UNIX-Based Foundation
64-Bit Computing
Advanced BSD Networking Architecture
Robust Security
Directory Integration
High Availability
Technology Overview
Mac OS X Server
2
Page 10 Integrated Management Tools
Server Admin
Workgroup Manager
Page 14 Service Deployment and Administration
Open Directory Server
File and Print Services
Mail Services
Web Hosting
Enterprise Applications
Media Streaming
iChat Server
Software Update Server
NetBoot and NetInstall
Networking and VPN
Distributed Computing
Page 29 Product Details
Page 31 Open Source Projects
Page 35 Additional Resources
The Universal release of Mac OS X Server
runs on both Intel- and PowerPC-based
Mac desktop and Xserve systems.
Technology Overview
Mac OS X Server
Introduction
Mac OS X Server version 10.4 Tiger gives you everything you need to manage
servers in a mixed-platform environment and to con gure, deploy, and manage
powerful network services. Featuring the renowned Mac OS X interface, Mac OS X
Server streamlines your management tasks with applications and utilities that are
robust yet easy to use.
Apple’s award-winning server software brings people and data together in innovative
ways. Whether you want to empower users with instant messaging and blogging, gain
greater control over email, reduce the cost and hassle of updating software, or build
your own distributed supercomputer, Mac OS X Server v10.4 has the tools you need.
The power and simplicity of Mac OS X Server are a re ection of Apple’s operating sys-
tem strategy—one that favors open industry standards over proprietary technologies.
It begins with a UNIX-based foundation built around the Mach microkernel and the
latest advances from the open source BSD community. This foundation provides Mac
OS X Server with a stable, high-performance, 64-bit computing platform for deploying
server-based applications and services.
3
Open source made easy
Tiger Server is the fth major release of Mac OS X Server, providing standards-based
workgroup and Internet services without the complexity of Linux or the cost inherent
in other UNIX-based solutions. Instead of developing proprietary server technologies,
Apple has built on the best open source projects: Samba 3, OpenLDAP, Kerberos,
Post x, Apache, Jabber, SpamAssassin, and more. Mac OS X Server integrates these
robust technologies and enhances them with a uni ed, consistent management
interface. Powerful administrative tools permit novices to con gure and maintain
core network services, while providing the advanced features and functionality
required by experienced IT professionals.
Because it is built on open standards, Mac OS X Server is compatible with existing
network and computing infrastructures. It uses native protocols to deliver directory
services, le and printer sharing, and secure network access to Mac, Windows, and
Linux clients. A standards-based directory services architecture o! ers centralized
management of network resources using any LDAP server—even proprietary servers
such as Microsoft Active Directory. The open source UNIX-based foundation makes it
easy to port and deploy existing tools to Mac OS X Server.
Technology Overview
Mac OS X Server
Best of all, Mac OS X Server ts easily into IT budgets everywhere. A complete suite of
workgroup and Internet services is included in the box, so network administrators can
get started right away. Mac OS X Server is available in 10-client and unlimited-client
editions. The unlimited-client edition does not require additional per-seat fees for
connecting more users, making it an a! ordable solution for organizations of any size.
Mac OS X Server: for supporting Mac and Windows workgroups, deploying powerful
Internet services, and hosting enterprise applications—all with an ease of use that is
uniquely Mac.
4
Xserve and Xserve RAID
Mac OS X Server unleashes the power
of Xserve, Apple’s rack-optimized server
hardware. With phenomenal performance,
massive storage capacity, high-bandwidth
I/O, and integrated remote management
tools, Xserve running Mac OS X Server is an
unparalleled server solution for businesses,
schools, and research centers. For even more
storage, Xserve RAID o! ers a high-availability,
high-performance storage solution in a 3U
enclosure.
Technology Overview
Mac OS X Server
New in Version 10.4
Mac OS X Server v10.4 continues the Mac OS X tradition by delivering a world-class
UNIX-based server solution that’s easy to deploy and easy to manage. This latest
release incorporates more than 100 open source projects and o! ers more than 200
new features. The key new features include:
64-bit applications. Mac OS X Server v10.4 brings the power of 64-bit computing
to mainstream servers. Its 64-bit addressing o! ers access to massive amounts of
memory, and its 64-bit optimized math libraries provide high-performance, extremely
accurate mathematical calculations. These capabilities make Mac OS X Server the ideal
platform for the most demanding databases and scienti c, technical, and creative
computing tasks.
Access control lists. To provide greater le sharing exibility in mixed-platform work-
ows, Apple has added support for access control lists (ACLs). With le system ACLs,
any le object can be assigned multiple users and groups, including groups within
groups. Each le object can also be assigned both allow and deny permissions, as
well as a granular set of permissions for administrative control, read, write, and delete
operations. For added security, Mac OS X Server v10.4 supports a le permission
inheritance model, ensuring that user permissions are inherited when les are moved
to the server and rewritten when les are copied to the server.
5
Software Update Server. Now you can decide whether the users in your organization
are noti ed of new Apple software updates. This gives administrators control over
which updates and patches users install. By hosting your own Apple software update
proxy/cache server, you will also save on network costs. Instead of each client computer having to download an update from Apple, all your clients can obtain updates
from a single copy cached on your software update server.
iChat Server. Mac OS X Server v10.4 includes a new iChat Server for secure instant
messaging—designed for organizations that need to keep internal communication
private. Your organization can de ne its own namespace and use SSL encryption to
ensure privacy. iChat Server works with Apple’s popular iChat conferencing in Mac
OS X client software, and it is compatible with open source Jabber clients available
for Windows and Linux systems and popular PDAs.
Weblog Server. With the emergence of weblogs, organizations now have a quick
and easy way to share information. Weblog Server, included in Mac OS X Server v10.4,
makes it simple to publish and syndicate these online journals. The prede ned blog
themes and calendar navigation provide an intuitive interface for managing blogs.
Individual users and groups can publish and access weblogs using only their normal
browsers; no additional tools or technical expertise is required. That simplicity makes
Weblog Server the perfect collaboration tool.
Technology Overview
Mac OS X Server
Xgrid. Mac OS X Server v10.4 includes Xgrid, the rst distributed computing architec-
ture to be built into a desktop or server operating system. Xgrid makes it easy to
turn an ad hoc group of Mac systems into a low-cost supercomputer by streamlining
the process of assembling nodes, submitting jobs, and retrieving results. Scientists,
animators, and digital content creators now have the opportunity to easily run a
single job across multiple computers at once, dramatically improving performance
and responsiveness.
