Slashdot Mirror
Linux Workstations in a Windows Domain?
gsperling asks: "As Windows licensing costs are gradually increasing, and options for those licenses are decreasing, I am forced to investigate Windows alternatives. I am trying to begin rolling out Linux as an alternative desktop solution to my enterprise. I am an IT Manager for a company of approximately 65 users. We are incorporating a second company into ours in the next six months, and that 65 number will grow to well over 150. This is a solution that I need to start working on TODAY. We currently have a Windows 2000 Server. It is primarily used as a file and printer sharing server, along with maintaining all of the user accounts domain-wide. I would like to know how it is possible to get a Linux Workstation to authenticate against the user database in our Windows 2000 Server. I have exhaustively Google'd, read thousands of mailing list archives, and have still come up short. After I receive my results, I plan on publishing a whitepaper on how this is done, of course giving credit where credit is due." For those of you using Linux in the Enterprise, how have you managed to get Windows to play nice with any Linux boxen in your domain?
It's sad to say, but what you're looking for is actually a Microsoft product.
p
http://www.microsoft.com/windows/sfu/default.as
That will most likely take care of your problem. I highly reccomend you wait for others to reply to see if there is a free alternative, but that's the easy way out.
The GeekNights podcast is going strong. Listen!
The Windows database doesn't contain all the information that a *nix system needs -- it doesn't know about shells or home directories, for example. (Well, it does know home directories, but they're different.) Even if there was a PAM module that would talk to it, I'm not sure where it would get this information from.
In your case, most people will set up a seperate server for the *nix network, using NIS to share password information. Using PAM you can even set up the *nix box to change the password on the Windows network when it's changed locally.
Alas, it's easier to set up a Linux box as a domain server for a bunch of Windows boxes than it is to make the Windows box act as a NIS server for a Linux network ...
Waitaminute. That's it -- you just need a NIS server for the Windows box. Looks like our old friends Microsoft sells something that may do what you need. (Disclaimer: I've never used it, and probably never will.)
I suspect it (the software) will cost more than a dedicated Linux box NIS server (the hardware), but it may be easier to maintain and sell to management. Personally, I'd prefer the Linux NIS server, but then again, I'm not a Microsoft guy.
http://www.samba.org/samba/docs/man/winbindd.8.htm l
Alex
Detailed instructions at the following: http://www.securityfocus.com/infocus/1563
I currently use a mixture of rsync in a cron deamon and winbind from samba.org. The two allow syncing remote users accounts on workstations and authentication against the domain for the following services: ssh, ftp, telnet, pop3, kdm. Others can be added if they support pam. One that I have not gotten to work as of yet is cvs but I'm working on it.
Well, there is a somewhat hole in bringing various things together, there are however may such things on linux. NIS is one. LDAP another common one, often used together with kerberos. Its perfectly doable, as I have a small network here using ldap for storing user information and kerberos for authentication and single signo on of services. Works amazingly well.http://www.bayour.com/LDAPv3-HOWTO.html provides a rather extensive howto. It's for debian, using RedHat/Fedora I found the patching and building from source unneeded.
You can use mysql or ldap as a user information source and log people in against that without 'actual' account on each machine. If you really want to get exciting, you can do the same with Kerberos and Hesiod. You can also use NFS or (my preference) AFS to hold the user directories so they actually have home dirs. MIT has been doing it since the 80's with their Athena Project... I keep wondering why Windows has such an issue with single sign on.
Redhat 9 is configured to allow authentication agains a Windows Domain Controller right out the box. It uses Samba to do this and I expect it's not to hard to configure samba on other Linux distros to do the same. I would question why you want to keep Windows on the servers. Just use Linux with CUPS for printing, NFS for file share, NIS for user management.
