![\"\"](\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/02\/osservericon.jpg\")
<\/i><\/p>\n<\/i><\/p>\n
[Update 01\/31\/18:<\/strong> macOS Server Will Lose Many Services this Spring: Here Are Alternatives<\/a>]<\/strong><\/p>\n [Update]<\/strong> Find the entire macOS Server series here<\/a>!<\/p>\n This is the second in a series of Rocket Yard articles in which we take you through the setup of macOS Server. macOS Server is an app that runs on macOS Sierra, providing services such as mail, web hosting, calendar hosting, and more to users in a workgroup. <\/i><\/p>\n In Part 1 of this series<\/a>, we discussed what macOS Server is, how a Mac mini<\/a> makes a very workable \u201cheadless<\/a> server\u201d, and how to purchase and install macOS Server. This week, we\u2019re going to set up our server for a small business called “Astounding Photos”.<\/p>\n Most companies want their servers to be accessible from outside of the confines of an office. This gives employees the ability to work securely with the network through a virtual private network (VPN) and send\/receive email, lets customers visit a website hosted on the server, and more.<\/p>\n As mentioned in Part 1 of this series, Apple provides an excellent set of built-in tutorials for macOS Server that are accessible from the Help menu of the server app. In the next few episodes, I\u2019ll be following the lessons outlined under \u201cSet up for small business\u201d in the tutorials. (Related:<\/strong> Get the best performance from your Mac mini server with MacSales.com<\/a>.)<\/p>\n Getting an Internet Identity<\/strong> 1) <\/strong>Get a static IP address<\/p>\n 2)<\/strong> Give your server a host name<\/p>\n 3)<\/strong> Get a domain name<\/p>\n 4)<\/strong> Set up DNS and reverse-DNS resolution<\/p>\n 5)<\/strong> Get a signed SSL certificate<\/p>\n 6)<\/strong> Get a company Apple ID<\/p>\n Getting a static IP address<\/strong> Home internet services use DHCP (Dynamic Host Configuration Protocol) to assign an IP address from a group owned by the ISP to your cable or DSL modem. Since the address can change each time the cable or DSL modem is rebooted, the IP address is not static.<\/p>\n A dynamic DNS service watches the IP address that is assigned to a home internet service and if it changes, it reroutes requests to the new IP address automatically.<\/p>\n One of the most well-known providers of dynamic DNS service is Dyn.com<\/a>. Their least expensive dynamic DNS service runs $40 per year, but that cost allows you to run up to 30 hosts \u2014 a bit of overkill if you\u2019re setting up one host name. There are also free dynamic DNS services like No-ip.com<\/a> that are perfect for just one host name, but they require verification once a month via email or have other quirks.<\/p>\n If you do have a static IP address but don\u2019t know what it is, you can visit whatsmyip.org<\/a> or look at the home screen for macOS Server and look at \u201cInternet\u201d. It will show that your server is available at a specific IP address. For security reasons, I\u2019ve blanked out part of the IP address for my server in the image below:<\/p>\n Give your server a host name<\/strong> The host name is required even if you aren\u2019t accessing the server over the internet in order for the server to be uniquely identified on your local network.<\/p>\n Make sure you\u2019re happy with the host name, as it can be difficult to change later on.<\/p>\n Get a domain name<\/strong> Domain names aren\u2019t purchased; you\u2019re actually leasing them from a domain registry for a period of time. It\u2019s drop-dead easy to register a domain name so the process won\u2019t be covered here. Some domain registrars you may want to consider are GoDaddy.com<\/a> and Dreamhost.com<\/a>. The annual cost of your domain name will depend a lot on the top-level domain used.<\/p>\n Whatever domain registrar you select, make sure that you familiarize yourself with their DNS tools as at one point you\u2019ll need to let them know the static IP at which your server resides.<\/p>\n Set up DNS and reverse-DNS resolution<\/strong> The domain registrar will almost always set up an SOA (Start of Authority) record for you, which is part of your DNS Zone file. This usually points to the DNS servers operated by the domain registrar. You can use the nslookup<\/strong> command in Terminal on your Mac to see the link between your domain name and the DNS host (see image below):<\/p>\n Note that the IP address listed here isn’t the static IP address of my server; since I’m doing an nslookup from my local network, it’s showing the local IP address of my router. To make sure that my domain name is properly pointed to the static IP address, I needed to perform the nslookup over a cellular connection on my iPhone using a free app called (oddly enough) nslookup<\/a>.<\/p>\n The next two records you\u2019ll need to set up are an \u201cA\u201d record linking your fully qualified domain name \u2014 in this example it will be astoundingphotos.com \u2014 to the static IP address and the reverse DNS entry. In Dreamhost\u2019s domain management tools, the A record is set up as follows (see image below, IP address obscured for security reasons):<\/p>\n Since I\u2019m thinking about hosting mail, calendars, contacts, messages, a web server, a VPN, and a Wiki on this server \u2014 all for access inside and outside of my local network \u2014 I also added A records for:<\/p>\n These are subdomains<\/i> of astoundingphotos.com. I may not need these subdomains, as each service uses specific TCP or UDP ports<\/a> to address the server, but I have set them up anyway…just in case.<\/p>\n Finally, let\u2019s add the reverse DNS entry. This can be done by adding a pointer record (AKA \u201cPTR\u201d) for your site. Apple demonstrates reverse DNS entries by showing that you\u2019d have entries that would not only link your domain name to a numeric IP address (i.e., astoundingphotos.com = 1.2.3.4) but also linking your numeric IP address to the domain name (1.2.3.4 = astoundingphotos.com).