Slashdot Mirror
How Linux Beats Windows in ID Management Ease
Amy Kucharik writes "Fed up with Windows systems management? A Linux conversion may be your ticket away from the daily hassles of managing and licensing domain controllers and related software devices. In this tip, Paul Murphy discusses the evolution of LDAP and how using it, along with Linux, can make an administrator's job easier."
dn: uid=anonymous, ou=linux, o=slashdot.org
changetype: add
slashComment: First Post!
slashModLevel: +5 Funny
I think this article is really preaching to the choir. I bet 75% of slashdot users already thought so befor reading the article.
Voice your opinion!
duh ...
Gooo Linux!
Is that the pr0n-viewing Knoppix-based distribution?
I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
not sure if you're loose, but you definately lost.
That would be break
Duh. =)
Lost at C:>. Found at C.
Gimme a brake..
here you go
I remember reading a long time ago (before Panther was released) that Apple was going to transition Mac OS X from NetInfo to LDAP for management purposes. Does anyone know what progress has been made in this transition, especially with the release of Tiger?
So how's user management via LDAP on Linux different from using Window's Active Directory?
There's nothing concrete in the article.
I read the link. It sounded like a good introduction to an interesting article. Then it abruptly stopped. Where, if I may ask, is the actual article describing how one might use LDAP effectively for user management?
Now I know somebody is going to say ARE YOU TOO STUPID TO USE GOOGLE!! No, I'm not. I'm simply saying that the article could have been much better, had they simply put actual information in instead of simply writing an introduction to the history of LDAP. As it stands, the article is exceedingly pointless.
I wish that Windows NT included some easy interface to LDAP for large corporations to manage all of their workstations ... like a directory. It could be used for logins, privileges, login scripts, mapping drives, controlling group policy, and even integrate with the mail and calendaring system. It would be one big active directory. That would be nice.
Video for Online Dating Profiles
I don't really get much from this article. Just that LDAP is out there, and that there are online manuals to help you get started. I figured that much out already. I'm not seeing much of a comparison between LDAP and AD/etc here. Anyone got some in-depth experience to share?
perl -e 'foreach(values %SIG){$_="IGNORE";}while(){}'
I am pretty sure I am not the only Linux veteran irritated by the increase in its user-friendliness, and mourning the loss of the good olde Linux, accessible only to those who enjoy kernel debugging. This is why I have decided to launch a new GNU/Linux distribution which requires extensive knowledge of Linux and of the computer system's internals.
The distribution shall be available in the combination of a floppy and a CD-ROM image. Why not only a CD-ROM image? I thought it would be a little too easy, and know you think that too; the CD-ROM is only accessible if you can read it, and this is why I provide a floppy: it contains an assembler and a linker, all you need to write a CD-ROM file system driver (and a partition driver to install the files). Here, I'll give you a head start: ISO 9660 specification. Don't expect every task to be so simple, I won't be giving the answers each time.
The distribution is somewhat minimalistic, but can do pretty much everything one demands from a modern computer.
Obviously, all tasks are accomplished through the command line interface (no GUI is provided).
A Web browser isn't included (as if you expected one to be anyway), just telnet to port 80 of the Web sites to surf the Internet.
As for an email client, telnet to port 25 and learn how to use your email server.
For FTP capabilities, you may telnet to port 21 and use the standard commands.
As I have demonstrated, this is a very versatile and capable GNU/Linux distribution, meanwhile staying available only to real men who back up to FTP and not to tape (to ensure this, legacy support for tape drives is excluded).
Since potential users may have varying levels of experience, I am hence providing different versions of the distribution:
Your suggestions are welcome, and I hope you enjoy using my GNU/Linux distribution.
This is neither news nor is it anything that matters. The core of the problem isn't ID management, it never was. It's application support for linux, which is pretty much non-existant in most fields.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
What a lousy article to post. There is one comment in the article saying that Windows admins hate user identity management, then it goes about with a little blurb about the history of NIS, etc, and then it has a couple of links to LDAP stuff. WTF? What kind of article is this? Are they going to start posting FAQs now? What a useless article!
Come on, this can't be seriouse.
... was an embarassment because OpenLDAP is a pile of junk compared to the quality of flagship OSS products like the LAMP stack.
Thankfully, Redhat's new Directory Server (based off iPlanet's) should be much easier to use and deploy.
Go somewhere random
That's a very nice little starting point, but the article has no depth. A little meat, even a mention of connecting Windows 2k/XP desktops to an OpenLDAP system via SAMBA for authentication, rather than relying on an Active Directory, for example, would be welcome.
And for the record: Active Directory design isn't, IMHO, harder than the design of any other well-administered LDAP-based authentication system. Further, I'll say that Microsoft has done a fantastic job of making the administration tools transparent and easy-to-use, and the integration of Exchange mail servers & NIS authentication via Services For Unix into the same tool is icing on the cake. Sure, the per-server licensing fees aren't cheap, but you do get what you pay for in this instance.
Even Jesus hates listening to Creed.
The article just says "Windows ID management is bad. LDAP is better. Why is Windows' ID management bad? I'm not telling. Why is LDAP better? I'm not telling." It does nothing explain the position the title purposes.
This isn't to say I disagree but calling this article "news" is like calling the OpenLDAP FAQ news.
