JDS 9.65 vs. Server 5.0.4

[cwaldrip]

If you're still running JDS 9.65 you should be aware that the installer doesn't recognize OS X Server 5.0.4.

Luckily I had a copy of 4.1.3 from another server I was able to copy over to my latest JDS box.

[were_wulff · Accepted solution]

Hey all,

We are aware of the issue in which the JDS no longer functions with Server 5.0.

There is an open defect filed under D-009587, and as @cwaldrip mentioned, the workaround is to revert back to a version of Server prior to 5.0.

If you are experiencing this issue, or need help on getting back to an older version of the Server app, please get in touch with your Technical Account Manager by phone, by e-mailing support@jamfsoftware.com, or by using the My Support section of JAMF Nation to get a case opened up so we can get it attached to D-009587 for tracking purposes.

Even if you've already fixed the issue by going back to an older version of the Server app, please consider opening a case anyway so we can get it attached to D-009587, as it does help us get a better idea of the scope/amount of users who are running into the issue.

Thanks!
Amanda Wulff
JAMF Software Support

[jyergatian]

The same goes for 9.72.

[emily]

And 9.73

[were_wulff · Accepted solution]

Hey all,

We are aware of the issue in which the JDS no longer functions with Server 5.0.

There is an open defect filed under D-009587, and as @cwaldrip mentioned, the workaround is to revert back to a version of Server prior to 5.0.

If you are experiencing this issue, or need help on getting back to an older version of the Server app, please get in touch with your Technical Account Manager by phone, by e-mailing support@jamfsoftware.com, or by using the My Support section of JAMF Nation to get a case opened up so we can get it attached to D-009587 for tracking purposes.

Even if you've already fixed the issue by going back to an older version of the Server app, please consider opening a case anyway so we can get it attached to D-009587, as it does help us get a better idea of the scope/amount of users who are running into the issue.

Thanks!
Amanda Wulff
JAMF Software Support

[jyergatian · Accepted solution]

I can confirm although the JDS.pkg fails to install with Server 5.x, if you have Server 4.x, you can install JDS.pkg and upgrade to Server 5.x afterwards without issues.

Perhaps a temporary workaround would be allowing a manual install of the jamfds binary, LaunchDaemon, and apache assets/configuration.

[were_wulff]

Hey all,

We have some updated workaround steps here that should get your JDS up and going if you’re already running Server App 5.0.

We are working on getting this made into an official KB, but in the mean time, these steps will help:

The main reason this happens is that our JDS Mac Installer is looking for a file that, as of OS X Server v.5.0, no longer exists, so the installer errors out.

To get around the issue of the JDS installer failing, we’ll need to do the following steps prior to running it:

1. cd /Library/Server/Web/Config/apache2/sites
   sudo cp 0000_127.0.0.1_34543_.conf 0000_any_443_.conf

2. Run the JDS Mac Installer.

3. Rename or delete the file created in step 1.

Next, we’ll need to go through the following steps to ensure that package downloads and replication from the JDS continue to work.

Those steps are as follows:

1) Stop the web service, either through Server.app or by opening Terminal and entering: sudo serveradmin stop web

2) Make a backup of /Library/Server/Web/Config/Proxy/apache_serviceproxy.conf

3) Modify the original /Library/Server/Web/Config/Proxy/apache_serviceproxy.conf to include the JDS certificate by adding the following:

# Add the JDS certificate file paths to the VirtualHost definition for port 443
 
...
<VirtualHost *:443>
...
    SSLEngine On
#   SSLCertificateFile "/etc/certificates/<hostname>.<id>.cert.pem"
#   SSLCertificateKeyFile "/etc/certificates/<hostname>.<id>.key.pem"
#   SSLCertificateChainFile "/etc/certificates/<hostname>.<id>.chain.pem"
    SSLCertificateFile /Library/JDS/certs/webserver.pem
    SSLCertificateKeyFile /Library/JDS/certs/webprivate.key
    SSLCertificateChainFile /Library/JDS/certs/jss_ca.cer