Ethernet link aggregation and network interface failover. Also known as IEEE
802.3ad, link aggregation allows you to con gure multiple network interfaces to
appear as a single interface, which can increase throughput and availability. First, link
aggregation multiplies the potential I/O performance by the number of interfaces.
For example, two 1-gigabit interfaces bonded together can provide up to 2 gigabits
of aggregate network bandwidth, and four 1-gigabit interfaces can provide up to
4 gigabits. Second, link aggregation eliminates a potential single point of failure. If
one interface fails, the remaining interface maintains the network connection.
Gateway Setup Assistant. The new Gateway Setup Assistant helps you quickly and
easily set up Mac OS X Server v10.4 to share a single Internet connection across a
local network. The assistant eliminates the complexity of setting up network services
by automating the process. All you have to do is make a few con guration choices
when prompted.
6
Adaptive junk mail ltering and virus detection. To protect your organization from
unwanted mail and destructive viruses, Mac OS X Server v10.4 integrates two popular
open source projects: SpamAssassin for adaptive junk mail ltering, and ClamAV for
virus detection and quarantine.
Technology Overview
Mac OS X Server
Operating System
Fundamentals
Mac OS X Server has an open source, UNIX-based foundation that provides a stable,
high-performance platform for deploying business-critical enterprise applications,
services, and technologies. The core operating system at the heart of Mac OS X Server
is known as Darwin.
UNIX-Based Foundation
7
Darwin provides Mac OS X Server with the stability, performance, and compatibility
associated with UNIX. It’s built around the Mach 3.0 microkernel, which is based on
the OSF/mk project from the Open Software Foundation. The Mach kernel in Darwin
provides services for memory management, thread control, hardware abstraction,
and interprocess communication. It also brings advanced features critical to the
operation of a server, including ne-grained multithreading, symmetric multiprocess-
ing (SMP), protected memory, a uni ed bu! er cache, 64-bit kernel services, and
system noti cations.
Darwin also includes the latest technological advances from the open source BSD
community. Originally developed at the University of California, Berkeley, BSD is the
foundation of most UNIX implementations today. Darwin is based in large part on
FreeBSD and includes the latest innovations from that development community.
64-Bit Computing
64-bit computing is the next big step in providing greater computing power to solve
even the most challenging tasks. It gives scientists, engineers, and other power users
the tools to address problems that are billions of times larger than the ones that can
be solved with 32-bit systems.
Mac OS X Server v10.4 brings the power of 64-bit computing to mainstream servers.
Its 64-bit addressing o! ers access to massive amounts of memory, transcending the
4GB memory limitation of 32-bit systems. And its 64-bit optimized math libraries
provide high-performance, extremely accurate mathematical calculations. These capabilities make Mac OS X Server the ideal platform for the most demanding databases
and scienti c, technical, and creative computing tasks.
Technology Overview
Mac OS X Server
Advanced BSD Networking Architecture
Mac OS X Server incorporates industry-standard protocols and the latest in security
standards to increase the performance and security of server deployments. Using
the time-tested BSD sockets and TCP/IP stack, this advanced networking architecture
ensures compatibility and integration with IP-based networks.
The networking architecture in Mac OS X Server v10.4 includes advanced features
critical to high-performance server operation and deployments. These include:
• Multilink multihoming for hosting multiple IP addresses on one or more network
interfaces
• IPv6 to support the next generation of Internet addressing
• IPSec for general-purpose protection of IP communications
• IP over FireWire for ad hoc network deployments and system administration
• Ethernet link aggregation and network interface failover (IEEE 802.3ad) for higher
aggregated throughput and increased server availability
• Virtual local area network (VLAN) tags that let you treat speci ed systems on di! erent
physical LANs as though they were all on the same LAN
8
Integration with directory services
Workgroup Manager works with Open
Directory or any other LDAP solution to
access and store user, group, and computer
information. Based on open standards,
Apple’s Open Directory architecture features
built-in directory access modules that simplify
integration with third-party directory services,
including IBM Directory Server, Microsoft
Active Directory, Novell eDirectory, OpenLDAP,
Sun ONE, NIS, and NetInfo.
• 802.1X network authentication for improved access security
• Ethernet jumbo frames to increase network e" ciency and throughput
Robust Security
Mac OS X Server is built on a robust UNIX foundation that contains many security
features in its core architecture. State-of-the-art, standards-based technologies protect
your server, network, and data. These technologies include a built-in rewall with
stateful packet analysis, strong encryption and authentication services, data security
architectures, and support for access control lists (ACLs). Simple interfaces and con g-
uration tools allow you to con gure systems easily and securely. In fact, when you take
an Apple server out of the box, it’s already con gured with secure settings—no security
expertise is required.
Directory Integration
By using open standards and publishing the schema extensions speci c to the Mac,
Apple has made it easy to integrate Mac OS X and Mac OS X Server systems into
virtually any directory-based network, including ones that use Open Directory,
Microsoft’s Active Directory, or open standard LDAP-based solutions.
Open Directory, Apple’s standards-based directory and network authentication services
architecture, is a robust, scalable directory server that’s perfect for organizations that
haven’t yet deployed centralized directory services—as well as for businesses and
institutions migrating from expensive proprietary solutions. Based on the LDAPv3
standard, the Open Directory architecture allows Mac OS X systems to use any LDAP
directory, leveraging the directory services in existing network infrastructures.
1
The Open Directory architecture comes with directory access modules for various
popular directory services solutions. It adheres to the RFC 2307 schema and also allows
for customized schema mappings. So attributes in an LDAP-based directory can be
mapped to settings on the Mac, eliminating the need to con gure each client system.
Apple has published these extensions as part of a comprehensive open source project
that includes all interoperability components.
Technology Overview
Mac OS X Server
High Availability
Computer problems such as unplanned shutdowns can severely impair an
organization’s operations. High availability of your computing resources is essential
to guarantee service levels, comply with industry regulations, and provide access to
business-critical information. Apple has built into Mac OS X Server powerful highavailability features that maximize server uptime and reduce the risks of shutdowns.