Free of Flash! Free of Flash!
ID management's biggest problem will never be solved by Linux. Nor will it be solved by Windows.
As long as we have people putting passwords on post-its attached to their screens, as long as we have people clueless enough to fall for even the most simple of social engineering, there's no real thing as a proper ID on a computer system.
In my (amazingly wonderful) opinion, no system deserves the name ID management unless it has a genuinely good chance of doing so. Physical tokens or biometrics (aka built-in physical tokens) are a minimum.
Well, unless you're after the account ID, but I think admins are normally more concerned about the ID of the person using the account.
We need to stop barricading the windows when people are walking merrily through the doors.
GNU/Linux is pretty well served in terms of LDAP tools and applications. thanks for asking.
now, someone please mod parent "-1 troll"
What ? Me, worry ?
"Just saying screw it and watching television all day may be your ticket away from the daily hassles of managing and licensing domain controllers and related software devices." Plus you probably won't have to go back to work tomorrow!!
Last time it was reported, slashdot readers were mostly Windows users. Why slashdot doesn't publish a zeitgeist is totally beyond me. An article on OS/browser statistics here would generate thousands and thousands of pageviews (that's dollarinos, Taco) and comments (more dollarinos) but they don't seem interested.
Go figure.
I agree. What good is being able to manage users if they don't have any tools to do their jobs? A large majority of people in my area need Excel to function, and open office is nowhere near as good in that department.
When linux catches up in terms of commercial software, maybe it can be used in work enviornments. Then we can easily manage our IDs.
/. ++
OpenLDAP is a snap! Its so easy to use, even a 10-year unix veteran can get it integrated with some systems assuming everything is setup properly and has been designed for integrating in this manner!
Thanks SearchEnterpriseLinux.com!
Sure, Linux is one way.
However, I'm very impressed by Novell NSure.
Do not overlook this product if you're looking for a solid LDAP based Identity Management solution.
Well, :)
Maybe he wanted to stop?
You made me laugh though.
Pretty thin article- if you were expecting a detailed argument for why OpenLDAP is better/easier to manage than ActiveDirectory, you'll have to look somewhere else.
He basically just summarized the history of NIS and OpenLDAP, then gave us a link to some documentation for setting up OpenLDAP. Have fun editing slapd.conf, kids!
I was expecting that he'd at least mention Redhat Directory Server, which is the most interesting recent development as far as easy-to-manage Linux identity servers go.
pi = 3.141592653589793helpimtrappedinauniversefactory7
I think it's funny that the summary leads the reader to believe that such a switch could be of trivial difficulty.
If your network is so complex and you have so many domains and related devices that you're "fed up" with Windows to the extent that you're ready to ditch it completely, a switch to Linux, while it would certainly eliminate certain issues, would itself hardly be a walk in the park.
Mods: Do you disagree with me? Go ahead and mod me down. Meta-mods will sort it out. Good luck!
I don't even know what Linux is, I just come here for the pretty colours.
There's nothing better in ID management the eDirectory, either running on Linux, NetWare, or yes.... even Windows. MS always promises that the *next* Active Directory version will have the features that eDirectory had 15 years ago. True container based security and delegation, partitioning, replication, all with the greatest of use. Yes, it's more expensive that OpenLDAP, but WAY better.
please excuse my apathy
I'll admit I didn't thuroughly ready the article, but really though. You are payed to manage a given system. This /. article says make it easer for an admin, which would make it harder for all other employees/clients to use it (because the rest of the world isn't used to Linux)? Doesn't seem quite right... Even if it is that much easier, It doesn't seem like a legit reason to switch....
In undeveloped countries, the consumer controls the market. In capitalist America, the market controls you.
Key points in the article:
-Backups in windows are really hard, but nobody ever wants to do them anyway.
-Project Athena at MIT invented Kerberos
-Sun NIS was originally called "Yellow Pages" in the 80's
-LDAP tools included with linux let you manage users, but you can change them if you want
Conformity is the jailer of freedom and enemy of growth. -JFK
LDAP, is a directory service, or database, that also has the ability to verify ID/Pass pairs, which is the most basic form of authentication.
For stronger authentication, using tickets for further authorization, use Kerberos. With LDAP, you must punch in your password repeatedly. Yes, it is the same password, but it must still be entered multiple times. In a properly Kerberized environment, you enter the PW once, and that's it. And, if desired, you can do some neat P
And, to head off some arguments -- Kerberos is pretty easy to setup. It is, at least, no harder than OpenLDAP to set up.
Try Kerberos -- you'll like it.
10b||~10b -- aah, what a question!
He's talking about managin IDs on networked systems. Not standalone.
I worked at a facility when they implemented Active Directory, and re-implemented Active Directory, and re-re-implemented Active directory, and re-re-re-implemented Active Directory. Eventually some contractors came around to each system that was dorqued and fixed it, sort of. They had to get help from both us contractors, and the local systems guy.
In other news, "Linux" is an alternative to Windows that has been around a while. It started out as a free clone of UNIX, but now it has come into its own and started a lot of other interesting projects. You can find out more about it on the Internet!
