Slashdot Mirror

It uses the smb url syntax that the Gnome nautilus and KDE file browers use. See here for details:

https://www.samba.org/samba/do...

Although the smb:// bare syntax for browsing won't work as NetBIOS is (or should be) dead, dead, dead :-).

Why not? The first thing every Linux installation does is enable interoperability with Windows networking. Wanacry very quickly spreads to SMB shares. If they are writable then a remote client can happily encrypt your shit. Or if you want, https://www.samba.org/samba/se... gives you your own Linux special flavour of Wanacry.

Now yes the GP is a troll, and it most likely wasn't the case. But security is about dealing with the possible, and just running Linux doesn't make you immune from anything, especially not user stupidity.

I've actually stopped setting up Windows networking by default on my Linux systems, especially my servers. It's easier to install FileZilla or WinSCP on Windows.

Why not? The first thing every Linux installation does is enable interoperability with Windows networking. Wanacry very quickly spreads to SMB shares. If they are writable then a remote client can happily encrypt your shit. Or if you want, https://www.samba.org/samba/se... gives you your own Linux special flavour of Wanacry.

Now yes the GP is a troll, and it most likely wasn't the case. But security is about dealing with the possible, and just running Linux doesn't make you immune from anything, especially not user stupidity.

> Did you ever tried to convince "Windows IT people" to use Linux instead? Thought so.

Thank you of reminding me of the experience. Teaching the Windows admins how to spell DNS was its own right of passage. Active Directory screwed up DNS backup files, anyone? They look like zone files, but don't actually work for anything because they don't start out by stating the zone being backed up, in violation of RFC 5936? And they allow multiple CNAME entries for the same domain name? And do not get me *going* on the use of mixed case.

Mind you, Linux tools have their own issue. Ever tried to set up a DNS slave to take the load and provide failover for a Samba DNS server? It *still* does not support zone transfers for DNS slaves!!!!! See https://bugzilla.samba.org/sho...

...and they already appear to have a fix

FWIW, it looks like running lsof -i will tell unix users what ports are open. If port 445 is open, you might want to kill smbd while you sort things out. Purportedly adding "nt pipe support = no" to your smb.conf file and restarting smbd might allow some samba capability while still stopping the threat. See
https://www.samba.org/samba/se...

Note: If this advice turns your system into a quivering ball of protoplasm, Don't blame me. I'm only the messenger.

For these critical info, a quick search on Google news got me this.

Extract:

All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. A patch addressing this defect has been posted to http://www.samba.org/samba/security/ Additionally, Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as security releases to correct the defect. Patches against older Samba versions are available at http://samba.org/samba/patches.... Samba vendors and administrators running affected versions are advised to upgrade or apply the patch as soon as possible.

For these critical info, a quick search on Google news got me this.

Extract:

All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. A patch addressing this defect has been posted to http://www.samba.org/samba/security/ Additionally, Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as security releases to correct the defect. Patches against older Samba versions are available at http://samba.org/samba/patches.... Samba vendors and administrators running affected versions are advised to upgrade or apply the patch as soon as possible.

https://gcn.com/articles/2017/...

https://www.samba.org/samba/se...

Fire up a linux distro, run MonoDevelop or your favourite Mono IDE, run your (.NET) code, host your website on Apache, access your MySQL database from your Java code. Run Solitare, run an Active Directory server, run office. Oh and do it all for free!

Seriously? First Microsoft criticise open-source and linux, then they're trying to win the market back. I don't think it's a bad thing that they're doing this but you'd only develop on windows if you had to. Otherwise, why not develop natively.

While so many seem to see another chance to put the boot into Microsoft, others of us, who work in interoperability every day, are really quite excited by this tool. I was pleasantly surprised when Garming Sam, my colleague at Catalyst and fellow member of the Samba Team, wrote this article on how to run Samba under bash on Windows:

https://www.samba.org/~garming...

The fact that Microsoft is implementing the POSIX API, and even more, the Linux ABI, seriously is really cool, and shows that something seems to have changed in Redmond. I could never have imagined this when I started in Samba 15 years ago!

Specifically, Samba 4.2 with Snapper. It's probably still a scheduled snapshot, but it looks to be better then how we did things in 4.0 and 4.1.

automatically encrypt your data locally and upload it to multiple locations. These locations can be public locations as only your private key can decrypt the incremental (or full) backups.

