Comments on: Xserve G4 running Panther Server 10.3.9: Didn’t like that security update… at all http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/ Notes from an unfinished world… Sat, 18 Feb 2012 11:48:53 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: sjk http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6198 sjk Thu, 15 Jun 2006 04:19:21 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6198 As Pierre and others already know, there can be integrity issues with backups/restores of "live" database and other "volatile" data using other software besides SD!. Just wanted to clarify that's a general concern and not SD!-specific. As Pierre and others already know, there can be integrity issues with backups/restores of “live” database and other “volatile” data using other software besides SD!. Just wanted to clarify that’s a general concern and not SD!-specific.

]]> By: Pierre Igot http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6194 Pierre Igot Tue, 13 Jun 2006 11:52:10 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6194 Andrew and sjk: Thanks for the additional advice. I don't why I didn't think of using BBEdit (which I own) to edit the httpd.conf file. Somehow I forgot that it (like TextWrangler) can open invisible files and edit root-owned ones. I will try SD! shortly to confirm that it works well to create a bootable clone of my OS X Server volume. (The developer has told me that the only issue might be the "live" MySQL databases. But it's not really a problem for me as I would do the backup during the night and the MySQL databases only change during the day. We don't offer the ability to comment on post items. FileMaker would also probably complain about databases not having been closed properly, but it would still work. In any case, I keep separate backups of the databases remotely.) Aapo: Yes, that's what I figured when I got the error message, and that's how I figured out that trashing the known_hosts file would probably clear the problem. The problem is that it's not very intuitive at all :). But I guess that's what you get with server solutions. They are just never going to be user-friendly like a client Mac OS environment. Andrew and sjk: Thanks for the additional advice. I don’t why I didn’t think of using BBEdit (which I own) to edit the httpd.conf file. Somehow I forgot that it (like TextWrangler) can open invisible files and edit root-owned ones. I will try SD! shortly to confirm that it works well to create a bootable clone of my OS X Server volume. (The developer has told me that the only issue might be the “live” MySQL databases. But it’s not really a problem for me as I would do the backup during the night and the MySQL databases only change during the day. We don’t offer the ability to comment on post items. FileMaker would also probably complain about databases not having been closed properly, but it would still work. In any case, I keep separate backups of the databases remotely.)

Aapo: Yes, that’s what I figured when I got the error message, and that’s how I figured out that trashing the known_hosts file would probably clear the problem. The problem is that it’s not very intuitive at all :). But I guess that’s what you get with server solutions. They are just never going to be user-friendly like a client Mac OS environment.

]]> By: Aapo Laitinen http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6193 Aapo Laitinen Tue, 13 Jun 2006 07:04:23 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6193 When you connect to a SSH server for the first time, a fingerprint (a cryptographic hash, to be exact) of the public key of the server is stored in known_hosts. In subsequent connection attempts, the SSH client ensures that the fingerprint of the key the server sent matches to the stored fingerprint. When you did a complete reinstall, the SSH server generated a new private and public key for itself. Since the SSH client can't tell whether the new key was generated on purpose or if someone is attempting a man-in-the-middle attack, it stops you from connecting. If you ever receive the same warning regarding a computer you don't administer youself, contact the party responsible for the server by phone and ask if the disparency is legimate or not. If you receive the warning without a clear cause (such as a reinstall), be very scared. When you connect to a SSH server for the first time, a fingerprint (a cryptographic hash, to be exact) of the public key of the server is stored in known_hosts. In subsequent connection attempts, the SSH client ensures that the fingerprint of the key the server sent matches to the stored fingerprint.

When you did a complete reinstall, the SSH server generated a new private and public key for itself. Since the SSH client can’t tell whether the new key was generated on purpose or if someone is attempting a man-in-the-middle attack, it stops you from connecting.

If you ever receive the same warning regarding a computer you don’t administer youself, contact the party responsible for the server by phone and ask if the disparency is legimate or not. If you receive the warning without a clear cause (such as a reinstall), be very scared.

]]> By: sjk http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6192 sjk Mon, 12 Jun 2006 23:20:56 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6192 I'd also recommend SuperDuper! for its integrity, plus support is fast and knowledgeable if you ever need it. I used CCC before SD!, but Mike Bombich has all but abandoned development in favor of NetRestore and CCC's forum is too "risky" to rely on for support. I’d also recommend SuperDuper! for its integrity, plus support is fast and knowledgeable if you ever need it. I used CCC before SD!, but Mike Bombich has all but abandoned development in favor of NetRestore and CCC’s forum is too “risky” to rely on for support.