I just hope they aren't using any of Excel's statistical functions. Or if they are, I hope they don't care about accuracy. There are so many problems with Excel's statistical functions (even the latest-and-greatest version) that it has been repeatedly ruled "unsuitable for serious statistical analysis". That's fine if "a large majority of people in my area need Excel to function" just be aware of its shortcomings (which are many). Gnumeric (and I think KSpread and StarCalc) is significantly better than Excel in this area (and many others, but I digress).
Of course, both this post, the parent and the parent's parent are "-1 Off Topic".
So how about a live cd so we can take a look and have a test? Heck, it could even save data to a USB stick and actually be useable.
The title of the story is "How Linux Beats Windows in ID Management." Okay, I read the TFA, and all I read was an introduction to LDAP. Where's the comparison that shows "Linux Beats Windows?" The article is not even about linux; it's about LDAP solutions that can be run on *nix systems. For the love of God please please don't run stupid stories like this again.
- Disclaimer: This could easily be considered as a troll or flameblait, but its only an observation since I have completely switched to using Linux last year and may be offtopic, but ... I immediately thought about how software/package
management and administration is also easier in Linux. Yes, i'm talking about APT.
Now before you mod me down, please consider this:
Does Windows offer anything that allows you to upgrade ALL installed packages (providing that updates are out there) with one command?
Does Windows allow you to make core changes to the installed packages and continue your computing tasks without rebooting?
Does Windows allow you to browse, download and install over free 15000 packages at once if that is your choice? (Synaptic - This is the best thing
since sliced bread, you can do so much with this application)
Don't get me wrong, Linux does suffer with package
installation sometimes, but I think MS should investigate how to implement something like APT into Windows. This may be a far stretch, but it is worth a mention.
I _used_ to hate trying to clean up my machine, and the files that are on it by digging through the registry, and the rest of that crap. Also some software sometimes refuses to uninstall. This is something that has always annoyed me.
He wrote the Ecmas editor in 1943 and started the Foundations for Getting Softwares for Free. In 1986 he was involved in a six-issue battle with Phil Gates for the ultimate control of the universe plus the Internets. It was a pretty decisive victory for Linux, but Phil got away, swearing revenge.
13:34ET - The low fuel sensor network is failing to respond, triggering a scrub. The sensor would detect an unsafely low fuel level, which could lead to catastrophic failure in the event a booster should run out of fuel at 100% throttle.
Sorry -- just had to do that. You're right of course ... fingers got ahead of the thought.
With the explosion of networking, the real ID Management problem is that teams form across administrative zones. Within a company, things are fairly simple, but how you you authroize Mary from a partner company see your Excange calendar?
If you can configure apache then you can configure openldap, its very simple and easy to setup. And "LAMP" is an embarassment, apache is a bug-riddled security nightmare, PHP is an order of magnitude worse, mysql is a wonderful replacement for flat files, but is worthless as a database, and linux doesn't really matter in the whole thing, any OS could be used and it would make no difference.
Currently Windows Update Services is out which allows for very good, grandular control of software updates and management, should more control be needed, there is always SMS2003. No it's not just for Windows. The newer releases of Update Services update all supported software detected on the system, this will include 3rd party applications as well. If applications follow standard Microsoft development "rules" one would not have to clean up anything, but as usual, people take the shortest and quickest path possible and leave crap all around. Is it perfect? Nope. But it works well when used properly.
The article incorrectly states that PAM (Pluggable Authentication Modules) came out of Project Athena.
However, it was actually invented by Sun, and was eventually adopted as RFC 86.0 by the Open Software Foundation in 1995.
I've tried, and the results were less than spectacular (they were actually more like craptacular.)
There are AD Unix "extensions" that are supposed to make it supply Unix-y stuff like numeric UIDs. But when I installed them, they made the AD server hang whenever a new user gets added. (Which took out the whole machine - as everything goes through AD.)
In the end, I had to reinstall the whole of Win2K (luckily I'm not stupid enough to do something like this on a production system) - it was the only way to make the system usable again.
So yeah - I'd like an explanation of how to do it too.
Swoosh.
Since it isn't possible for one article to explain how to configure identification, authentication, and authorization for all systems, the article contained links to more information.
That's because you often have to learn about things in order to do them. With flexibility comes a price, and that price is work. Luckily, they pay you for that, if you do it well enough.
Or maybe he should have published a GUI along with the article? Sorry for being flippant, but I think you're expecting too much hand-holding.
Raise your children as if you were teaching them to raise your grandchildren, because you are.
Fed up with Windows systems management? A Linux conversion may be your ticket away from the daily hassles...
Flame me for this, but Windows is a hell of a lot easier to learn and manipulate for the regular Joe users. In windows, if you want to change settings, you hit Start, Settings, Control Panel and you just select what you want to play with. In Linux, you actually have to know (very well) what you're doing and how to do it. Now compare this. What will common users choose? Ease of use and user-friendliness, or painful, long and extensive research (read: understanding how it works first, then understanding the 3rd party softwares to administrate it, then learning how that one works, then learning the command syntax) before typing shit out in a console?
A computer makes it possible to do, in half an hour, tasks which were completely unnecessary to do before.
The author obviously has never dealt with any real IdM issues at a large company. With mergers and divestitures constantly happening, you end up with a patchwork of HR systems, facilities management systems, access request systems, application data stores and authentication systems. Saying "use OpenLDAP for IdM" is like saying "this paper airplane flies well - if you throw it hard enough, you can get it to the moon."