Some backends:

• azure backend (Azure Blob Storage Service) Microsoft Azure SDK for Python - https://github.com/Azure/azure...
• boto backend (S3 Amazon Web Services, Google Cloud Storage) boto version 2.0+ - http://github.com/boto/boto
• cfpyrax backend (Rackspace Cloud) and hubic backend (hubic.com) Rackspace CloudFiles Pyrax API - http://docs.rackspace.com/sdks...
• dpbx backend (Dropbox) Dropbox Python SDK - https://www.dropbox.com/develo...
• copy backend (Copy.com) python-urllib3 - https://github.com/shazow/urll...
• gdocs backend (Google Docs) Google Data APIs Python Client Library - http://code.google.com/p/gdata...
• gio backend (Gnome VFS API) PyGObject - http://live.gnome.org/PyGObjec...
• D-Bus (dbus)- http://www.freedesktop.org/wik...
• lftp backend (needed for ftp, ftps, fish [over ssh] - also supports sftp, webdav[s]) LFTP Client - http://lftp.yar.ru/
• mega backend (mega.co.nz) Python library for mega API - https://github.com/ckornacker/..., ubuntu ppa - ppa:ckornacker/backup
• OneDrive backend (Microsoft OneDrive) python-requests - http://python-requests.org/ python-requests-oauthlib - https://github.com/requests/re...
• ncftp backend (ftp, select via ncftp+ftp://)
• NcFTP - http://www.ncftp.com/
• Par2 Wrapper Backend par2cmdline - http://parchive.sourceforge.ne...
• rsync backend rsync client binary - http://rsync.samba.org/

There are plenty of apps that use QT--probably the most mainstream one is Google Earth.

Now, look at me with a straight face and say, "And Google Earth has a great UI!"

To me, this is the problem with cross-platform UI. It starts from a mistaken premise: Windows and Mac or iOS and Android have the same basic UI. There's even a grain of truth to it. But it doesn't really work.

The example I love to use is French and English. They are, basically, the same language, right? They both have words, sentences, and paragraphs. They both have nouns, verbs, and adjectives. So if you just translate the words and move around the adjectives, you've got a French/English translator! It's that simple!

No, not really. If it's 100 degrees outside and you've just come from the outside and remark to a pretty girl "Je suis chaud" (literally, I am hot), she might very well slap your face. Because you've just said that you are hot as in, "Oh, baby, you make me so hot."

And those are the silly mistakes that cross-platform UIs make.

Take a simple one from Mac versus Windows: On the Mac, in a dialog box, the default button is always the right-most button. So you have a dialog box that says, "Are you sure you want to do this?" and the right-most button would say, "OK" and the button to the left of it would say, "Cancel." On Windows, the default "OK" button would be on the left with the "Cancel" button the right of it.

Alignment, again, is a question. I'm not sure there's a standard on Windows--I've seen things centered and I've seen them aligned right. On Mac OS X, there's a standard. Which means when Windows aligns them on the right like on the Mac, I'm always pressing the Cancel button.

So, yeah, you can use QT to have a cross platform application and it will work fine. And it's great, if you have an application like Google Earth, which has lots of great GIS capabilities so that the result is worth the pain. But, frankly, if Microsoft did an equivalent to Google Earth but made a Mac application that was "correct," I'd use it in a heartbeat. Because, all else being equal, I'd rather have an application that "speaks my language" to one that only sort of does.

Have you ever spoken to a tech support person from another country with a thick accent? That's the equivalent of using Google Earth on a Mac.

But Novell didn't do the necessary integration, and the rest is history.

The back story on what went on when Novell bought Unix is quite interesting. And was probably what prompted the anti trust suit. Story was that there were a few calls made when Novell proposed this idea. If Novell expected to ever work with a Windows platform again, the Unix plan would have to be dropped. Unix would have to be sold (to a Microsoft front company) and Noorda would have to go.

In the final analysis, the suit was probably dropped because there was no intellectual property for Microsoft to share. SMB services had so many different variants between Windows versions that Microsoft couldn't offer a heterogeneous environment. Their only solution was to insist that customers standardize on one Windows version. At one point it was rumored that the Samba developers had a better handle on SMB variants. And could provide more stable services in a mixed Windows world.

Rsync your CherryTree file, or sync with whatever cloud storage solution you use, Google Drive, Microsoft NSAAS, whatever.