4) Make a backup of /Library/Server/Web/Config/apache2/sites/0000_127.0.0.1_34543_.conf

5) Modify the original /Library/Server/Web/Config/apache2/sites/0000_127.0.0.1_34543_.conf to include the JDS settings and certificate:

<VirtualHost 127.0.0.1:34543>
## Begin copy from JDS conf
    Include /Library/JDS/conf/apache_aliases.conf
    ServerName <hostname>
    <Directory /Library/Server/Web/Data/Sites/Default/jds/>
        SSLVerifyClient require
        Options None
        AllowOverride None
    </Directory>
    <Directory /Library/JDS/shares/>
        Options None
        AllowOverride None
    </Directory>
    RewriteEngine on
    RewriteRule ^/jds/api/([0-9a-z/]*)$ /jds/api.php?call=$1 [QSA,NC]
## End copy from JDS conf
 
    ServerAdmin admin@example.com
    DocumentRoot "/Library/Server/Web/Data/Sites/Default"
    DirectoryIndex index.html index.php /xcode/ /wiki/ default.html
    CustomLog "/var/log/apache2/access_log" combinedvhost env=!forwarded
    CustomLog "/var/log/apache2/access_log" combinedvhostproxy env=forwarded
    ErrorLog "/var/log/apache2/error_log"
    <IfModule mod_ssl.c>
        SSLEngine Off
        SSLCipherSuite "ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM"
        SSLProtocol -ALL +TLSv1
        SSLProxyEngine On
#       SSLCertificateFile "/etc/certificates/<hostname>.<id>.cert.pem"
#       SSLCertificateKeyFile "/etc/certificates/<hostname>.<id>.key.pem"
#       SSLCertificateChainFile "/etc/certificates/<hostname>.<id>.chain.pem"
## Begin copy from JDS conf
        SSLCertificateFile /Library/JDS/certs/webserver.pem
        SSLCertificateKeyFile /Library/JDS/certs/webprivate.key
        SSLCertificateChainFile /Library/JDS/certs/jss_ca.pem
## End copy from JDS conf
        SSLProxyProtocol -ALL +TLSv1
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
    </IfModule>
    <Directory "/Library/Server/Web/Data/Sites/Default">
        Options All -Indexes -ExecCGI -Includes +MultiViews
        AllowOverride None
        <IfModule mod_dav.c>
            DAV Off
        </IfModule>
        <IfDefine !WEBSERVICE_ON>
            Require all denied
            ErrorDocument 403 /customerror/websitesoff403.html
        </IfDefine>
        RewriteEngine on
        RewriteCond %{HTTP:X-FORWARDED-FOR} !^$
        RewriteCond %{REQUEST_METHOD} !^(PROPFIND|OPTIONS)$
        RewriteCond %{REQUEST_FILENAME} -d
        RewriteRule ^(.*)([^/])$ %{HTTP:X-FORWARDED-PROTO}://%{SERVER_NAME}/$1$2/ [R=301,L,NC]
    </Directory>
</VirtualHost>

6) Restart the web service, either through Server.app or by opening Terminal and entering: sudo serveradmin start web

7) Open up Casper Admin and verify that you are able to upload files to the master JDS and replicate to a child JDS if your environment has one.

8) Verify that we are able to download a package from the JDS to a managed client either by running a policy or through Casper Remote.

If making these changes does not seem to fix the problem, please get in touch with your Technical Account Manager.

Thanks!
Amanda Wulff
JAMF Software Support.

[retroroscoe]

Hi Amanda,

do you comment out the host certs?

[were_wulff]

Hey all,

We now have a KB up on JAMF Nation that will walk you through the steps to get a JDS working with Server 5.0.

Troubleshooting JAMF Distribution Server (JDS) Issues on Computers with OS X Server v5.0 Installed

If you're still running into problems with the JDS and Server 5.0, please check out the above KB; if there are still issues after going through those steps, please get in touch with your Technical Account Manager by giving them a call, sending an e-mail to support@jamfsoftware.com, or by using the My Support section of JAMF Nation.

Thanks!
Amanda Wulff
JAMF Software Support