This is not to say it couldn't be part of the solution, but the end state is going to have a bunch of different components.
And MS's out-of-the-box tools (e.g. AD Users & Computers) are deeply pathetic for anything other than casual directory browsing. Third party tools are needed for the variety of different tasks involved in managing an AD-based NOS.
That being said, some of the cool new work being done with Samba taken with a Kerberos KDC for authorization and OpenLDAP for authentication could be a good place to start in building out an IdM system. Unfortunately, you would really need to be starting from scratch to have this be feasible....
Left shift 1 for e-mail...
Didn't redhat just release the new fedora directory server, based off of netscapes code?
What are we going to do tonight Brain?
The article is on an enterprise Linux related site - there's your converted. The chances of this fabulous, life-saving news reaching Win32 admins is self-defeatingly low.
- Why did it take me 2 hours to configure xorg.conf to get my laptop working in 1400x1050 properly when Knoppix did it in 30 seconds?
- Why did I have to spend 3 hours writing bash scripts to make power management work?
- Why did I have to use fdisk when Mandriva has graphical partition manager?
- Why does Gentoo not detect my DVD drive when I use it in my other laptop?
- Why doesn't my mouse work automatically when I plug it into the USB port?
- Why do I have to install and configure alsa when Knoppix sets it up automatically?
Face it folks, linux has a long way to go before it makes desktop inroads. Sure you can put Mandriva on a PC and it'll work fine forever for office stuff, listening to music etc. But if the user want flexibility and ease of use? We want to update device drivers quickly to take advantage of new features, but without reading manpages. We want to change resolutions without fixing a text file. We want plug-and-play devices to perform as described. We want to print to different printers without referring to CUPS docs or learning to set up a Samba server.When will linux combine usability with power and flexibility? They're not mutually exclusive.
I bet that the parent did mean brake, as in "Stop the world I want to get off..."
Since the article didn't really say anything about managing LDAP or playing with OpenLDAP, I thought I would share a useful utility my team has recently started using for LDAP management and administration.
Have a look at JXplorer (or alternate Sourceforge link).
It's a really nice open source LDAP administration and management utility that not only lets you do the easy entry editing stuff but a lot of the more complex tree management operations. It also has some really nice search building interfaces. I'm in no way connected with this project but it has replaced a number of free and commercial utilities we used to use.
It also lets you play with populating an OpenLDAP installation so you can begin to understand some of its real power and tuning potential.
I was referring to actual work applications ( in my case, Xray software, practice management software ect... ), thanks for asking.
Now, someone please mod parent "-1 Clueless"
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Er, you can bind to LDAP in multiple ways y'know. Including Kerberos.
Lacking mod points, I think I'll simply repeat your post, since even those that don't read AC posts should see it:
I just hope they aren't using any of Excel's statistical functions. Or if they are, I hope they don't care about accuracy. There are so many problems with Excel's statistical functions (even the latest-and-greatest version) that it has been repeatedly ruled "unsuitable for serious statistical analysis". That's fine if "a large majority of people in my area need Excel to function" just be aware of its shortcomings (which are many). Gnumeric (and I think KSpread and StarCalc) is significantly better than Excel in this area (and many others, but I digress).
So we learned what the history of LDAP is and how easy it is on linux. But what about other systems etc...
Not a good article. Slashdot has reached the prime of its peak and is now in its decline.
This might be better
Guy is strapped down into a pack of pressurized tanks and launched into the air.
It is windows media file but xine and mplayer under linux (x86) can open it.
http://www.lookatentertainment.com/v/v-1169.htm
The article has been submitted by someone with a TechTarget email address, for a vapid, puff piece article on a TechTarget website.
Editors, do your fucking jobs.
I always wanted to do a TCL interface to LDAP book and call it slapd and TCL("slap-d and tickle"). I hate to steal Theo's model of free code and selling T-shirts but please buy our edible thongs.
One of the really tragic points is that although NDS and eDirectory were already ahead of what MS-Active Directory (AD) is now *ten* years ago. AD is suddenly what all the MS fanbois talk about to the exclusion of the more mature, secure, flexible, and compatible options like either eDirectory or plain ol' Kerberos + LDAP.
Actually, most AD articles don't cover many facts or even how to operate in a multi-platform environment. Plus there are a lot of short comings *still* in AD like scalability, performance and interoperability with non-MS systems. These are problems that you don't get with eDirectory or plain LDAP/Kerberos.
I'm sure part of it can be explained by the fanboi mentality where anything and everything from Redmond is great, especially the next version which is just over the horizon, etc. And that MS "valued" partners are more or less forbidden from looking at competing technology. Maybe other parts can be explained by MS' standard marketing methods, like the smear campaign against Novell.
I guess more of it makes sense if one looks at MS like a marketing company, as other posters have pointed out, rather than a software company. Though to me that's a bit 90's. MS is now heavily into lobbying and is bordering more on a political movement than a technology. Talk of AD is then a way of signaling membership in the movement/ideology. That would be another way of explaining fanbois who ignore LDAP+Kerberos or products like eDirectory, not even doing shoot outs against these competitors. doesn't make sense.
