click Install

Front 7

What three applications can you use to display graphs of performance characteristics of your Lion Server?

Back 7

The Server app, Server Admin, and the Server Status widget all display graphs.

Front 8

What’s the difference between a root certificate authority (CA) and an intermediate CA?

Back 8

An intermediate CA’s public key certificate is signed by another CA. A root CA’s public key certificate is signed by itself. Note that there is a set of root CAs that Lion and Lion Server trust.

Front 9

What’s the problem with just using a self-signed SSL certificate?

Back 9

Computers and devices that access services that use a self- signed SSL certificate will see a message that the SSL certificate is not trusted. It’s a security risk to teach users to just trust any SSL certificate that causes a warning.

Front 10

Describe the difference between authentication and authorization, and give an example of each.

Back 10

Authentication is the process by which the system requires you to provide information before it allows you to access a specific account. An example is entering a name and password while connecting to a Lion Server’s Apple Filing Protocol service. Authorization refers to the process by which permissions are used to regulate a user’s access to specific resources, such as files and shared folders, once the user has been authenticated.

Front 11

What is the difference between user and administrator accounts on Lion Server?

Back 11

User accounts provide basic access to a computer or server, whereas administrator accounts allow a person to administer the computer. On Lion Server, an administrator account is typically used for changing settings on the server computer itself, usually through the Server app, Server Admin, or Workgroup Manager.

Front 12

Which applications can you use to configure Lion Server local user and group settings?

Back 12

You can use the Users & Groups preferences, the Server app, and Workgroup Manager to create and configure local users and groups.

Front 13

What tool can you use to import and export user accounts?

Back 13

You can use Workgroup Manager to import and export user accounts. Additionally, you can use the Server app to import network users after you authenticate as a directory administrator.

Front 14

Which two file formats can you use to import users with
Workgroup Manager?

Back 14

You can use Workgroup Manager to import a character- delimited text file with user information, but you need to use Workgroup Manager to define the characteristics of the information contained in the file. You can also import a text file that has a header line at the beginning of the file that defines its contents, such as a file exported from another OS X Server computer.

Front 15

Can you export user passwords with Workgroup Manager?

Back 15

No. You can only import user passwords; you can’t export user passwords when you export users with Workgroup Manager.

Front 16

What tool can you use to authorize a nonadministrative user to administer or monitor specific services on Lion Server?

Back 16

You can use Server Admin to give a nonadministrative user the ability to use Server Admin to administer or monitor specific services.

Front 17

What’s the difference between service ACLs and limited administrator settings?

Back 17

Service ACLs determine which users can use a given service, whereas limited administrator settings control which nonadministrative users can monitor or change a service with Server Admin.

Front 18

What’s an easy way to help your users running Lion to quickly configure their computers to use your server’s VPN service?

Back 18

Select VPN in the Server app sidebar, click Save Configuration Profile, and distribute the resulting .mobileconfig file to your users. When a user of a computer with Lion opens
the .mobileconfig file, the Profiles preferences automatically open and prompt the user to install the configuration profile.

Front 19

What’s the main function of directory services?

Back 19

Directory services provide a central repository for information about the computers, applications, and users in an organization.

Front 20

What standard is used for data access with Open Directory? What version and level of support is provided for this standard?

Back 20

Open Directory uses OpenLDAP and the Lightweight Directory Access Protocol (LDAP) standard to provide a common language for directory access. Open Directory uses LDAPv3 to provide read and write access to the directory data.

Front 21

In terms of Open Directory, what four roles can Lion Server play?

Back 21

Lion Server can be an Open Directory master, a standalone server, connected to a directory system, and an Open Directory replica.

Front 22

What are the two methods of applying password policies, and where are they located?

Back 22

Per-user policies are defined in Workgroup Manager, and global policies are defined in Server Admin or the Server app.

Front 23

When you create an Open Directory archive, is the sparse image created on the server that hosts the Open Directory service or on the administrator computer from which you run Server Admin?

Back 23

The archive is created on the server that hosts the Open Directory service.

Front 24

What criteria determines the Open Directory locale with which a Lion Open Directory client associates?

Back 24

If a Lion computer’s IPv4 address is in the range of a subnet associated with an Open Directory locale, that computer should use any of the Open Directory servers associated with that locale. Otherwise, it will use the default locale.

Front 25

What log shows successful and failed attempts to authenticate against the password service?

Back 25

Password Service Server Log, located at /Library/Logs/ PasswordService/ApplePasswordServer.Server.log, shows successful and failed attempts to authenticate.