These features include:
• Watchdog processes that continuously monitor activity and recover services in the
event of an application, system, or power failure
• IP failover to further increase service availability in the event of a failure on one server
• File system journaling to dramatically expedite le system repairs on system restarts
• Software RAID with disk mirroring to eliminate drive failures bringing down a server
• Disk space monitoring to access available drive space and, if necessary, proactively free
up space by deleting or backing up noncritical logs and utilities
9
Technology Overview
Mac OS X Server
Integrated Management
Tools
Mac OS X Server comes with industry-leading management tools that simplify the
con guration and deployment of network services for Mac, Windows, and Linux
clients. Everything required to deliver powerful network solutions within a department, across an enterprise, or over the Internet is built in and ready to use. With the
unlimited-client edition of Mac OS X Server, your organization can add clients as
your needs grow—without draining the IT budget.
10
Server Admin displays service activity in
real time, as well as graphs of network tra" c,
throughput, and performance history.
Managing Services with Server Admin
1
2
2
Server Admin
Server Admin provides a graphical user interface that makes it easy to set up,
manage, and monitor services from any Internet-connected Mac OS X system.
Mac OS X Server also supports SSH for secure remote administration from the
command line, as well as the open standard SNMPv3 protocol for integration
with third-party monitoring and management software.
1
Encrypted, authenticated access.
3
5
4
Use Server Admin to securely access
servers from any Internet-connected
Mac OS X system. Manage and
monitor multiple servers from a
single interface.
List of services. Select a service to
2
manage settings and monitor activity.
Indicator lights display at-a-glance
information about the status of
individual services.
Activation button. Turn services on
3
or o! with a single click.
Admin tools. Choose from a selection
4
of logs and graphs to view real-time
and historical information. Or choose
Settings for detailed con guration
and management options.
Functions. Con gure services and
5
change settings using contextsensitive functions.
2
Use Workgroup Manager to:
• De ne accounts for users, groups, and
computers
• Control access to hardware, software,
and network resources
• Set up network-based group folders
and printers
• Create customized settings for individual
users and groups
Technology Overview
Mac OS X Server
Workgroup Manager
Mac OS X Server features the innovative Workgroup Manager application for de ning
and managing directory information. This powerful tool makes it easy for administrators to set up user accounts, de ne group relationships, and manage computing
resources in a directory-based network environment. Workgroup Manager scales from
managing local accounts on a single server to managing an entire organization using
an enterprise directory server.
By taking full advantage of the robust manageability features built into the Mac OS X
client operating system, Workgroup Manager provides greater control over organizational resources. At the same time, it optimizes the user’s computing experience
with consistent settings, network-based home directories, and easy access to network
resources, such as printers and group folders.
De ning users, groups, and computers
Workgroup Manager features an intuitive interface for directory-based management
of user, group, and computer account information. Administrators can control
passwords, print quotas, email quotas, and group membership, as well as set up
share points, for Mac, Windows, and Linux clients—all from a single interface. The
information de ned in Workgroup Manager can be stored on the local server or
in a central LDAP directory server.
11
Managing Users, Groups, and Computers with Workgroup Manager
12
4
5
3
1
Share points. Designate folders
or volumes to share among Mac,
Windows, and Linux clients on
6
the network.
2
Account settings. Set up user and
group accounts and lists of computers
in the directory.
Preferences. Set preferences and
3
policies for Mac OS X systems on
the network.
Users, groups, and computers.
4
Choose to de ne settings on a
per-user, per-group, or per-computer
basis. Depending on the selection,
Workgroup Manager displays a list
of users, groups, or computers
currently de ned in the directory.
5
List of users. Select a name to set
up accounts or change settings.
Network resources. Manage
6
network resources and settings
for individual users.
Technology Overview
Mac OS X Server
De ning preferences for Mac OS X clients
Administrators can use Workgroup Manager to set preferences and de ne privileges
by user, group, computer, or any combination of the three, providing an appropriate
balance between organizational control and user access.
3
The exibility o! ered by Workgroup Manager makes it easy to create custom
computing environments for di! erent workgroups or classrooms. When users log
in, prede ned group applications launch automatically, and shared network resources
are mounted on the desktop. The same functionality can be used to restrict operations. For example, administrators can disable media burning, limit which applications
can be used, or require authentication for access to speci c devices or printers.
12
The available settings vary for users, groups, and computers, but they include
the following:
Applications. Specify available applications, preventing users from running unauthorized applications. Set authorized applications to open automatically when a user or
a group member logs in.
Classic. Designate the location of the Classic startup system. Control Classic utilities.
Set the system to launch Classic automatically at startup, if required.
Dock. Manage Dock attributes such as display, size, magni cation, and position
onscreen. Ensure that personal and group applications, documents, and URLs are
always in the Dock.
Energy Saver. Set a computer to make optimal use of power, depending on
performance requirements. (This setting is especially useful for lab environments.)
Finder. De ne Finder behavior, desktop appearance, availability of Finder menu
commands, and the desktop display of hard disks, removable media, and connected
servers. Con gure Simple Finder for environments such as a kindergarten classroom
or a visitor area.
Internet. Set preferences for default email and web applications, such as de ning
a default home page and download location, controlling email account types, and
restricting outgoing email tra" c.
Login. De ne the Mac OS X login experience. Set the login window to display a list of
users local to the computer and on the network. For greater security, require users to
enter their user names manually at login.
Technology Overview
Mac OS X Server
Media Access. Set authenticated access to, or disable the use of, internal and external
disks, including hard drives, CD-ROMs, DVDs, and USB and FireWire devices.
Mobility. Set a portable system to cache the LDAP user, group, and computer account
information, including authentication token, on its hard drive. (This enables managed
settings to remain in e! ect when the computer is disconnected from the network.)
Synchronize folders on users’ portable computers with their network home directories.
Network. Set preferences to con gure network proxies such as FTP, Web, and
Secure Web.
Printing. De ne a set of printers and a default printer for any user, group, or computer.
For example, associate a computer with a nearby printer, or associate individual users
with a particular printer regardless of the computer they are using.
Software Update. De ne a software update server for Mac OS X systems.
13
Technology Overview
Mac OS X Server
Service Deployment
and Administration
Mac OS X Server v10.4 comes with a wide range of Internet and workgroup services
based on open standard technologies. Mac OS X Server integrates these robust
technologies and enhances them with a uni ed, consistent management interface
that takes full advantage of the renowned Mac ease of use. The result is simpli ed
deployment and administration that permit novices to con gure and maintain core
network services, while providing the advanced features and functionality required
by experienced IT professionals.
14
Why directory services?