I miss the days the product comparisons actually compared useful tools and brought up the good and bad points of the ones examined rather than going over pre-approved 'talking points' I guess even Consumer Reports is no longer unaffected.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
It's amazing that an article can go on and on and say absolutly nothing at all. It was a passible history of LDAP, but it didn't address how LDAP was any better or worse than MS AD.
Ok, I give. LDAP is initially hard to understand (objectclasses, schemes, replica's, DNs), but once you do, it's a snap.
Here is my real world setup.
1. RedHat Enterprise server
2. OpenLDAP
3. Postfix (SMTP auth, Spamassassin, TLS, Postgrey)
4. Cyrus Imap Server
5. Samba File server
6. Apache WebDav
Right now I have a master copy of LDAP on the internal file server. Then two other servers (on the DMZ) are replicas. Samba pulls info from LDAP, Cyrus, Postfix, WebDAV as well. Not using Kerberos at this time, but all passwords for Logging onto the computer, email, outgoing email, are same username/password.
Very nice. Some of the configuration and stuff I have documented no my wiki
http://www.spydorweb.com/wiki/
This space available for rent.
All op-fluff without even coherent editorial never mind subject matter. If /. cannot stop dupes because no one is reading them, it should follow that the articles being linked to aren't being read either.
I wonder how long till someone writes a three paragraph submission linking to goatse and tubgirl and it gets through.
In the meantime, Windows has point and click administration and the only people who find it difficult are beginners and people from other platforms. Exprienced Win admins don't tend to have a lot of problems.
Thankfully, Linux has more and more GUI apps and there's some for administering it. Just as hard to use as Windows domain controllers ever were, which means equally easy once you know what Unix systems expect and hardcore Windows admins, especially the security conscious, have more than a bit of passing familiarity with finer grain permissions and so forth.
I am not seeing the news or stuff that matters here.
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
The article is a plug for the author's book, "The Unix Guide to Defenestration" so it's part of a larger plot (I'm all for it BTW). Preaching to the PHB who gets bonuses based on the number of password resets and the bloat of his staff rather than overall security and performance. It doesn't seem to be a very technical book, and if you already know why it's good to defenestrate your AD server, then you probably already know how to do all the technical stuff.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
Obviously the author has never used Windows 2003 server. AD is a snap, easy to use, and easy to manage a large user base, if a competant person has set it up. After working in an environment running a large number of linux and windows servers, I never want to work with linux in a large scale ever again. Peice of shit compared with 2003 server.
what a dick. no proof or facts in his article backing up his claim.
OpenLDAP is what OpenLDAP is supposed to be. A Database Management Service. like MySQL. MySQL is one of the most sought after DBMS systems in the LAMP combo.
Now, couple things. MySQL's command line tools are no harder to use than LDAP's - It is not LDAP's responsibility to provide you with Graphical LDAP Management tools. Remember. LDAP is a Database architecture. That means its meant to communicate with other operating Facilities like:
PAM, NSS, MySQL, Apache, Kerberos, Nagios, PHP and the list goes on.
Its so difficult to configure LDAP to interconnect with all these other systems due to the lack of a Unified LDAP Management ultlity. LUMA and phpLDAPAdmin come close but still have a lot to go on.
There was a discontinued utility called Directory Administrator that is now obsolete
Someone needs to contribute to a standardized method of maniptlating the LDAP Databases, Managing slapd.conf (Core Configuration) slapd.access.conf (ACLs,) ldap.conf (LDAP Client).
I get so sick of listening of about how horrible OpenLDAP is because there is not enough inerta to create standardized LDAP Configuration Utilities in Perl, or PHP or C++ to manipulate the LDAP Database.
OpenLDAP is a good, solid implimentation of the LDAPv3 Protocol with as much flexibility as MySQL given peoples ability to use it correctly and having good third party open source Management Utilities.
I have operated LDAP for a number of years with very positive results my major problem being badly designed or non-existant third party management applications that lack flexibility.
I don't blame this on the OpenLDAP staff but rather the third party management tool makesrs like GQ, LUMA and phpLDAPAdmin for making LDAP so unweildly A properly configured Linux machine as an LDAP client is completely transparent.
Maybe even definitely .
All the asshats who just scream RTFM whenever you ask a question
Hear, hear!
ID management is a problem computer science students like to work on, hence it works well in linux. Actually making an operating system that people find useful and usable is an uninteresting and difficult problem, hence little work is done in that direction.
Moding a comment down because you disagree is double plus ungood.
I would guess that more than half, if not 2/3, of the readers here are Republican Window users. Many are in support of Windows, and the rest are in support of invading Iraq. Just look at all the comments.
his law suit against Chester Gould did win. So he renamed the area from McHenry to BULL Shit. Of course, the locals were opposed to that so it was renamed again to Bull Valley.
I prefer the "u" in honour as it seems to be missing these days.
First it is not LDAP, but LAPD. Everybody knows that it is the LAPD that beats on others. So now, Paul is haveing the LAPD help Linux beat Windows. Cool. Can not wait until the law suit.
I prefer the "u" in honour as it seems to be missing these days.
I think you have forgotten the time and effort you made when you learned to use windows.
To use an old analogy:
Windows is like buying a car with the hood welded shut. Buy a new one when this one breaks.
Mac and OSX is like buying a luxury car. Lots of status and high-performance for driving to the market.