Front 26

What tool can you use to confirm forward and reverse DNS records?

Back 26

You should use Network Utility to confirm forward and reverse DNS records before configuring as an Open Directory master or replica, or binding to another directory service.

Front 27

What tool can you use to check the ability to obtain a Kerberos ticket?

Back 27

Ticket Viewer is in /System/Library/CoreServices, and you can use it to confirm the ability to obtain a Kerberos ticket.

Front 28

What tool is used to create profiles?

Back 28

The Profile Manager web app is used to create profiles.

Front 29

Name at least three ways a profile can be delivered.

Back 29

User portal, email, web page, manual delivery, or a push to enrolled devices via the Mobile Device Management capabilities of Profile Manager.

Front 30

Why should a configuration profile be signed?

Back 30

A configuration profile should be signed to validate the contents of the profile.

Front 31

How is a profile removed from an OS X computer? From an iOS device?

Back 31

In OS X Lion, the profiles are managed in the Profiles preference pane within System Preferences. On an iOS device, navigate to Settings > General > Profiles to view and remove installed profiles.

Front 32

What is a configuration profile? An enrollment profile?

Back 32

A configuration profile contains settings and preferences to manage the user experience in a controlled device. An enrollment profile allows the device to be remotely controlled, performing such tasks as remote wipe and lock, and installation of other configuration profiles.

Front 33

What steps are involved with turning on the Profile Manager service?

Back 33

You can click the On/Off switch in the Server app Profile Manager pane to turn on the Profile Manager service. To enable device management (also known as Mobile Device Management), click Configure next to Device Management, select a valid SSL certificate, and specify a verified Apple ID to obtain an Apple Push Notification service certificate.

Front 34

What steps are involved with specifying that you want to sign your configuration profiles?

Back 34

In the Server app Profile Manager pane, select the checkbox labeled “Sign configuration profiles,” then choose a valid code signing certificate. Then, when you create profiles with the Profile Manager web app, they’re automatically signed.

Front 35

What three components comprise Profile Manager?

Back 35

The Profile Manager includes the Profile Manager web app, the user portal, and the optional device management (Mobile Device Management) service.

Front 36

What are the advantages of using NetBoot?

Back 36

Because NetBoot unifies and centralizes the system software that NetBoot clients use, software configuration and maintenance are reduced to a minimum. A single change to a NetBoot image propagates to all client computers on the next startup. NetBoot also decouples the system software from the computer, decreasing potential software troubleshooting.

Front 37

What are three ways to configure the network startup disk?

Back 37

A client can select a network disk image from the Startup pane within System Preferences, by holding down the N key at startup to boot from the default NetBoot image, or by pressing the Option key.

Front 38

Which network protocols are used during the NetBoot startup sequence? What components are delivered over each of these protocols?

Back 38

NetBoot uses DHCP, TFTP, NFS, and HTTP during the NetBoot client startup sequence. DHCP provides the IP address, TFTP delivers the boot ROM (“booter”) file, and NFS or HTTP delivers the network disk image.

Front 39

What is a NetBoot shadow file?

Back 39

Because the NetBoot boot image is read-only, anything that the client computer writes to the volume is cached in the shadow file. This allows a user to change the boot volume, including setting preferences and storing files; however, when the computer is restarted, all changes are erased.

Front 40

What are the major differences between NetBoot, NetInstall, and NetRestore?

Back 40

NetBoot allows multiple machines to boot into the same environment. NetInstall provides a convenient way to install operating systems and packages onto multiple machines. NetRestore provides a way to clone an existing image to multiple machines.

Front 41

Name three file-sharing protocols supported by Lion Server and their principal target clients.

Back 41

AFP for Mac clients, SMB for Windows clients, and WebDAV for iOS devices are three file-sharing protocols supported by Lion Server.

Front 42

How does Lion Server support browsing for Windows clients?

Back 42

Lion Server uses NetBIOS to advertise its presence to Windows clients; Windows users see Lion Server in their Network Neighborhood or Network Places.

Front 43

When does an access control entry (ACE) for a folder’s access control list (ACL) get propagated to items in the folder?

Back 43

An ACE of a folder’s ACL is propagated to a new item that’s created in that folder, or copied into that folder from another volume, if the inheritance options for the ACE apply. Also, an administrator can select a folder in the Storage pane of the Server app, choose Propagate Permissions from the Action pop-up menu, select the Access Control List checkbox, and click OK. Finally, if you use the File Sharing pane to modify an ACL that has been inherited, the changes will be propagated.