----
pam_smb:
pamsmb.sourceforge.net
pam_smb FAQ:l
http://pamsmb.sourceforge.net/faq/pam_smb_faq.htm
Features (v1 and v2):
Features (v2 only)
Samba 3.0 can talk to an Active Directory PDC and using winbindd (for the NSS) along with pam_smb and kerberos (for authentication) and smbmount (for home directories) we can provide a full windows users on linux solution.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
When it comes to interoperability between Windows and *nix, the answer is usually Samba. For you, you need Winbind, which will authenticate against a Windows Domain's PDC, and can be hooked into PAM.
Browsing the docs is a very good idea. And, you can read The Official Samba-3 HOWTO and Reference Guide online. In particular, see Chapter 21. Winbind: Use of Domain Accounts.
Good luck.
This is just a question to the linux public, this maybe be just a little off topic but here we go anyway. I have karma to burn.
.net and nothing but microsoft on the workstations there is no good reason to try to force them to program on linux/apache. There is not a good reason to try to force them to use samba, and there is not a good reason for DNS to be run on Linux in that shop.
Why do so many linux guys ignore "best tool for the job" and just force linux into a solution? I mean it is clear that linux has very good uses, just as windows does. Yet I have watched time and time again someone force linux or solaris into a job that would have worked better as a windows machine.
Before you get on your high horse and scream that there is nothing that windows can do that linux can not do better just save it. Your wrong, dead wrong. In an all windows shop running
There are plenty of awesome reasons to use linux, but for petes sake your shooting yourself in the collective foot when you try to force linux in. You end up having management hear "integration" issues...The linux DNS is not talking to the ADS correctly....the Syslog server is not responding....that damn linux.....I could go on and on on this because someone forced linux into a shop that was all windows. Then did it poorly on top of that.
I guess what I am trying to say is that Linux is not always the answer. Sometimes, you have to pick the best tool for the job, and sometimes that is not linux. Pick your battles my friends, and put linux in where it will shine like a white knight if your looking to change minds. Don't just take on every job with the idea that your going to "make them use linux". Find that perfect high profile job that linux will shine at, not the problem child job that you know is going to have issues.
You want more linux in the shop? Start by putting it in the right place and follow up on it like you should. Don't just 1/2 ass force it.
Just my 2 bits...I may just be bitter cleaning up after 1/2 assed linux imps that have gone wrong this week.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
Choose to use it or not, but it's an accepted jargon term and has been for a long time.
Dewey, what part of this looks like authorities should be involved?
OP: This is just a thought, and I may be totally off base here but it sounds to me like you have several (many) years of supporting a Windows network and Windows desktop clients, and zero experience supporting Linux either at the server or desktop level (in a work environment.)
... and the money you could have spent on standardizing the shop will seem tiny in comparison.
If you are the only guy supporting 65 users in a professional shop and you are going to be expected to support 150 users by yourself, you are going to need to be 100% on your game - that means supporting what you know. Yes adding 85 seats of Windows (XPPro with Office 2003) is going to be expensive, plus CALs for you server - but the minute you need to hire a second guy for the IT department because you simply can't handle it the costs go up dramatically - $60,000 a year ($40,000 a year plus overhead for a new guy) for the next three years will buy a LOT of standardization in your shop.
What do I recommend? Standardize on one desktop OS, one Office suite, one exactly identical desktop computer (same make, model, configuration, hardware, everything!), one two or three identical servers that use identical parts to each other, and off the shelf hardware for routers, switches, etc - all the same brand. You can get half a dozen spare desktops for hot-swapping parts (or the entire machine) out when something craters, and because everything is the same your updates and maintenance can be done using images. With new hardware you can even get 3 year on-site maintenance agreements meaning you get an extra set of hands whenever something is broken - this is a little pricey though, but worth considering if uptime at the desktop level is not optional.
You can go the Franken-system approach, building each machine by hand using the best or cheapest parts available on a case by case basis, using whatever OS and office suite is cheapest or available but in approximately one year your system maintenance is going to be a freak show and you are going to need to hire a new guy to help out anyways
Glonoinha the MebiByte Slayer