Linux is like owning a formula 1 race car. Very high performance, modifiable, and now with very attractive body. It has a hood you can open and modify to do exactly what you want. All at a very attractive price.
Finally, the oft-referred to "common user" uses what fills their needs. Linux can definitely fill their needs. My wife is quite happy and she is definitely the "common user."
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Not only is the article light on content, but it is rather meaningless to argue that LDAP is better than Active Directory, since AD is an implementation of LDAP (featuring Kerberos authentication and the LDAP data stored in a multimaster replicated database).
Of course, it has taken MS a while to catch up with the features Novell's NDIS directory offerings, but they are finally getting it right with 2003, and it is arguably the easiest to manage enterprise-scale LDAP implementation around. It isn't perfect mind you (we dig up plenty of bugs), but does seem to be the best thing going. Furthermore, Group Policy Objects are a seriously kick-butt feature. Besides, nothing else can properly issue authorization tokens (SID keychains) for Windows clients.
Now if only they would fix the huge heaping piles of Exchange integration bugs in Entourage...
(No, I'm not a MS apologist. They piss me off on a regular basis, both in terms of product quality, or lack thereof in many cases, and in terms of business practices; however, folks are barking up the wrong tree where these criticisms of AD are concerned. In a short time it has matured into a quality product.)
*** Quantum Mechanics: The Dreams of Which Stuff is Made ***
I've looked into using Linux with OpenLDAP, SAMBA and Kerberos before and in it's current state it simply isn't going to work as a replacement Windows domain controller.
All the key components exist, but none of them are well enough integrated to provide a convincing solution. Notably, Windows machines that log onto a domain use a microsofti[sz]ed version of the LDAP standard, CLDAP (Connectionless LDAP) which from my understanding OpenLDAP doesn't want to support because it's non-standard. This makes it's unsuitable for a Linux-based domain controller but suitable for most other tasks. Also, SAMBA 3 doesn't support Kerberos as an authentication backend, and so password synchronisation and single signon is difficult in a mixed windows and *nix environment.
The up and coming SAMBA 4 is promising to fix these shortfalls, with an inbuilt implementation of CLDAP, support for Kerberos authentication, etc. Until this happens, SAMBA and LDAP aren't going to meet the requirements of most medium size businesses as a replacement domain controller.
The lesson I learnt from my research is that a Windows server currently makes more sense for a Windows environment for things other than relatively simple implementations that a Linux one.
Graham
LDAP for security Part 1;
Linux LDAP Tutorial;
Enjoy,
It's just the normal noises in here.
He's talking about managin IDs on networked systems. Not standalone.
And your point is?
I worked at a facility when they implemented Active Directory, and re-implemented Active Directory, and re-re-implemented Active directory, and re-re-re-implemented Active Directory. Eventually some contractors came around to each system that was dorqued and fixed it, sort of. They had to get help from both us contractors, and the local systems guy.
Then it wasn't implemented correctly in the first place. Just because it's Windows (and therefore largely point-and-click) doesn't mean that it's easy to implement a large infrastructure with it. You have to know what you're doing, and clearly whoever implemented yours didn't - otherwise why did they need the external contractors? As for the contractors needing help - they probably didn't know what they were doing either...
I work at a institution that migrated from a Windows NT4 domain to a Windows 2003 Active Directory last year. We have nearly 30,000 users.
It worked first time, and it still works.
These postings should be vetted first, no self-serving BS allowed. Also, ban these types of losers from posting in the first place, they will never have anything valuable to contribute.
I'll soon be shopping for a DS manager. I look back fondly on NDS, which I used in 1999. RDS looks interesting, but the RH product pages, as they always seem to be, are pure fluff. So, questions:
- Is that open source? The page makes it look like it isn't.
- Is this the reincarnation of Netscape Directory Server?
- If it isn't, is it similar in use/functionality/stability/scalability?
Bah, big annoying questions. If anyone has any answers, I'm grateful. Been out of the DS admin scene for a while, other than hand-loading OpenLDAP.
I forget what 8 was for.
To use an old analogy: Windows is like buying a car with the hood welded shut. Buy a new one when this one breaks. Mac and OSX is like buying a luxury car. Lots of status and high-performance for driving to the market. Linux is like owning a formula 1 race car. Very high performance, modifiable, and now with very attractive body. It has a hood you can open and modify to do exactly what you want. All at a very attractive price.
And how easy is driving a Honda Civic (sorry i don't know any shutted hood cars) or a Lexus compared to a F1 Ferrari? As for your wife using Linux, she has you (which i assume is quite Linux-knowledgeable) to help her, she doesn't have to read three bibles of howtos and docs to get it to work. She just asks you, and if you want sex you can't tell her to RTFM. So you think every "common user" has a linux guru by their side willing to help them?
A computer makes it possible to do, in half an hour, tasks which were completely unnecessary to do before.
With as many features and extensions that LDAP has added, at what point does it become simply DAP?
Well, there's spam egg sausage and spam, that's not got much spam in it.
That's more like "Fed up with Dandruff? A head transplant may be your ticket away from the daily hassles of washing and combing your hair."
WindowsAD(Win2k3) + SQL Server + Exchange + .Net or VBS WMI = Extremely simple administration.