A key component of any modern
computing environment, directory services
allow organizations to centralize information about users, groups, and computing
resources. A network-based repository
consolidates resources, simpli es system
management, and reduces support and
administration costs—all while providing
strong authentication and passwordprotected access to network resources.
For example, when an employee leaves the
company, the administrator can change
that user’s password, archive the user’s
network home directory, and delete the
user’s account quickly and easily, all from
the administrator’s own desk.
Open Directory Server
Mac OS X Server includes a robust LDAP directory server and a secure Kerberos
password server to provide directory and authentication services to Mac, Windows,
and Linux clients.
Apple has built the Open Directory server around OpenLDAP, the most widely
deployed open source LDAP server, so that it can deliver directory services for both
Mac-only and mixed-platform environments. LDAP provides a common language for
directory access, enabling administrators to consolidate information from di! erent
platforms and de ne one namespace for all network resources. This means a single
directory for all Mac, Windows, and Linux systems on the network; there’s no need
to maintain a separate server or separate user records for each platform. It also results
in a streamlined user experience: Users can authenticate to Mac OS X Server and
access network resources from any platform using a single password.
To store directory information, the Open Directory server uses Berkeley DB, one of
the world’s most scalable databases, for high-performance indexing of hundreds of
thousands of user records. In addition, a robust replication feature maximizes availability and scalability. The ability to replicate directory and authentication servers enables
organizations to maintain failover servers for high availability, as well as remote servers
for fast client interaction on distributed networks.
Technology Overview
Mac OS X Server
15
Server Admin makes it easy to set up replication services for Open Directory. Replica
directories automatically synchronize with the master directory, so user accounts and
authentication information remain consistent across distributed networks.
Single sign-on using Kerberos
Open Directory integrates an authentication authority based on MIT’s Kerberos
technology to provide users with single sign-on access to secure network resources.
Using strong Kerberos authentication, single sign-on maximizes the security of
network resources while providing users with easier access to a broad range of
Kerberos-enabled network services. For services that have not yet been “Kerberized,”
the integrated SASL service automatically negotiates the strongest possible
authentication protocol.
Directory support for Windows clients
In Mac OS X Server, Apple has integrated the NT Domain services of the popular
open source Samba 3 project with Open Directory, making it possible to host NT
Domain services. You can set up Mac OS X Server as a Primary Domain Controller
(PDC) or Backup Domain Controller (BDC) for your network, allowing Windows users
to authenticate against Mac OS X Server directly from their PC login windows.
NT Domain services also enable Mac OS X Server to host roaming pro les and
network home directories for Windows clients. Now any user in your directory can
securely log in and access the same user account, authentication, home directory, and
network resources from either a Mac or a Windows system. These capabilities make
Mac OS X Server ideal for replacing aging Windows NT or Windows 2000 servers, without requiring businesses to transition to an expensive Active Directory infrastructure.
Shared folders hosted on Mac OS X Server
appear in the Network Neighborhood on
Windows clients.
Technology Overview
Mac OS X Server
File and Print Services
Mac OS X Server is one of the easiest, most cost-e! ective ways for small businesses
and departments to share network resources. Since native support for Mac, Windows,
and Linux is built in, all users can have access to storage on the server and shared
PostScript and raster (inkjet) printers. Apple’s innovative tools for streamlined remote
administration make it easy to con gure services, manage user access privileges,
enforce disk and print quotas, and view system tra" c from virtually anywhere on
the network or over the Internet.
Support for mixed-platform networks
Mac OS X Server v10.4 features enhanced support for heterogeneous networks,
making it easy to set up central network storage that is accessible to clients throughout your organization. This versatile solution maximizes user productivity and makes
your le services more secure and easier to manage.
Using native protocols, Mac OS X Server delivers le services to all the clients on your
network: AFP for Mac, SMB/CIFS for Windows (via Samba 3), and NFS for UNIX and
Linux. It also o! ers WebDAV and FTP for Internet clients.
The advanced capabilities for Windows clients include high-speed le and print
services, and support for authenticated login, home directories, and roaming pro les.
Mac OS X Server systems appear right in the network browser just like a Windows
server, so Windows users can browse folders and share les without having to install
additional software.
16
Mac OS X Server even works in organizations with an existing Active Directory deployment, allowing you to provide lower-cost le services while still integrating with Active
Directory for user and group account information, permissions, and authentication.
Any disk, volume, or folder hosted on Mac OS X Server can be shared using any
combination of protocols, making it available to Mac, Windows, and Linux clients.
Technology Overview
Mac OS X Server
17
Compatibility in heterogeneous
environments
Apple’s ACL implementation is compatible
with the POSIX 1003e draft. This enables full
interoperability with the native permissions of
Windows Server 2003 and Windows XP, while
maintaining compatibility with traditional
UNIX le permissions. Such versatility makes
Mac OS X Server the ultimate platform for le
sharing in mixed-platform work ows.
File system access controls
Mac OS X Server v10.4 supports both traditional UNIX le permissions and access
control lists, o! ering administrators an exceptional level of control over le and
folder permissions.
Most UNIX- and Linux-based operating systems are constrained by the UNIX le
permissions model, also known as Portable Operating System Interface (POSIX) permissions. Standard UNIX le permissions allow you to assign one access privilege
to the le’s owner, one to a group, and one to everyone on the network. Access by
multiple users or multiple groups is not allowed, nor is ownership by a group. The
traditional UNIX model also lacks some other important le access features. It supports
only three permissions (read, write, and execute) and does not support permission
inheritance, which enables new or copied les to automatically inherit the access
controls of the parent directory.
To provide greater exibility in complex computing environments, Apple has added
support for ACLs in Mac OS X Server v10.4. With le system ACLs, any le object can
be assigned multiple users and groups, including groups within groups. Each le
object can also be assigned both allow and deny permissions, as well as a granular
set of permissions for administrative control, read, write, and delete operations. For
added security, Mac OS X Server now supports a le permission inheritance model,
ensuring that user permissions are inherited when les are moved to the server and
rewritten when les are copied to the server.
CUPS print services
At the heart of the print services in Mac OS X Server is the Common UNIX Printing
System (CUPS), an open source printing architecture that supports standard crossplatform print protocols, including IPP, LPR, SMB/CIFS, and AppleTalk PAP.
