Searching for a Directory Service Solution?

kumulan wonders: "I've got the responsibility to set up directory services as well as a messaging/groupware system for my organization of app. 100 employees spread out over three locations. We are a startup that is merging three existing smaller companies and, given the state of existing IS infrastructure at each of these locations, the decision has already been made that we are better off starting from scratch. It would be great to hear from Slashdot readers concerning which option is 'better' and why." "For me, the choices are stark and clear:

1. MS Exchange/Active Directory
2. A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists).

For (2) we have evaluated, and are strongly considering, the following:

• Samba/OpenLDAP/Kerberos
• Bynari Insight Server for messaging/groupware.
• Nitrobit Group Policy for, you guessed it, group policy management.

Of course, Samba 4 will address some of this 'cobbling', but we can't wait for that."

Comments

Easy.

[XorNand]

So, the question seems to be: OSS vs. Microsoft. Am I right? If so, the answer is easy: Which platform are the people who will be managaging the stuff have the most experience with? It may be sacrilege to say it here, but if you've a crew of MCSEs on staff who've never touched Linux, it's going to be more expensive and a bigger hastle go the OSS route.

I forget who said it but "OSS is free like a puppy is free". You need to have the staff to tend to the care and feeding. In the Detroit area at least, Windows guys are a dime a dozen. Competent Windows guys, while a bit more rare, are still easier to find than experienced Linux admins. (Of course, I'm looking at your question from a business consulting standpoint. If you're looking more for a technical recommendation, there's a lot more people here better qualified than me.)

Re:Easy.

[ndansmith]

You may be underestimating just how much is actually costs to get a Microsoft enterprise solution off the ground. You have to pay for the Server 2003 software, Exchange, XP Pro (volume), Office, Terminal Services licenses, and don't forget server CALs. Plus, you have to worry about Microsoft "obsoleting" your software via Vista, Longhorn Server, Blackcomb, and beyond; another round of licensing (and by extension of Vista's hardware requirements: another round of hardware updates / replacements).

Sure, it may require a fine tooth comb and/or training to get some qualified Linux guys on board, but I doubt that compares with the expense of purchasing the Microsoft solution.

Re:Easy.

[zulux]

if you've a crew of MCSEs on staff who've never touched Linux, it's going to be more expensive and a bigger hastle go the OSS route.

MS's newest/latest/greatest has a large learning curve as well. You old MCSE who knows Windows Domains will have just as much trouble learning Active Directory as he would have learning Samba 3.

I've trained MCSEs in open source technology - about 50% do just fine. The otheres were paper MCSEs and sucked at Windows too.

Re:Easy.

[Daengbo]

While I agree with you, the K12OS mailing list that I continually lurk on has quite a few inexperienced Linux fols, and the single sign-on issue has basically been solved by one of them. David Trask has put together a script which automates setting up smb-ldap for a PDC, and it's here: http://web.vcs.u52.k12.me.us/linux/smbldap/

As for a groupware solution, I currently use egroupware ( http://egroupware.org/ ), which is fairly mature, can authenticate to ldap, and can be used both over the web and thorugh Kontact as a client.

Re:Easy.

[XorNand]

Not really--I myself and am MCSE and run my own consulting company where the majority of my clients run Active Directory. I'm quite aware of the costs. MS includes a license for Outlook when you buy a CAL for Exchange, so that extra expense is negated. OpenOffice also might make a viable office suite for this person, but the question was about directory services. Terminal Services is a non-issue in the same regard.

And it's not as cheap and easy to get quality techies as you might think. Putting your existing staff through a boot camp is only the tip of the iceberg expense-wise, and it's a very inefficent solution.

Re:Easy.

[killjoe]

Just be sure to include your long term costs when you are evaluating. you should calculate the costs of integration and upgrades too. MS products don't work well with other companies products and will inevitably cost you hundreds of man hours if you are ever presented with the problem of integrating non standard MS software with software from other vendors.

As far as admins go studies have shown that unix admins on average maintain more servers per admin then windows admins. You may be able to do with one unix admin as opposed to two windows admins.

windows machines as a rule run less services per machine then unix machines do. This means more servers, which means, more servers to patch, keep up to date, backup, and admin.

Finally the perenial problem of backups and bare metal recovery. This is trivial in unix but costs thousands if not tens of thousands of dollars for windows.

There is a lot to think about. Just saying I have used windows XP before so i can maintain a active directory/exchange environment is plain old stupid.

Re:Easy.

[XorNand]

For the record, I'm also a CNE and greatly prefer NDS to AD. However, it would wrong of me to recommend to a client that they actually consider a new installation of Netware just because it's technically superior, or worse, just because I like it more.

A lot of techies forget that technical and business interests sometimes conflict. In such cases, business interests always need to be given a greater priority.

Re:Easy.

[j-cloth]

But why would you use a patched together system in production when a coherent system already exists? The cost of AD/2K3 is made up pretty quickly with the time lost reading mailing lists to find a work around to allow single sign-on.

Re:Easy.

[Anonymous Coward]

MS includes a license for Outlook when you buy a CAL for Exchange, so that extra expense is negated.

When did they start doing this? I noticed at my school they announced the included license only in the last year (for the first time). So, for at least 2-3 years before that we'd been having patrons pay for the Office Suite product in order to use their paid-for-by-the-month Exchange accounts.

Re:Easy.

[hagrin]

MS's newest/latest/greatest has a large learning curve as well. You old MCSE who knows Windows Domains will have just as much trouble learning Active Directory as he would have learning Samba 3.

I've trained MCSEs in open source technology - about 50% do just fine. The otheres were paper MCSEs and sucked at Windows too.

Ok, so you're saying techies trying the latest and greatest without any training fail more often than the users who received your training in OSS solutions? So, obviously, the parent still remains correct - whatever you are trained better in should be the solution that is adopted. Otherwise, the cost savings you get from OSS may never be reaped as their company experiences downtime, frustration, inexperience and getting the proper training they need.

I think it's fairly clear that with the proper training and proven, qualified individuals that any solution will work if properly implemented and maintained.

Re:Easy.

[Anonymous Coward]

Why does it even have to be like that? Sun has an LDAP server product as well.

Re:Easy.

[TedCheshireAcad]

Parent has a valid point, setting up and administering your OSS solution will take more work. However, you can tailor it better to your needs.

I worked at Major Software Company in the Bay Area (tm), and their LDAP/Kerberos/Jabber/SMTP infrastructure worked very well, but of course, there were armies of admins to make things run smoothly. It was not without hiccups - but most if not all of the hiccups were minor (failed hard drives, etc.) and remedied within 20 minutes.

My vote is for LDAP. You can do so much with it - authenticating users on your web apps is a cinch, directory lookups are easy, it integrates with every piece of mail client software, and it's free. Just my $.02.

Re:Easy.

[sillypixie]

I think you are missing more than a few options there.

IBM has directory services.

Sun has directory services.

Novell has directory services.

My thoughts:

- the problem with IBM's directory is that it sits on top of DB2. This abrogates one of the coolest parts about directories - that you don't need a DBA. And a mistuned IBM directory is an ugly, ugly thing.

- the Sun/Netscape/iPlanet/SJSDS-whatever-they-call-it-t his-second tends to run well directly out-of-the-box without the need for much in the way of expertise, in smaller environments. I would call this directory the defacto standard (although this statement may now be obsoleted by the advance of AD - hard to say). If you are using other SUN infrastructure, or if you are using the Sun Calendaring/Messaging product (which I would recommend as a very solid alternative to MS exchange), this DS is an excellent choice.

- Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult.

- OSS - I would consider this an advanced option. My suggestion is, if you know nothing about directory services, that you would be better off with something a little more... packaged. I'm sure many here will rabidly disagree with me, but I certainly would consider that choice as risky. A second issue is that many LDAP-enabled products that you may wish to run on top of your directory layer (provisioning, WSSO, etc) only support commercial directory servers.

- Microsoft - well, you're probably going to have to install this one anyways, in order to get a LAN. Although I'm a unix chick at heart, I must admit that I have seen many well-run AD directories. If you aren't already in the UNIX world for any good reason, AD is probably a logical direction. Many many companies have cut their directory services teeth this way. The disadvantage is that your Enterprise Directory is also your NOS, which can be a pain from a licensing perspective, if you want to store authentication-only users as well.

FWIW, hope that helps...

Re:Easy.

[Tadrith]

This is definitely true. I've found it much easier, if instead of thinking of people as Windows techs, or Linux techs, you simply think of them as techs.

A good tech should not be afraid of discovering and learning any system he or she might put their hands on, because part of being a good tech is learning how to keep your mind open and troubleshoot a problem. It doesn't matter if the problem is Windows, Linux, or a coffee maker -- you use the tools that you have to do the best job you can.

I am a programmer for a living, but I also do double time as a technician. I am just as comfortable configuring Windows Server 2003 as I am with Novell Netware 6.5, or any flavor of Linux. I don't see it as my job, or my passion, to devote myself to one platform. My job is to help people with computers and give them advice on what solution works best for them. Of course, I have a primary area of expertise, but that doesn't stop me from learning on my own.

Re:Easy.

[paulproteus]

I am a programmer for a living, but I also do double time as a technician.

You no-good double-timin' scoundrel!

Re:Easy.

[arc.light]

You can run NDS (or eDirectory, or whatever they're calling it these days) and many other Novell products on Linux without any NetWare servers.

Re:Easy.

[Xerp]

Oracle has directory services too.

Microsoft Exchange was mentioned, so you may be looking for something like Oracle's Collaboration Suite which, like Microsoft Exchange and Microsoft's Active Directory, features a Directory, Calendar, Tasks and Email system.

100 users is a very small implementation, but even at these low figures you'd probably be surprised to find out that a market leader such as Oracle can provide a system that is actually much cheaper than Microsoft's!

To be honest, if can can avoid locking yourself into the Microsoft route then you'll be doing yourself a favour. You'll probably be looking to throw the whole lot out once "Vista" comes along anyway and if you don't do it now, then you'll be forced that way one Microsoft stop supporting 2003. On top of that, its a licensing minefield!

Then think of your disaster recovery routines. Ever tried to restore a Microsoft Windows system? Onto different hardware? Then you'll know the pain.

And do you really want that all important anti-virus software slowing everything down? And what happens when the thing you relied on to protect you, suddenly doesn't quite integrate so well with the latest operating system patch?

Just some things to think about!

Re:Easy.

[Daengbo]

quite possibly, but single sign-on is pretty well handled on the k12os list. Like the GP said, if your guys are all MCSEs, then you're likely to go with the AD solution, but otherwise, I doubt that reading the list and the howto are going to take any more time than reading the AD docs...

Re:Easy.

[__aamcgs2220]

If you're a CNE and you don't know that eDirectory (it hasn't been called NDS for about 4 years now) runs on Linux, Solaris, NetWare, and Windows platforms, I'm going to need your name and company so I can be sure never to hire you.

Re:Easy.

[Total_Wimp]

A good tech should not be afraid of discovering and learning any system he or she might put their hands on, because part of being a good tech is learning how to keep your mind open and troubleshoot a problem. It doesn't matter if the problem is Windows, Linux, or a coffee maker -- you use the tools that you have to do the best job you can.

This is probably true for new guys learning an in-place system or a few new systems added to the familiar core network, but far less true for a bunch of newbies (to the system in question) trying to design something good from scratch.

A good ADS guy will know how to design a good forest, he'll know how to acquire and install the necssary patches, he'll know how to set up a secure systems and he'll know the quality sources of help when he needs them. He'll know which built-in and third party utilities will save his bacon and he'll know what to check on if stuff stops working.

The only thing that will teach an MS guy how to do all this with Open Source is experience. The only way he'll get that is with a bunch of time working with the products in question.

In other words, it's dangerous as hell to trust your brand new network with a bunch of noobs. Even if they're very bright noobs who will catch on quickly, you take quite a risk while they're doing the catching on. Put a bunch of these guys under a couple of experienced people and they'll likely do ok with the new network, but if you don't have that experience on hand you're begging for trouble if you uproot a known system and throw a bunch of new stuff in to replace it.

TW

Re:Easy.

[snowblind]

- Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult.

My oh my. Thank you for the laugh. And yes our Novell boys do tend to want to at least try to run everything Novell makes.... "Yes let's make everyone home drives accessible from the Internet and through a web browser"

Oddly your comment would explain the shaved heads and flowers I keep seeing them walk around with.

Re:Easy.

[Anonymous Coward]

Lighten up, Francis.

Re:Easy.

[killjoe]

The Sun/iplanet ldap server has been bought by Red Hat and open sourced. You can find it here

"The disadvantage is that your Enterprise Directory is also your NOS, which can be a pain from a licensing perspective, if you want to store authentication-only users as well."

Other disadvantages include cost, vendor lock, increased maintenance, and inability to interoperate.

Finally I would also look at oracle, they too have a directory and an excellent groupware system which in many ways is superior to exchange.

Re:Easy.

[Anonymous Coward]

well la-dee-da

Re:Easy.

[Anonymous Coward]

Not exactly. The Red Hat and Sun directory servers are each descendents of the iPlanet DS. What Red Hat bought was the Netscape fork of the Sun/Netscape Alliance's code tree. Sun has retained their own version since the fork. Both versions of the DS have been added to significantly since the fork. As a result, they are similar but not identical.

Re:Easy.

[Ucklak]

I may be wrong here as to how it is with the current market but MS including a license for Outlook is almost a false positive that started during Exchange 2000 deployment.

What I mean by this is if you're on some SA plan or Open license (I deployed quite a few MOLP), and you wanted Office AND Exchange, you still had to buy the Standard Office Suite AND Exchange CALS so you ended up buying licenses for Outlook twice.

Now you can look at that a couple of ways. You buy an Exchange CAL and you get access to it (which is technically what a CAL is) using whatever client or you buy an Exchange CAL and Outlook comes with it but you'll have to buy Outlook with your Office purchase.

Re:Easy.

[Tadrith]

Definitely good points. I didn't mean to imply that a newbie should be tossed on a network that he isn't aware of; it's obviously best if someone with experience were to work with it, someone who can provide a guiding hand.

I was mainly referring to the fact that a lot of the technicians I've worked with, seem to resist learning at all, be it on their own, or from another more experienced technician. Some of it seems to stem from a fear of the subject matter, and some of it stems from just plain bias. My point was just to keep an open mind about it, because you never know if what you learn might come in handy some day.

Re:Easy.

[thrift24]

This Novell business is nonsense. How long has it been since Novell has used NDS? It's all eDirectory now. I'm no expert with eDirectory, but from what I understand it's a very viable cross platform solution that doesn't require an all Novell shop. eDirectory running on top of SuSE Linux seems like an appealing choice from all the people I've talked to that have tried it.

Re:Easy.

[Anonymous Coward]

This gets moderated insightful for repeating the Slashdot memes? Jesus. Break it down for me, monkey -


Just be sure to include your long term costs when you are evaluating. you should calculate the costs of integration and upgrades too. MS products don't work well with other companies products and will inevitably cost you hundreds of man hours if you are ever presented with the problem of integrating non standard MS software with software from other vendors.

Riiiiight. So, all of these vendors - IBM, Oracle, Sybase, Siebel, etc. - they don't integrate well? Oracle on Red Hat ain't a fucking cake-walk, either. Support? Like "RTFM, newb!"? Right. Or "look it up on alt.who.the.fuck.knows"?

Truth is, vendor support for Microsoft applications is superior - you're working with a known factor - Windows. OSS: Linux, Unix, or ? Stock or custom kernel? Which kernel version? What glib? Build from source or binaries?

As far as admins go studies have shown that unix admins on average maintain more servers per admin then windows admins. You may be able to do with one unix admin as opposed to two windows admins.

I won't dispute this claim, as many "Windows admins" are desktop techs who know enough to get by. A *true* Windows administrator, however, can be just as efficient (or more) than a Unix/Linux admin. Windows now has quite a nice set of remote support tools built in - including command line utilities.

windows machines as a rule run less services per machine then unix machines do. This means more servers, which means, more servers to patch, keep up to date, backup, and admin.

Errr, what? Many organizations run a Linux/Unix firewall/router/proxy server, and then a Windows AD Controller/Exchange/File & Print Services/WINS/DNS/DHCP server. Are these ideal configurations? No. It depends on what you're doing with them. Is your Internet connection absolutely critical? No? Then run a cheap Unix box with a 2nd NIC, and throw it up with a smoothwall distro, etc., - or get a purpose-built distro. If your connection is CRITICAL, you'll run Debian or Red Hat Enterprise, or a *nix-based appliance.

Windows does not scale well, no. But your blanket statement is patently untrue.

Finally the perenial problem of backups and bare metal recovery. This is trivial in unix but costs thousands if not tens of thousands of dollars for windows.

Trivial? Fine - you show me a trivial way to backup open files on the fly in Unix - cause I would LOVE to know that. I'll set up a Samba server tomorrow and start having all my clients use that instead of Backup Exec for Windows.

There is a lot to think about. Just saying I have used windows XP before so i can maintain a active directory/exchange environment is plain old stupid.

No shit? Wow, that's deep. That's like saying that because you can install Fedora Core 4 on a modern P4 PC from Dell or HP, you're a Unix admin.

Re:Easy.

[OrangeSpyderMan]

My vote is for LDAP. You can do so much with it - authenticating users on your web apps is a cinch, directory lookups are easy, it integrates with every piece of mail client software, and it's free. Just my $.02.

$0.02? I think you're being generous with yourself :-)
LDAP is of course the protocol, this is like saying "I'd recommend HTTP for web serving , and SMTP/IMAP for mail - they're great and FREE" :-) There are many (very good) commercial LDAP offerings which are not free (as in beer or speech), though of course there are free directory servers that support it too.

Re:Easy.

[askegg]

Technical abilities always have a direct impression on business interests. For example with NSS I can assign rights to a folder and the users will automatically see the patch to the files they have access to, but not any other files or folders on the way. More secure, less breaches, better compliance.

No manager will listen to any talk of "but this what everyone uses" when the server crashed again due to memory allocation issues or yet another virus attack. They don't care, they just want the services to employees and customers running.

You are also confusing NDS with Netware - they are seperate products. NDS (now EDirectory) runs on Netware, Windows, Linux, AIX and Solarius.

Re:Easy.

[askegg]

Voting for LDAP? That's like voting for HTTP - it's an access protocol, not an implimentation specification. You don't compare IIS and Apache because they both use HTTP.

Re:Easy.

[Ath]

eDirectory is actually available on about 9 different platforms, including Windows. You absolutely do not need Netware.

Also, eDirectory is the only platform that truly provides a mechanism, using the Identity Manager solution, to synchronize across multiple directories. Dream on if you want, but there is no single directory solution. Even if you go with a 100% Microsoft set of solutions, you will inevitably get data that is stored outside of Active Directory and you will find some application that needs this data.

The author already rejected (or never even considered) eDirectory despite the fact that it is the only directory services solution that works well in a multi-site environment. You can partition the directory and set up replicas to contain only the relevant parts of the directory for different sites.

Re:Easy.

[rshimizu12]

Avoid AD. AD uses it's own non-standard object id's so that Microsoft can lock you into a AD/IIS environment. MIcrosoft's solution for interoperability is to sell you their MMS Microsoft metadirectory services product. If you don't have a exceptionally large directory Novell's E-directory makes a lot of sense. It's mature and is very extensible. IBM's directory service is free and is DB based. For large directories this good since it speeds up replication and lookups. No you don't need a DB admin for IBM"s directory service. Sun's has a very strong LDAP product Openldap: It's promising but still evolving, not ready for large enterprises yet. The other problem is that it requires some programming and lot of technical knowledge to implement.

Re:Easy.

[Anonymous Coward]

Just a curious question, from someone who's platform agnostic, but too lazy to go googling this morning:

As I understand AD, it is/was effectively LDAP+DNS, with some MS-specifics woven in there.
What are the MS specific bits, and do they buy the end user anything?

Re:Easy.

[AlphaSys]

Mod up. Always forgotten, no less true!

Re:Easy.

[AlphaSys]

Right, but you're arguing utility of diversity in disciplines now. Sorry to butt in on you two, but you're miles away from OP. He asked what DS he should run on his network.

The truth of the matter is that most corps who implement DS today don't view it as a business-critical endeavour until later when all the DS-aware apps come sit on top of it. By then there is often a painful lesson to be learned about planning properly from the start. My advice to OP would be to screw what his in-house techs know the most about if they are not multi-disciplinary DS experts.

Determine which apps you really need your DS to support, contract with certified experts to help you properly plan and provision for it. Have them deploy it and train your in-house staff on maintaining it, plus have a support contract with the experts to do monthly maintenance which includes continually increasing your in-house staff's awareness and knowledge on the inner workings and best practices, etc.

Involved implementing DS may be; rocket science it is not.

Re:Easy.

[plumby]

No manager will listen to any talk of "but this what everyone uses" when the server crashed again due to memory allocation issues or yet another virus attack.

Oh, but they do. And there're certainly more likely to listen to that than "no one else uses it, but I like it" if something goes wrong with your preferred solution. It may not happen as often, but when it does, it'll be your neck on the line.

I'm not suggesting that this is a good thing, but it's why many people follow the herd when making these choices. If something goes wrong with the industry standard choice, then it's the industry's problem. If something goes wrong with your own, non-industry standard choice, then it's your problem. Remember the old "No-one ever got fired for buying IBM" slogan?.

Re:Easy.

[ocbwilg]

This is definitely true. I've found it much easier, if instead of thinking of people as Windows techs, or Linux techs, you simply think of them as techs.

I don't think that the distinction is that the techs are only capable of learning one or the other. I think that the distinction is that they've chosen a specific path (Windows or Linux), and for both systems there is such a great deal of detail to learn that it usually makes learning and mastering both, and then keeping up to date with both, difficult. You can certainly be a jack of all trades, but you'll be a master of none.

Re:Easy.

[Anonymous Coward]

Would you rather have your physician do your brain surgery or a neuro-surgeon?

Would you like a Windows specialist managing linux or a linux specialist managing windows?

Re:Easy.

[Himring]

Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult.

I don't know anything about other DSs, but I admined many NDSs back in the day, and I also work with MS's AD today. I'll say this much, AD is almost as good as NDS was nearly a decade ago. Back in the mid 90s, NDS had far more granularity to control every object and OU than AD does right now. Out of the box, years ago, you could set password complexity and other attributes per individual user, group, OU, whatever in NDS. With AD you have to jump through hoops and it is not ready to go out of the box at all. Out of the box, with AD, you set a policy at the top, at the domain, and it's one size fits all. From a simple day-to-day administrator's POV, NDS was, and arguably still is, a more viable solution....

Re:Easy.

[Anonymous Coward]

So to avoid "locking yourself into" Microsoft, you suggest using Oracle? Isn't that like saying "Don't get yourself locked into christianity, go Hare Krishna"?

Re:Easy.

[Jon-o]

I'd rephrase your question a little: unless your infrastructure is heavily based on MS software already, it's going to be expensive and a huge hassle.

Of course, most businesses just run windows, and have no interest in anything else. In that case, I expect AD would work really quite well. From what I've seen of it, there's an awful lot that it does very very well, and a lot that isn't really doable with other systems, at least not without a lot of messy hacking.

That said, most of those interesting features are only available to windows machines, so if you use anything else, you've basically just got a very expensive and quirky LDAP server. In my case, I work at a university that is in the process of switching to AD - it's been several years and the process is ongoing, and it's been *painful*. I think there have been some poor setup procedures complicating matters, but in general, there are several departments that don't benefit from the system at all, because they don't/can't use windows and MS Office.

Of course, a university is an extremely hererogeneous situation, and this is a large organization with a million overlapping previous IT structures. I expect it would be much simpler with a company.

To sum up - I wouldn't go with AD unless you know you can stick with it for the next decade or more at the very least, and will never be using anything other than MS software. You just might find yourself in a very messy situation otherwise.

Re:Easy.

[GungaDan]

"It is sort of like joining a secret cult."

Shhhhhhhhhhhhhhhhhhh! The first rule of Novell club is that you don't talk about Novell club. ;-)

Re:Easy.

[vgaphil]

I myself and am MCSE and run my own consulting company where the majority of my clients run Active Directory.

Don't the majority of your clients run AD because you are a MCSE? Has there ever been an instance where you offered them something other than AD? Just wondering.

Re:Easy.

[nkrgovic]

- the Sun/Netscape/iPlanet/SJSDS-whatever-they-call-it-t his-second tends to run well directly out-of-the-box without the need for much in the way of expertise, in smaller environments. I would call this directory the defacto standard (although this statement may now be obsoleted by the advance of AD - hard to say). If you are using other SUN infrastructure, or if you are using the Sun Calendaring/Messaging product (which I would recommend as a very solid alternative to MS exchange), this DS is an excellent choice.

Been using this for over a year, without a single glitch. Setup is a bit long and complex, but it's straightforward and well documented. Once you're out of it however - everything runs smooth, and without any problems for very long periods of time.

The only advantage AD has is, well, AD integration - in the sence that you can define windows policies much stricter than with generic directory. However, you can integrate Sun JES with AD, and store AD data in Sun LDAP. This integration makes a lot of sense too : you use Sun for everything, and just add AD to directly control windows machines (and maybe add automated upgrades to the story too).

All in all - I higly recommended it.

Re:Easy.

[DigitalJeremy]

Well said!! I second your comments, wholeheartedly.

Being a tech doens't mean being a platform tech, it means fixing computers and making recommendations considering cost, ease of use, scenario, and the user. Maybe ISA will work, maybe a *nix firewall will be OK too. Depends on the situation.

Re:Easy.

[op00to]

However, it would wrong of me to recommend to a client that they actually consider a new installation of Netware just because it's technically superior, or worse, just because I like it more.

Are you high? Of course you should recommend a product because you think it's technically superior -- that's your job, that's why you're the expert. You pick out products. As long as it works, and it works well, and isn't a support headache, what does it matter what the server software is?

Re:Easy.

[sumdumass]

I ran into a tech durring a joint venture once who thought having some things break every once in a while was job security. He actualy prefered certain products over others because of thier know issues and bugs.

I explained to him that every succesful, low maintinance instal or setup he had actualy made more money in the long run due to referals and upgrades from growth. He was either playing games with me or actualy didn't understand the concept of doing somethign to the best of yuor ability and having that effert come back to reward you.

Some people might not recomemd a product specificaly because it is superior. It would seem that being onsight looking like an expert is more important then being the expert. Can't say it is what the grandparent post is doing but i know of others who will.

On another note, I almost had the local newspaper talked into running a survey/story once. The plan was to get a few drives and mirror the install from a computer after installing a reletivly harmless virus and making a couple obscure config changes which would point to hardware. Then taking the same machine to the various different local repair shops and reporting on their findings and solutions, how well it worked afterthe repair, as well as the costs of fixing it. We would place one of the other mirrored drives in before sending it to the next shop for the same purpose (so they all had the same problems to fix).

The editor decided against it for fear of a lawsuite and thinking the cost would be too high to pay for the fake repairs. He eluded to bestbuy charging over $250 for a virus removal and spyware cleaning on his home computer once.

Re:Easy.

[zevans]

This is definitely true. I've found it much easier, if instead of thinking of people as Windows techs, or Linux techs, you simply think of them as techs.

There ARE people out there that understand Windows, AND AD in some depth, AND Linux, AND TCP/IP, AND SANs, AND the implications of integrating that lot into some sort of solution, AND the applications on top, but there are not many of them (us!) (Which is why we charge what we charge :-) )

I've found that usually such people understand Unix first and then everything else later, and it's not often people go the other way, from MCSE to Linux god. This is because really you have to understand the idea of an OS, and a network, and a directory, and then just work out the foibles of a particular implementation and apply your transferable skills. MCSE just isn't taught that way, whereas implementing things on Unix tends to teach you the principles of what you're doing because you can't just click your way around at random.

Re:Easy.

[SillyNickName4me]

Are you high? Of course you should recommend a product because you think it's technically superior -- that's your job, that's why you're the expert.

What kind of unrealistic utopian world do you live in? That is not the job of a consultant. The job of a consultant is to find a solution that is suitable to the clients problem and advice them on getting the solution implemented. Technical superiority is an argument, but is irreleavnt if there is no good match between the proposed solution and the customer situation (which is the first and more important argument in such choices)

Re:Easy.

[Anonymous Coward]

The only advantage AD has is, well, AD integration - in the sence that you can define windows policies much stricter than with generic directory.

That's a misconception! Applying policies to client machines is NOT a job of the directory! The directory is a data store. Of course, you can have a management system running on top of the directory that does this. For example Novell's ZENworks Desktop Management product can do most of what AD does in this area (such as Group policies, distributing MSI packages, etc.) and much more (workstation imaging, inventory, application launcher). However, Windows admins usually see AD as the only way to manage a large number of Windows workstations.

Re:Easy.

[Anonymous Coward]

Not really. Oracle's software is standards compliant - for example their Internet Directory is fully LDAPv3 compliant. On top of this they provide tools that not only allow integration with exisiting directory services, such as Microsft's Active Directory or SunONE, but also some useful development tools for a fully customised experience. Better do some research in the future, rather than just making stupid comments.

En abyme

[timeToy]

There is no directory service for directories services ?

Perfect directory service solution

[Anonymous Coward]

1. Install Windows XP SP1

2. leave open without a router

3. never patch, and notice people turn your computer into a fileserver solution

4. Profit!!!!!
 

3. Mac OS X Server

[dgatwood]

Considered Open Directory?

Other options?

[MonoNexo]

What ever happened to Novell? I used that at the college I attended - web apps, email, directory, rempote access, etc. Is this no longer a valid option, or was it just forgotten on the above list?

Re:Other options?

[killjoe]

It's all still there, it's still viable, it's still better then what MS offers, it's still cheaper then MS.

Just because something doesn't get a lot of press doesn't mean it's gone.

Re:Other options?

[Anonymous Coward]

> better then what MS offers, it's still cheaper then MS

I think you mean better than. "Then" means soon after that or following next.

Re:Other options?

[xgamer04]

What ever happened to Novell? I used that at the college I attended - web apps, email, directory, rempote access, etc.

It's used at my college as well. Of course, now we're using stuff like Moodle as well (which rules, btw).

Re:Other options?

[iolaus]

I converted a 150+ user enviornment from Novel/Groupwise to Win2K3/Exchange and I can tell you that Novel+Groupwise is not any easy system to manage. Win2K3 and Exchange certainly have their quirks and some pain-in-the-ass things here and there but they were much much more friendly to maintain in my opinion. In addition, Windows 2003 provided Group Policy management that made a massive difference in the required setup and maintenance of client boxes.

Re:Other options?

[Blakey Rat]

There's:

Exchange/Outlook
Novell NDS/Groupwise
Lotus Domino/Notes

The problem is, of the three, Outlook is the only email component that doesn't utterly suck ass. Groupwise and Notes are both bloated pigs with terrible, terrible GUIs... even worse if you run a Macintosh (compared to Entourage, the MacOS version of Outlook.)

It's not just about making you, the admin, happy, you need to make your users happy also. I can guarantee people won't be happy with Groupwise or Notes... if you're choosing from those three, Outlook is the only practical solution.

If you make your own cobbled-together Linux solution, you can use many good email clients with it, so that becomes a non-issue.

(And if anybody from Novell or Lotus is reading this, FIX YOUR GODDAMNED EMAIL CLIENTS ALREADY. How many DECADES does Lotus Notes have to be a mutant pig before somebody figures it out and starts fixing the problems? Sheesh! You can't complain about Microsoft stealing your customers if your product sucks ass.)

Re:Other options?

[afidel]

God do I hear that. Novel's solution would be a lot more tempting if it wasn't for the abortion known as Groupwise. It's the single worst email solution I have ever used. When I was a consultant I winced every time I had to fix a problem on a customers Groupwise server, or even had to load the slow arse Java management console.

Re:Other options?

[leandrod]

still better then what MS offers

How so? As far as I know its only benefit over MS products is that it runs over GNU/Linux and Evolution, and perhaps has better LDAP and Kerberos compliance. Other than that it is just as proprietary, and less popular. And their Netware OS is still a joke.

If you're open to different hardware...

[Anonymous Coward]

...check out Kerio Mailserver on Mac OS X Server.

I'm currently evaluating the combination above to see how good a job it will do replacing Windows and Exchange. Looks promising so far, and it supports MAPI-- so end users can use Outlook.

Re:You want to save money?

[Mr. Underbridge]

Christ on a motorcycle, it doesn't matter what machine he runs, that doesn't solve his problem. Goddamn, at least keep the evangelism moderately relevant.

Look at OpenExchange

[adturner]

It's a standards based (LDAP) mail/groupware app which supports standard SMTP/IMAP clients as well as Outlook/Palm clients (for an additional fee).

Seems competitively priced to Exchange and there's also a free pure OSS version available (although if you want offical support and a nice installer, you need to pay for it).

http://www.openexchange.com/

I haven't personally used it, but I've been looking at it as an Exchange alternative (I really really hate exchange) for the small company where I work.

Re:Look at OpenExchange

[Anonymous Coward]

Look at cybozu solution (www.cybozu.com). I have implemented it on Linux and Windows solution and it is does support Outlook.

There is also a very interesting email solution released by Zimbari (www.zimbari.com) which runs on Linux.

Re:Look at OpenExchange

[Doc Ruby]

Open-Xchange uses OpenLDAP by default, though they claim any (standards-compliant) LDAP server can be plugged into it. And there is documentation of people plugging Samba into it, the way a Windows Domain Controller would plug into Active Directory.

The LDAP datastore is kept separate from the rest of the data (which is in Postgres), and I've heard of some problems with "LDAP clients", like Evolution, which can't write Contacts to the server. Which allows those Contacts to get out of sync with Contacts entered through the Web interface. Though perhaps there is a solution from installing OpenLDAP with Postgres as its datastore, and patching the two Contacts DBs together, but that sounds like LDAP wizardry to me. Outlook seems to work without a hitch, using their OX "driver" (which is $ware).

The OX user community is active and lively, collaborative. And OX is a very exciting groupware platform that's just being born. It could use more commercial deployments and the "non-negotiable" specs that developers there would adapt to.

Re:Look at OpenExchange

[jbellows_20]

Why hate Exchange? I've managed Exchange 2000 and 2003 for 5 years and I have loved working with it. Simple to setup and manage and loads of features. I've looked for a truly comprable OSS option and haven't found one that does nearly as much with the same ease.

Re:Look at OpenExchange

[jaseuk]

Having trialled openexchange I wouldn't recommend it, particularly as an exchange replacement for use with outlook. The Outlook integration is poor quality and doesn't correctly support alot of groupware functionality. Shared calendars for instance are not handled very well at all.

Openexchange seems to treat the outlook connector as a stepping stone to getting everyone using the web interface which although usable is not the ideal platform for everyday use. Web clients should be supplemental tools for use away from the desk and not as a primary means of working with a system.

Openexchange also does not play nicely with PocketPCs or other tools that sync to Outlook folders.

One product that is very promising and perhaps even has better groupware functionality than exchange and is linux based is Scalix.

This has a very high quality outlook connector and a very nice webclient. Amongst other things it allows users to delegate their own mailboxes to other users, configure their own shared calendars. Allows users to access group mailboxes and has nice offline working.

Scalix is Linux based and runs on top of Redhat Enterprise Linux or CentOS.

It's not cheap, but if you are looking for a Linux based quality alternative to exchange then it's a good bet.

Jason.

Re:Look at OpenExchange

[adturner]

Because I don't use outlook. Getting Exchange to play nicely with fetchmail/mutt is a PITA. I've never been in an exchange environment where the admin ever was able to turn on SSL for IMAP (something like having to reinstall IIS and Exchange from scratch???). Not to mention, non-standards based calendaring.

The webUI is broken in Safari/Firefox.

Basically, you're a 2nd class citizen if your company uses Exchange and your not using Outlook/Windows.

Re:Look at OpenExchange

[sumdumass]

I'm not sure what you mean by plugging Samba into it. I do know that Samba 3 can authenticate from LDAP and is able to use the same userset i have for a postfix install going to the same LDAP implementation. I don't know if that is even close to what you were looking for. The adduser and smbadduser script probably could be modified to invoke each other.

Re:3. Mac OS X Server

[Anonymous Coward]

Open directory is (as I understand it) basically openLDAP with a config file and a nice GUI. Don't get me wrong, GUIs are useful, but if you want to go OSS, cut out the middleman.

Of course since the questioner didn't mention openLDAP to begin with, he's probably better off with a "managed" solution like MS or Apple.

STOP....

[ellem]

just save yourself the trouble

W2K3.

Just shut up, buy it and be done with it. It'll hook up with whatever you're running and it is fine as long as you take the same precautions any decent Sys Admin would.

Re:STOP....

[Anonymous Coward]

it is fine as long as you take the same precautions any decent Sys Admin would

You mean turn on all the services and connect it directly to intarweb?

Re:STOP....

[j-cloth]

You have to use the right tool for the job. In this case there is no directory server that can touch AD. Any other solution is just trying to replicate it.
Exchange, I'm no so sold on, but it works and is well documented enough that you can do most of things with it that you will want.

Re:STOP....

[Anonymous Coward]

You're a moron. Just as you wouldn't hook a Linux/Unix box destined for life as a server directly to the network, you'd not do that with a Windows server, either. You install, download SP1 off of another machine, and apply the SP. Then you attach it behind a firewall, like any other server.

I'm so fucking sick of this mindset on this site ... time to find a real 'news for nerds' site.

Re:STOP....

[aaronl]

Novell with NDS does all that AD does, and a lot more. It is an incredibly well designed directory server, and it existed before AD. The big reason to go with AD is because of group policy; I don't know if NDS has an equivalent to it.

It might still be that W2k3 is the right tool, but please, have your information straight!

Re:STOP....

[Curunir_wolf]

This is a troll?

WTF?

Re:STOP....

[aaronl]

I guess that somebody doesn't like me!

Re:STOP....

[killjoe]

Nah, some MS shill modded you down so that your post won't be visible. The astro turfers are always very active when novell or oracle is mentioned.

Re:STOP....

[divisivemind]

Though I've never laid eyes on an OSS directory alternative to W2K3, I'd be surprised if it could be any either to use out of the 'box'. Another thing, if you plan to do some LDAP work, in say perl, modules exist that can add/remove/delete/etc from your AD that are rather painless to use. Automated account addition.... On a side note, for those in higher education, there is a good chance you have a campus-wide MSAD. Where I used to work, we kicked all students out of our domain and instead one way trusted their campus MSAD accounts. Imagine not having to deal with user accounts again =) This still allows you to moderate access to your domain machines (assuming you have the proper OUs set up) and retain administratiive (both local and domain) control over your machines. We chose to leave faculty/staff on the old domain for the ease of not changing the entrenched. This was actually a pretty seemless transition. Students still have access to their home directories on the local domain (ala perl automation) and FTP/Terminal Server access. FWIW have fun.

Re:STOP....

[AmigaBen]

It's eDirectory these days, rather than NDS. And as for group policies and so much more, see ZENWorks.

Re:STOP....

[Anonymous Coward]

Ironically, you would hook a Mac directly to the network. Because Macs are secure out of the box.

Re:STOP....

[Anonymous Coward]

if you plan to do some LDAP work, in say perl

Then just fucking kill yourself.

Re:STOP....

[Anonymous Coward]

Had the question been "what is the best directory service for managing Windows desktops" then undoubtedly you're right.

But it wasn't, the question was what is the best directory service, non OS specific.

AD wins hands down for Windows networks sure, put a load of Unix/Apple machines into the equation and you can forget it.

Re:STOP....

[Anonymous Coward]

Mindset on this site? If you actually ran any servers and realized that most windows servers in small companies, schools etc are connected up like this then you may get the joke. In the interim, kindly take your little pissy-fit over to a MSDN blog.

Re:STOP....

[AngryElmo]

Along with Zenworks (an eDirectory enabled management application) you can have your group policies too! Buy Netware (or Open Enterprise Server - Suse SLES 9.0 + Novell services by another name) and you'll get all of the eDirectory and Linux goodness, plus DirXML which is a programmable metadirectory allowing synchronisation between eDirectory and whatever you want (including MS-AD)

Re:STOP....

[Ath]

You can absolutely apply group policies using Zenworks, which is the absolute best Windows application distribution and management solution on the market. Fully integrated with eDirectory.

Re:STOP....

[sgtrock]

Group policy have been in eDirectory for several years. Microsoft COPIED the concept from Novell, for heaven's sake!

Re:STOP....

[AngryElmo]

Although I use Zenworks every day (and love it), by no means would I suggest that Novell invented group policies. Novell just found a way to make group policies useable. MS (native) has since caught up on that aspect. But there is more to managing windows devices aside from group policies....

There are Other Options

[Anonymous Coward]

Other Options to Consider:

Novell:
Linux Small Business Suite
http://www.novell.com/products/linuxsmallbiz/
It includes edirectory, groupwise for email, suse enterprise server,Novell ZENworks Linux Management Client

IBM (Lotus)
http://www.lotus.com/lotus/general.nsf/wdocs/nd7co ntent
You can use Domino as an ldap server.
Other IBM Software on Linux:
http://www-306.ibm.com/software/os/linux/software/
or
http://www-1.ibm.com/linux/matrix/

Re:There are Other Options

[spazimodo]

I would second Domino. Exchange is definitely a lot more popular in the SMB space, but I think a pretty compelling argument can be made for Domino.

I (along with one other admin) support around 9000 mailboxes for a F500 on Domino 6.5 on Linux. We still have plenty of time for other projects. Exchange is easier to set up, but Domino is far easier to keep running. (try manipulating messages in an active mail queue in Exchange.)

The major complaint about Domino is the unappealing client. I happen to like it, but then I'm a Lotus fanboi :) (Though I also think that OWA2003 is a much nicer webmail client, in Internet Explorer at least, than DWA6.5) For multiple sites however Domino replication could be a huge benefit since I think the performance is substantially better over slow connections than the equivalent in Exchange/Outlook.

I also suggest looking at IMP/Horde (http://www.horde.org/) as a front end for IMAP. I think IMP is a fantastic mail client, and previously while consulting for small and mid size businesses I found that people loved it.

Re:There are Other Options

[darqchild]

Our company tried lotus. It's awful. Active directory is more reliable.

After our experiences with lotus, upper management told us to roll our own.

Still in the process of doing that. The only thing missing is a decent calendar.

Re:There are Other Options

[Khan]

I also recommend Domino. I have been running a Domino 5x server for 4500 clients for the last 4 years on 1 server (with a 2nd in failover mode). Running and taking care of the server is cake. The Domino Admin. client blows away the Exchange admin. client by a long shot. Every Exchange admin. that sees what I can do via Domino is in awe. The Notes client has gotten better and for a company of 100, it'll be a breeze to manage. And it runs under Linux so you can save on the cost of a Win2K3 server license.

Re:There are Other Options

[IgorMrBean]

I would definitivly say Novell eDirectory They are doing directory services for so many years, and eDirectory is fully cross-platform, full-replication, etc.etc.. Linux Small Business is not suitable here, because it is for less than 50 employees.... But an OpenEnterprise server would be good for them. It can run ZENworks 7, and Groupwise 7 (full linux/windows/mac support)

Re:There are Other Options

[Daengbo]

Since your Novell Linux Small Business Suite is priced at up to 100 users, it sounds like that matches the submitter's needs and "maximizes value." I think I need to puke after using that phrase...

Novell NDS

[kalibyrn]

There's also Novell's NDS... That could be your third option perhaps...

Re:Novell NDS

[Anonymous Coward]

Novells's server also has its calendar system well integrated for freely available tools in Linux, UNIX,and MacOS, unlike every other commercial grade server.

Oracle *has* one they bought from Stettor, which bought it from Netscape, which got it from etc., etc., etc. The unfortunate result is that "integrating the software into their new business model" is the only thing they've been able to do for the last 3 years or so, and it's thus woefully out of date and has never properly been streamlined or debugged. Installing Oracle to support is a huge burden not suggested for anyone with only 100 users.

Re:Novell NDS

[IgorMrBean]

Precision : NDS (Novell Directory Services) is no longer existing. It was part of Netware, and has been seperate from it's core to be eDirectory. eDirectory runs on Windows, Linux, Netware, Unix, Solaris

Another Consideration

[joelleo]

What exactly is the newly merged company doing? Is it supposed to be geeky-cool? Is it doing something totally unrelated to computers or technology? Is the IT infrastructure just a means to an end - users getting their work done?

If the company is trying to do something geeky-cool, you may be best served by using a "cobbled-together" open source architecture. It'll show your boy's and girl's prowess on the console and could be used as a Hercules-on-a-pedestal showcase for your talents.

On the other hand, in either of the other two cases, you're most likely going to be using MS on the desktop and your people aren't going to care that you've implemented OpenLDAP as long as their Word, Excel and Outlook work. In this situation, as has already been noted, you'd probably be best served by implementing Windows Server 2003 + Active Directory. An additional benefit is the expertise is relatively cheap and available, and may already be in-house with your amalgamated IT staff.

Good luck!

Re:Another Consideration

[benjamindees]

may already be in-house with your amalgamated IT staff.

Or there very likely isn't an IT staff, almagamated or not. Three companies that join to form 100 employees, with poor infrastructure, typically means one company of 50 employees and a "Windows admin/something else" and two companies of 25 employees each that paid somebody to setup their networks five years ago and have since just watched it deteriorate.

It sounds like the inquisitor is about to inhereit a huge mess without necessarily the skills or resources to deal with it. If that's the case, I'd suggest taking a long-term approach:

1) Decide who will manage the network (this is a full time job),
    A) if it's you, then
          i) choose what you're most comfortable with, else
    B) if it's not you, then
          i) put an ad in the employment section, outlining your requirements in a non-specific way, contact outsourcing firms, and take applications.

You may be suprised at what you get. Linux and Open Source can save a ton of money and hassle long term, especially when implemented from scratch, but you have to know what you're doing. If you don't know or aren't sure, get help. A company of 100 employees can easily justify having two admins, especially when combined with the savings Linux and OSS are capable of.

Re:Another Consideration

[Penguinshit]

Cost is definitely a major factor here.

While going the W2K3 route would be easy and very functional, one has to take into account the cost of the eventual [forced] upgrades. A company of 100 folks probably isn't turning a wild profit in terms of real money, and what money there is will undoubtedly get funneled into R&D or advertising or SomethingOtherThanITInfrastructure. This is where the long-term cost savings on a "cobbled" solution will pay off handsomely.

The decision is best made right now.

Re:Another Consideration

[Penguinshit]

Troll?

I dare that coward asshat who modded me troll to come out from under his/her rock and prove the honesty of that mod.

I guess that person never heard of the "Software Assurance" program from Microsoft that forces upgrades every two years (with the alternative being a highly-inflated upgrade price whenever one is eventually required to upgrade). Everything else I said comes directly from my decades of personal experience in administering Microsoft and Unix/Linux (as well as Mac) networks.

I've got karma to burn. But leave your bullshit agendas out of the moderation (that goes both ways).

Re:Another Consideration

[secolactico]

This is where the long-term cost savings on a "cobbled" solution will pay off handsomely.

But will the "cobbled" solution scale properly when the company of 100 folks becomes a company of 5000 folks distributed worldwide? Unplanned-for growth can be messy in "cobbled" systems, and if you take the time to develop a solution that will grow well, then you might be devoting too many resources to the IT infrastructure.

Also, in a company of 100 folks, how many will be in the IT department? What will happen when those folks leave the company (by moving on to greener pastures or getting hit by a bus)? Will the next guys be ready to provide the support needed?

You don't have to go the Win2003 route (I can't bring myself to refer to it as w2k3... looks kind of wrong...). There are several other directory systems available. There must be a couple that's priced reasonably and scales well.

Re:Another Consideration

[Forbman]

100 folks becomes a company of 5000 folks distributed

Yes, because chances are the successful 100-FTE company will get absorbed by a 3000-5000 FTE company, not grow into that level, and the bigger company will just absorb or migrate.

But if the 100-FTE company does grow, it's not going to happen immediately. If it took 15 months to get to 100 FTE, it'll take 14x50 months to get to 5000, at least.

Besides, "what will happen if the IT Dept gets hit by a bus" matters a lot less than "will our product suck?" or "will be sued for something?".

Unless just starting out, chances are, things will keep rolling for awhile on their own, even if the entire IT dept suffers simultaneous cerebral hemorrhages one night. Which means, the company will get to throw good consultant $$$ at it until they come up with a new plan.

IT is important to a company, but it's not as important as AP/AR...

Re:Another Consideration

[nutbar]

Howdy,

Your comment about being "forced" to upgrade or to pay a huge price when you want to shows a gross misunderstanding of Software Assurance. Any business is free to purchase whatever products they want and stick with them. All that it means is that:

• Business's that don't purchase software assurance are free to stick with their current version of the product, or pay for new versions or upgrades when they come out, if they feel so inclined.
• Business's that *do* purchase it have the option of upgrading at their leisure, as software assurance entitles them to the rights of the new version

It also makes licensing a hell of a lot easier - you don't have to keep track of the huge number of different versions of software that large businesses typically have installed.

Re:Another Consideration

[Nefarious Wheel]

Cost is definitely a major factor here.

Whups, business hat on here -- how do you know that? 100 employees in three firms might be 100 corporate attorneys each of whom believe a 450SEL is a minor expense. In that case, reliability and ability to get the caseload connections would be far more important.

My point - look at what your users want to do, first. See who they have to interact with, first. Choose your options based on whatever gives you the lowest aspirin bill. If it doesn't matter who they talk to, then you get to make your choices. But don't presume what your end users want, find out first. Applications determine infrastructure.

If your 100 user firm exclusively provides services to a 10000 seat government that's gone Open Office, then that's probably the way to go. If you trade Notes docs a lot, go Domino. If your major client base is Microsoft-only, you go that way.

I have some very clear ideas as to which is better, but I'd rather give my customers a vote in how they want to spend their money. If they're clueless, then there's an opportunity to educate. If I want to sell a technology, I'll find out what their priorities are first and then find the best match I can.

Don't forget geography, either. If you're surrounded by university campii, it's not such a reach to go Linux/OSS. If you're in Medicine Breath or Oatlands and the nearest tech suppliers / support office is a short plane trip away, you go with what they have.

Re:Another Consideration

[Anonymous Coward]

Well, it wasn't me, but for instance:

While going the W2K3 route would be easy and very functional, one has to take into account the cost of the eventual [forced] upgrades.

Prove that there will be eventual forced upgrades. Plenty of people run w2k to this day and are not being forced to upgrade, unless you assume that FUD=forced upgrade. Please.


A company of 100 folks probably isn't turning a wild profit in terms of real money, and what money there is will undoubtedly get funneled into R&D or advertising or SomethingOtherThanITInfrastructure.

bullshit. 100 people can make massive profits and have only internal software to drive the business. You are making generalizations about market segments that you don't bother to acknowledge. Those market segments have been shown to run their internal software on Windows, so your point is both ambiguous and misleading.


This is where the long-term cost savings on a "cobbled" solution will pay off handsomely.

Special pleading. Nice try, though.

I guess that person never heard of the "Software Assurance" program from Microsoft that forces upgrades every two years (with the alternative being a highly-inflated upgrade price whenever one is eventually required to upgrade).

Software assurance is for suckers. Nobody in their right mind would buy into that bullshit. Given that many not in their right mind have done just that, intelligent choices can still avoid the upgrade roller coaster.

Mods can sometimes call a troll a troll and actually be correct.

Can you even show for the supposed bullshit agendas that you claim against your post?

It's best to stop these things early on, hence MODERATION. Have a nice day.

Re:Another Consideration

[SparklingClearWit]

You may be suprised at what you get. Linux and Open Source can save a ton of money and hassle long term, especially when implemented from scratch, but you have to know what you're doing. If you don't know or aren't sure, get help. A company of 100 employees can easily justify having two admins, especially when combined with the savings Linux and OSS are capable of.

Y'know, I keep seeing this argument on Slashdot, and it's always with the caveat "almost as good" or "the savings that Linux provides".

I've yet to see somebody come up with a real cost savings - a TCO study - for a small business using a "cobbled together" Linux/OSS solution compared to a Windows-centric solution.

Firstly: The admins. Linux admins aren't plentiful. They might appear so here, but just because you've installed Gentoo, you're not a real admin. Your users and business owners will dictate to YOU how things will be. You can have influence, and you may steer things, but being a zealot doesn't pay the bills.

Let's say they hire you, and you implement OpenLDAP, perhaps Linux for Terminal Services on the desktops (you smart guy, you), and a snazzy Windows-like distro for the execs and upper dudes in your 100-seat organization. You've got the desktops all set up great, etc., and new machines go on the network with no problem.

Now, the company is acquiring another firm - and they use (Oh Noes!) Windows! (oops, sorry - M$ Windoze - did I do it right?) They've got a KillerApp(TM) that your suits decide they Must Have and Use Daily as it will Multiply Productivity!

So you test. Oops, no OSS equivalent. Damn. Ooops, doesn't work in Crossover Office. Or Wine. Damn again. The company has no plans for an OSS release. Damn again. So ... you can install a couple Windows machines to satisfy the execs, right? Ooops, then they push it company-wide. Oh, sorry boss - you've gotta pony up for 100 seats of Windows XP Professional so we can run this app.

Second scenario: After this horrible mess, you decide to leave for purer, greener OSS pastures. what does the company do? Did you document all your work? Does *anybody* know what you've done? After all, you can't just 'pick up' Linux - it's not easy, like dumb old Windows! So how does the company hire to replace your knowledge? Oh, they can't? You're indespensible now?

These thoughts are what percolate through the minds of business owners. They're not uninformed about Linux. They've heard all the zealotry and pitfalls, and the risk to their business is NOT worth it. The cost of upkeep, finding workarounds to compatibility with their partners, vendors and customers, and the inability to just 'buy a program' is the hamstring for mainstream business adoption.

Re:Another Consideration

[DaveV1.0]

While I won't argue about the growth and take-overs, I would like to remind of one little thing.

IT is never important to a company until the T stops working and the I is unavailable. At that exact moment, IT becomes the center of the universe.

If your accounting dept can't access AP, AR, or the GL because the cobbled together system stopped working and the only person who knows how it works and can get back up was hit by a bus 6 months ago and replaced with "the guy in shipping that knows computers", you can bet IT is the most important thing in the world.

It is just like backups. Backups are never important to anyone outside IT, until they are needed. At that point they become invaluable.

A company with 100 FTEs will not want to spend huge amounts of money for a contractor/consultant to come in and set things straight. And pay they will, just like people pay $1000.00 to get important data off of fried hard drives.

It is better to have a system that is fairly simple, well documented, and easy to maintain and at least two people who know how it all works. Even if one of them is part time, the odds of your entire knowledge base leaving one day is decreased dramatically, as is the odds that something bad will happen during that critical persons vacation.

Re:Another Consideration

[ocbwilg]

I guess that person never heard of the "Software Assurance" program from Microsoft that forces upgrades every two years

Software Assurance is not mandatory. There are quite a few companies (probably the majority) who don't use SA. Mine doesn't. Upgrades are still cheaper than buying new, but most companies aren't all that keen on constantly upgrading, and the ones that are will go with SA. Most companies buy new hardware, and buy it with and OS and applications they will need. The hardware runs and does it's job for 3-5 years, and when it's ready to be replaced the next version of the OS and applications are purchased.

I dare that coward asshat who modded me troll to come out from under his/her rock and prove the honesty of that mod.

You can't mod and post in the same topic. But assuming that the coward asshat did come out under their rock what would you do? Kick their ass? Grow up. Bad moderation is usually corrected by othe mods and is somewhat lessened by metamoderation. Get over it.

Re:Another Consideration

[ocbwilg]

While going the W2K3 route would be easy and very functional, one has to take into account the cost of the eventual [forced] upgrades.A company of 100 folks probably isn't turning a wild profit in terms of real money, and what money there is will undoubtedly get funneled into R&D or advertising or SomethingOtherThanITInfrastructure. This is where the long-term cost savings on a "cobbled" solution will pay off handsomely.

There are not forced upgrades with Windows. If you choose to buy into Software Assurance that's a different story, but I have yet to see a company that actually does go with SA. When you're dealing with a small company that "probably isn't turning a wild profit it terms of real money", what are the chances that they will choose to pay annual rental fees on their software instead of just buying the licenses outright at the time the hardware is purchased? Pretty slim I suspect.

I also think it's ridiculous to think that the "cobbled" solution will be significantly cheaper (if any) in the long-run than an off-the-shelf solution. By it's very nature it is going to involve significant work integrating (cobbling) the different products together, and that will cost time and money. And assuming that it is built on an OSS or Linux platform, what are the chances that they will have qualified administrators on hand to keep the cobbled together system together? Outside training and consulting is expensive.

Re:Don't listen to these fools

[Anonymous Coward]

Yea...listen to that little red, horned devil on your shoulder. Or you can listen to the force and shun the dark side and the son of Satan.

Fedora Directory Server

[LnxAddct]

Use Fedora Directory Server or Red Hat Directory server. It is derived from the acclaimed Netscape Directory Server. It is easy to set up, scalable and *just works*. For groupware just use phpGroupware or something. If all you need is mail access, I recommend Roundcube for the web access, it uses Ajax to give a nice user experience akin to Yahoo or Gmail. Keep an eye on the Hula Project too, it looks like when a release it made it will be real nice.
Regards,
Steve

If you end up going OSS...

[HeelToe]

Also check out Fedora Directory: http://directory.fedora.redhat.com/wiki/Main_Page

Communigate pro

[not_sleepy]

Stalker.com and rad thru alll the possibilities! It runs on almost anything.

NDS

[discordja]

I'm sure some /.ers can give you a better view of the quality of Netscape Directory Server but from the rumblings I've heard it's a complete package and it's pretty damned amazing (not to mention it supposedly scales through the roof).

You can check out the documents here

Re:NDS

[tonyr60]

Netscape Directory Server is now Sun One Directory Server and it is pretty damned amazing. Performance leaves AD for dead.

Re:NDS

[Anonymous Coward]

Not to mention, you can couple it together with the Sun identity server/identity manager.

I help maintain a Sun ONE Directory Server LDAP deployment that has well over 100,000,000 records at the moment. Our solution is integrated with Sun ONE Messaging Server so we provide POP, IMAP and Webmail for our users, too.

It's not cheap, but once you've learned it and paid for it you can do some amazing things with it and it's such a perfectly complete solution that I wouldn't trade it for anything. I can't even think of how much my job would suck using any other directory product right now.

Re:NDS

[Penguinshit]

I can, too, can vouch for the Sun ONE Directory Server. I use it to handle authorization for various websites (which also use the Sun ONE applet server) as well as the email security for a couple of start-ups. Postfix and Courier work very well with it.

I one day hope to test the scalability...
:-)

One vote for...

[PooR_IndiaN]

MS Exchange/Active Directory (Cause I'm a Support Tech for AD!)

Re:One vote for...

[PooR_IndiaN]

forgot to type in (FLAMEBAIT)

Novell

[Anonymous Coward]

I don't know what your selection criteria are, but it seems to me that you have another choice: Novell's products. More specifically:
1. Directory Services: eDirectory. It runs on multiple OS platforms such as Windows, Linux, NetWare, Solaris, etc. It is more robust than AD, particularily across wan links (viz. replication). And of course it is LDAP v3 compliant so nearly any LDAP client can use it for authentication and authorization.

2. Open Enterprise Server, Linux and NetWare. For hosting your file and print services. You get the best file system out there - NSS - on either platform. Real ACL's and vastly more refined trustee assignment and inherited rights filtering capabilities than any other filesystem.

3. Groupware/Messaging: I am less experienced in the alternative offerings in this catagory, but I believe that Novell has a decent product in GroupWise 7, which runs on Windows or Linux or NetWare.

Again I don't know what your selection criteria are, but you may have skipped Novell due to lack of awareness...

Cheers.

I know! I know!

[Anonymous Coward]

Pick out one of the most osbscure, underdevelopd linux distro (I suggest shadbix.) You want it to be underdeveloped because you are going to port it some old routers. Next go to source forge and look at all the directory services packages, messaging packages, etc packages. Pick ones with a version numbers less that .0.0.0.2. Once you get it all working, leave the confines of your basement and HIRE SOMEONE WHO KNOWS WHAT THEY ARE DOING. If out of your hundred plus employees, you don't have an admin capable of this. Get rid of one or two and get someone who does.

Re:I know! I know!

[mabhatter654]

The whole point is that he wants to learn to be the expert! If everybody on slashdot knows so much why is this such a difficult question? This is where the rubber-meets-the-road folks... if you want to use Linux and OSS professionally these are the questions that need answered by the community.

Re:I know! I know!

[myz24]

Mod this guy UP!

There haven't been a lot of useful answers for this guys question.

Personally I understand what the question asker looking for. I've been a RedHat guy for years but I'm really disappointed with the their "enterprise" offerings. Their tools for configuring the various server packages are WEAK. The DNS configuration interface is iffy at best, DHCP...doesn't exist. You can barely setup a Samba system more advanced that you'd want to use at home. Any of the real options require you to hand edit the files and while I'm perfectly happy doing this on a very small network or at home it gets tiresome on larger networks.

Also, if RH wants to charge a guy a minimum of $300 per server for ES then they damn well better provide me with the tools required to make my job quicker and easier to cover that cost.

In the end, I think this guys best bet is to go with AD or eDirectory.

Re:I know! I know!

[Anonymous Coward]

Also, if RH wants to charge a guy a minimum of $300 per server for ES then they damn well better provide me with the tools required to make my job quicker and easier to cover that cost.

I read the licensing for enterprise pretty closely, as did my boss. We both concluded that the $300 was for support and could not find anything about not being able to install on multiple servers, so we only bought one copy and have installed it on quite a few servers. I have read many, many legal docs in my life and the few that I have passed on to my personal lawyer never really told me anything that I did not already know by reading it first.

Re:I know! I know!

[DaveV1.0]

The reason this is such a hard question to answer is the same reason EMAC vs VI is such a hard question. Everyone has the system they believe is better and will promote it religiously, even if it is not the best solution to the problem.

In a word, fanatasism.

Re:I know! I know!

[myz24]

You both need to go read it again. $300 gets you nothing but access to up2date. You must pay $300 for each machine you want to update via their system unless you want to authorize one, update it, authorize a different one and so on. That's a hassle.

XAD

[lukehatpadl]

Try XAD from PADL.

To Windows clients, it acts as an Active Directory domain controller, so it supports Kerberos authentication, group policies, etc. It also includes RFC 2307 support for seamless integration of Linux/UNIX clients.

Duplicate?

[slashname3]

Is this a duplicate post? Or was someone else doing their job by asking /.? Seems like a poor way to get a job done.

Wonder if his boss will read his question on /.? Could be a resume generating event......

Re:Duplicate?

[Anonymous Crowhead]

No Ask Slashdot gets lots of "how do i do my job posts" for example from yesterday:
How do I implent EDIS?
http://ask.slashdot.org/article.pl?sid=05/09/16/16 16221&threshold=-1&tid=215&tid=4

A summary of the answers:
That's silly.
Don't.
Why?
Leave it to the pros.
Quit your job. Seriously.
Overkill for your situation.
Are you kidding me?
It's hard because it's hard.

Sounds like you answered your own question...

[nick13245]

1. MS Exchange/Active Directory
2. A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists).

The choices are actually:

1. MS Exchange/Active Directory - quick, easy, and cheap.
2. Shell out alot of money for something else.
3. Have a headache "trying" to set with something similar with OSS.

Re:Sounds like you answered your own question...

[Anonymous Coward]

As has been mentioned throughout this topic, look into Novell. Their directory has better pricing, more flexibility, and is more "mature" than AD. Open Enterprise Server can be run on a good amount of hardware, and software. Whether you want to go Netware, Linux(SuSE Enterprise), or Windows you can run OES on them. Groupwise runs on netware and linux. There is the win32 groupwise client in addition to the cross platform java based(I'm fairly sure it is) client which runs on *nix.

The biggest issues with Novell, from what I've seen actually using it, are the lack of a good directory management tool and that the groupwise client is lacking in the usability department. The latter is changing, mostly due to the recently released groupwise 7 which adds many features seen in outlook and the webaccess version of outlook to the related groupwise counterparts. Dragging and dropping in the web access, name completion in the webaccess, and a customizable view in the win 32 rich client. The backend adds things like global sigs and some other behind the scenes stuff.

The other bad part, which also effects other novell products, is the management tools. Console one is pretty clunky. As of right now, using netware 5.1, I use the old nwadmin tool and console 1. If I were at Netware 6.5 or any "OES" build I would have to add imanager into the group. Imanager is nice because it's web based and I could technically admin the directory from anywhere as long as I had a web browser. But for frequent admin duties, I could see it being cumbersome.

eDirectory is LDAP compliant, while active directory is just LDAP compatible(and not even guaranteed). I see Novell offering a more flexible framework.

The real big issue, is whether you see Novell as a viable solution down the road. I do, assuming they don't go get themselves sold to Sun who will probably screw their whole product line to hell. Beyond that, I have and will continue to like their offerings.

Re:Sounds like you answered your own question...

[Anonymous Coward]

your calling $3000 for 100 plus users not cheap??? It will cost 10 fold that in time and labour not to mention hardware. $3000 for the NOS for this solution is DIRT CHEAP and will barely rate in the overall cost.

That's what I thought.

[lsommerer]

That's what I thought when I read the requirements. Netware (or whatever they are calling it now that it runs on Linux) and Groupwise should be all you need.

I don't know about cost. We have their educational license, and that includes Netware and 3 other products (we use Groupwise, ZENworks and iFolder) for less than $3.50 per student. The license covers as many servers as we care to run those products on.

Re:That's what I thought.

[askegg]

Close.

Novell's products such as eDirectory (LDAP & x.500 compliant directory service), Groupwise (Exchnage equivilent), Zenworks (application management), etc all run on Netware, SuSE linux and Windows.

Re:That's what I thought.

[ocbwilg]

Netware (or whatever they are calling it now that it runs on Linux) and Groupwise should be all you need.

Groupwise is a pig and should be taken out back and shot. I can't believe that Netware would still be peddling it, but even if they are it is not comparable to Exchange/Outlook. And I'm not sure how you can say that "Groupwise should be all you need" without knowing detailed requirements of the project.

Re:That's what I thought.

[i2878]

Groupwise has:

• email
  
• individual and group calander
  
• tasking
  
• file sharing
  
• document control/sharing
  
• instant messaging
  
• clustering
  
• clients for Windows, Linux, Web
  
• agents to run on Netware, Linux and Windows
  
• has LDAP connectivity
  
• user accounts are the same as eDir

What am I missing?

Plus (according to Novell) 69% less downtime than Exchange, and over 50% of Groupwise servers go 6+ months without reboot.

Re:That's what I thought.

[Anonymous Coward]

Your numbers are from Novell. Don't get me wrong, I greatly dislike Exchange. Then I started working where I work now.
Groupwise sucks. It integrates with nothing. Our sales people constantly want to buy packages that do not integrate with it. An Exchange server had to be set up for the BES until recently (RIM didn't support native groupwise til about 6 months ago).
And around here it is down a lot, and I have never once heard a complaint about the Exchange servers being down for 1 minute while the cluster fails over. However, there are lots of complaints when the GroupWise system is down for hours.

Re:That's what I thought.

[ocbwilg]

Plus (according to Novell) 69% less downtime than Exchange, and over 50% of Groupwise servers go 6+ months without reboot.

Interesting numbers. I have three Exchange 2000 servers at my present company. In the 2 1/2 years that we've had them, we had one of the three go down (due to a bad third-party Antivirus scan engine update that caused STORE.EXE to eat up all available CPU cycles). Technically it wasn't actually down, it was just extremely slow and nearly unusable. The only time that the servers are rebooted are when a security update to the OS requires a reboot. Before MS was on a monthly patch schedule that was only a couple times a year. Now because of the OS it is every couple of months. But with regards to stability, Exchange 2000 on Windows 2000 (or Exchange 2003 on Windows 2003) is extremely stable, and can easily go months without needing a reboot. I have never needed to reboot a server for Exchange's sake (once it was installed, anyways).

A lot of people seem to base their opinions of Windows server products on the NT4 days where regular reboots were advisable. I don't know if that means that they've never used the newer stuff, but that would be my guess.

Re:That's what I thought.

[leandrod]

A lot of people seem to base their opinions of Windows server products on the NT4 days where regular reboots were advisable

No, we are just comparing it to something better (POSIX systems) instead of something worse (Netware, MS W95).

Try Solaris

[tonyr60]

Download Solaris for free. It includes LDAP plus Samba etc. Includes fairly easy admin tools (for example webmin) The LDAP is first class and integrated fully with the OS and Samba. You can do it all and nothing is "cobbled together".

Re:Try Solaris

[DiogoFerreira]

Yes, Solaris has prooved trustworthy on the last few months. (ironic look)

Netscape Directory Server

[andydread]

We used the original Netscape Directory server for user authentication of 1700 users worldwide for many years on 2 sun netra 333mhz boxes. The Netscape code back then was bulletproof. If that code is now free then all hell has broken loose and its only a matter of time before OSS has a truly free, truly robust all purpose directory server.

Re:Netscape Directory Server

[Anonymous Coward]

Hahahaha... bullet proof my ass... Maybe for 1700 people but not for 50,000 people. Trust me, after being oncall for that software for 50,000 customers you'll realize that it isn't bullet proof at all.

cobbled-together?

[AstroDrabb]

2. A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists).

Well, it sounds like you are an MS-Only type guy with limited experience outside of the proprietary MS-World. There are some excellent solutions that run under Linux. Have you looked at Novell GroupWise?

Novell GroupWise is a complete collaboration software solution that provides information workers with e-mail, calendaring, instant messaging, task management, and contact and document management functions. The leading alternative to Microsoft Exchange, GroupWise has long been praised by customers and industry watchers for its security and reliability

GroupWise is cross platform, unlike MS Exchange/AD. GroupWise has plenty of free tools to help you along the way like:

• GroupWise Migration Utility 2.0.1 for Microsoft Exchange
• GroupWise PDA Connect 1.0 SP1 Multi Lingual
• GroupWise Import Utility 2.0 for Microsoft Outlook
• GroupWise Gateway 2.0 for Async Connections
• GroupWise Gateway 3.0 for Lotus Notes

Just check out Novell to see some of their products (no, I do not work for Novell, I just like some of their products).

Also, there are some really great LDAP/IMAP type solutions you can put together under Linux for zero cost. Obviously this option requires someone more capable than your typical point-n-click "MS-Admin". It would take one employee with the ability to read a book or some docs. Though, I know your typical point-n-click "MS-Admin" wants to be able to just put in a CD and let AUTO-RUN do all the "hard" work for them.

If I personally owned a small company with ~100 employees, I would rather have one talented admin that could handle *nix/Win than 2-3 point-n-click MS "admins". If you added up the salaries, that one guy would cost you less than the 2-3 less capable point-n-click MS "admins". TIJMO (This is just my opinion).

Re:cobbled-together?

[jred]

If he's going to go with Groupwise, he might as well use Novell's dir services.

Re:cobbled-together?

[saleenS281]

and it's especially useful to only have one person who knows the ins and outs of the hacked together system, so if he decides:

to leave the company
turns out to be a douchebag and gets fired
or is say, just sick on a day a critical service goes down

you have no one to keep the system running. See, now you understand why it's obvious you've never run a "REAL" business. Anyone who has would know they'd be better off with 3 mediocre people who can all do the job than 1 excellent person who the company hinges on.

Re:cobbled-together?

[danharan]

With the loaded costs of 3 point and click monkeys, you can offer a decent salary to a real sysadmin. Until the salary differential is more than 3 times, the grandparent still saves money.

Meanwhile you have 3 monkeys running a network. I wonder who's safer and most productive?

Re:cobbled-together?

[rborek]

We use Novell Netware and Groupwise where I work. I can't say it enough - I absolutely HATE Netware and Groupwise. Novell's QA went out the window years ago - we've been running it for 3 years, and it still crashes network-wide at least once a week, even with Novell techs in working on the server and the crashes. Not to mention it's a royal pain to manage (there are at least 3 different user/object administrator tools, and none of them do everything). There are also major issues with stuff like NDPS (you can set up the printer and have it install to workstations, but you then have to set up the printer settings on each computer - stuff like whether a duplex unit is installed, etc).

Groupwise is a whole other story. It likes to crash, but by far the worst thing about Groupwise is it's client - it's ugly, non-functional, complex, and can't handle some of the most basic tasks (setting up a multi-day appointment requires you to create individual appointments for each day, and creating a Vacation message requires you to go through and set up a complex rule).

Go with anything else - I administer a separate Windows server where I work, and I used to do some Linux sysadmin stuff. Doesn't matter whether it's Unix, Linux, Microsoft, Oracle, Sun... just stay away from Novell products!

Re:cobbled-together?

[Anonymous Coward]

yeah groupwise can be pretty retarded, from a user perspective. as an email client, its average to slightly below average, calendaring is fine, network stuff must be a pain, since our admins tell us every other week or so that it'll be down for an hour or 2 on such and such a nite. file sharing stuff is good but too slow (we have 3 locations, may not be configured right i suppose).

Re:cobbled-together?

[ThisOrThat]

That's odd. We use Novell for all user storage/printing/groupwise/etc for thousands of PCs and have none of the issues you list.

Which version of NetWare are you on?

The college is went to a number of years ago used NetWare (and still do) and it works very well for them.

At work we have edir and AD integrated, edir being the main directory. I mostly work with HPUX/AIX/Linux but have done a little NetWare stuff in the past. I don't know about current QA at Novell but we don't seem to have many issues that I can tell. GW use to be pretty bad a few years ago but they have since upgraded and it's been working like a charm.

When I have had to do administration of MS servers (doing contract work or what not) I realize how much better the admin tools are in NetWare vs MS. Unless it's changed (and I don't think it has) assigning/administrating file rights and users is a pain for any sort of large network. Also login scripting in MS bites really really bad IMHO. I can't believe that MS can't have a better way of doing login scripts.

Oh well,

- Justin

Re:cobbled-together?

[saleenS281]

Even a monkey can click "windows update". Win2k3 is safe by default, so short of them INTENTIONALLY opening things up, it'll be secure. Hope off the zealot train and join reality.

You've still COMPLETELY ignored the fact that having your business revolve around one person, is business suicide. Again, welcome to the adult world.

Re:cobbled-together?

[Forbman]

From a user perspective, GroupWise *SUCKS*.

Some of the other Novell stuff isn't bad, though.

Re:cobbled-together?

[ZenShadow]

Or they could be doing backups every other week...

--S

Re:cobbled-together?

[Kjella]

With the loaded costs of 3 point and click monkeys, you can offer a decent salary to a real sysadmin.

Are you suffering from a bad case of "LALALALA I can't hear you"? You offer exactly no counter-arguments to the grandparent. Any one person could get sick, might be in an accident, on vacation. No matter how badly you want to keep him sometimes people do move (moving to gf's location, leave to fulfill some kind of personal dream, whatever).

Have you ever tried to fill a position which basicly requires "familiarity with lots of different software and ability to figure out a ton of custom glue"? The salary isn't the biggest problem. It's that it takes you forever to find someone who can handle it on paper, and more often than not you end up employing someone which it turns out can't handle it. Even a real admin would require some time to get up to speed so you have to cut him some slack. Then after watching your network being run for months by a monkey posing as a real sysadmin, I wonder who's safer and more productive...

Kjella

Re:cobbled-together?

[Forbman]

Really?

How many companies out there are sole proprieterships? What about LLCs, where one of the people happens to have/bring in about 80% of the billables.

Just about every "owner" or "CEO" fits the "business revolves around one person". Apple now w/o SteveJ? Yeah.

Besides. The real person your business revolves around is your bookkeeping service and accountant, because you probably don't have time to deal with the former, and you probably could maybe balance your personal checkbook to save your life, but that's it (unless you happen to also be an accountant).

Is that server you bought last week depreciable as a capital asset or a consumable? Is that investment property you bought to "expand to in a few years" depreciable? Can you Sched 167 your Ferrari this year?

Because come IRS audit time, your accountant will make you or break you.

Re:cobbled-together?

[tfiedler]

Groupwise sucks. Anyone that says otherwise has either never used anything else or has a big red "N" stuffed up their butt sideways.

I'd recommend Exchange over Groupwise ANY DAY, and I don't care for it either.

Re:cobbled-together?

[DaveV1.0]

How many companies out there are sole proprieterships? What about LLCs, where one of the people happens to have/bring in about 80% of the billables.

This is exactly why so many small businesses fail. A sole proprietorship (SP) where the owner is in an accident or gets sick and can't work or an SP with an owner who can't do it all. Great tech but a crappy marketeer, or good salesman but lousy time management or poor quality work. An LLC where one person brings in 80%, and then that person leaves, gets sick, dies, etc. is pretty much doomed to fail. I have seen it happen.

Just about every "owner" or "CEO" fits the "business revolves around one person". Apple now w/o SteveJ? Yeah.

While a small business with consolidated power will revolve around the one or few people with the power, one being the CEO does not mean the business revolves around one. That is the kind of thinking that led to the dot.com bust, Enron, and all the other scandals. It is also the kind of thinking that has caused CxO pay to balloon, while the middle and lower employee's pay has barely increased (it hasn't even kept up with inflation). If what you say is true, then no CEO would ever be unseated because it would be death for the company.

Re:cobbled-together?

[Anonymous Coward]

The best part about Novell Groupwise is all the 3rd party software designed to work with it. Oh wait... good luck with that.

Re:cobbled-together?

[Anonymous Coward]

There are also major issues with stuff like NDPS (you can set up the printer and have it install to workstations, but you then have to set up the printer settings on each computer - stuff like whether a duplex unit is installed, etc).

Lol! Your incompetency is ridiculous.

1. Recent versions of NDPS/iPrint DO have a solution for what you describe here - Novell calls it "printer driver profiles".
2. Windows Server 2003 and Samba still don't.

So, in short, you blame Novell for not having until recently a feature that its competitors still don't have. Now this is quite brain-dead, isn't it?

Fedora Directory Server?

[graphicartist82]

I've just started to take a look at Fedora Directory Server. It is very easy to set up and with the GUI manager, it seems about as easy to manage as Microsoft AD.

Re:Fedora Directory Server?

[saleenS281]

I can't believe you really just recommended a beta product for someone to base a company of 100 people off of... HI2u!

Re:Fedora Directory Server?

[einhverfr]

The poster said that they were investigating this software. The issue is that if it is beta software, it is still worth investigation. I routinely investigate beta software for customers with the idea that once it enters production, it may be fair game.

Re:Fedora Directory Server?

[Anonymous Coward]

I can't believe you really just recommended a beta product for someone to base a company of 100 people off of... HI2u!

Considering that "beta" software is Netscape's (the people who pretty much defined LDAP) directory server, from which Sun's offering was forked not all that long ago in terms of major revisions, I'd say it's a pretty good option, and will scale way better than OpenLDAP ever will.

Re:Fedora Directory Server?

[kauttapiste]

I can't believe you really just recommended a beta product for someone to base a company of 100 people off of... HI2u!

I can't believe you just called Fedora Directory Server "a beta product". :-) FDS is the same as Redhat DS, which in turn used to be Netscape Directory Server. NDS then is the same Directory Server which is being shipped inside HP-UX operating system and provides some of the core functionality of HP-UX (would they ship some crappy DS?). Also, Sun's Directory Server comes from the source of Netscape Directory Server.

Fedora Directory Server is by no means a beta product.

Why, again?

[Dunkirk]

Why are those your "stark and clear" choices? I know, for example, that there are solutions from Novell, SuSE, and Sun, without even thinking about it. Are there more factors involved here than just "we need a directory?" Given a clean sheet of paper, I'd be using eDirectory, since it's completely (according to the marketing papers -- I've never used it) cross-platform.

Why are you asking this?

[BHearsum]

You are obviously inclined to use Microsoft, so use it. You will only bitch if you use Unix.

Re:3. Mac OS X Server

[Penis_Envy]

The questioner did mention openldap. The advantage of going to the apple solution would be the integration that it would provide, rather than "cobbling" together the solution themselves (as they said themself.) It's not just the GUI. Then again, it would be one more thing to manage/maintain.

Bynari / Samba - Win-win scenario

[Kris2k]

I do some implementation projects for an IBM reseller who does implementations on the iSeries platform, and they push (and I implement as the consultant, go figure) a lot Samba + Bynari to the point that I was actually convinced myself and bought myself a few lics for Bynari.

The nice part about Bynari is that they have great support, and they are continueously improving their product, and they use open technologies (OpenLDAP/Cyrus/Postfix) so its easily hackable. The Outlook IMAP connector rocks, and so far, I think is the only viable product out there if you're on a trim budget.

I haven't tried it yet, but having Bynari and Samba share the same LDAP schema seems to be my next personal project. Maybe even lobby the concept to them ;)

Re:Bynari / Samba - Win-win scenario

[tgbrittai]

I run both Exchange and Bynari servers. Bynari is a nice solution but I wouldn't deploy it for more than ~50 users. Exchange requires less than half the administration/maintenance/troubleshooting time that Bynari requires. This is based on almost a year of running it.

The Outlook client configuration is akward and easily breakable in Bynari. They provide a client configuration script to automate the process but it requires the user to have administrative rights on the computer and I don't allow that. That leaves manual configuration as the remaining option. Users can (and often do) re-configure the Bynari Insight Client because it's options are readily available and changeable using the highly visible toolbar it adds to Outlook. Exchange/Outlook is instantly configurable using group policies. And the settings are mostly hidden from the user.

The Web mail interface has a lot to be desired. They have redesigned this in a recent version, but I have not had a chance to look at it.

Even though the users' data is stored on the server, it is synchronized back to the user's hard drive into a PST file. This is nice because if there is a problem you can delete the PST and re-synchronize from the server. However, it causes problems when users get over ~150MB of e-mail. The synchronization process takes several minutes. During this time the hard drive thrashes and the CPU maxes out. This means that the end user experience is degraded and users do not get their messages immediately as they do in Exchange.

On the upside, I actually do like Bynari. It is maturing at a rapid pace. Their tech support has been exceptional. They fix bugs and add features on a regular, frequent schedule. And the product is priced way better than Exchange. My advice is to download and read the Bynari manual. You should also install a demo version and abuse it for a couple of weeks to see how it works for you. Good luck!

Mixed technologies

[lucm]

If you have a solid VPN link between your sites you could go with Microsoft Small Business Server. In this edition you get Exchange and Windows server licensing at once, and the GPOs are ok. Also with SBS you can setup Exchange to download POP3 emails from your ISP, so you can use Exchange locally without having to worry about the web front-end.

If you do not have a reliable VPN then you have to come up with a mixed environment. In this scenario not only will you have to master each component, you will also need to learn how they can interact. Quite a learning curve if you don't have hands-on experience.

Finally if you have the big bucks you can always go with Sun software; they have stuff to cover all your possible needs. The Directory Server, included in the JES, is quite impressive.

Why are those your only two choices?

[Anonymous Coward]

What's wrong with Novell or Sun/iPlanet/Netscape?

The only problem I could see with either of those solutions (the Sun LDAP server is superior to everything else out there) is that it may be overkill for 100 users.

Novell

[RabidMonkey]

Theres always EDirectory ... it runs on sles9 now (as of version 7). All the joy of NDS, but it runs under Linux (and windows, and netware if you want).

I'm going to a Zenworks 7 thingy on Wednesday .. if you want more information about running edirectory under linux, email me and i'll pass along what I find out.

it's not just about OSS and Windows .. there are other products there. NDS is far superior to AD, so consider it as well.

How do you get email addresses into a directory?

[harlows_monkeys]

I've looked briefly into this, at a much smaller scale--I just wanted something where I can have a centralized email server that receives my home and work email, and allows me to access that mail from home and work, securely, using regular email clients (no webmail).

What puzzled me was how to get information into the directory. Say I receive an email from bob@sub.genius, and he is not in my directory. All the common email clients seem able to consult a directory, such as an LDAP server, but none seemed to have the ability to add to the directory. It appears that you have to use some other program to add, so in this example, I'd have to run some other program, paste in "bob@sub.genius", and tell that program to update the directory.

I have only looked at open source stuff for this. Is this something an MS solution would make easier?

Or did I just miss how to do this with open source email clients and directories?

Scalix + OpenLDAP

[ink]

We use Scalix which authenticates against OpenLDAP. They are a commercial solution, but their software is very opensource friendly and their support is very good (including pulic forums). We also have Tomcat, Apache, PAM, PPP/CHAP (for Remote Access with L2TP/PPTP), OpenSWAN (ipsec), Samba and custom applications authenticating against LDAP. Our centralized directory system is all home-brew, but this also gives us a lot of flexibility (we have 5 different password hashes for various systems!). It's not the easiest route in the short term, but it pays off in the long term. We have bindings for pretty much any language (including shell script via ldapsearch, etc) which offers tremendous flexibility. OpenLDAP is synchronized with a hot-backup, so we have redundancy built-in.

Directory service/groupware

[drwelts]

Simple- Firstclass Server. Centrinity.com. Cross platform, robust, full of features. Inexpensive. Expandible to voice services

Do you have Windows desktops ?

[drsmithy]

If you do, AD is your only realistic choice. Group Policy alone justifies using it.

Added to that, it's not especially difficult getting Unix machines to talk to AD for authentication and other information (it's just LDAP, after all).

It's a hell of a lot easier to integrate and manage a handful of unix machines in a Windows environment than it is to integrate and manage a hundred Windows desktops in a unix environment. IME, that's typically the scenario (unix servers for mail, fileserving, DB, etc and Windows desktops).

Re:Do you have Windows desktops ?

[Anonymous Coward]

AD is not the only way to impliment group policies - any decent application management solution can enforce settings on the users workstation.

Re:Do you have Windows desktops ?

[Anonymous Coward]

AD is your only realistic choice. Group Policy alone justifies using it.

Doesn't AD + GP get blown out of the water by NDS + Zenworks? Even in an all-windows environment? And if you throw in a Mac, or a Linux box, or a little Netgear print server..., or anything that smells anything like muli-platform, any solution that starts with the word Microsoft gets pretty wobbly.

Re:Do you have Windows desktops ?

[1s44c]

Added to that, it's not especially difficult getting Unix machines to talk to AD for authentication and other information (it's just LDAP, after all).

And thats the open source attitude and why we are always getting screwed over by microsoft.

It's not just LDAP once they get their filty paws on it, it's a twisted version designed to work 80% of the time and make it look like the non-microsoft end is screwing up the other 20%. Microsoft can't do open standards. They have a hard enough time keeping boxes up long enough to do anything at all.

Yes I have seen AD used for linux authentication. It's totally unreliable, use anything else but not AD. Use a real LDAP server or local files distributed by scp, anything but AD.

Re:Do you have Windows desktops ?

[Anonymous Coward]

Give me a break, group policy. Have you heard of Novell's ZEN product. It manages windows desktops better than Microsoft does....

Re:Do you have Windows desktops ?

[ErikTheRed]

Most of the useful aspects of Group Policies are accessible through Samba. See: link

Mod parent hilarious

[Anonymous Coward]

W2K3 ... is fine as long as you take the same precautions any decent Sys Admin would.

Myself being a decent Sysadmin, I can tell you my first priority is always to banish MS products to the extent possible. It takes time, but if you're starting from scratch this is an excellent opportunity to avoid future problems.

Start by NEVER running anything mission critical under MS - especially a directory service.

Continue by banning Internet Explorer companywide, and finish by

Don't get me wrong; MS Windoze does have its strong spots. It is superb for playing games, hosting virus servers, spam drones, and spyware. If you want East European crime gangs to install packet sniffers, keystroke loggers, and Trojan Horses on your network, there is no platform more ideal than Microsoft Windows. But of course these strengths have nothing to do with running a secure business.

Since you probably will have to run MS Office, do a trial run of MS Office under Mac OS X. You'll be quite impressed: You can have MS Office without all the client problems! Who would have believed such a thing could be possible? You may even find that OpenOffice is far more than sufficient.

Deploy OpenOffice far & wide, but keep a couple spare seats of MS Office (for the Mac) onhand "just in case" some executive starts whining about different software, so you can just install it here or there selectively and shut them up. (That's the main purpose for buying MS Office. To shut people up.)

The executives may question issuing Powerbooks for the traveling employees, but they WILL NOT complain when you show them the respective overhead and MIS support estimate numbers and corporate security differences when viruses and so on are all taken into acount. Your company will remain freer of viruses when those traveling notebooks get plugged into the internet at hotels, then subsequently carried back to the office and plugged in again. Windows notebooks are one of the most notorious and uncontrollable computer virus vectors for spyware/crimeware.

Re:Mod parent hilarious

[Anonymous Coward]

Andy: Hey, weren't we supposed to have a company meeting about that uh..... brand new programming system?

Employee #1: Yeah, I think they're sending the computer guy, Nick Burns, over to answer any questions.

Employee #2: I don't like that guy.

Andy: It must be about the upgraded desktops.

Employee #1: Hey, do they have to upgrade because of security?

[ Nick Enters ]

Nick Burns: Considering you use M$ widoze, luzer, i'd say YES.

Theme Song: "Nick Burns, the computer guy. He'll fix your computer, then he's going to make fun of you. Cause he's Nick Burns, the company's computer guy."

Nick Burns: Over the holidays, we upgraded all the desktops to the latest version of Gentoo. Start compiling LOL, semicolon, parentheses.

Re:Mod parent hilarious

[ScytheBlade1]

Only on slashdot would this level of trolling be modded "insightful."

Grow up. Is linux/OSX better than windows in some ways? Sure. How about you learn to prove a point without senseless bashing though?

People might care when you talk like you know what you're talking about.

Senesless flaming and trolling comes at a dime a dozen.

Re:Mod parent hilarious

[Anonymous Coward]

Interesting that several people assumed I was championing Linux over Windoze, when I never even mentioned the former. It's encouraging that people must already be aware of these advantages.

Did my choice of verbiage & rhetoric lead you to interpret my comments as senseless bashing? I used strong words, but they were meaningful - not senseless. Mine were the words of someone who HAS grown up, and graduated from toy operating systems long ago.

I was responsible for a 600+ node network before my software design skills ushered me into even greener pastures. But I still do network design and admin of new systems until staff can be located or trained. ...learn to prove a point...

The inferiority of Windoze security has been well established. It not something that needed to be further "proven" let alone here. By alluding for effect, I make a far more efficient use of space.

And I'll point out that I didn't blindly praise *nix, as they are not created equal. I could tell you about HP's own LaserJets among other things totally crashing that kludgeware known as HP/UX, orphaning 600+ client sessions simultaneously and bringing a $1B company to a screeching halt. Digital Unix on an AlphaServer 8400 resolved that problem very nicely. So... *nix or Windoze, I am equally merciless when an OS deserves to be banished.

I suppose you could interpret my tone as flame-like, but know that any verbal plasma emanating from my fingertips are hard-earned flames, well intended to inform.

People might care when you talk like you know what you're talking about.

Apathy is neither my problem, nor am I aware of any cures. But if caring people are uninformed or short on ideas, I may be able to help in such cases.

Re:Mod parent hilarious

[Anonymous Coward]

The z in Windoze stands for zealot.

Re:Mod parent hilarious

[Anonymous Coward]

The z in Windoze stands for zealot.

And what are you? A sheep who believes that monopolies benefit the consumer? They don't. Sheep get sheared! Even Microsoft is getting into the antivirus market, so you know, envision see a strong future for that kind of software. If you're still running that crap, consider switching horses.

Whenever I'm going to be the one ultimately responsible for cleaning up a computer mess (which is often), increasingly I'll insist on participation in the specification process. This only makes practical sense.

What I've learned is that it's possible to make my own life and my customers' lives much easier by spending the money up front and investing in quality, when it counts. My desktop preference of OS X over Windoze nearly always makes a huge difference. On the servers, it's Tru64, Solaris, BSD or Linux in that order, depending on application and budget.

Call me a zealot if you like, but if I'm sick & tired of fixing screwed-up Windoze boxes for my customers, family and friends who either didn't solicit or didn't take my advice, and perhaps I'm just tired of hiding the fact.

Lately I've taken a more proactive stance in influencing these decisions, and it's spilling over into this forum.

Re:Mod parent hilarious

[Neil Blender]

Heh, I'll answer that post logged in. Sorry, but I can't take people who use clever alterations like windoze, micro$oft, etc seriously.

I have used OSS nearly exclusively at both work and home for almost 5 years. (Hell, I am posting from a RHE3 WS rig at home which is identical to my work machine.) I also attend user's groups for a number of disciplines and am in a hiring capacity where I work. The minute I pick up the zealot vibe from someone, they get put on a mental blacklist. That clever replacement of $ for an s puts you on that list. Using 'luser' puts you on that list. Saying 'boooooooo patents' or 'booooooo microsoft' puts you on that list. I don't use "windoze" much but I don't automatically think everyone who uses 'micro$oft" products are "lusers". Bad mouthing the secretary who doesn't know better gets you on that list. Guess what? She's a secretary, not a fucking computer expert. If she was, she wouldn't be a goddamned secretary. Her life does not revolve around the box that sits under her desk.

Call me an anti-zealot zealot. Call me a hypocrite. I really don't care. But the minute you spew such clever words and phrases, well, I'll stop listening or maybe insult you back. And I certainly wouldn't hire you. As a matter of fact, I have a number of carefully crafted interview questions to draw out zealotry from both sides of the isle.

PS If you hate what you do, get another job. If you hate fixing family and friends computers, do what I do - say, "well, I use linux mostly, I'm not really the best person to ask about windows."

Re:Mod parent hilarious

[Anonymous Coward]

Thanks for the sincere comments. Interesting that perceived zealotry could be considered a liability. I'll take that into consideration.

I appreciate the advice in your PS but unfortunately that won't work for me as I've had the reputation since chilhood of being able to figure out literally anything. Anybody who knows me expects me to be able to walk into any situation blind and make sense of it. It's been very good for me professionally, but it's also a bit of a liability, as I experience it.

I rarely have cause to blame the secretary, as she's not the one making OS decisions. Too often, such decisions get made for invalid reasons - such as by default, when people assume there is not a choice.

I don't consider fixing Winboxen to be my job, and I've never specifically advertised that I can do it. But of course I can. People know or correctly assume that I can, and if there's nobody else around who can do it, naturally I get roped in.

The term seems strange to me - I've never considered myself a "zealot" but rather one who has learned that it actually takes quite a bit of skill to operate MS's operating systems in a secure manner, and the typical user is just not up to that task. If the secretary (correctly) doesn't consider safe computing to be her job, then there are matches for an OS desktop, IMNSHBCO.

Sure I have very strong opinions rooted in experience, but it's not a religious thing for me. It comes solely from pragmatism. If a computer expert really wants to run MS, well bless 'em as long as they actually understand what they're doing. The problem is, too few do. Given the choice, I never do - and it saves me a whole lot of hassles.

(PS: In case you're curious, I'm AC because I actually don't have a /. account. I've been around here for years without signing up.)

Novell's/Suse's SLES 9

[mgpeter]

Suse Linux Enterprise Linux 9 should have everything you need. It sets up and stores just about everything in LDAP. It is extremely easy to configure and maintain. Yast's Email Server module will setup Postfix/Cyrus/IMAP for you, hell it even installs Antivirus and Spam filters for you.

If you need to control Windows Clients simply create custom Policies for Microsoft's System Policy Editor (or use mine at my web site).

I have currently replaced 5 Windows Servers with SLES9 and have not had a single problem. IMO it is much easier to maintain/use than anything MS has released in the server department.

Active Directory and Exchange

[mrscott]

Before I write, I should say that I'm in no way opposed to open source and use it where appropriate.

If you want something very well supported, not horribly difficult to administer in a simple environment and tried and true, just go with Active Directory and Exchange, especially if your company's focus is on something other than providing unique technology solutions. (i.e. you sell baskets)

While the open source solution might cost less up front, there is nothing in open sourece land at present that can touch the Exchange/Outlook combination. Sure, there are products such as OpenExchange, but, let's assume that you want the option to easily add other services later on, such as true handheld synchronization (i.e. www.good.com)

I know it can be sacrilege on Slashdot to not promote an open source solution every time, but sometimes, the business side of the house is more important than a cool technology solution.

Re:Active Directory and Exchange

[Anonymous Coward]

If you want something very well supported, not horribly difficult to administer in a simple environment and tried and true, just go with Active Directory and Exchange.

You must have been dealing with a different company called "Microsoft" than I have all these years. When I was an admin for Microsoft stuff, I would not have called their products "very well supported" by any stretch of the imagination.

Re:Active Directory and Exchange

[Anonymous Coward]

I would take a look at http:\\www.scalix.com

Scalix provides a products that functions virtually identically with Outlook the way Exchange does. It also has web access that is virtually identical to Outlook Web Access that has a few superior features.

It runs on Linux and is very easy to setup. Its worth a look.

Re:Active Directory and Exchange

[Anonymous Coward]

If you want something very well supported...

My Windows Server didn't come with any support. What's all this support you're touting?

There is nothing in open sourece land at present that can touch the Exchange/Outlook combination.

So why limit yourself to open source? Novell can offer better solutions than MS, at better prices. Oh, and with better support.

Let's assume that you want the option to easily add other services later on

This is an argument against MS, right?

Re:Active Directory and Exchange

[xaoslaad]

That depends on how much you are willing to pay for support. At the most basic levels, ya shit. On the higher end, they'll bow down and call you God to fix your problems if that is what it takes. I had the interesting position of working in a company that went from the low end of support to the high end.

The more willingly you devote your soul (i.e. wallet), the better they will support their products.

Re:Active Directory and Exchange

[1s44c]

If you want something very well supported, not horribly difficult to administer in a simple environment and tried and true, just go with Active Directory and Exchange, especially if your company's focus is on something other than providing unique technology solutions. (i.e. you sell baskets)

While the open source solution might cost less up front, there is nothing in open sourece land at present that can touch the Exchange/Outlook combination. Sure, there are products such as OpenExchange, but, let's assume that you want the option to easily add other services later on, such as true handheld synchronization (i.e. www.good.com)

You want to tell that to the 1000+ users I have that could not work for a week because of AD crashing every few kinit's?

Don't go near AD for any environment except maybe a very small windows only one. It's full of application holes that somehow manage to cause OS downtime.

Re:Active Directory and Exchange

[mrscott]

I've never called Microsoft for support for Exchange. I *have* called consulting groups with people that know more about Exchange than I thought possible. I don't think MS does a great job supporting their products, but some third party integrators do a great job.

Centrify or Vintela

[Anonymous Coward]

You can use ActiveDirectory and then a solution by Centrify or Vintela.

eDirectory

[CounterZer0]

Those all suck, get eDirectory, which rules.
And it runs on linux.  And it's cheap!

Check out Kerio

[jcims]

We've been struggling with the same question for some time.

We just started using Kerio Mailserver for mail, integrated with Active Directory for authentication, and it's been working out great!

Can't touch this!

[ink]

In this case there is no directory server that can touch AD.

Yes, but don't you want your directory server to interoperate with other systems? Isn't that the whole point? I'm half joking, but half serious as well; one of the main gripes I have with AD is the lack of customization that one can perform with it. It's great when you want to integrate it with Microsoft Remote Acess or Microsoft SQL Server or any of a dozen other Microsoft products, but try getting it to authenticate against opensource P2PP/PPP (which easily integrates with other LDAP solutions).

Re:Can't touch this!

[Electrum]

It's great when you want to integrate it with Microsoft Remote Acess or Microsoft SQL Server or any of a dozen other Microsoft products, but try getting it to authenticate against opensource P2PP/PPP

It's trivial to authenticate a user with a single API call.

Re:Can't touch this!

[cloudmaster]

Well heck, all you've gotta do is include Windows.h or link to Advapi32.lib and you're all set. Why what could be easier than porting whatever you want to use over to Win32? That's real interoperability there - "just rewrite the program and make it run on Win32". Sigh.

Lots of other options

[njcajun]

You might want to check out Fedora (or Red Hat) Directory Server, which I've had some success with. It's not absolute perfection, but it saved me from dealing with OpenLDAP, which is a bit harder to deal with, especially if you're used to easy-to-use GUIs and the like. Novell's eDirectory is also a great solution, and it runs under Linux as well. Truthfully, I'm not using their stuff, but I eval'd some of it, and their groupwise stuff with eDirectory might be just what you need. There have been lots of other good suggestions here, so I'll just throw a "me too" in there for things like Bynari and OpenXchange.

Re:3. Mac OS X Server

[Anonymous Coward]

With http://firstclass.com/ for group messaging.

Works for an org I know that manages 1000+ staff members...

"Cobbled together"

[Dolda2000]

I don't see why a solution based on OpenLDAP, MIT/Heimdal Kerberos and (if you really need it) Samba would be "cobbled together". Would you mind expanding on that?

As I see it, each of these programs perfectly implements the standard it was designed for, and the directory service you get by combining them is just that: a directory service. It seems to be fulfilling the intended purpose perfectly.

Is the "cobbled-togetherness" a result of them not being shrink-wrapped together into a product with a single name, as all the "professional" directory services are? I'm not intending to troll, but I just can't see any other way they are "cobbled together".

Roundcube... holy crap Batman, that's awesome!

[DamienMcKenna]

I'd not seen it before but Roundcube is pretty darn nice! Now if only the Horde team would merge in some of its UI...

Damien

Just go with Exchange / AD

[ajv]

There are some things OSS is good at, and there are some things that Microsoft is good at. Exchange is one of them.

Ask your business what its objectives for the new system are. Keep these in mind when you select products and design a solution.

Now back to solution mode. You can have a minimal three site AD and Exchange system set up in less than a day from bare metal servers. As long as you have adequate bandwidth (about 64 kbit/s will do for minimal acceptable performance for 100 users), it just works. Just add users.

Win2003 AD is fairly robust if you make mistakes with topology design, but honestly, with such a simple setup, just go political structure in OUs in a single domain, single forest AD, with three sites. Exchange will work it out.

Once you have it working, AD and Exchange are very deep products, and it will pay to learn about the zillions of features. But by default, you can set and forget.

No matter which platform or choice, keep up to date with patches and secure lockdowns.

Andrew

one caveat

[HBI]

AD does not scale well up into the million object range and beyond.

Just trust me on this one. It's intended for the average case, not the huge-ass case. You find limitations on the number of GPOs. You find problems with everything when you start in with huge numbers.

That said, if all you care about is Windows, AD is the easiest of all the options.

Re:one caveat

[Raspberry]

Actually I can say I worked on one of the largest directories in the world... over 52 million user objects and hundreds of millions of objects.

AD does not scale well. Senior Mgmt wanted to move from eDirectory to AD due to some price breaks on desktop os and MSOffice for over 50000 employees... so we made the attempt with Microsoft in house providing consulting services... they eventually admitted even they couldn't get it stable in our large distributed environent... during the one year migration troubleshooting process we had contractors restarting servers in hundreds of locations around the clock.

We're now back on Novell eDirectory with Open Enterprise Server and stable again.

Re:one caveat

[XMyth]

Seems very strange to have a directory with 52 million user objects....surely they're not all users that actually need to authenticate at some point, are they? Even so, it seems like a real database would be better suited to this task.

Don't get me wrong, I'm not calling you a liar...I'm geniunely interested why you'd use a directory service for 52million users instead of a database like Oracle or (heaven forbid) SQL Server ?

Re:one caveat

[MaGGuN]

Actually I can say I worked on one of the largest directories in the world... over 52 million user objects and hundreds of millions of objects.

Wow.. must be a big company, but considering that the worlds biggest companies would not come close to those numbers I have serious doubts about your story. Microsoft is said to have stress tested active directory with 1,5 million user objects, well beyond the needs of any corporation existing today, and you say the requirement at your previous employer is 52 million user objects? I think not. I am curious now, what is behind these requirements?

...we had contractors restarting servers in hundreds of locations around the clock.

On top of 52 million user objects and hundreds of millions of objects, its distributed over hundreds of locations? Sounds like bad management, scary and unlikely.

Senior Mgmt wanted to move from eDirectory to AD due to some price breaks on desktop os and MSOffice for over 50000 employees

So because of a price break on OS and MS Office management decided to move 52 million user objects and change the backbone of the distributed network? For a large corporation, what you save on the "price break" for those 50000 employers is negligent compared to what the total cost of the project, long term and short term.

Re:one caveat

[Anonymous Coward]

Could be a customer portal supporting B2C single signon. I've worked on such beasts, and you can't beat the integration of identity and secret store (for the per-user private keys of a mutual ssl/tls authentication scheme) of a distributed directory for such applications.

Re:one caveat

[supergreentriangle]

Perhaps the objects within his directory are not company employees. Perhaps they use a directory service for their customers. There are a number of companies that would have millions of customers..

Let Wikipedia explain..

http://en.wikipedia.org/wiki/Novell_eDirectory

eDirectory leaves AD for dead.

Re:one caveat

[ocbwilg]

Actually I can say I worked on one of the largest directories in the world... over 52 million user objects and hundreds of millions of objects. AD does not scale well.

This was certainly true with Windows 2000 AD. I was involved in a similar project for a large insurance company a couple years ago that ended up going the same route. Have any of the changes to AD with Server 2003 helped alleviate this?

At any rate, the company he is discussing is only 100 users or so, so the likelihood that they will be hitting th eupper limits of AD supportability anytime soon is small.

Re:one caveat

[JourneymanMereel]

So because of a price break on OS and MS Office management decided to move 52 million user objects and change the backbone of the distributed network? For a large corporation, what you save on the "price break" for those 50000 employers is negligent compared to what the total cost of the project, long term and short term.

You obviously haven't worked with the management I have. Most decisions seem to be made based around golf buddy opinions rather than technical superiority.

Re:one caveat

[kelzer]

Senior Mgmt wanted to move from eDirectory to AD due to some price breaks on desktop os and MSOffice for over 50000 employees

Microsoft has been doing this for years with large corporate accounts. It still amazes me that when the DOJ was investigating them, they never touched upon this anti-competitive practice.

Re:one caveat

[aaronl]

Actually, it sounds like IBM. They have hundreds of sites worldwide, and hundreds of thousands of active employees. They could easily have 1.5 million employees in a directory, if they included past employees. Then you get into machines, rooms, vehicles, etc and that number goes up dramatically. You could add in client data, too. You would have a directory that would far surpass the capabilities of AD.

A national ISP could easily have millions of objects. A telephone company could have hundreds of millions.

The GP might not have been talking about IBM, since there are quite a few other huge companies, but that's one easy example that I know about.

And yes, it is foolish to try to rip that kind of system out for a price break, but dumber things have happened. Look at the fiasco that MS had when trying to convert Hotmail to Windows from BSD...

Re:one caveat

[Raspberry]

bingo...

some of the more negative flame comments calling my 52 million authenticable user objects absurd or impossible have never had the pleasure of this insanity ;)

Re:one caveat

[Raspberry]

agreed -- thanks for coming to the rescue -- always nice to have somebody know wtf I'm talking about :)

Time to boost Apple?

[puregen1us]

I realise Apple is getting a lot of press at the moment, and there is a certain amount of feeling that Slashdot is a publicity machine, but they tend to receive little support at the server end.

Tiger server actually performs very well, and admin is a synch. Given that you are starting from scratch you could easily get a some xserves...

Group messaging: Jabber server, built in.
There is Active directory and Samba support build in.

In fact, just about everything is built in.

If you don't like that solution, just look at the xserves. They're beautiful.

Just a couple of extra cents thrown into Slashdot's fountain.

Re:Time to boost Apple?

[macsimcon]

Tiger Server cannot act as an AD server, but it can tie-in to an existing one fairly seamlessly.

If you were really starting from scratch, configure a Mac as an Open Directory Master, and use ACLs to control access for users and groups. That should give 90% of admins all the granularity they'll need.

How much of Exchange's functionality will you really use? Would Tiger's built-in POP/IMAP mailserver do the job, or do you need an Exchange server replacement like Kerio MailServer (which runs great on OS X Server)?

Keep in mind all those CALs you're going to need to purchase or upgrade if you go with a W2K3/Exchange solution. Tiger Server will give you unlimited client licenses for $1,000, and Kerio's licensing is less expensive than Microsoft's.

Re:3. Mac OS X Server

[Anonymous Coward]

Specifically, Open Directory integrates LDAP, Kerberos, and Samba already, and provides a GUI configuration interface.