]]> By: Andrew Aitken http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6191 Andrew Aitken Mon, 12 Jun 2006 21:44:03 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6191 We use SuperDuper exclusively to deploy both OS X Client and Server. So I know it works well for OS X Server. Wherever possible, I try to have the boot volume of the Xserve mirrored to another internal drive. When I want to install a software update like this, I simply pop the drive out, thus breaking the mirror. If it all goes pear shaped, I just plug the other drive back in, and reboot as if nothing happened, while I work on sorting out the now broken drive. With regard to editing config files, I use <a>TextWrangler</a> a lot. It is free, and offers authenticated saves - so you don't have to use the command line text editors to edit files that need superuser authority. With regard to the drive module question - a few months ago I had a customer who wanted me to replace the HD, rather than the whole module in his G4 Xserve. So far, there have been no problems. It's a very simple procedure, and the drive (which I actually have in front of me now!) is a standard 60 Gig IBM DeskStar - with some silly red marker-pen marks on it… The drives are just standard drives, but have been 'tested' by Apple, and confirmed capable to run 24/7/365 in an Xserve. If cost is an issue, I wouldn't worry too much about putting a 3rd party drive in, just make sure it's a reputable make. The Maxtor MaxLine range seems good, so does the Seagate NL35 series (not sure if they come in non-SATA however) We use SuperDuper exclusively to deploy both OS X Client and Server. So I know it works well for OS X Server.

Wherever possible, I try to have the boot volume of the Xserve mirrored to another internal drive. When I want to install a software update like this, I simply pop the drive out, thus breaking the mirror. If it all goes pear shaped, I just plug the other drive back in, and reboot as if nothing happened, while I work on sorting out the now broken drive.

With regard to editing config files, I use TextWrangler a lot. It is free, and offers authenticated saves – so you don’t have to use the command line text editors to edit files that need superuser authority.

With regard to the drive module question – a few months ago I had a customer who wanted me to replace the HD, rather than the whole module in his G4 Xserve. So far, there have been no problems. It’s a very simple procedure, and the drive (which I actually have in front of me now!) is a standard 60 Gig IBM DeskStar – with some silly red marker-pen marks on it…

The drives are just standard drives, but have been ‘tested’ by Apple, and confirmed capable to run 24/7/365 in an Xserve. If cost is an issue, I wouldn’t worry too much about putting a 3rd party drive in, just make sure it’s a reputable make. The Maxtor MaxLine range seems good, so does the Seagate NL35 series (not sure if they come in non-SATA however)

]]> By: Pierre Igot http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6190 Pierre Igot Mon, 12 Jun 2006 21:22:10 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6190 My understanding was that ACLs were introduced in Tiger. Since I am running Panther Server (10.3.9), I don't think they are the problem. Even the SuperDuper! developer himself says that my CCC clone should have worked. My understanding was that ACLs were introduced in Tiger. Since I am running Panther Server (10.3.9), I don’t think they are the problem.

Even the SuperDuper! developer himself says that my CCC clone should have worked.

]]> By: AlanY http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6189 AlanY Mon, 12 Jun 2006 20:54:23 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6189 It could be the BSD flags, but it's much more likely to be the missing ACLs that were the source of the problem. It could be the BSD flags, but it’s much more likely to be the missing ACLs that were the source of the problem.

]]> By: Pierre Igot http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6188 Pierre Igot Mon, 12 Jun 2006 18:12:22 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6188 Thanks for the links and pointers. I will take a closer look. I already use SuperDuper! on my home office computer to back up data, but I don't use it to back up an entire startup volume. My main question would be whether it works well with Mac OS X Server. OS X Server obviously has more stuff going on behind the scenes and ensuring that all this is preserved is probably harder than with OS X Client. I'll ask the developer. What he says about CCC doesn't seem to explain why my backup failed, unless there are BSD flags on the volume that have to be preserved for the system to work properly. Thanks for the links and pointers. I will take a closer look. I already use SuperDuper! on my home office computer to back up data, but I don’t use it to back up an entire startup volume. My main question would be whether it works well with Mac OS X Server. OS X Server obviously has more stuff going on behind the scenes and ensuring that all this is preserved is probably harder than with OS X Client. I’ll ask the developer.

What he says about CCC doesn’t seem to explain why my backup failed, unless there are BSD flags on the volume that have to be preserved for the system to work properly.

]]> By: AlanY http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6187 AlanY Mon, 12 Jun 2006 16:45:11 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6187 CarbonCopyCloner is indeed no good. See this article: http://blog.plasticsfuture.org/2006/04/23/mac-backup-software-harmful/ and the earlier article in the series: http://blog.plasticsfuture.org/2006/03/05/the-state-of-backup-and-cloning-tools-under-mac-os-x/ That author runs tests on almost all Mac backup options and finds most of them lacking, but identifies one (SuperDuper) that does everything perfectly. CarbonCopyCloner is indeed no good. See this article:
http://blog.plasticsfuture.org/2006/04/23/mac-backup-software-harmful/
and the earlier article in the series:
http://blog.plasticsfuture.org/2006/03/05/the-state-of-backup-and-cloning-tools-under-mac-os-x/

That author runs tests on almost all Mac backup options and finds most of them lacking, but identifies one (SuperDuper) that does everything perfectly.

]]> By: mricart http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/comment-page-1/#comment-6186 mricart Mon, 12 Jun 2006 14:35:05 +0000 http://www.betalogue.com/2006/06/12/xserve-g4-running-panther-server-1039-didnt-like-that-security-update%e2%80%a6-at-all/#comment-6186 We have been using "Synchronize! Pro X" for startup disk mirroring, and so far it worked. We have been using “Synchronize! Pro X” for startup disk mirroring, and so far it worked.

]]>