1

All I'm really trying to do is set up my wife's laptop to use my Mac Pro as a network Time Machine server. We both recently upgraded to Mavericks and I just installed Server.app.

Problem is all connection attempts from her account fail, and I can't work out why (after lots of time and effort diagnosing the problem).

One ars forum post describes a similar problem, and one of the suggestions is that the connection is being blocked by a SACL. This theory is validated by the fact that I can connect with my own (admin) account.

More searching, and it seems that the suggestion is to edit the SACL using the Server Admin app. I guess this has now been rolled into Server.app?

Can someone please enlighten me, where are Service ACLs configured?

|improve this question
2

You can enable individual access to services for users and groups inside of Server.app 3.0. Select the Users or Groups section from the sidebar, and then click on the user or group that you'd like to configure access for. Click on the action (gear) icon below the list of users or groups, and choose "Edit Access to Services...":

Choose "Edit Access to Services"

You'll be presented with a list of services that allow access to be enabled and disabled for this user/group. If the list is disabled, you may need to choose to "Manage Service Access":

Service Access window

The software may prompt you to confirm your choice to enable management of Service Access:

Manage Access prompt

Some information on how to configure these checkboxes using dseditgroup is available. It should also be noted that users from external directories are denied access to services by default.

If you're just trying to confirm that the user is inside of the group that's allowed to access the AFP service, you can perform this command:

dscl localhost read /Local/Default/Groups/com.apple.access_afp GroupMembership

If the command reports that the record is not found (-14136), you probably don't have an ACL applied to the AFP service.

|improve this answer
  • Great answer, thanks. I had found this screen, and confirmed that both file sharing and time machine services were enabled for the user. However I am unable to confirm membership with the dscl command, as it returns read: Invalid Path <dscl_cmd> DS Error: -14009 (eDSUnknownNodeName). Any thoughts? – Alastair Oct 29 '13 at 15:10
  • @Alastair I've corrected the dscl command that was provided in the answer. – Eddie Kelley Oct 29 '13 at 15:20
  • Thanks so much - didn't help me fix my problem but it did rule out at least one possibility. – Alastair Oct 29 '13 at 15:43
  • By the way, would you advise anything else to check as to why this other account cannot connect to perform a time machine backup? (checked password many times, now SACL) – Alastair Oct 29 '13 at 15:45
  • @Alastair Can you provide a screenshot of what the permissions look like inside of System Preferences -> Sharing -> File Sharing? Alternately, performing the Terminal command ls -ale /Path/To/Folder may also provide some helpful info. – Eddie Kelley Oct 29 '13 at 16:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .