Slashdot Mirror
How Linux Beats Windows in ID Management Ease
Amy Kucharik writes "Fed up with Windows systems management? A Linux conversion may be your ticket away from the daily hassles of managing and licensing domain controllers and related software devices. In this tip, Paul Murphy discusses the evolution of LDAP and how using it, along with Linux, can make an administrator's job easier."
I don't really get much from this article. Just that LDAP is out there, and that there are online manuals to help you get started. I figured that much out already. I'm not seeing much of a comparison between LDAP and AD/etc here. Anyone got some in-depth experience to share?
perl -e 'foreach(values %SIG){$_="IGNORE";}while(){}'
The article just says "Windows ID management is bad. LDAP is better. Why is Windows' ID management bad? I'm not telling. Why is LDAP better? I'm not telling." It does nothing explain the position the title purposes.
This isn't to say I disagree but calling this article "news" is like calling the OpenLDAP FAQ news.
Free of Flash! Free of Flash!
ID management's biggest problem will never be solved by Linux. Nor will it be solved by Windows.
As long as we have people putting passwords on post-its attached to their screens, as long as we have people clueless enough to fall for even the most simple of social engineering, there's no real thing as a proper ID on a computer system.
In my (amazingly wonderful) opinion, no system deserves the name ID management unless it has a genuinely good chance of doing so. Physical tokens or biometrics (aka built-in physical tokens) are a minimum.
Well, unless you're after the account ID, but I think admins are normally more concerned about the ID of the person using the account.
We need to stop barricading the windows when people are walking merrily through the doors.
Haha :) You know, 90% of the people reading your post will not understand that you're being sarcastic. And not only is AD already there, you can get your Linux boxes to authenticate to the same infrastructure as well since AD is a Kerberos based technology. Not to mention that Kerberos is a lot more secure than the typical LDAP based user authentication implementation.
I prefer to use Kerberos for Authentication and LDAP for authorisation. It is very secure, easy to administer and universally supported by the commercial vendors. However for some reason, it does not get a lot of press.
One is Free, the other is easy to use.
Funny?
This is the truth.
More
One of the really tragic points is that although NDS and eDirectory were already ahead of what MS-Active Directory (AD) is now *ten* years ago. AD is suddenly what all the MS fanbois talk about to the exclusion of the more mature, secure, flexible, and compatible options like either eDirectory or plain ol' Kerberos + LDAP.
Actually, most AD articles don't cover many facts or even how to operate in a multi-platform environment. Plus there are a lot of short comings *still* in AD like scalability, performance and interoperability with non-MS systems. These are problems that you don't get with eDirectory or plain LDAP/Kerberos.
I'm sure part of it can be explained by the fanboi mentality where anything and everything from Redmond is great, especially the next version which is just over the horizon, etc. And that MS "valued" partners are more or less forbidden from looking at competing technology. Maybe other parts can be explained by MS' standard marketing methods, like the smear campaign against Novell.
I guess more of it makes sense if one looks at MS like a marketing company, as other posters have pointed out, rather than a software company. Though to me that's a bit 90's. MS is now heavily into lobbying and is bordering more on a political movement than a technology. Talk of AD is then a way of signaling membership in the movement/ideology. That would be another way of explaining fanbois who ignore LDAP+Kerberos or products like eDirectory, not even doing shoot outs against these competitors. doesn't make sense.
I miss the days the product comparisons actually compared useful tools and brought up the good and bad points of the ones examined rather than going over pre-approved 'talking points' I guess even Consumer Reports is no longer unaffected.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Sure you can put Mandriva on a PC and it'll work fine forever for office stuff, listening to music etc. But if the user want flexibility and ease of use?
You seem to be implying that there's something Mandriva can't do that all the other "more flexible" linux distros can. I'm not aware of such a thing. I'm not a linux guru... but I run Mandriva on a few machines and there's never been something that I wanted to do that I couldn't (remote administration, webserver, MythTV, etc.). I understand the "fun" of setting up a Gentoo machine... but if you want ease of use combined with power and flexibility, then use Ubuntu, Mandriva, etc. Everything installs easily, and then you can configure and fine-tune to your heart's content.
I have to agree with you. I have implemented LDAP systems and its no peice of cake. How do you get Windows and Linux using the same system? How do you deal with groups (there are at many different ways each with different applications supporting them)? What about tying in web applications? can you have a seemless sign on or do users need to reenter their password? What about security on those web apps; are they going to use basic, digest, NTLM? Are we going to syncronize with Active Directory or maybe just expand the AD schema? What about user provisioning and protecting sensitive data in the tree. What about tree structure?
Basically if all I needed was a place to look up email addresses I can just throw up OpenLDAP on a linux box and be done. If I want identity management I need some real planning and some serious engineering. Even the comercial solutions like Novell is offing using eDirectory on Linux are complicated and resource intensive implementations in anything but the simplest environments.
The idea of "it's Linux" so there is no throw away work is foolish.