LDAP is like 5% of what AD provides. Remember that AD offers authentication as well as OS level authroization. I don't know of anything in the Linux world that offers that just by running through a wizzard (ever set up AD?). You don't have to type anything if you don't want too, and for the programming heads, WMI/ADSI can do what isn't in the tools. There are also a lot of 3rd party products that can plug into AD.
True they bastardized the Kerberos implemention and you are locked into windows but without an enterprise wide OS level authentication/authorization Kerberos SSO model available you'll never convince a CIO to go linux with 20,000 desktops. IMO it's the reason that linux fails as a desktop. You simply can't sell it to corporations, even though it's free. Plus windows does much better to protect your system files than Linux, where any admin could use root to read any file without knowing it was done. In windows, you own your files and can restrict even domain admins access, unless they take ownership, but then they can't give it back.
You can linux vs windows all you want but Windows kicks the sh** out of linux when it comes to managing and administrating large environments. I also feel that windows has a much better security model and short of being the #1 target for hackers, has the potential to be much more secure than any Linux I've seen, short of SE Linux which does NOT make administration eaier at ALL. In fact I'll say that Windows is too easy to administrate. It still takes thinking like an admin to do it well but the truth is you could train someone who worked at Jewel's to administrate AD in about two weeks (it happened at my old gig). After using linux(Gentoo) for 6 months now I've determined that linux is the best system to work on and Windows is the best system to work in.
Flame on.
Ever done a `man` on `top` ?
See, this article is the first in a 2 day series. He posted it here so /. would do his research for him.
But Gnumeric is as good as Excel if not better.
Just a Tuna in the Sea of Life
... We already have a *nix like that ...
-GenTimJS
How do you get Windows and Linux using the same system?
pGINA: PAM modules for Windows.
Winbind, part of Samba.
OR for apache use: auth_kerb_module
OR for authentication only (manually add dummy users) use pam_krb5.conf
Its all fairly easy and you don't need to touch the unix services toolkit.
Jason.
LDAP, is a directory service
Correct.
that also has the ability to verify ID/Pass pairs, which is the most basic form of authentication
No. You can *USE* LDAP to store password information, but you are in no way required to, nor is it the only way to authenticate.
With LDAP, you must punch in your password repeatedly.
Umm, WHAT!?!?!
As you mentioned in your first (and only correct) sentence, LDAP is a directory service. What you use that directory for is up to you.
Comparing Kerberos and LDAP is like comparing apples and volkswagons. The two are completely different entities (that can be used together, or apart.)
Moding a comment down because you disagree is double plus ungood.
Bleh, I half expected this. Attacking slashdot, however indirectly, always leads to being modded down. Well, almost always.
Regardless, I don't see why we should get all riled up by stating the obvious. Linux *is* good at ID management, always has been. Windows lags way behind linux in this dept. No one is surprised. It's making it usable to a wide variety of people that has been and will continue to be the problem.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Yea, you're damned right. Microsofts' point-and-click stuff really backfires on them sometimes because you end up with these Admins that set up AD systems completely half-assed.
AD works. Sure, Windows 2000 without any service packs sucked, but they've pretty much nailed down most of the functionality bugs by now. And, it's not all that hard to use AD as a directory for all your systems, including Linux and Mac systems.
There's a lot of considerations for AD design and if you spend some quality time designing the directory and infrastructure with knowledgable people, you'll get it running well and it will stay running well.
As much as I dislike Microsoft, and as much as I didn't like AD at first, it's not all that bad.
- It's not the Macs I hate. It's Digg users. -
I agree. I think a large part of the problem, though, is that people are being given unrealistic demands for digital security wherever they go, that simply ignore everything we know about an ordinary human's cognitive ability. Even if a user can cope with one or two severely complicated passwords, nearly every organisation they deal with is going to require yet another one, whether it's their employer, separate sub-services within the same employer, a bank, or any number of online services. It's no surprise that people write down passwords, ignoring instructions---why should they respect instructions that are crazy and unrealistic?
Several years ago I was helping to implement a card reading system around the organisation for "extra security". Many of the employees decided to simply leave the cards in the readers continuously, even though they were told they should never do this. When I returned a couple of years later, even the branch that'd dished out the cards now had a compromise of simply storing the card in an unsecured drawer overnight. It was no huge surprise, however, because everyone was already flooded with other people wanting to force them to carry identity cards. There were at least another two, I think, just for independent parts of the same company! (Entering building, opening doors, etc.) There are only so many demands from all directions that people can be expected to submit to.
Many policies are very hypocritical, especially when compared with something like credit cards. Credit cards usually don't require remembering anything at all -- the "secret" number is written down, and people are encouraged to give it to anyone. Even my cash card only requires me to remember a 4 digit number (practically criminal according to many password policies), although I need the card to activate it.
Most people probably have more stake in their credit card security than in nearly any password-protected service. One of the differences is that Credit Card companies play a role in watching carefully for things that look like fraud. They have systems to restrict how much damage can be done if it's done (eg. credit limits), and have processes to deal with it after it happens.