It's a bit limited for complex things, but it worked for some students I know tracking the majority of their note-keeping needs. Stopped using 3rd party solutions since I eat my own dogfood, and now have notes integrated into my distributed versioned whiteboard / issue tracker / build & deploy & test product. I have issue/note/image annotation plugins for coding with Netbeans, Eclipse, Visual Studio, Emacs and Vim -- Which reminds me of a Vim plugin I just saw that you might find useful... if you can run a (home) server (and port forward around NAT), then install Wordpress on a LAMP stack (in a VM, because PHP exploits) -- I'm pretty sure Emacs has all that built in by default now: C-x M-c M-microblog.

I jest, it's just Org mode. Save your .org to your Git repo, and away you go.

There's really no way around it. Storage media is not permanent. You can store your important stuff on RAID but keep the array backed-up often. RAID is there to keep a disk*N failure from borking your production storage and that's it. If you can afford cloud storage, encrypt your array contents (encfs is good) and mirror the contents with rsnapshot or rsync to amazon, dropbox, a friends raid array, whatever. SATA drives are cheap enough to keep a couple sitting around to just plug in and mirror to every weekend but you'll probably find a friend's cable modem and rsync+ssh a very handy alternative (hint: check out --bwlimit option) when run from cron.

Microsoft even helped perform interoperability testing for Samba4:

https://www.samba.org/samba/news/releases/4.0.0.html

It does in many way sounds like it could be exploited as a tax dodge too. And the thing is, these would be companies free/open source people wouldn't have ever heard of, because they would be fake.

That seems like a conclusion jumped to with not a single example.

Check out the first line on this page: http://www.libreoffice.org/about-us/
Or this IRS letter proudly displayed on the Apache Foundation. http://www.apache.org/foundation/records/ASF-501c3.pdf
Or the statements on the Samba website: http://www.samba.org/samba/donations.html

These are hardly companies you have never heard of.
But each of them have probably taken a lot of money out of the pocket of other big players in the industry.
Players that have influence. Players that hold grudges. Players that can write letters and offer campaign donations.

This isn't about catching fake companies, its a political payback for large corporations.

The thing about a non-profit is that it really doesn't reduce tax revenue much at all. The money has to go somewhere, to the employees as salary or perks that have to be reported on their tax forms. It all gets taxed in the end.

Here's a question:
To know which bits have changed, doesn't it need to compare the two files. How does this result in bandwidth savings?

No, because it only sends a hash of the data. The other side computes a hash of it's data, and if the hashes match, the transfer is complete. If The hashes don't match, there is a rolling hash that can verify a partial match, and send only the changed data. There's more info here

They're not going to do that. The director of Windows server development at Microsoft even gave us a quote for the Samba 4 press release.

https://www.samba.org/samba/news/releases/4.0.0.html

For the tl;dr crowd:

"Active Directory is a mainstay of enterprise IT environments, and Microsoft is committed to support for interoperability across platforms," said Thomas Pfenning, director of development, Windows Server. "We are pleased that the documentation and interoperability labs that Microsoft has provided have been key in the development of the Samba 4.0 Active Directory functionality."

Thanks a *lot* Thomas !

See https://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html#NTLMAUTH

If you set ntlm auth = no, then Samba will reject plain NTLM and require either NTLM v2 (the normal case) or LANMAN (if you have bizzarely backdated your XP box). There is a risk that some software w2ill fail, so it's probably best if you create a pair of virtual servers, and set one up to use NTLMv2. As you find out what fails, you can move the unbroken services to the v2 server.

--dave

Dear Microsoft VP and deputy general counsel Dave Heiner,

Please explain to me why the Samba project exists.

Thanks,
Everyone.

It really bothers me that everyone here is propping up all these new proprietary system for something like a backup solution whenever there are so many open alternatives.

Almost anything is better than buying some black box solution that will sure to be outdated and out of the users control in a year.

Now, I have one last suggestion. On a Windows machine, an AD is setup with a simplistic wizard, where standard AD questions get asked. It seems that such a wizard might be a good idea - even if at the end the wizard advised where to make additional changes. (This might give you a leg up in selling to Windows ops)

I suggest you read our HOWTO when the server recovers, because you will see that our samba-tool domain provision command does exactly that, and the HOWTO covers things from top to bottom. Samba Administrators have been deploying Samba as an AD DC for a number of years now, and they consistently point to these two things as why they find it so easy to do so.

Andrew Bartlett
Samba Team

Of course what you failed to mention is that Microsoft only did this because the European Commission forced them to:

I answered GP's question with a simple quote from TFA. I didn't think it was necessary to go into the history of how/why Microsoft became involved.

