Este es el procedimiento que he seguido:
Instale una copia nueva de macOS Mojave en un volumen APFS
Realice la configuración inicial del sistema operativo y cree un usuario 'admin' en el primer lanzamiento. Asigne una IP estática de la red privada 192.168.168.0/24. Utilice un servidor DNS ubicado en una red privada. Asegúrese de que la IP se resuelva en un FQDN ('test.mydomain.com') y viceversa.
Seleccione 'myshare' y haga clic en el botón Opciones para asegurarse de que el uso compartido de SMB esté habilitado.
Intente conectarse al servidor de archivos desde una computadora cliente dentro de la misma subred a través de smb://test.mydomain.com/myshare o alternativamente smb://192.168.168.X/myshare usando las credenciales 'admin' o 'testuser'
En el último paso, la conexión falla para las cuentas 'admin' y 'testuser'. Si apago Open Directory, puedo conectarme con el usuario 'admin'. Los reinicios en cualquier fase del procedimiento no hacen ninguna diferencia.
¿Por qué no puedo acceder a SMB cuando Open Directory está habilitado?
Aquí están las entradas de registro de opendirectoryd desde la creación del maestro OD (paso 5): https://pastebin.com/uQm8b8NM
Aquí están las entradas de registro de opendirectoryd y smbd del intento de inicio de sesión (paso 14): https://pastebin.com/U2RS3LYC y https://pastebin.com/7bFNfd8V
El problema es que las ACL no están configuradas en el directorio local para SMB y AFP. Estos solían crearse en las aplicaciones de servidor más antiguas que tenían archivos compartidos. He escrito un AppleScript que se encarga de todo esto. Crea los grupos de ACL apropiados en el directorio (/Local/Default/Groups/com.apple.access_smb y com.apple.access_afp), luego agrega todos los usuarios. El guión está debajo. Lo armé hoy tratando de resolver este mismo problema. Esperemos que ayude a otros.
-- Script to sort out ACLs for file sharing
set savedDelimiters to AppleScript's text item delimiters
display alert "Setup File Sharing ACLs" message "This script will set up the appropriate ACLs in the local directory to allow users to connect to file sharing on a macOS 10.14 server with OpenDirectory.
WARNING: Changes will be made to your local directory. Administrator privileges are required (you will be prompted for a password).
USE AT YOUR OWN RISK!
Set for all users, or only a single user?" buttons {"Cancel", "All Users", "Single User"} default button "Single User" cancel button "Cancel"
if button returned of result = "All Users" then
set progress description to "Loading User List..."
-- Load all directory users from the server
-- (identified by UserShell value of '/bin/bash'; most likely to be normal users)
-- The delimiter is horrible, but it's the only way to do it
set delimiter to tab & tab & "UserShell = (" & return & " \"/bin/bash\"" & return & ")"
set AppleScript's text item delimiters to {delimiter & return, delimiter}
set users to every text item of (do shell script "dscl /LDAPv3/127.0.0.1 search /Users UserShell \"/bin/bash\"")
else if button returned of result = "Single User" then
repeat
set username to the text returned of (display dialog "Enter Username:" default answer "" with icon note)
if username is "" then
display alert "Please enter username, or click cancel to end"
else
exit repeat
end if
end repeat
-- Add blank element to end, as this happens with output from dscl above
set users to {username, ""}
end if
-- Create the SMB & AFP ACL groups if necessary (this may be the first user)
createACLGroup("afp", 250)
createACLGroup("smb", 110)
-- Go through all the users now
set total to (length of users) - 1
set progress total steps to total
set progress description to "Adding Users to ACLs..."
set current to 0
repeat with idx from 1 to total
-- Need to use indexed repeat because of issue with missing username in list from dscl
set username to item idx of users
try
set progress completed steps to current
set progress additional description to "User " & (current + 1) & " of " & total & " (" & username & ")"
-- Now, check to see if the user is already in the file sharing lists
set AppleScript's text item delimiters to {" "} -- Split words, not letters!
set currList to every text item of (do shell script "dscl /Local/Default read Groups/com.apple.access_smb GroupMembership")
if username is in currList and length of users is 1 then
-- Only alert if in single user mode
display alert "Username already set up"
else
-- Go ahead and set it up
-- Firstly, get the user's GeneratedUID from the LDAP directory
set isError to false
try
set guid to second item of (every text item of (do shell script "dscl /LDAPv3/127.0.0.1 read Users/" & username & " GeneratedUID"))
on error
display alert "Error" message "User " & username & " is not a directory user"
set isError to true
end try
if not isError then
-- Add the user to the group
addUserToACL("afp", username, guid)
addUserToACL("smb", username, guid)
end if
end if
set current to current + 1
on error
-- Likely an empty username from the delimiters tokenising the list from dscl
end try
end repeat
set current to total
display alert "Process completed!"
set AppleScript's text item delimiters to savedDelimiters
on createACLGroup(acltype, groupid)
try
do shell script "dscl /Local/Default read Groups/com.apple.access_smb"
on error
-- Doesn't exist, so we need to create it!
do shell script "dscl /Local/Default create Groups/com.apple.access_" & acltype with administrator privileges
do shell script "dscl /Local/Default create Groups/com.apple.access_" & acltype & " RealName \"" & changeCaseOfText(acltype, "upper") & " ACL\"" with administrator privileges
do shell script "dscl /Local/Default create Groups/com.apple.access_" & acltype & " PrimaryGroupID " & groupid with administrator privileges
end try
end createACLGroup
on addUserToACL(acltype, username, guid)
do shell script "dscl /Local/Default append Groups/com.apple.access_" & acltype & " GroupMembership " & username with administrator privileges
do shell script "dscl /Local/Default append Groups/com.apple.access_" & acltype & " GroupMembers " & guid with administrator privileges
end addUserToACL
on changeCaseOfText(theText, theCaseToSwitchTo)
if theCaseToSwitchTo contains "lower" then
set theComparisonCharacters to "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
set theSourceCharacters to "abcdefghijklmnopqrstuvwxyz"
else if theCaseToSwitchTo contains "upper" then
set theComparisonCharacters to "abcdefghijklmnopqrstuvwxyz"
set theSourceCharacters to "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
else
return theText
end if
set theAlteredText to ""
repeat with aCharacter in theText
set theOffset to offset of aCharacter in theComparisonCharacters
if theOffset is not 0 then
set theAlteredText to (theAlteredText & character theOffset of theSourceCharacters) as string
else
set theAlteredText to (theAlteredText & aCharacter) as string
end if
end repeat
return theAlteredText
end changeCaseOfText
Mira este artículo :
https://support.apple.com/en-ca/HT210659
El artículo explica cómo habilitar SMB-NTLMv2 como mecanismo de autenticación para que cualquier cliente pueda autenticarse en el servidor.
De lo contrario, el cliente debe vincularse a Open Directory y usar Kerberos para acceder al recurso compartido.
Vuelva a instalar High Sierra con Server App 5.6 y funciona.
Ortwin Gentz