Linux Workstations in a Windows Domain?

gsperling asks: "As Windows licensing costs are gradually increasing, and options for those licenses are decreasing, I am forced to investigate Windows alternatives. I am trying to begin rolling out Linux as an alternative desktop solution to my enterprise. I am an IT Manager for a company of approximately 65 users. We are incorporating a second company into ours in the next six months, and that 65 number will grow to well over 150. This is a solution that I need to start working on TODAY. We currently have a Windows 2000 Server. It is primarily used as a file and printer sharing server, along with maintaining all of the user accounts domain-wide. I would like to know how it is possible to get a Linux Workstation to authenticate against the user database in our Windows 2000 Server. I have exhaustively Google'd, read thousands of mailing list archives, and have still come up short. After I receive my results, I plan on publishing a whitepaper on how this is done, of course giving credit where credit is due." For those of you using Linux in the Enterprise, how have you managed to get Windows to play nice with any Linux boxen in your domain?

Comments

Not too hard ...

[dougmc]

I would like to know how it is possible to get a Linux Workstation to authenticate against the user database in our Windows 2000 Server.

When you say `user database', are you referring to the Windows domain, or something like LDAP? I suspect it's the former ...

The Windows database doesn't contain all the information that a *nix system needs -- it doesn't know about shells or home directories, for example. (Well, it does know home directories, but they're different.) Even if there was a PAM module that would talk to it, I'm not sure where it would get this information from.

In your case, most people will set up a seperate server for the *nix network, using NIS to share password information. Using PAM you can even set up the *nix box to change the password on the Windows network when it's changed locally.

Alas, it's easier to set up a Linux box as a domain server for a bunch of Windows boxes than it is to make the Windows box act as a NIS server for a Linux network ...

Waitaminute. That's it -- you just need a NIS server for the Windows box. Looks like our old friends Microsoft sells something that may do what you need. (Disclaimer: I've never used it, and probably never will.)

I suspect it (the software) will cost more than a dedicated Linux box NIS server (the hardware), but it may be easier to maintain and sell to management. Personally, I'd prefer the Linux NIS server, but then again, I'm not a Microsoft guy.

part of samba can do this for you,

[Alex]

http://www.samba.org/samba/docs/man/winbindd.8.htm l

Alex

Google Is Your Friend

[Anonymous Coward]

Detailed instructions at the following: http://www.securityfocus.com/infocus/1563

pam_smb

[hab136]

pam_smb is a PAM module/server which allows authentication of UNIX users using an NT server.

pam_smb:
pamsmb.sourceforge.net

pam_smb FAQ:
http://pamsmb.sourceforge.net/faq/pam_smb_faq.html

Features (v1 and v2):

• Authenticates Linux users against SMB servers in user mode(95, NT, samba etc). Will not authenticate against share level systems.
• Supported OSes: Linux (any PAM supporting distro), Solaris 2.6 or greater.
• Supports NT/Lanman encrypted passwords.
• Any service which uses PAM can authenticate against NT.
• Can setup to ignore lack of a local password entry when something else provides the users information such as RADIUS.

Features (v2 only)

• HP/UX 11 and FreeBSD 4.8 or 5.1 support.
• Caching support.
• Username mapping of Unix usernames to NT usernames.

Samba - Winbind

[jtosburn]

When it comes to interoperability between Windows and *nix, the answer is usually Samba. For you, you need Winbind, which will authenticate against a Windows Domain's PDC, and can be hooked into PAM.

Browsing the docs is a very good idea. And, you can read The Official Samba-3 HOWTO and Reference Guide online. In particular, see Chapter 21. Winbind: Use of Domain Accounts.

Good luck.

Re:[OT] boxen

[Just Some Guy]

From Jargon File (4.3.0, 30 APR 2001) [jargon]:

boxen /bok'sn/ pl.n. [very common; by analogy with {VAXen}] Fanciful plural of {box} often encountered in the phrase `Unix boxen', used to describe commodity {{Unix}} hardware. The connotation is that any two Unix boxen are interchangeable.

Choose to use it or not, but it's an accepted jargon term and has been for a long time.