Front 44

What two actions are necessary to provide a network home folder for a network user?

Back 44

You need to first edit a share point and select the checkbox “Make available for home directories.” Then you can edit a user, and select that share point in the Home Folder pop-up menu.

Front 45

What permissions can you choose for an ACE in the File Sharing pane of the Server app?

Back 45

In the File Sharing pane of the Server app, when you edit an ACE, you can choose Read & Write, Read, or Write.

Front 46

What permissions can you specify for an ACE in the Storage pane of the Server app?

Back 46

In the Storage pane of the Server app, when you edit an ACE, you can select checkboxes for 13 kinds of permissions. The categories include Administration, Read, and Write.

Front 47

In the Storage pane of the Server app, what four rules for inheritance can you apply to an ACE?

Back 47

There are four inheritance rules: folder, child folders, child files, and all descendants.

Front 48

How do you remove an inherited ACE?

Back 48

In the Storage pane of the Server app, navigate to the item that has an ACL, click the Action pop-up menu, choose Edit Permissions, click the Action pop-up menu, and choose Remove Inherited Entries.

Front 49

What might it mean if you see a GUID rather than a user
name in an ACL?

Back 49

If you see a GUID instead of a user name, it could mean that you removed a user or a group from your Lion Server, and the ACE is displaying that user or group’s GUID because it can’t map the GUID to a user or a group.

Front 50

What URL should you use from an iOS device to save to a WebDAV-enabled share point hosted by the Lion Server at server17.pretendco.com, if the web service on the Lion Server uses an SSL certificate?

Back 50

In the iOS application that supports WebDAV, you would use the URL https://server17.pretendco.com/webdav. Depending on the application, you’ll see a list of share points that support WebDAV.

Front 51

Do both the File Sharing and the Time Machine services need to be turned on to offer Time Machine services to your users?

Back 51

Yes, both File Sharing and Time Machine need to be on to offer the Time Machine service to your users.

Front 52

On what software is Lion Server’s web service based?

Back 52

Lion Server’s web service is based on Apache, the open source web server software.

Front 53

Which permissions are necessary on a web folder to ensure that visitors to the site can access the pages?

Back 53

The everyone or www group must have read access to the web files.

Front 54

What are access controls?

Back 54

Access controls are paths to folders that can be restricted based on group.

Front 55

Where is the default location for the Apache log files?

Back 55

The default location for Apache log files is /var/log/apache2/ access_log and /var/log/apache2/error_log.

Front 56

What is the advantage of using SSL on a website?

Back 56

SSL helps protect the traffic traveling to and from the website by encrypting the data.

Front 57

What protocol is used for the iChat service?

Back 57

The iChat service uses the Extensible Messaging and Presence Protocol (XMPP).

Front 58

How would you limit access to iChat service on Lion Server?

Back 58

You can limit access through Service Access Control Lists, available per user in the Server app.

Front 59

What tools can an administrator use to specify which users can create wikis? How does a network user specify which users and groups can edit a wiki?

Back 59

Administrators can use the Wiki Creators list in the Wiki service settings in the Server app. When creating a wiki with a web browser, a user can specify permissions for users and groups to access and edit the wiki.

Front 60

How would you enter the iChat name for the user Jet Dogg (short name: jet) on server17.pretendco.com?

Back 60

The iChat name format for Jet Dogg on server17.pretendco.com is [e-mail].

Front 61

What application do you use to create resources and locations for use in iCal events?

Back 61

The Server app is used to create resources and locations for use in iCal events.

Front 62

What open source protocol does the Address Book service use?

Back 62

he Address Book service uses CardDAV.

Front 63

What is an open relay?

Back 63

An open relay is a mail server that allows anyone on the Internet to anonymously send email messages through it. It’s the primary tool used by spammers on the Internet.

Front 64

What is an MX record?

Back 64

An MX record is a DNS record that indicates the priority and host name of a domain’s email server.

Front 65

What is SMTP?

Back 65

Simple Mail Transfer Protocol defines how messages travel from one computer to another on the Internet.

Front 66

What are the main differences between POP and IMAP?

Back 66

IMAP keeps a copy of the email message and its state on the server, maintains a persistent connection between the client and server, allows folder access, and supports higher security authentication methods. POP typically stores the message only until it’s downloaded by the client and requires fewer server resources than IMAP.

Front 67

What method can be used to limit the amount of disk space used on a mail server?

Back 67

The method to control disk consumption by users is user quotas.