Apple Server
OS X Server Essentials 10.8
OS X Server Essentials 10.8
-
- 1 / 124
-
Cartes-fiches
What is the main function of directory services?
Directory services provide a central repository for information
about the computers, applications, and users in an
organization.
What standard is used for data access with Open Directory?
What version and level of support is provided for this
standard?
Open Directory uses OpenLDAP and the Lightweight
Directory Access Protocol (LDAP) standard to provide a
common language for directory access. Open Directory uses
LDAPv3 to provide read and write access to the directory
data.
In terms of Open Directory, what four roles can OS X Server
play?
OS X Server Open Directory roles include Open Directory
master, standalone server, connected to a directory system,
and Open Directory replica.
What criteria determines the Open Directory locale with
which an OS X Open Directory client associates?
If an OS X Mountain Lion computer’s IPv4 address is in the
range of a subnet associated with an Open Directory locale,
that computer should use any of the Open Directory servers
associated with that locale. Otherwise, it will use the default
locale.
What log shows successful and failed attempts to
authenticate against the password service?
Password Service Server Log, located at /Library/Logs/
PasswordService/ApplePassword Server.Server.log shows
successful and failed attempts to authenticate
What tool can you use to check the ability to obtain a
Kerberos ticket?
Ticket Viewer is in /System/Library/CoreServices, and you can
use it to confirm the ability to obtain a Kerberos ticket.
How do you import local network users from a text file with a
properly formatted header line?
Choose Manage > Import Accounts from File, select the text
file, choose Local Network Accounts from the pop-up menu,
provide directory administrator credentials, and click Import
What are some reasons that a client computer might not be
able to use Kerberos authentication to access a service?
The client computer might not be bound to a directory
service that provides Kerberos; the system time between the
client computer and the server computer might be off by
more than 5 minutes; there could be a DNS configuration
issue; or the service might not be configured to use Kerberos.
In addition to authentication, what else can Kerberos provide?
Kerberos provides identification and authentication.
How can you disable a local network user account so that it
can’t be used to access services or log in on a bound Mac?
In the User pane of the Server app, double-click the user to
edit the user, and deselect the checkbox “Allow user to log
in.”
What are some examples of global password policies that you
can configure for users that apply the next time they change
their password?
Some examples include that passwords must differ from
account name; contain at least one letter; contain both
uppercase and lowercase letters; contain at least one numeric
character; contain a character that isn’t a letter or number;
contain at least a given number of characters; or differ from
the last given number of passwords used.
What are some examples of global password policies that you
can configure to disable login after certain events occur?
Some examples include that the login will be disabled on a
specific date; after using it for a given number of times; after
inactive for a given number of days; or after a user makes a
given number of failed attempts.
How does a user obtain a Kerberos service ticket?
Once a user has a ticket-granting ticket, OS X automatically
attempts to obtain a service ticket when the user attempts to
connect to a Kerberized service.
What tool is used to create profiles?
The Profile Manager web app is used to create profiles
Why should a configuration profile be signed?
A configuration profile should be signed to validate the
contents of the profile.
What is a configuration profile? An enrollment profile?
A configuration profile contains settings and preferences to
manage the user experience in a controlled device. An
enrollment profile allows the device that it’s installed on to be
remotely controlled, performing such tasks as remote wipe
and lock, and installation of other configuration profiles.
What steps are involved with turning on the Profile Manager
service?
You can just click the On/Off switch in the Server app Profile
Manager pane to turn on the Profile Manager service, but to
enable device management (also known as Mobile Device
Management), click the Configure button next to Device
Management, select a valid SSL certificate, and specify a
verified Apple ID to obtain an Apple Push Notification service
certificate.
What steps are involved with specifying that you want to sign
your configuration profiles?
In the Server app Profile Manager pane, select the “Sign
configuration profiles” option, and choose a valid code
signing certificate. Then when you create profiles with the
Profile Manager web app, they’re automatically signed.
What three components comprise Profile Manager?
The Profile Manager includes the Profile Manager web app,
the user portal, and the optional device management (Mobile
Device Management) service.
