According to http://docs.zope.org/zope2/releases/2.13/INSTALL.html

1. Download and install Python 2.7 (or 2.6) from http://python.org
2. install setuptools from http://pypi.python.org/pypi/setuptools
3. easy_install-2.7 virtualenv
4. create virtualenv e.g. virtualenv --no-site-packages /usr/local/Zope-2.13
5. activate the virtualenv: cd /usr/local/Zope-2.13 and source bin/activate
6. easy_install additional bits if necessary, e.g. 4Suite-XML, Amara (==1.2.0.2), psycopg2, python-ldap (==2.3.13 on osx) with easy_install -Z 4suite-xml etc
7. install Zope2 (in the version you want): easy_install -Z -i http://download.zope.org/Zope2/index/2.13.8 Zope2
8. create your Zope instance with /usr/local/Zope-2.13/bin/mkzopeinstance (choose a directory outside of /usr/local/Zope-2.13 for the instance)

• Products.ZSQLMethods needs to be easy_installed
• PsycopgDA needs to be patched
• ExtFile needs to be patched

• empty-encoding patch for Safari still needs to be applied. The http.py to patch is found in /usr/local/Zope-2.12/lib/python2.6/site-packages/zope.publisher-3.8.0-py2.6.egg/zope/publisher/ (or so)
• mkzeoinstance doesn't create a working zeo.conf: ZODB3-3.9.4-py2.6-macosx-10.3-ppc.egg/zdaemon/zdrun.py needs to be replaced by zdaemon-2.0.4-py2.6.egg/zdaemon/zdrun.py (or so)

To log in any client from a subnet it is not longer necessary to use the IntranetUserFolder Product. It can be done with the normal User Folder:

• If ZOPE is accessed through a reverse proxy e.g. Apache the address of the proxy has to be set as trusted-proxy in the ZOPEs etc/zope.conf
• One user has to be created with an empty password and a domain restriction (e.g. “141.14.236.* 141.14.237.* 141.14.238.* 141.14.239.*”)
• The User Folder has to be switched to domain authentication mode through the URL “[…]/acl_users/setDomainAuthenticationMode?domain_auth_mode:boolean=True”

From AccessControl/userfolder.py:

    def setDomainAuthenticationMode(self, domain_auth_mode):
	"""Set the domain-based authentication mode. By default, this                                       
           mode is off due to the high overhead of the operation that                                       
           is incurred for all anonymous accesses. If you have the                                          
           'Manage Users' permission, you can call this method via                                          
           the web, passing a boolean value for domain_auth_mode to                                         
           turn this behavior on or off."""