Mail services
• SMTP (Post x)
• POP and IMAP (Cyrus)
• Berkeley DB for indexing
• SSL/TLS encryption (OpenSSL)
• Junk mail ltering (SpamAssassin)
• Virus detection (ClamAV)
• Mailing lists (Mailman)
• Webmail (SquirrelMail)
Using Open Directory and Workgroup Manager, Mac OS X Server provides centralized,
directory-based management of printer resources. Printers can be assigned to any
combination of users, groups, and computers, and print quotas can be enforced on
a per-user and per-queue basis. Flexible queue management and remote monitoring
tools allow management of high-volume, cross-platform printing for Mac, Windows,
and Linux clients from a single, intuitive interface. Settings and access policies are
stored in any LDAP server using Open Directory.
Mail Services
Mac OS X Server combines several robust technologies from the open source community to deliver comprehensive, easy-to-use mail server solutions. Full support for
Internet mail protocols—Internet Message Access Protocol (IMAP), Post O" ce Protocol
(POP), and Simple Mail Transfer Protocol (SMTP)—ensures compatibility with standardsbased mail clients on Mac, Windows, and Linux systems. With support for thousands of
users per server and no per-user licensing fees, these high-performance mail services
o! er signi cant cost savings for small organizations and large enterprises alike.
Core mail services
Mac OS X Server uses the high-speed Post x server for SMTP messaging and the
Cyrus mailbox server for scalable, enterprise-class POP and IMAP mail. Flexible mail
storage makes it easy to scale the mail server to meet growing needs, and highperformance Berkeley DB indexing ensures continued responsiveness when clients
access their mail, delete messages, and move les on the mail server. To protect your
network mail services from unauthorized access or abuse, Mac OS X Server includes
built-in SSL/TLS encryption, strong authentication, junk mail and virus ltering, and exible mail quota handling capabilities.
Technology Overview
Mac OS X Server
18
Post x and Cyrus are easy to con gure and manage using the Server Admin utility.
Protection against junk mail and viruses
To defend your servers and clients against unwanted mail and destructive viruses,
Mac OS X Server v10.4 integrates two popular open source projects: SpamAssassin
for adaptive junk mail ltering and ClamAV for virus detection and quarantine.
SpamAssassin enables Mac OS X Server to analyze the content of each mail message.
Using a wide variety of local and network tests, SpamAssassin assigns a probability
rating that the mail is spam. If the probability is high, it classi es the mail as potential
junk mail and allows the user to decide how to handle it. The SpamAssassin junk mail
lter is adaptive, which means it can be trained to recognize which marginal mail messages are spam and which are not. Training can be done automatically: SpamAssassin
analyzes the content of user inboxes every night and adapts its lters accordingly. Or,
for greater control, postmasters and users may prefer to train SpamAssassin manually.
Technology Overview
Mac OS X Server
ClamAV scans mail messages and attachments for viruses. Administrators choose how
ClamAV should handle a suspected virus. They can have the mail server bounce back
the message to the sender, delete the message immediately, or quarantine it in a speci ed directory for further analysis. The server can also automatically generate an email
message notifying postmasters or senders that their message has been quarantined.
19
Junk mail and viruses can be easily avoided using the Server Admin utility.
In addition to these new capabilities, Mac OS X Server works with real-time blacklists.
The mail server will refuse incoming tra" c from hosts that are on any of the lists.
Your organization can even add its own junk mail blacklists. It’s also easy to prevent
unauthorized outsiders from using your server to send email, and to refuse email
messages that exceed a speci ed le size.
Additional standards-based mail solutions
Mac OS X Server provides a graphical user interface for Mailman, making it easy to
deploy one of the most popular listserv solutions in the world. Mailman features list
archiving, content ltering, and digest delivery options, as well as a web-based inter-
face that enables individual users to create and maintain lists.
Completing its suite of industry-standard mail solutions, Mac OS X Server includes
webmail services using the open source SquirrelMail project. SquirrelMail allows users
to access their email from any standards-based browser, with full support for MIME,
address books, and folders for organizing stored messages. PHP is fully integrated
with the Apache web server, so webmail pages render in pure HTML 4.0—with no
JavaScript required—for maximum compatibility across browsers. SquirrelMail is easy
to con gure and works with any IMAP server.
Technology Overview
Mac OS X Server
20
Web Hosting
Combining the latest open source and standards-based Internet services, Mac OS X
Server makes it possible for organizations of any size to host websites and deploy
powerful web applications—quickly and a! ordably. Mac OS X Server web technologies
are based on the open source Apache web server, the most widely used HTTP server
on the Internet.
fast, reliable web hosting and an extensible architecture for delivering dynamic
content and sophisticated web services.
Getting started with Apache
Apple’s innovative administration tools take the complexity out of con guring,
hosting, and managing websites. Apache is precon gured with default settings, so
novices can create a static website in a few simple steps and add features as their
expertise grows. The web server supports aliases for greater website exibility,
making it possible to move web pages without breaking links and to create multiple
URLs that refer to a single le. In addition, support for virtual hosting allows multiple
sites to reside on a single server. Each of the websites can be con gured with unique
security options and separate log les for tracking and reporting.
4
With performance optimized for Mac OS X Server, Apache provides
A graphical interface makes it easy to customize web server settings, as well as to implement
advanced web hosting features.
Hosting dynamic content
Mac OS X Server includes everything professional webmasters need to deploy sophisticated web services: integrated tools for collaborative publishing, inline scripting,
Apache modules, and custom CGIs, as well as support for JavaServer Pages and Java
Servlets. Database-driven sites can be linked to the included MySQL database; ODBC
and JDBC connectivity to other database solutions is also supported.
Weblog services
With the emergence of weblogs, organizations have a quick and easy way to share
information. Weblog Server, included in Mac OS X Server v10.4, makes it simple to
publish and syndicate these online journals. The prede ned blog themes and calendar
navigation provide an intuitive interface for managing blogs. Individual users and
groups can publish and access weblogs using only their normal browsers; no additional
tools or technical expertise is required. This simplicity makes Weblog Server the perfect
collaboration tool.
Technology Overview
Mac OS X Server
Weblogs can be easily published and syndicated using this intuitive interface.
21
Application services
• JBoss application server (EJB)
• Apache Tomcat (JavaServer Pages, Java
Servlets)
• Java virtual machine (J2SE)
• Apache Axis (SOAP, WSDL Web Services)
• WebObjects deployment
Weblogs can be published and syndicated using HTML, RSS, RSS2, RDF, and Atom
protocols, allowing users to receive content in their desired format automatically.