OS X Server also includes a Jabber server, for IM, and a 'blog server. I don't know much about 'blog servers, but Apple's website has this to say:

With Mac OS X Server, non-technical individuals can share information and syndicate content on the web using HTML, RSS, RSS2, RDF and ATOM protocols -- and a selection of Apple-designed blog themes makes it easy to get started. The Weblog Server supports both user and group blogs, calendar-based navigation and integration with Open Directory for authentication and access controls.

Check it out.

Stick with the KISS principle:

[Anonymous Coward]

/etc/hosts

Parent should NOT be modded troll

[xyphor]

Seems pretty insightful to me...

Hire a good consultant.

[supabeast!]

One person who isn't sure what to do probably shouldn't be handling this on his own (I say probably on the off-chance that you're a competent genius, in which case you wouldn't have asked /.). What you really need to decide is if you want to do Windows or OSS, and then hire a good firm to implement the system and train the IT staff to use it.

So call IBM.

Re:Hire a good consultant.

[Anonymous Coward]

great post until the "So call IBM" stuff. seriously if you want whats best for your business DON'T call IBM, they have there view on what they think is right and usually that involves what will make them the most money around there consulting. Try a vendor neutral tech firm if you actually want good advise.

Edirectory + SLES + GroupWise

[Recovering Anonymous]

Really what else do you need?

Novell?

[sjs132]

What, Just rule them out? They've been doing Active directory and groupware LONG before Microsoft decided to emulate (steal) the ideal...

Novell 6.5 is the latest, and I can lock out users based on windows policies, etc.. just like MS active dir... assign various sub admins to rule over their own dept, etc... AND Groupwise (IMHO) is a great email/calender app... (Groupwise 7 is supposed to be better, but I haven't gotten to play with it yet...)

AND they are starting to move everything over to Linux via SUSE Linux, so you have the OSS...
Best of both worlds if you ask me...

Sure, Novell AND Microsoft cost $$$, you could build your own Linux server and hack it together, but if your a REAL company and you expect to play REAL Ball, you will PAY to have the propriatory software to compete with everyone else... At least with Novell, you can still play OSS and support linux, etc... even if you have to buy their version...

OSS Does not equal FREE... Thats the problem... too many freeloaders want EVERYTHING for FREE... If that was the case then your company would just give its product away also... oops, now your company is dead... Guess that model won't work.

I must admit, I do ADMIN a Novell network, and I do like SUSE Linux... Much better than anything MS has to offer...

Again, just my .02 worth... (climbing into Flame resistant suite)

Re:Novell?

[Anonymous Coward]

Isn't ... it ... creepy ... to use ... so many ... ellipses?

Re:Novell?

[Anonymous Coward]

I would have been bothered by the ellipses, but I was too busy being bothered by the random words in all caps.

Re:Novell?

[Anonymous Coward]

AND they are starting to move everything over to Linux

They aren't starting, they have already done it. Groupwise, eDirectory and the Netware stuff are already available for Linux. I agree 100% with the rest of your post.

And btw standalone eDirectory is almost free (as in beer - $2 per user) and it's much better than OpenLDAP and Fedora Directory Server, even on Linux. So it makes a lot of sense to choose it even if he goes with OSS for file, print and e-mail.

Re:How do you get email addresses into a directory

[Anonymous Coward]

Centralized directories aren't supposed to be your personal address book. Most e-mail clients let you keep a personal address book along with a connection to the centralized directory. Directories are for corporate IT types who want to centrally administer user accounts for some (perfectly valid) reason. If you're not an administrator of that database, your access is more or less read-only. LDAP was designed from the get-go as a read-optimized solution, which is what makes it faster than something like an SQL server for far less resources. It's more or less a replacement for NIS (in the Unix world).

What's missing from Apple

[DorkFest]

We implemented Apple Open Directory, serving ~400 users, using four Xserves and and two Xserve RAID's. We're using Apple's mail services, file, web, web log, and VPN service.

So far, things have gone better than I expected. We are authenticating Mac, Windows and Linux PC's, all of which can access the same home directory. The Open Directory master server also acts as the Windows PDC and serves up roaming profiles for Win XP clients.

What I've been hounding my Apple rep about is the lack of a real group callaboration suite. The pieces are there; iCal, Address Book, Jabber, Cyrus/Postfix. They need to be brought together in an Exchange/GroupWise sort of fashion. We are still using Steltor Corporate Time (now Oracle Collaboration Suite) for calendaring, task lists, and shared contact lists. I'm watching the Hula project closely. Rumor has it Apple is shopping around for a comprehensive group collaboration system. Hula might be it! Zee dork

Re:What's missing from Apple

[AliasTheRoot]

I hope they get some group calendaring stuff going soon, it's a real thorn in our side at the moment - and iCal in its current state certainly isn't the solution.

Maybe not so easy.

[jd]

Let us say that you build a direct equiv. in Linux. "Impossible!" I hear you cry! Well, maybe not. Not unless you've cracked into my machine and installed an MP3 of yourself.

Anyways, let us examine the different components and see how far OSS can take us. Maybe it can't go the whole journey, but if it can do some, then a hybrid solution will work.

Open Groupware, SuSE's Open Exchange and OSER will handle the Exchange part, including support for all those MS Exchange clients, such as Outlook.

That just leaves the Active Directories part. ISC's DHCP supports Dynamic DNS. However, you may want to add in DHCP2LDAP to get a good link between DHCP and BIND. OpenLDAP provides the LDAP implementation part. Kerberos and DNS are easy (although some may quibble with my choice of Kerberos version!)

Provided you're not planning on having both MS Active Directory and the above amalgam running, you should then be set to go with a comprehensive Active Directory lookalike which will interact with client systems in the same way Microsoft's software will.

The problem I found is that there's almost no way of getting from a Linux solution -to- Active Directory. If AD is present, it must be a root server, which Linux CAN pull from.

Do I recommend this kind of a setup? Probably not. The Exchange and Groupware stuff should be fine, but the Active Directory stuff isn't as coherent as it could be and I've heard of nobody who has completely replace AD with an Open Source solution, even though from a purely technical perspective it should be possible.

Re:Maybe not so easy.

[Korgan]

May I introduce you to an opensource Directory solution that quite nicely replaces Windows Active Directory. Many moons ago it started life as just OpenLDAP but it is now become so much more.

http://www.apple.com/server/macosx/features/opendi rectory.html

Good ol' Apple.

Darwin, *BSD, Linux, various Unixes. Builds with GCC and source is available under Apple's OpenSource license.

Redhat's RHDS available on subscription for RHEL3 and RHEL4 is another. Based on Netscape Directory Services. Thats mostly available under the GPL now, called Fedora Directory Server.

http://directory.fedora.redhat.com/

Personally my favourite has been eDirectory. It may not be opensource or even free, but the little you do pay for it is definitely worth the product. Anyone skipping over it is either deliberately obtuse or just plain ignorant. Especially if they're willing to pay for Active Directory and all the costs that go with it (including licensing, security and maintence/administration) while receiving a far inferior product.

Ultimately, Ask Slashdot is the worst place for the original poster to ask this kind of question. They need to sit down with people from various companies and vendors to get an idea of all available products. Many will happily discuss the requirements and work together with you to find the best solution, not just sell you a solution from a preferred supplier.

Ask various engineering places in the district to submitt RFP's based on requirements you set. It doesn't have to be a multi-million dollar contract to get many interested. Companies are starting to really take notice of the SME market now days. Ultimately the have to. ;-)

Re:Maybe not so easy.

[iolaus]

Is there any open software to allow group policy management with the directory services? In an enviornment where the users are on Windows boxes (which is most enviornments) group policy is an invaluable tool.

Re:Maybe not so easy.

[Wolfrider]

[[
Ultimately, Ask Slashdot is the worst place for the original poster to ask this kind of question. They need to sit down with people from various companies and vendors to get an idea of all available products.
]]

--Maybe it's not the _best_ place to ask this question, but it does get the issue out in front of a fairly wide audience.

--My friend and I were trying to rebuild a 2000 Server with AD and Exchange last night after a virus attack. Worked on the box for almost 16 hours straight, called MS Support, and it *still* wasn't fixed by the time I left, at 6:30am.

Re:Maybe not so easy.

[Korgan]

May I ask why the company continues to use Windows 2000 and Exchange then? :-)

I'm not trying to be negative or a downer, but I wouldn't accept that kind of performance or response from any product or company. Especially not for something as core critical to most businesses as email.

A lot of people claim there are no feature comparable alternatives, but thats not true. There are plenty. Its just a case of taking the time to research it.

So ultimately, if you have AD and Exchange and they're down for at least 16 hours and even Microsoft is struggling to help restore the service, why does the company continue to rely on the products? More importantly, why pay Microsoft support fees to fix a problem that should not be anywhere near as difficult as it appears to have become?

Personally, I would consider that amount of down time and difficulty of resolution to be 2 serious reasons to start looking for an alternative. They're two costs over and above your normal admistrative/maintenance costs. I'd consider 16 hours to be as much as I'd be willing to pay for in any half year. I know that with the solution I use I can build a new mail server, restore the mail and have everything back up and running from scratch in far less time than its taken to resolve that problem. If it came down to it I can use simple shell scripts to go through and clean out any viruses from the mail store.

Fortunately, the mail server (or any other for that matter) isn't running on Windows or Exchange and so virus issues are almost non-existant. The desktops/laptops all running Linux or OSX might help that too though. ;) There are still virus scanners in place, but my concern of something going rampant on my network is mitigated significantly by design and deployment. But at least I know that if something does happen, I won't be spending 16+ hours trying to fix a single issue.

And if in the future I do end up in that situation, then I'll be back on the market looking for a replacement again. As I think you should be right now.

Anything but Novell

[sameat]

I'm afraid I can't help answer the initial question, but I have to caution you strongly regarding all of the suggestions for Novell products.

I live the Novell dream everyday, and "cobbled together" would be a generous description of their products and services. This is a company with a time honored tradition of rendering promising technologies useless. They handed most of the market to MS on a silver platter.

Before you consider Novell too seriously, look through the forums at forums.novell.com, be sure ask about your support options , and try to get a feel for the staffing and training required for a network of your size and scope.

Stick with your inital instincts, just remeber that very few Novell products are actually Open Source.

Re:Anything but Novell

[Anonymous Coward]

I smell either an incompentent admin or a Microsoft troll. Do you actually update your products? Have you upgraded to anything resembling a recent Novell offering?

While it takes a little bit of study and might take a little typing, a properly configured Novell solution blows Microsoft out of the water -- and eDirectory scales much better than AD> While our Netware servers run seamlessly for months on end (I have no doubt they'd run years, if we didn't do service packs), our Windows boxes have to be rebooted anytime an application is upgraded or a critical update is installed. And, you won't ever find a NetWare, SUSE, or OES server needing to be defragmented.

The parent is correct about checking Novell's site. This is a good idea. See how Novell allows users to interact among themselves and with support staff. It's for sure a "warts and all" approach -- just like most Linux vendors and sites. Then, skip going to Microsoft's site, where you'll only find the most glaring of Microsoft problems, and go to some site like Annoyances.org, which actually got it's name because it supports Microsoft products -- here, you will see how Microsoft users truely fare.

I am not a Novell employee or reseller. I am only a satisfied customer.

Re:Anything but Novell

[sameat]

Not a microsoft troll, I abhor MS business practices.

As to "incompetent admin", that may be the case. That doesn't change the fact that Novell is a very closed solution, that they won't even answer the phone without payment ($325), that the latest (just a few weeks ago) version of Zenworks has some serious flaws, and that they make no bones abut the "advanced technical training" ($2500 a pop plus travel) that is required to use each feature of their products effectively.

You and I see different forums...in my opinion, your description of MS forums aptly describes my experience with the Novell forums, only on a smaller scale (therefore, less chance of a random expert answer). I have certainly never gotten assistance from actual Novell support staff there.

Just because Novell isn't relevant enough to warrant it's own annoyances.org does not mean it is a stellar product.

The OP mentioned 100 machines or so. I have extensive experience with a network of a little less than 200, so I believe that experience is relevant. The TCO of Novell solutions is just too high in a network of this size.

Back to the original point...As a long time Novell small business customer, I have to say that I would never willingly purchase another Novell product without exhausting all other options. They are right below Microsoft on the list.

Re:Anything but Novell

[Anonymous Coward]

I've been a long-time Novell customer and what you say just ain't true.

eDirectory is the only LDAPv3 certified directory out there, as far as I know.

ZENworks provides a higher TCO than any other product out there. In fact, according to an NTBugtraq poll about a year ago, ZEN is used more for deploying Microsoft workstation patches than Microsoft's own pay-for solution.

I worked for a Fortune 50 company that had a TCO study done on the ZEN implementation and it was rated "Best of Class", with comments from the team that did the evaluation that they'd never seen a product give such a high ROI in that class of products.

eDirectory integrates with RADIUS (through the FreeRADIUS project - as a *supported* solution). It scales far, far beyond anything else out there today. Active Directory is a *toy* by comparison.

AD in W2K3 is *better* than it was on W2K, but it's still an immature product plagued by - among other things - scalability issues. That Fortune 50 company that I worked for was preparing to deploy AD across a very large implementation; Microsoft said "oh, yes, you will want to monitor it using MOM" - at a cost of *several million dollars*. Novell's iMonitor absolutely blows any monitoring of AD that Microsoft provides out of the water - and it's included with eDirectory at no extra charge.

My experiences with AD showed that if you try to use dcdiag and replmon to monitor, you're asking for trouble. I sat there with a Microsoft consultant (not a third party, this was someone from Microsoft's own Consulting Services group) and showed him how it was that replmon and dcdiag could provide conflicting information about the same domain controller. Yep, one said everything was healthy, and one said everything (literally) was broken. That's not a lot of use.

Novell support staff do hang out in the support forums, though many do not identify themselves as such. I know many of them personally, and they want to see what problems customers are having and don't want to see a "filtered" view (one way *or* the other).

People come to the Novell support forums for help on Microsoft products on occasion because they get useless answers from Microsoft's MVPs (who, BTW, are not Microsoft employees).

Latest version of ZEN has "serious flaws"? Never looked at a Microsoft FCS product before, have you? Hell, even after being out for years, Microsoft products have serious flaws. At least Novell *fixes* their flaws.

Re:Anything but Novell

[sameat]

I'm only continuing this dialogue so the original poster doesn't get confused.

Fortone 50 does not equal small bsuiniess. I'd wager that 100 employees menas an IT staff of 1 (2 would be excessive), with "helpers".

There is absolutely no comparison between the 2.

If you have one guy, you probably want him to spend as much time as possible supporting actual production functions and not infrastructure. That's where novell falls apart...small businesses without staff devoted to their products.

I get that MS products are horrible, bug-filled security risks. But they also have market penetration and a much broader user base in this market, which means a better chance of finding someone in the same boat (and possibly a solution).

Try google searches for any Microsoft solution, then the same for the comparable Novell product. You'll see quickly that the amount of information out there isn't even comparable between the two.

Finally, I find MS objectionable in just about every way, but sometimes we have to face the fact that through no fault of their own, they have the best tool for the job,

Microsoft and Novell both suck in my experience. In most cases, an alterntive to both would be best.

Re:Anything but Novell

[Anonymous Coward]

I agree with the grandparent; I've supported networks that use a Novell infrastructure in the 100-200 user range, and they worked just great.

I've also worked with pure Windows infrastructures in the small business, and usually there are a handful of expensive consultants who have to maintain them because Microsoft's products are basically bailing wire and duct tape solutions.

In fact, I was the only person supporting one of those infrastructures, with a handful of AS/400 programmers making up the rest of the MIS department staff.

The environment from a server infrastructure consisted of two NetWare servers and a single AS/400 to handle the database tasks.

Installed it, configured it, and ran it. Spent most of my time fixing Excel macro problems because the server just worked.

Managing a Novell infrastructure ain't the rocket science you seem to think it is.

Just because there's a lot of information about a product doesn't mean the information's any good. I find the quality of information outside of Novell to be far superior to the third-party information on the whole for Microsoft products. There's a lot of crap on the 'net, and I can count on the information on Novell products being accurate regardless of the source.

Well, except for the blathering that goes on on slashdot, that is. But then again, I don't come to slashdot for technical information.

As for finding solutions because of a larger user base for Microsoft products, don't make me laugh. If the larger user base meant there was a better chance for solutions regarding malware/spyware/viruses/other crap, it wouldn't have half the problems it has.

A well implemented Novell infrastructure is extremely difficult to hack; the server isn't susceptible to Windows viruses (because - newsflash - it doesn't run EXE files!), GroupWise when used with Novell's GW client doesn't have the MAPI exposures that are the cause of the majority of worms out there that spread via e-mail...I could go on and on and on, but you get an idea.

The people running a Novell infrastructure just laugh their asses off when the virus outbreaks hit. Update the signatures for viruses (push via ZENworks) and keep on working.

After all, the goal of an IT infrastructure isn't for the users to lose productivity; it's to improve it. I've never worked on a production infrastructure with Novell products at the core that wasn't easier to manage and that didn't increase productivity in the end users. I can't say that about networks built on a Microsoft infrastructure - there's always something breaking in those infrastructures. I've even seen Windows servers fail to start up after a hard down due to a power failure - and those servers needed to be completely rebuilt (that is, they were totally unrecoverable). Never seen that with a NetWare server. They just run.

Re:Anything but Novell

[Anonymous Coward]

That doesn't change the fact that Novell is a very closed solution
1. Novell is a company
2. GroupWise supports Linux, Netware and Windows on the server-side and Windows, Linux and MacOSx on the client-side. That makes a hell more closed than Exchange and Notes, right?
3. eDirectory supports more platforms and access protocols than any other DS. Now this makes it the most closed of them all, doesn't it?
4. Go on with OES, ZENworks, iFolder, etc.

that they won't even answer the phone without payment ($325)
All vendors charge for qualified, per incident support. Plus, he will almost never need it. For 90 users he should be able to find all the answers in the knowledgebase or the support forums, both of which are excellent.

and that they make no bones abut the "advanced technical training" ($2500 a pop plus travel) that is required to use each feature of their products effectively

WHY THE HELL would he need ATT to run a network with 90 clients? It's like saying you need excellent knowledge of the NT kernel internals to browse the web successfully. CNA-level knowledge would be sufficient.