We use Hyper-V at our work, and sometimes VMs won't start if by chance there is an issue with the DC, that's why we have multiple AD servers. Plus I doubt Samba would integrate with System Center. There is a whole list of unsupported features and known issues - https://wiki.samba.org/index.php/Samba_4.0_Whitepaper

Of course what you failed to mention is that Microsoft only did this because the European Commission forced them to:

December 20th 2007. Today the Protocol Freedom Information Foundation (PFIF), a non-profit organization created by the Software Freedom Law Center, signed an agreement with Microsoft to receive the protocol documentation needed to fully interoperate with the Microsoft Windows workgroup server products and to make them available to Free Software projects such as Samba. Microsoft was required to make this information available to competitors as part of the European Commission March 24th 2004 Decision in the antitrust lawsuit, after losing their appeal against that decision on September 17th 2007.

Granted the guide he linked to refers to an ALPHA release but as of October 30. release candidate 4 is out and an updated howto (SambaWiki so this is updated continuously) is available at http://wiki.samba.org/index.php/Samba4/HOWTO
Yes samba has its own dns server but it can easily (according to the howto) be integrated whit recent bind releases so yoy don't have to abandon your current dns infrastructure

"This is the first release candidate of Samba 4.0.0! This is *not* intended for production environments and is designed for testing purposes only.".

http://lists.samba.org/archive/samba-announce/2012/000277.html

The basic samba code has indeed been around for decades, and it's great.

Do be aware that samba4 release candidate 4 only got released on 30th October 2012 and as the announcement says "This is the first release candidate of Samba 4.0.0! This is *not* intended for production environments and is designed for testing purposes only.".

http://lists.samba.org/archive/samba-announce/2012/000277.html

When you talk about alternatives to Active Directory you need to be specific as to what features of Active Directory you refer to. Active Directory is a lot of things: Distributed multi-master database, Authentication provider, Authorization provider, Configuration management system, and more. The Active Directory infrastructure provides: File services, Print services, Group policy, LDAP, DNS, DHCP, and other services.

I haven't read in detail about Samba 4, and it appears that the Samba Wiki is down at the moment, but there is a decent description on the Fedora Project site. According to the Fedora site, Samba 4 includes the ability to be a domain controller and implements the Kerberos stack, but it is not clear that it provides the centralized configuration management that Active Directory does. This centralized management (Group Policy) and the ability to delegate administration (Organizational Unit based delegation) are very powerful features of Active Directory and what keep large organizations on the platform.

If what all you are looking for is a shared account database and the ability for multiple workstations to authenticate against it, Samba 4 may be just the ticket. If however you are looking for a replacement for Active Directory at an enterprise level, I doubt it is there yet.

This is a fairly clear case where Samba would be of use for LAN access. It's quite simple to set up and runs very reliably on top of your favorite distro.

For remote sharing, SFTP would be the way to go. SSHFS is a clever trick for very user-friendly remote access.

The reason for SAMBA was simply that Windows (Windows 3.1 for Workgroups) came with SMB file sharing.

SAMBA helped integrate these workstations with larger networks and servers.

Actually, SMB was created by DEC for their Pathworks software suite to connect VAXen to other computers.

Windows' involvment came later, partly because Microsoft hired a lot of VAX people over to do NT and a lot of Windows' heritage tends to reflect that.

http://www.samba.org/samba/docs/using_samba/ch01.html

Or maybe it had more to do with MS actually inviting the core Samba team to Redmond so they could work on better integration points to AD; they did this around the time Win2k8 was released. They have done this numerous times.

Microsoft Contributes Code to Samba
Samba Team Visits Microsoft For SMB2.2 Interop Event

I would recommend checking out Sogo. This would provide a good groupware solution. In their upcoming version, 2.0, it will have some goodies like Exchange Server emulation so it will integrate well with those using Outlook. For collaboration, you can check out Alfresco. As for a common identity management solution therein lies the trick. If you are brave, you can check out using Samba4 and configure all of your clients to authenticate against their version of Active Directory. The Samba wiki has some good instructions on that. I know that there is an open source software package that helps integrate Linux with Active Directory but I cannot remember its name. It does get packaged with Ubuntu, however. Hope this helps some .....

might want to have a look at http://www.samba.org/samba/PFIF/PFIF_history.html

there was nothing generous about microsoft's involvement in samba. if anything it serves as an example of how microsoft doesn't work with the foss community

so no, microsoft doesn't deserve any credit for being forced under EC monopoly provisions and then being paid $10k merely for access to the protocol documentation