With Open Directory authentication and access controls, Weblog Server ts into any
environment.
Security and authentication
To protect credit card information and business data transmitted during web transactions, Mac OS X Server integrates OpenSSL with the Apache web server for strong
128-bit encryption. For intranet sites and collaborative publishing scenarios, it’s also
easy to set up realms to require user authentication, or to use Kerberos authentication
for single sign-on.
Enterprise Applications
Mac OS X Server is one of the easiest ways to develop and deploy robust, reliable
enterprise applications based on Sun’s Java 2 Platform. It comes with all the components necessary to host J2EE applications, including JBoss, Apache Tomcat, and
Apache Axis. Together, these components enable enterprise application services such
as Enterprise JavaBeans (EJB), Java Message Services (JMS), XML-based web services,
and Java Database Connectivity (JDBC).
Mac OS X Server also supports the SOAP and WSDL Web Services standards for
exchanging data among distributed applications. Increasingly popular for businessto-business transactions, these transport protocols provide the integration essential
in sophisticated, multitiered applications.
The J2EE architecture
The Java 2 Platform, Enterprise Edition (J2EE) standard de nes a modular architecture
for building secure and interoperable enterprise applications. Using a standards-based
framework, these enterprise-grade Java server applications can deliver advanced
features such as automatic data persistence, secure transactions, database connectivity,
and dynamically generated web pages. Applications originating from another system
(or even another application server) that adhere to the J2EE 1.3 or J2EE 1.4 standard
can also usually be hosted on Mac OS X Server.
WebObjects
Apple WebObjects (sold separately) provides
a rapid development environment for
J2EE-compatible applications. With built-in
assistants, it’s easy to create web services or
three-tier Java server applications—backed
by robust relational databases—with rich
HTML or Java client interfaces. WebObjects
applications can be deployed, without
recon guration, on virtually any J2EE-capable
server—including the Mac OS X Server JBoss
application server.
Technology Overview
Mac OS X Server
JBoss application server
Mac OS X Server makes it easy to manage and deploy J2EE-based applications,
without having to edit numerous XML les by hand. A JBoss application server comes
preinstalled and preintegrated for use with the built-in Apache web server, along with
MySQL, the popular open source SQL database. And unlike expensive proprietary J2EE
application servers, Mac OS X Server does not impose per-CPU license fees or highpriced maintenance fees.
Apple’s JBoss application server features graphical management tools for validating,
con guring, and monitoring J2EE applications. Deploying an enterprise application
can be as easy as starting JBoss and copying the application resources to the deployment directory. Upgrading is instant—there’s no need to restart the server. JBoss also
features clustering, load-balancing, and failover capabilities that increase the reliability
and scalability of J2EE deployments.
22
Standards-based streaming
• Delivers streams over RTP/RTSP via
multicast or unicast transport
• Supports native MPEG-4 and 3GPP streaming
• Serves MP3 les via Icecast-compatible proto-
cols over HTTP to MP3 clients
• Supports H.264 video streaming
The JBoss Management Console allows administrators to monitor the activity of applications
and services on the JBoss application server, as well as to con gure new resources such as
databases and message queues.
Media Streaming
Mac OS X Server v10.4 includes the latest version of the popular QuickTime Streaming
Server. These powerful tools provide a complete, a! ordable, standards-based solution
for delivering rich audio and video over the Internet and high-speed wireless networks.
Using the open standard Real-Time Transport Protocol/Real-Time Streaming Protocol
(RTP/RTSP), QuickTime Streaming Server streams media—from modem to broadband
rates and beyond—to users everywhere. Because QuickTime has no client-access
license fees, it’s a highly cost-e! ective platform for creating, playing, and streaming
digital media over the Internet.
Support for industry standards
QuickTime is one of the most versatile platforms for streaming live and on-demand
media. It supports the latest global multimedia standards, including H.264, AAC,
MP3, MPEG-4, and 3GPP, so your content can be played anywhere using standardscompliant media players—a Mac or Windows system, mobile phone, or set-top box.
Technology Overview
Mac OS X Server
23
Easy-to-use management tools
Setting up and administering QuickTime Streaming Server (QTSS) is a snap with the
Server Admin application in Mac OS X Server. Server Admin provides secure remote
management and monitoring of your server from anywhere on the Internet. Allowing
you to do anything from setting passwords to binding QTSS to a speci c IP address,
Server Admin will have you up and streaming with just a few clicks.
In addition, QuickTime Streaming Server comes with a web-based administration tool
that lets you monitor streaming activity from any computer that has a web browser.
Preparing content for streaming
Mac OS X Server v10.4 also includes the latest version of QTSS Publisher, Apple’s
QuickTime content management software. With an intuitive interface, QTSS Publisher
allows individual users to publish media for streaming to the server quickly and easily
from any Mac OS X system that has an Internet connection. Upload les to the server,
create playlists of content, generate web pages, and much more, using this powerful
application built into Mac OS X Server.
Broadcasting live events
Working seamlessly with QuickTime Streaming Server, QuickTime Broadcaster enables
experts and novices alike to produce professional-quality live events for online delivery.
This live encoding software has broad, extensible codec support that includes H.264
video, making it easy to reach large numbers of viewers for corporate meetings, online
courses, keynote addresses, and other special events.
QuickTime is an extremely versatile, coste! ective platform for creating, playing,
and streaming digital media over the
Internet. It supports all the latest digital
media standards, including MPEG-4,
H.264, and 3GPP, so content can be played
anywhere, using any standards-compliant
media player.
Based on standards, live broadcasts can be viewed in a variety of compliant devices
in addition to QuickTime Player on Mac and Windows PCs. Live streaming begins with
a Mac desktop or notebook computer connected to a video camera, microphone, or
other media recording device. Using QuickTime Broadcaster, the system digitizes and
compresses the media feed and sends the encoded signal to the server. The QuickTime
Streaming Server software then re ects the signal, sending it out to audiences, who
“tune in” with QuickTime Player or other compliant devices.
The intuitive QTSS Publisher interface makes it easy to upload prerecorded media to the streaming server and manage media playlists for simulated live broadcasts or on-demand viewing.
Technology Overview
Mac OS X Server
iChat Server
With instant messaging quickly becoming a primary collaboration tool in organizations of all sizes, the importance of secure instant messaging has rapidly increased.
