OS X Server Essentials 10.10 - 2.

0 Configuring Accounts
2.3 User Accounts
User Accounts

Two primary types of user accounts

1. Local Users
Unique to an individual machine
Not recognized/honored by any other system
Managed with Users & Groups system preference
2. Local Network Users
Stored in a centralized directory service
Shared/honored by any other system bound to the directory
Managed with Server App
Creating an account
Server App -> Users -> +
Type
Local User
Local Network User
Full Name
Displayed throughout the OS when a user name is requested by software
Account Name
Used by the underlying BSD system
The true username
Can contain:
a-z
A-Z
0-9
. (Period)
_ (Underscore)
- (Hyphen)
E-mail Addresses
Password
Password assistant is available
Allow user to administer this server
Permits using the Server App to control the server
Home Folder
Local Only
Standard user folder created on the server
Not synchronized between clients
None - Services Only
No user profile is created
User is unable to logon locally to the server
User is only permitted to access services via the network
Limit disk usage to...
Only available if the user has a home folder
Applies a quota limiting their usage
Keywords
Tags that assist with filtering the user list
Notes
Any additional comments you may have
NOTE: To customize service access, ctrl-click the user and choose "Edit Access to Services"
Disabling an account
1. Server App -> Users -> Select user
2. Gear -> Edit User
3. Uncheck Login
Deleting an account
Server App -> Users -> Select user -> -
Bulk import user accounts
Server App -> Manage -> Import Accounts from File
Mavericks Server Admin: Create a file to import users or groups
Yosemite documentation has not been updated
Expects a particular format inside a text file
[Import File Example][]
Password Policies

Allows enforcing password requirements on users

Does not apply to administrators
To set:
1. Server App -> Users -> Local Network Users
2. Gear -> Edit Password Policy
Settings
Disable login...
On a specific date
After using it for X days
After inactive for X days
After user makes X failed attempts
Password must...
Differ from account name
Contain at least one letter
Contain both uppercase and lowercase letters
Contain at least one numeric character
Contain a character that isn't a letter or number
Be reset on first user login
Contain at least X characters
Differ from last X passwords used
Be reset every X days/weeks/months
Note: Make sure you choose "Local Network Users" in the drop down box
Local Users have their own password policy
 Groups

Allows combining multiple users into a single entity for ease of administration
Permissions can be assigned in-bulk instead of on a per-user basis
Can also be used as e-mail distribution groups
Creating Groups
Option #1: Import the groups similar to user accounts
Option #2: Manually create them
Server App -> Groups -> +
Select Local Network Groups in the drop down to ensure you are creating Open Directory groups
Populating groups with members
Option #1: Edit the group and add in the users
Option #2: Edit the user and add in the groups
Groups can be nested
Example:
Sales People
NA Sales
SA Sales
EU Sales
Access Control

ACLs can be applied to the Server App services

Controls which users are allowed to access each service
Can be applied to users or groups
Generally we want groups, as individual assignment is a huge administrative burden
Control-Click a user or group and choose Edit Access to Services
Troubleshooting

Common issues with Kerberos authentication

Incorrect DNS configuration
Client is unable to find server
Verify DNS servers in network configuration
Verify search domains
Incorrect time
Time differences in excess of 5 minutes trigger a packet retransmit warning in Kerberos
Results in failed authentication
Check the clocks
Check the time-zone
Use an NTP server (Date & Time preferences)
Kerberos disabled for a service
sudo serveradmin settings calendar:Authentication:Kerberos:Enabled = yes
sudo serveradmin stop calendar
sudo serveradmin start calendar
Incorrect user account settings
Verify the ACL on the user
Verify the user is a Local Network User
Verify user is not disabled
You can examine the Kerberos ticket
In terminal, use klist
Useful for seeing which server you authenticated against
Also shows the date/time the TGT was issued and when it expires

Import File Example

User Accounts
0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 3 RecordName Password RealName dmustaine:password123:Dave Mustaine dellefson:password123:David Ellefson nmenza:password123:Nick Menza mfriedman:password123:Marty Friedman

Groups
0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Groups 3 RecordName Password GroupMembership the-band2:password123:dmustaine,dellefson,nmenza,mfriedman