The path they took to force Australia to adopt DMCA-alike laws, for instance? Who cares about democratically elected representatives' opinions when DFAT bureaucrats can be hoodwinked into deciding what new laws to create (in effect).

smbfs has not been maintained in the last few years. Instead, development has been focused on another implementation of the CIFS protocol in the kernel.

http://www.samba.org/samba/smbfs/

http://www.samba.org/samba/news/articles/low_point/column11.html

The Low Point â" a View from the Valley â" Column 11
The Land of "Nothing for free"

On the map, Laguna Niguel looks like a beautiful Pacific coastal area south of Los Angeles, a little like one of my favorite spots Monterey, south of San Francisco. But I forgot; this is Los Angeles, where the brown haze of the air lies like a thick blanket over the insane sprawl of "Generica". It's an endless landscape of McDonalds, strip-malls and gas stations familiar to anyone who has seen the movie "Ghost World". Nothing is free here. You pay for parking (nothing but valet available), driving on toll roads, access to much of the beach (private). If they could figure out how to charge for the air I'm sure there'd be meters every block or so. It's a fitting home for the entertainment industry.

I was down there to give a talk on "Open Source Business Models" for a conference. Also represented were entertainment industry lawyers, "Big Telecom" management, and a smattering of software people. Microsoft was there of course. You can't hold a church fete with "Open Source" on the banner these days without Microsoft turning up and requesting representation. At least we also had Bruce Perens on our side to help make up the balance. The venue was an unbelievably expensive hotel. Even though I was on expenses I balked at asking the company to pay for a room there and found something cheaper (not by much) a few miles down the road.

Along with the collection of apologists for the "ultimate evils" (tm) of Hollywood and Telephone companies there were some very interesting presentations. A Japanese telecoms researcher made all the software people jealous by describing the idyllic state of broadband in Japan, where providers vie to sell gigabit fiber-optic pipes to the home. Yes, you read that right, Gigabit. The obvious question was asked; "what do people use all that bandwidth for" and the less than obvious answer was that they use it for all the same things people in less bandwidth-friendly countries do, they just do more of it. I could see a collective shudder pass through the entertainment industry people. They knew what that meant.

A keynote by Lawrence Lessig made the point even further. He showed a series of "mash-ups" of copyrighted material which were incredibly creative and funny. All completely illegal and currently being hunted off the Internet by entertainment industry lawyers. One of the most amusing asides was from a Walt Disney legal reply to a parent requesting "fair use" rights to use some clips from a Disney movie to put in his home video. He pleadingly promised them it was meant only for family viewing. "We currently deny all requests to use our material....". Even if you are impudent enough to ask, the answer is always no. At least one of the other studios replied that the current commercial rate was $700 to use a 30 second clip. I can see that being popular amongst parents making home movies. He also covered the current patent quagmire. A very interesting fact from his talk was that the total unit cost for a Chinese manufacturer to build a DVD player was around $26. However the total royalty fees they have to pay to western companies for the patent rights to build a player is $21 per unit, thus completely eliminating any profit they might make. No wonder the Chinese are currently creating their own digital video standard, completely incompatible with Western ones. It's the only thing that makes economic sense for them. This is almost certainly behind the Chinese refusal to use the new WiFi standards for wireless devices also.

I ended up making myself unpopular by publicly attacking the Washington-based economist who'd advised the Clinton Administration on "Intellectual Property" issues. It's a very personal issue for me as it affects my everyday life and work, so when he made the statement that "strengthening the patent system leads to

The law forced Microsoft to provide them with the Windows Networking documentation: http://www.samba.org/samba/PFIF/

How this could or would apply to Skype . . . ?

TL;DR: commandline-only interface on the server is fine, since you won't be administering the server locally in most cases.
To implement: "sudo apt-get install webmin sshd knockd", then read the documentation and edit/create your configuration files.

Webmin is a useful tool for "avoiding the command line"; it gives you a browser-based interface to many common server systems and tools.

Between webmin and SAMBA, you can avoid the CLI for many common tasks, if that truly is your goal.

On the other hand, if you're serious about administering your server, you'll just bite the bullet and learn the handful of commands you'll need on the CLI to do the things you need to do, and read the man pages for ssh ("Secure SHell", a remotely accessible command-line interface using cryptographic security measures).

Implement port-knocking (Google "knockd"), use a non-standard SSH port, and implement certificate-based security to simplify your security concerns and keep the bots from being able to crack your sshd.