<\/p>\n Update from an earlier version of this post: the owner of the IP address — most likely your ISP — will need to set up the reverse DNS entry. Previously we had noted that it would be the domain registrar that would perform this task; that was incorrect.<\/p>\n Get a signed SSL certificate<\/strong> A Certificate Authority is a trusted third party that verifies the identity of an SSL certificate. They do this by making sure that you are who you say you are, and then charging you to digitally sign the cryptographic keys that are used to encrypt communications to and from your server.<\/p>\n Having the signed SSL certificate installed on your macOS Server means that any users accessing that server for email, web services, and so on can rest easy knowing that their data is encrypted en route.<\/p>\n There are a couple of ways you can get a signed SSL certificate. First, you can act as your own Certificate Authority and digitally sign your own keys as long as you have control over all of the machines that will access your website. That\u2019s unlikely, so we won\u2019t cover that eventuality.<\/p>\n The next way is to use a popular and trusted CA. Several of these are Comodo<\/a>, Geotrust<\/a>, and Digicert<\/a>. Most of these services provide a free 90-day trial if you\u2019re just setting things up to learn about servers and SSL, but you\u2019ll find that certificates can be a bit expensive.<\/p>\n If you\u2019re a business, you most likely want to get what\u2019s called an \u201cExtended Validation SSL\u201d certificate. When someone visits your website, they can tell just how secure the site is immediately \u2014 in both Safari and Chrome, the address shows a \u201clock\u201d icon and the site owner information appears in green in the address bar.<\/p>\n The time to get an SSL validated depends on just how much validation you wish to get. If you just want domain validation (i.e., your site or server is owned by XYZ), that can be done by sending domain ownership information via email in five minutes or so. The requirements for business and extended validation are more stringent, where business documents showing your company\u2019s location and ownership need to be sent to the CA.<\/p>\n You can also get a free domain validated SSL certificate from Let\u2019s Encrypt. This is a free, automated, and open CA that is run for the public\u2019s benefit by the Internet Security Research Group. Some major domain registries can provide you with a Let\u2019s Encrypt certificate through their domain management tools; that\u2019s how I grabbed a Let\u2019s Encrypt SSL certificate for this example.<\/p>\n What does your SSL certificate look like? In many cases, you\u2019ll received four sets of alphanumeric keys. One is called a CSR or Certificate Signing Request, the next is the Certificate itself, the third is the Private Key, and the final is an Intermediate Certificate (see image at right for an example).<\/p>\n You\u2019ll need to have these keys close by and be able to copy and paste them into the appropriate space in your macOS Server configuration. We\u2019ll cover how to install the certificate in a future article in this series.<\/p>\n Get a company Apple ID<\/strong>
\nThe first step in making our server available to customers and employees is to set up an identity that will be accessible from anywhere on the Internet. The tutorial points out the things that we must do to set up our identity:<\/p>\n
\nThere are two ways to get an unchanging IP address that\u2019s associated with your location. First, and probably the easiest, is to work with your internet service provider (ISP) to have a static IP address assigned to you. Note that for home internet service users, many ISPs do not allow static IP addresses; you may need to switch to a business account or use a dynamic DNS (Domain Name System) service.<\/p>\n![\"The](\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/02\/Image1.jpg\")
\nA host name is the name that your server has on the local network. When your server is accessed over the internet, it will need to have a fully-qualified domain name that includes the host name (say \u201cserver\u201d) and the complete domain name (astoundingphotos.com in this example).<\/p>\n
\nDomain names are the \u201cwritten addresses\u201d where a server resides (uniquename.tld, where tld is a \u201ctop-level domain\u201d such as .com, .org, .info, etc\u2026 DNS is used to translate a written address \u2014 astoundingphotos.com \u2014 into a numeric address (your static IP address) when someone tries to access your server.<\/p>\n
\nIt\u2019s now time to set up DNS and reverse-DNS resolution. As noted before, this is the link between the domain name you\u2019ve leased and the static IP address of your server.<\/p>\n![\"The](\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/02\/Image2.png\")
![\"Adding](\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/02\/Image3a.jpg\")
\n
\nOne of the most important things you can do when setting up your server is to ensure the security of your users and data. One of the best ways to do this is to get a signed SSL certificate from a Certificate Authority (CA).<\/p>\n![\"SSL](\"https:\/\/eshop.macsales.com\/blog\/wp-content\/uploads\/2017\/02\/Image4.jpg\")
\nThis is the final step in building your internet identity. The Apple ID is used to enable push notification for services, and a personal Apple ID isn\u2019t recommended. You can<\/em> use a personal Apple ID if you\u2019re an individual setting up a personal server; for businesses, it\u2019s highly recommended to get a company Apple ID since an individual might leave the business or delete their personal Apple ID.<\/p>\n