By default, many instant messaging services are not encrypted, so any text messages
and les exchanged by users can be compromised. That lack of security makes those
instant message products risky for business communications. For example, when a
user on a business trip chats with a colleague back at the o" ce, the information they
share can be intercepted as it goes over the Internet and through the o" ce LAN.
iChat Server, new in Mac OS X Server v10.4, makes secure communications within the
rewall possible. Designed from the ground up to be secure, iChat Server encrypts
communications using SSL, ensuring that text messages and les are protected as
they move between users.
Based on the popular Jabber open source instant messaging project, iChat Server
works with iChat in Mac OS X Tiger, as well as with Jabber clients available for
Windows and Linux computers and popular PDAs.
Because iChat Server builds on the Jabber server, it supports namespace management
and user authentication using Open Directory. By leveraging Open Directory, an
organization can use existing user accounts stored in its Open Directory server, as
well as Active Directory or other LDAP-based directory servers.
24
Software Update Server
Mac OS X Server v10.4 includes Software Update Server, which acts as a proxy for
software updates for Mac OS X Tiger client systems. This caching server allows
administrators to control when and how software updates become available for
users’ systems. It can also reduce network costs.
Your software update server automatically mirrors itself to Apple’s software update
servers, ensuring that you have the most current updates available. For security, all
updates are digitally signed by Apple.
This easy-to-use interface o! ers the option to mirror or enable each update, while providing
detailed information on each software program.
Technology Overview
Mac OS X Server
25
Managing client updates
In an uncontrolled environment, users may connect to Apple’s software update servers
at any time and update their computers with whatever software they want, even if
it has not been approved by the IT group or system administrator. When you deploy
local software update servers, users are restricted to downloading only approved
software updates.
For example, IT administrators may not want to deploy every update on its day of
publication. They may instead wish to go through a testing and evaluation phase
before deploying the new software to users. By creating local update servers, you
can control when and whether users get the new updates.
Using Workgroup Manager, you can assign various users, groups, and computers to
speci c local software update servers. You can also control which software update
packages users can access by enabling and disabling individual packages at the
local server.
Controlling costs
A local software update server caches software updates from Apple’s software update
servers, then shares them with local network clients. By eliminating the multiple
Internet downloads required when each Mac OS X user individually accesses Apple’s
servers, the local server reduces the bandwidth demands on your Internet gateway—
and therefore, your organization’s costs for external network access. Having control
over client updates also helps IT sta! manage the support costs associated with help
desk requests—the largest cost of ownership for personal computers.
Use NetBoot to:
• Con gure multiple desktop computers with
the same operating system and applications
• Replicate server con gurations for compute
farms and data centers
• Deploy new systems and restore compromised systems instantly
NetBoot and NetInstall
Included in Mac OS X Server are two powerful applications for standardizing and
upgrading client systems. The NetBoot service allows multiple Mac clients to start
up from a single server-based disk image. NetInstall enables automated software
installation from a master image. The new System Image Utility streamlines system
deployment and reduces administration costs by providing a convenient single
interface for both NetBoot and NetInstall functions.
NetBoot
The NetBoot service makes managing a group of computers as easy as managing a
single Mac. Client systems can boot from a server-based disk image, which enables the
same operating system and applications to be deployed across an entire workgroup.
NetBoot can even be used to create server con gurations and run multiple servers
from one image. Updating the disk image on the server updates all of these systems
automatically the next time they are restarted. NetBoot is also a powerful tool for
deploying new systems, repurposing desktop or server systems, and deploying
network-based diagnostics and repair utilities.
5
Technology Overview
Mac OS X Server
NetBoot is a proven technology that enables businesses and institutions to streamline the support of Mac clients and reduce system administration costs. The ability to
deploy a standard desktop con guration across multiple systems and to protect them
from alteration makes NetBoot ideal for computing environments such as classrooms,
computer labs, kiosks, and computational clusters.
26
Use NetInstall to:
• Install system software and packaged applications on desktop and mobile computers
• Standardize con gurations and upgrade
schedules
• Manage options for automated or semiautomated installations
• Con gure new systems or repurpose existing
systems
The new System Image Utility makes it easy to create a NetBoot disk image by cloning a local
volume—no con guration required—or to build a new image from a Mac OS X Install CD.
NetInstall
NetInstall uses the same technology as NetBoot, but instead of starting up the client
system from a server-based disk image, it installs the contents of the image on the
client computer’s hard drive. Once the installation process is complete, client systems
no longer need to be connected to the network, making NetInstall an excellent tool
for managing mobile computers.
Designed for administrators who manage operating system installations and software
updates for their organizations, NetInstall performs automated software installations,
whether it’s a new version of the operating system, a speci c suite of applications for
a workgroup, or both. It saves time and eliminates the expense of distributing software
on CD or the need for administrators to con gure each system in person. The block-
copy installation capabilities in this powerful tool make con guring new systems or
repurposing existing ones even faster and more reliable.
Apple Remote Desktop
The remote control capabilities of Apple
Remote Desktop 3 (sold separately) enable
administrators to specify the startup disk
for multiple networked Mac computers and
restart them remotely. This makes it easy to
con gure or update computers for an entire
classroom, lab, or o" ce at once.
Technology Overview
Mac OS X Server
Networking and VPN
Mac OS X Server includes everything needed to set up and secure a local area
network. The Server Admin tool adds an intuitive interface to core network services
(including DNS, NAT, NTP, DHCP, and Firewall), making it easier to set up an IP
network infrastructure.
27
For maximum security, Mac OS X Server comes with all ports, except those used for remote
administration and monitoring, locked by default. Any port can be opened by selecting the
service using Server Admin.
Windows network infrastructure
Samba 3 provides network browsing and name-to-address translation services for
Windows clients by integrating WINS (Windows Internet Naming Service) and NetBIOS
(Network Basic Input/Output System) services. WINS allows Windows clients to use
dynamic computer name registration and resolution to nd each other on the same
network or, when used with NetBIOS, to discover Windows clients and domains across
subnets without requiring a local domain controller. DHCP can be con gured to auto-
matically assign WINS and NetBIOS information to Windows clients, simplifying system
con guration and network administration.
VPN server
The built-in Virtual Private Network ( VPN) server provides secure remote access to the
LAN from any Internet-connected computer, or between LANs over the public Internet.