None of my servers have anything attached except power and network, unless/until there is a reason to interact directly with them - remote administration is the way to go.

Creepy wrote:

"GPL3 is a (commercial) plague - anything that uses any GPL3 library MUST comply by GPL3 and any license that is not GPL3 becomes GPL3, so Apple had to abandon SAMBA - if they integrate a SAMBA interfacing gui into their OS (which they did under GPL2), they immediately are required to release the entire OS under the GPL."

Can I have some of your 'shrooms please, they must be *really* good :-).

This is so far from the truth it's easier just to point at this:

ftp://www.samba.org/pub/samba/slides/linuxcollab-why-samba-went-gplv3.pdf

and hope people read it than to try and rebut your ravings.

Jeremy.

Programming tools are one of the areas that hasn't gone to the cloud.

distcc and (sun) grid engine don't count? Both of them can be used for distributed compilation, etc.

Did no one read the final paragraph in the article? While GPLv3 may well have been part of the decision, it appears compatibility with Windows 7 has been somewhat problematic for Samba. A quick Google search shows this page, indicating that the current solution involves hacking the registry. Not exactly seamless, and I can see Apple wanting to switch for that reason alone.

assuming Samba is owned by one entity

It isn't, they don't require copyright assignment to the project. If they want to distribute under a different license they need to contact each contributor and if any refuses they have to rewrite his/her code.

http://www.samba.org/samba/devel/copyright-policy.html

From the advisory:

A patch addressing this defect has been posted to

    http://www.samba.org/samba/security/

Additionally, Samba 3.5.7 has been issued as security release to correct the defect. Patches against older Samba versions are available at http://samba.org/samb/patches/. Samba administrators running affected versions are advised to upgrade to 3.5.7 or apply the patch as soon as possible.

I believe this patch works with OSX as well. Not surprising, because OSX is POSIX-compliant. Even if it didn't, Samba is open source, so it's probably not too hard to find out where the source was fixed, apply it yourself, and recompile.

Except that you have to run Windows to run Exchange and everything will "just happen" to work better with other MS products. There's plenty of alternatives so don't chain yourself to MS. I'll bet you can get Zimbra up and running at least as quickly as Exchange Server. After which, your boss can focus more time on actually conducting business and less time trying to fight with Windows and Exchange. See how that works.

http://wiki.samba.org/index.php/Exchange_Server_Alternatives

Why use Win2K8 for a domain/active directory when you can use Samba4 instead?

http://wiki.samba.org/index.php/Samba4

Advantages:

  * Fully scriptable
  * Easy to back up and duplicate to backup server
  * Backups are easy to restore
  * Better, more complete logging
  * Easy to administer remotely
  * Easy to make self-healing with nagios
  * No server license + client access license (no nickel-and-diming) and no worrying about whether to choose per-user or per-device
  * disaster recovery is easy to be made 100% successful and repeatable in your staging environment - using BSD userland tools, not having to spend thousands to tens of thousands on buggy proprietary solutions
  * It requires a sysadmin with a clue, which greatly increases your chances of continual uptime and avoiding the need for disaster recovery in the first place
  * Easy to cluster without having to pay for an expensive "enterprise edition" of Windows
  * Inexpensive to replicate to your staging environment - legally avoiding have to pay for additional server license for the one-time-use software

Disadvantages:

  * You need to not be a mouth-breather to configure it (your average drooling paper-MCSE with no experience need not apply)
  * The documentation sucks

Replacing windows with Linux using centralised authentication isn't that easy. We tried it recently where I work where we run both Linux and WIndows 7. This meant it had to be AD.

Using ldap for web services was easy enough as was getting win 7 desktops joined up. The hard part was getting Ubuntu machines on the domain...

The first thing I tried was likewise-open which I had a number of problems with. We eventually settled on winbind which worked incredibly well for a samba file server joined to the domain, but for desktops it wasn't ideal. If the domain controller became inaccessible for whatever reason, the whole machine would freeze up even with cached credentials turned on. The other caveat was user's inability to change their domain passwords from Linux. Well.. it was possible but whenever they changed their password, both the new and old passwords would still work. (see http://wiki.samba.org/index.php/Samba_&_Active_Directory#password_changes) It was also impossible to force a user to change their password, it would fail constantly.

If I weren't so determined I would have likely just gone with Windows 7 for ease of use despite the extra cost. There is one more commercial product I need to try and that's centrify. Fingers crossed.