I think passwords have just evolved from an ancient system that used to be more meaningful. Many organisations' policies are based on common beliefs instead of actual researched facts, and they're afraid to do something against the norm. Some users of some services clearly still require effective passwords, but other services demand it from everyone unrealistically. I'm convinced that we're often required to use impossible-to-remember passwords for the same reason we have impossible-to-read EULA's. It's about organisations protecting themselves from legal action so they can blame everything on the other party if something breaks.
well none of them will bring my ldap to work or even let me add a user....
wenn i add a user:
testmachine:/etc/ldap# ldapadd -x -D "cn=fakeuser,dc=fakedomain,dc=fakedomain2,dc=tld" -W -f fakeuser.ldif
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
testmachine:/etc/ldap#
can anybody give me some advice what could went wrong? maby here maby per email? rockor@rambler.ru
It's the truth. When you force users to conform to absurd password rules, you force them to write the passwords down.
Some admins believe that you should enforce these crazy long and complicated passwords, and then have everyone change them every month or less.
I wouldn't blame you for writing that password down on a sticky note, and I'm willing to bet that almost everyone else the company will do so as well. Not to mention the volume of calls that will be made to Help Desk when the people that DIDN'T write down their passwords forget what they were.
A strong password policy is fine, as long as it's loose enough for users to remember what they are. Forcing the changing of passwords too often is always bad, however.
The best solution would be some sort of SecureID type thing - but these hardware key solutions are often very expensive and come with their own set of problems. They aren't for every business. Not yet, at least.
- It's not the Macs I hate. It's Digg users. -
Since when was managing AD difficult?
I've found AD to be the most usefull thing for managing windows users and machines since sliced bread. I have everything grouped in a nice logical order seperated by object type/role, then location. Just about ANYTHING i want to do to any computer or user in my organization, I can do via Active directory. Software on our computers is deployed via active directory. Local machine passwords are changed on a regular basis via active directory. user/computer settings are managed via active dierctory. I've even delegated out rights to HR to be able to change certain identity attributes of users, like department, location, job title, etc, and that data is dumped out to a database and used on our website's employee directory.
It's easy. It's powerfull. It's reliable.
Now, why in the hell would I want to replace that with some half-assed LDAP based implimetation?
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
But -- to expand and defend my points:
You are absolutely correct in your statement "What you use that directory for is up to you." However, please take my above comment in the context of SSO/AuthN, as is being discussed in many of the
10b||~10b -- aah, what a question!
Now theres a false statement. If this was even slightly true there would be far far less windows install bases. The ONLY selling point windows has is ease of management. When, or make that IF, another OS matches or beats it the market share numbers will dramaticly change. This article is just another bunch of fluff.
Am I the only one who did a double take with the words: "Linux" and "ease"?
Recently I've ran into a situtation where I had to fix Red Hat 8.0 with OpenLDAP server. Mac OX 10.2.x workstations were authenticating off Red Hat 8.0 OpenLdap server with DHCP w/ directory service string in broadcast. Curiously I've looked dazed at what the previous sysadmin had to go through to make secure athentication using OpenLDAP, Kerberos5, DHCP, DNS, YP, and nss-lib package.
Looking at the configuration and service list, anyone could have seen that the previous sysadmin had gone through hell to make it work.
And from my experience, it wasn't easy either. Working with AD from Win2K and Samba2-TNG with LDAP and Kerberos support isn't something I'm proud of doing. There were many hacks and workarounds done during that project which could have been a trivial to do under Windows AD only environment.
If I'd had to do it again, I wouldn't even try to LDIF strip off AD and make Linux machine act like Win2K AD server, just for the sake of "I have done it." bragging factor. I'm only glad that I've learned a lot about Win2k AD schema and authentication and OpenLDAP and nothing more.
If the intention of the article written was to entice naive Windows admins/Linux novice into migrating Linux into their environment, it's very misleading with captial "READ THE FINE PRINT".
Saying it's possible is totally different than it's practical and proven.
"Don't let fools fool you. They are the clever ones."
Except a Formula 1 racecar costs $15 million dollars and takes a world class team of engineers and mechanics to figure it out when something goes wrong.
:)
Let's see your wife go take an F1 car for a spin and then fix the gearbox when it breaks
NIS stood for "Network Information Services", BTW.
I'm not kidding. The man is an idiot. Any high-school kid could do a better job.
I'm not just saying that because of this article. The guy always writes idiotic crap. I think just about anybody familiar with Paul Murphy would agree.
...is that the submitter works for the same company that the author of the linked article does. ...which happens to be my employer, too. ;)
Funny, how that works. Still an interesting article.
When politicians are involved, everyone loses.
http://hacks.oreilly.com/pub/q/all_hacksd _open_source.htm e r.html
http://www.tldp.org/HOWTO/Tips-HOWTO.html
http://souptonuts.sourceforge.net/how_to_linux_an
http://cyberciti.biz/nixcraft/vivek/blogger/blogg
Hi, as poster of "the worst story ever," I feel a responsibility to make good. If one of you smart SD people could write a tip on AD vs OpenLDAP or Kerberos, I would like to see it and could probably get it published for you. These are good questions that I can't answer, but somebody out there probably can: "How do you get Windows and Linux using the same system? How do you deal with groups (there are at many different ways each with different applications supporting them)? What about tying in web applications? can you have a seemless sign on or do users need to reenter their password? What about security on those web apps; are they going to use basic, digest, NTLM? Are we going to syncronize with Active Directory or maybe just expand the AD schema? What about user provisioning and protecting sensitive data in the tree. What about tree structure?"
Cheers,
akucharik@techtarget.com