Using L2TP and PPTP tunneling protocols, Apple’s VPN server works with standardsbased VPN clients to support encrypted IP connections for Mac, Windows, and Linux
systems. Mac OS X Server VPN services use highly secure authentication methods,
including MS-CHAP and network-layer IPSec.
Technology Overview
Mac OS X Server
Distributed Computing
Mac OS X Server v10.4 includes Xgrid, the rst distributed computing architecture to
be built into a desktop or server operating system. Xgrid makes it easy to turn an ad
hoc group of Mac computers into a low-cost supercomputer by streamlining the process of assembling nodes, submitting jobs, and retrieving results. With Xgrid, scientists,
animators, and digital content creators can easily run a single job across multiple
computers at once, dramatically improving performance and responsiveness.
28
Xgrid Admin makes it easy to monitor and manage jobs and agents on multiple controllers.
Integrated directly into Mac OS X Server v10.4, Xgrid works across portable computers,
desktops, and servers to create a seamless distributed computing environment. Xgrid
comes with administration tools for managing Xgrid clusters, monitoring job submissions and progress, and displaying the status of individual jobs.
Xgrid controllers mutually authenticate with both clients and agents, using either a
password or the single sign-on facility in Mac OS X Server. Similarly, clients and agents
can locate a controller using Bonjour, Open Directory, a host name, or DNS service
lookups. This means Xgrid clusters can range from a single rack of Xserve systems to
a roomful of Mac desktop computers to a diverse collection of Mac systems dispersed
across the Internet.
Technology Overview
Mac OS X Server
Product Details
Mac OS X Server can be purchased in 10-client and unlimited-client editions to
meet the needs of server deployments of any size. License restrictions apply only to
simultaneous le-sharing services for Mac and PC clients.
• Mac OS X Server 10-client edition. The easiest way to deploy powerful network
services, the 10-client edition is designed for small workgroups and Internet hosting
services that do not require simultaneous le sharing among more than 10 Mac and
PC clients.
29
• Mac OS X Server unlimited-client edition. The most cost-e! ective way to support
Mac and Windows workgroups, the unlimited-client edition is perfect for classroom
labs, creative professionals, and medium-size to large workgroups with high volumes
of le-sharing activity.
Also available is an unlimited-client upgrade from the 10-client edition.
Package Contents
The Mac OS X Server package includes Mac OS X Server v10.4.7, Admin Tools, and
Xcode 2 developer tools. Product documentation includes a getting started guide
and the following electronic administration guides:
• Collaboration Services Administration
• File Services Administration
• High Availability Administration
• Mail Service Administration
• Migrating to Mac OS X Server from Windows NT
• Network Services Administration
• Open Directory Administration
• Print Services Administration
• QuickTime Streaming Server Administration
• Server Glossary
• System Imaging and Software Update Administration
• Upgrading and Migrating
• User Management
• Web Technologies Administration
• Windows Services Administration
• Worksheet
• Xgrid Administration
Technology Overview
Mac OS X Server
30
System Requirements
Mac OS X Server v10.4.7 requires an Xserve or Mac desktop system with an Intel or
PowerPC G4 or G5 processor; 512MB of RAM; built-in FireWire; and 10GB of available
disk space.
Apple Maintenance Program
This optional program for Mac OS X Server makes it easy for customers to manage
software expenditures while bene ting from the latest technologies and improve-
ments. With one payment, customers automatically receive major Mac OS X Server
software upgrades for three years. For more information, including program terms
and conditions, visit www.apple.com/server/maintenance.
AppleCare Technical Support
Mac OS X Server comes with 90 days of toll-free telephone support for installation,
launch, and recovery and lifetime access to Apple’s online support resources, such as
the AppleCare Knowledge Base and discussion forums.
In addition, Apple o! ers consultative phone and email support for advanced server
migration and integration issues. Customers can choose from three levels of AppleCare
technical support:
• Select covers up to 10 incidents with 4-hour response for priority 1 issues (server
down), 12 hours a day, 7 days a week.
needed.
• Preferred covers an unlimited number of incidents with 2-hour response for
priority 1 issues, 12 hours a day, 7 days a week,
manager to the organization.
• Alliance covers an unlimited number of incidents at multiple locations with 1-hour
response for priority 1 issues, 24 hours a day, 7 days a week.
onsite review by an Apple technical support engineer.
For more information about AppleCare support products, including terms and
conditions, visit www.apple.com/server/support.
6
Additional incidents can be purchased as
6
and assigns a technical account
6
This plan includes an
Training and Certi cation
Apple o! ers comprehensive instruction on Mac OS X and Mac OS X Server applica-
tions and technologies. A combination of lecture, demonstration, and hands-on
exercises, classes are taught by Apple Certi ed Trainers with real-world experience
and dynamic presentation skills. Customers can choose to attend classes at an Apple
Authorized Training Center or have Apple deliver training onsite at their business
or institution.
Once IT professionals have acquired the requisite skills, Apple certi cation programs
provide tangible evidence of their technical expertise. Three certi cation levels—
Apple Certi ed Help Desk Specialist, Apple Certi ed Technical Coordinator, and Apple
Certi ed System Administrator—are based on corresponding training course content.
For more information about Apple training and certi cation programs, visit
www.apple.com/training.
Technology Overview
Mac OS X Server
Open Source Projects
Mac OS X Server v10.4 integrates more than 100 open source projects.
We invite you to explore Apple’s website to learn more about Mac OS X Server
and Apple server solutions.
To download documentation and technology briefs:
www.apple.com/server/documentation
To learn about third-party products that extend or enhance the capabilities of
Mac OS X Server: www.apple.com/server/resources
35
For More Information
For more information about Mac OS X Server,
Xsan, Xserve, Xserve RAID, and other Apple
server solutions, visit www.apple.com/server.
To learn about development resources: developer.apple.com/server
To access technical support resources: www.apple.com/server/support
For a list of Apple press contacts: www.apple.com/pr/contacts.html
1
Schema modi cations may be required to manage Mac OS X client systems from the directory. 2Remote server administration
requires Mac OS X v10.3 or later.
versions 1.3 and 2.0 are installed in Mac OS X Server v10.4 and are accessible from the command line; Server Admin provides a
user interface for con guring and managing Apache 1.3.
physical Ethernet connection; it does not support AirPort wireless technology. NetInstall requires Mac systems released in October
1999 or later; application installation requires client systems with Mac OS X v10.2 or later. Licensing terms apply to Apple and thirdparty software deployments.