At what levels can clients be managed?
Users, user groups, devices, and device groups.
Name at least three ways a profile can be delivered.
User portal, email, web page, or manual delivery. The mobile
device management capabilities of Profile Manager can also
push profiles to enrolled devices.
What service does push notification rely on?
Apple Push Notification service (APNs).
How is a profile removed from an OS X computer? From an
iOS device?
In OS X 10.7 Lion and later, the profiles are managed in the
Profiles preferences. On an iOS device, navigate to Settings/
General/Profiles to view and remove installed profiles
How can you view the content of a profile?
Any text editor can view the content of a profile. The text
contained in the profile is either straight XML or XML with
some binary data if signed.
Name three file sharing protocols supported by the
OS X Server File Sharing pane and their principal target
clients.
AFP for OS X clients, SMB for Windows clients, and WebDAV
for iOS devices are three file sharing protocols supported by
OS X Server.
What is one concern with using the FTP service?
Normally the network traffic is not encrypted for
authenticating to the FTP service with username and
password.
How does OS X Server support browsing for Windows clients?
OS X Server uses NetBIOS to advertise its presence to
Windows clients; Windows users see the server in their
Network Neighborhood or Network Places.
How do you enable guest access to a share point?
Edit a share point and select the “Allow guest users to access
this share” checkbox.
Where can you quickly view the number of AFP and SMB
connections to your server?
The Connected Users tab displays the number of AFP and
SMB connections; you may need to choose View > Refresh (or
press Command-R) to refresh the number.
How can you configure a share point to be accessible to an
app on an iOS device?
Edit a share point and select the “Share with iOS devices
(WebDAV)” checkbox.
Where would you find information about AFP service errors?
The Logs pane of the Console app displays the AFP Error log,
which displays the contents of the log file: /Library/Logs/
AppleFileService/AppleFileServiceError.Log.
How can you create a new share point?
In the File Sharing list of share points, click Add (+) and either
select an existing folder, or create a new folder and select the
new folder.
What file sharing protocols are enabled by default for a share
point you just created?
AFP and SMB are enabled by default for a new share point.
Do you need to start the Websites service in order to provide
WebDAV service?
No, the Websites service doesn’t need to be running in order
for you to offer File Sharing services via WebDAV (of course,
the File Sharing service must be running).
When does an access control entry (ACE) for a folder’s ACL
get propagated to items in the folder?
An ACE of a folder’s ACL is propagated to a new item that’s
created in that folder, or copied into that folder from another
volume, if the inheritance options for the ACE apply. Also, an
administrator can select a folder in the Storage pane of the
OS X Server Essentials 10.8 Exam Preparation Guide
21
Server app, choose Propagate Permissions from the Action
(gear icon) pop-up menu, select the Access Control List
checkbox, and click OK. Finally, if you use the File Sharing
pane to modify an ACL that’s been inherited, the changes will
be propagated.
What permissions can you choose for an ACE in the File
Sharing pane of the Server app?
When editing an ACE in the File Sharing pane of the Server
app, you can choose Read & Write, Read, or Write.
What permissions can you specify for an ACE in the Storage
pane of the Server app?
When editing an ACE in the Storage pane of the Server app,
you can select checkboxes for 13 kinds of permissions. The
categories include Administration, Read, and Write.
What four rules for inheritance can you apply to an ACE in the
Storage pane of the Server app?
The four rules for inheritance are: Apply to this folder, Apply to
child folders, Apply to child files, and Apply to all
descendants.
How do you remove an inherited ACE?
In the Storage pane of the Server app, navigate to the item
that has an ACL, click the Action (gear icon) pop-up menu,
choose Edit Permissions, click the Action (gear icon) pop-up
menu, and choose Remove Inherited Entries.
What might it mean if you see a GUID rather than a user
name in an ACL?
If you see a GUID instead of a user name in an ACL, it could
mean that you removed a user or a group from your server,
and the ACE is displaying that user or group’s GUID because it
can’t map the GUID to a user or group.