Re:3. Mac OS X Server

[macshome]

Open directory is (as I understand it) basically openLDAP with a config file and a nice GUI. Don't get me wrong, GUIs are useful, but if you want to go OSS, cut out the middleman.

Well, it's a bit more than that. With a few button clicks you can have a fully functioning Directory Service with OpenLDAP and Kerberos. You get password policies, single sign on for everything from mail to smb to web, and you even get a one click samba pdc.

The only thing it lacks is the groupware support. Firstclass or any number of OSS solutions can provide that.

Check out our site, or even just Apple's server site for more info.

Of course since the questioner didn't mention openLDAP to begin with,

Yeah he did, by name even.

The client is called OXLook...

[msimm]

And is still available as a free (Beta) download here.

Don't know how long that will last and I image its not part of the OSS suite.

I haven't used it but would like to do some testing with it at work. For more general directory type support (domain controller, etc) I'd look at Suse LINUX Enterprise Server with their Novell Open Enterprise (sorry thats a PDF). It uses Samba and LDAP, but its the closest thing to a usable AD "killer" I've seen so far.

Win2003 with Sharepoint

[Michael Snoswell]

I hate to say it but this is pretty darn good. If starting from scratch then this is easier than open source solution and cleaner and more integrated. Sharepoint brings together exchange, web stuff, calendars, share and individual todo lists etc in a fairly new and integrated way and is very fast. Underneath it's mostly the same Exchange and Active Directory stuff. We just rolled it out to 450 people over multiple sites and it was painless - just needs some design work up front for how to organise data.

Novell Groupwise is good too, I've managed it on a large multisite company but generally you'd only choose it if you already had Novell servers. I haven't used it in the last 5 years so maybe it's much better now though I doubt it.

I have less experience of Lotus notes (set it up over a large network but never actually used it much) and would say it much more complex than the MS solution - though it's a slightly different tool and probably has greater functionality. Great if you're an IBM shop and fairly easy to get training or consultants who know it - though they're more expensive than Novell or MS consultants.

I've looked numerous times for solutions that cover unixes (linux, sun, sgi etc) and windows and there's no simple solution. So if you're a PC shop running windows clients then MS is the most integrated solution with the best support.

If the thre separate companies are already on linux or Sun servers with good unix admin skills inhouse then one of the OS solutions would be more cost effective though would require more time to set up.

This guy needs to be fired.

[smooth_shave]

I don't know the motive behind this post, but maybe writing about the possible motives might help. Please comment with me and lets see if we can see through where this guy is coming from.

He/She doesn't know squat about directory solutions available. All major OS vendors have a strong DS to go with their 'package'. Lets see, IBM .. Apple .. Novell .. Red Hat ..

He/She doesn't know computer technology very well. Anyone who's been an MCSE or worked with Microsoft products knows they are just as 'cobbled together' as anyone else.

Given the appearant low skill shown by the poster, I wonder if he is really in the position described. Maybe:

1. Poster has skills/has the position. Then they are just playing a game with /.
2. Poster has no skills/has the position. Maybe the poster is a transfer from another career/sector and doesn't know technology at all besides a little bit of solitaire and the 'internet thing'.
3. Poster has skills/not in position described. Maybe the poster is a MS hack trying to see how much the tech crowd knows. Perhaps is it someone in a compentitors business that is trying to make the /. crowd look bad/foolish
4. Poster has no skills/in position described. Clueless idiots that play solitaire do get these jobs sometimes. They should be fired, but that doesn't make the # of MSCEs any less.

Novell eDirectory

[Raspberry]

novell will do everything you want... Client OS Independent... they're getting more and more cross-platform every day.

They produce Windows / Linux / Mac OS X / HTML clients for almost all of their products and they meet all of your requirements.

If you have under 100 employees you can use Novell Small Business Suite in which the licenses are about 1/2 price. Once you cross 100 users you must upgrade your licenses... You also are allowed 2 server licenses with the small business suite.

Novell is really flexible and much cheaper than Microsoft. The security and stability is also there... although their Netware product since 4.11 has left much to be desired, but that's ok... they've got Linux (and have been for some time.) Their servers run Tomcat(web-java), Apache2, Perl, PHP, MySQL and all kinds of goodies right out of the box (they're install options, many are required.)

Anyway, very slick and VERY excellent and low-cost/maintenance for small business. Plus you're supporting open source (directly and indirectly) :)

http://www.novell.com/products/openenterpriseserve r/index.html?sourceidint=hp_products_oes

Ryan

Oh jeez...here we go with OSS again

[threedognit3]

Go with Windows...go with Win2K and plan on upgrading to Vista in two years. Anything else and you're asking to be fired. Every open source dweeb is going to point you towards Linux but you will soon find no one else will converse with you. The dweebs live the open source stuff. It's their drug of choice. Like all drug addicts they find themselves in the back roads of nowhere, alone except for a few other drug addicts, yet they extoll the virtues of open source as if it will promise you the nirvana you yearn for. Most, if not all, are anarchist just waiting for the opportune moment to unleash their warez. Novell, Sun and IBM saw the light...they only seek to entrap the misantrophes who have been misguided by the hope of being on the forefront of something that is impossible. Here we go with the college CS dweeb weenies who just can't get away from the group mentality. Open source in nothing more than wishful thinking. It will never amount to anything except for allowing the new millenium hippies to dance around a fire place and chant phrases of 'we're almost there'. There are only two OS's, Unix and Windows...you choose. All else are misdirected ideals who have a slim but non-existent chance of even being accepted by some strange organization. Oh yes...let them in the last gasp of hopefulness, emplore you to accept MAC OS. It's they're only chance of redemption. Walk away...please walk away. While Windows is not perfect...it's what 95% of the world uses.

Re:Oh jeez...here we go with OSS again

[Antique Geekmeister]

The desktop isn't the problem, and it's most certainly not 95% Microsoft at the server level.

  For small scale, less than 50 users, MS is very common. For large scale, more than 50, it doesn't scale well. The interdependencies of what are functionally very different parts of the system (user authentication, file services, DNS, email, calendar, etc.) just don't work well in a large shop based on Microsoft. And the licensing costs are prohibitive at the medium scale, unless you've got an educational discount or someone willing to buy an MSDN license and violate it to install at least 3 distinct MS servers for general use.

Even Microsoft can't use it at the large scale of over 1000 users: hotmail and MSN were running on Suns, the last time I looked.

Re:3. Mac OS X Server

[plsuh]

Open directory is (as I understand it) basically openLDAP with a config file and a nice GUI.

Open Directory covers a lot more than LDAP. Yes, it's based on OpenLDAP -- in part. Yes, there is a nice GUI, which you can use to administer users and groups remotely, from another Mac OS X machine.

But there's also MIT Kerberos, integrated with the LDAP. When you create a user in Open Directory, the necessary Kerberos principals are created for that user. User identification (linking usernames with Kerberos principals and home directories) happens automatically.

But wait, there's more -- there's also the Apple Password Server, which is based on the SASL layer from CMU. This provides centralized, non-Kerberos password support, for things like CRAM-MD5 authentication, or NTLMv2 auth for Samba. The Password Server passwords are automaticaly synchronized with the Kerberos passwords. When you change a user password in the KDC the corresponding password is also changed in the Password Server or vice versa.

Still not happy? How about built-in replication support for load-balancing and high availablility. It covers not only the LDAP database via slurpd but also the Kerberos and Password Server databases?

Oh, and one more thing -- encrypted archiving built in to the GUI. Archive your entire set of LDAP user information and your password database to an encrypted disk image. Secure and convenient.

(Yes, I work for Apple -- but the parent post misses most of the good parts.)

--Paul

Just a thought...

[nicktripp]

I can't speak from experience, so I'll just ask. How about Open Directory on Mac OS X Server? Good? Bad?

mmmhmm. Scales great. Sure.

[HBI]

It scales like ass. It's slow. It has dependency issues. You have to disable commonly available services in large installations to avoid issues. But the 1000 GPO limit is just the icing on the cake.

Otherwise, explain why a large organization - perhaps the largest in the US - was compelled to split its AD installation into four illogical geographical domains without transitive trusts, due to scalability issues? So, now, you can't add people from a location in the western US to their correct OU in another region.

Yeah, didn't think you could. But yeah, it's scalable, right.

Directory Services

[Anonymous Coward]

I am a senior designer in the Directory Services organization of a very large international company. As such, I'd offer you the following observations:
--
*Microsoft Active Directory/Exchange*

Pros: Works out of the box. Integrates best with other off-the-shelf products. Large pool of available techs to design/implement/support your solution. Well documented. Excellent technical support. Mature products. Is a comprehensive solution for LAN login, messaging, Group Policy management, audit tracking, delegated security management, and can be easily leveraged for other solutions such as patch management, asset management, etc.

Cons: Minimal. You must purchase your software from the Evil Empire.
--

*OpenLDAP/some flavor of commercial UNIX directory*

Pros: Extremely flexible during the design phase. You also get bonus cred points when posting on Slashdot due to your open source solution.

Cons: Not an off-the-shelf solution (requires significant customization and implementation). Documentation can be spotty and confusing. Technical support low. Harder to staff from a technical perspective. Not a unified solution - all additional functionality must be customized through additional coding or "plug in" functionality. Less flexible once designed and implemented without causing significant impact to the existing environment. Requires dedicated developers for ongoing coding/scripting support in addition to standard technical operational staff.
--

Now I know those comments may annoy those that have knee-jerk reactions against Microsoft technology when it thumps heads against some form of *nix or Open Source. For large organizations (100k+ users) or very small organizations (under 1000 users), Microsoft simply has the best combination of features for the business.

The small companies will get everything they need in one nice little package. There are tons of AD admins out looking for jobs, it's easy to staff. There are thousands of training classes available for technical staff, and thousands of books and websites with real-life examples and how-to's. You get the whole bundle at once.

Less headaches. Easier to implement. AD is the way to go for a very small enterprise.

An IBMer writes...

[Anonymous Coward]

For goodness sake, don't call IBM. Unless you're planning on spending $50k on a "business value assessment" (paid sales process), $100k on Regatta servers, another $50k on Lotus Workplace software licenses, and $500k on an army of consultants like me to try to make the damn thing work without the aid of two crutches and a walking frame, even though the lead shark told you that it worked straight out of the box and we've never seen it throw that error before, what do you mean it won't even install?, are you running an unsupported configuration?, looks like you'd better upgrade to the latest release, tell you what I'll put you on Passport Advantage, that'll save you $10k, oh and by the way here's the bill for another $100k for the upgrade, what do you mean it still doesn't work?, oh well I don't care, I've just been reshuffled anyway, so long sucker!

Don't misunderstand me: IBM has a lot of good products and good people. And I've been proud to be an IBMer ever since the strong support for OSS. But you don't see the company at its best when dealing with small projects and new technologies.

OpenGroupware

[diogenes57]

Adopting OpenGroupware at my university has garnered few complaints. It is still beta though and there are a few areas that show it. But we're willing to stick with it and watch it grow. All of the basic functionality is there: news, calendar, email, tasks, projects, even interface with Evolution or Outlook (with a non-free plugin). The only problems seems to be a bit of a learning curve for the users and the lack of some more advanced news editing features like HTML or any kind of formatting tags.

Don't hit me

[Anonymous Coward]

What does your new business do? Do provide Directory Services for your customers?

If not, outsource it and focus your time on stuff that will earn money for your company.

(ducking)

Novell?

[ezs]

Don't confuse your application choice with your platform choice.

Look at using Novell NetMail with Novell eDirectory.

It's fast, cost effective, standards based, scalable - and it runs on Linux, Windows, Solaris - or even NetWare.

For 100 users it will be just great.

If you want open source - and depending on your acceptance of 'newness and risk' - look at Hula - again based on the NetMail codebase.

NDS not AD

[Anonymous Coward]

If you want off the shelf software, then Novell Directory Services (NDS) or Novell eDirectory are probably what you mean and not MS Active Directory (AD). AD still hasn't caught up to how NDS was ten years ago in ease of use and functionality. NDS also supports multiple platforms, unlike AD, and is a separate service, unlike AD which is part of MS Windows Server. Also, AD still suffers from severe scalability problems.

If you don't want off the shelf, then a combination of LDAP and Kerberos is what you want. It's not as hard as the MS apologists claim it is.

The bizarreness of the mindshare MS has over people. The quesion is not MS vs OpenSource, the question is MS vs all other products open and closed.

Mac OS X Server

[Aron S-T]

Cheap - $1K for an unlimited server license, and the Xserves come with the license and are great performers in their own right and cost-effective.

It has ease of use GUI goodness, with a full open source stack underneath: supports Open/LDAP directory services, single sign-on, kerberros, email, calendering (via WebDav), file services (via Samba for Windows and Linux), CUPS, Apache, DNS, Mailman - the list goes on and on. It plays extremely well in mixed environments and is extremely easy to administer - no steep learning curve.

It's far cheaper than all the other alternatives, including Novell and RH, not to speak of Microsoft. And soon you will be migrating all your users to OS X boxen as well once you see all the advantages.

I have done administration on all the other alternatives and I'm far from an Apple fanboy, so don't start flaming me on that score.

Re:Mac OS X Server

[Kjella]

And soon you will be migrating all your users to OS X boxen as well once you see all the advantages.

Down boy. I wouldn't start recommending an OS migration to any company I don't even know what is. Even though they want to uproot the "generic" collaboration tools, they may still rely on Windows only applications used in their field of business. Still, it's a mighty fine chance to free yourself of as much lock-in as possible.

Kjella

Re:Mac OS X Server

[tbo]

I second this. We run OS X Server 10.4.2 on an Xserve G5 to provide directory, authentication, and home directory / file sharing to about 15 Linux and Windows clients. The Xserve G5 might sound like overkill, but there's some light scientific computing / numerical work that happens on these machines, which can generate substantial loads. It's funny, but OS X Server was actually the best match for providing these services to our heterogenous Windows/Linux environment.

OS X Server 10.4 still isn't perfect. Examples:
Software RAID on OSX Server is crap--save yourself the trouble and get a hardware RAID (either an external device, or an Xserve with hardware RAID card). OS X Server is not quite as polished as a longtime Apple user might expect, but better than most alternatives. The 10.3 --> 10.4 upgrade was a bit problematic--the recommended approach is to do a clean install of the new version, followed by re-importing the user database, but this doesn't preserve user passwords.

Even with these flaws, OS X Server is an inexpensive, scalable, reliable, easy-to-setup option. It plays well with Windows, OS X, and most* unix-like OSes. If, at some point, you want to switch to a cobbled-together OSS solution, you'll likely find it much easier to do so from OS X than from a Microsoft setup, since much of OS X Server is already OSS.

* most means not FreeBSD 5.2.1. We encountered a bizarre incompatibility between OS X Server 10.4 and FreeBSD 5.2.1's NFS implementations that caused a race condition that broke KDE logins for users with NFS-shared home directories. KDE developers were stumped, and we ultimately had to switch to Linux from FreeBSD. The problem didn't exist with OS X 10.3.x. We attributed it to looseness in the NFS spec, which allows for different implementations to be compliant yet subtly incompatible.

Some tips and a little more on Lotus Domino

[JDAP]

As this is my First! Slashdot! Post! Ever! (R), I'm hoping to avoid any crass errors in style or etiqutte..fortunately, based on some posts I've read over the years, there'a a pretty high bar. (Hopefully, smartass jokes are also OK.)

I've done a lot of work with a range of customers on implementing and maintaining directory infrastructure, mainly centered around Lotus Domino and the IBM Directory Server. To start the shameless plug, I'll say that based on your criteria - directory services and a groupware/mail solution - you should give Domino a hard look. A Domino server contains a totally integrated mail system (both fat client and web mail based), an application development platform with Java support, LDAP directory server, Web, SMTP, IMAP and POP server, predefined application database templates, and advanced security services like PKCS and SSL out of the box; it can also synchronize user information with Active Directories for centralized user account administration. Outside LDAP servers can be associated with Domino to allow those users direct access to resources like web-based apps. Current versions are shipping that run on Windows, Linux, HP-UX, and other platforms, which allows for platform flexibility.

To save this from becoming a sales pamphlet, there are some good reasons to consider other options depending on your needs. Some corporations demaand that directory services be highly integrated into the OS; Domino's directory is not, though it can share information with native services if they exist.

While Domino is great for having so many services instantly available out of the box, they are not necessarily best-of-class. If a very large, intensively utilized directory system is planned, then a dedicated LDAP server like the ones mentioned in previous posts may offer better performance. Some advanced LDAP features, like multi-master replication aren't included in Domino.

All that aside, in my opinion the most important things to remember in creating a directory services infrastructure is to plan around intended use and growth, not around products and glib promises a sales rep will spout. When you talk about the need to "set up directory services", take some time to plan what workflow will be used the most, what functions will need to be the most efficient, and what future applicaions and products will be hooked into the system. Create a concrete, detailed outline of what operations you'll need supported - signing people onto their workstattions is usually just the beginning.

After that's done, it's easier to look at hardware and software more critically to suit your needs - much better than fitting your needs to what a particular solution can provide.

Re:Some tips and a little more on Lotus Domino

[Anonymous Coward]

Someone please mod this guy informative!

open ldap + postgresql

[MagicMerlin]

If you are interested from managing this from a database you should check out my good friend Magnus's work with integrating openLADP and postgresql via dblink.
Check his blog

communigate pro

[istokj]

I've tried a lot of the "cobbled" together solutions as well as the paid ones, and communigate pro is one of the top ones out there. It easily scales to what you want and offers all of the protocols you mentioned and then some. Yes it costs money, but runs on just about any platform out there and allows clients from just about any platform out there - including groupware abilities.

Novell eDirectory/GroupWise

[Anonymous Coward]

Want the best of multiple worlds? Have you ever seeen any other Directory every try scaling to a billion objects, must less succeed at it? eDirectory does it.

GroupWise with just 100 users could be run on one server without blinking but, to save headaches when the WAN went down, spread it across the three already running eDirectory (for the same reason, and for redundancy). File-sharing exists the same. If you had a Novell partner they could implement something like this in a day in a lab without much thought and maintenance means patching three servers (like every other solution) once in a while. Honestly I could build your entire environment in a lab in one day.

For those who believe n true OSS to the rescue (as I do too) eDirectory supports LDAP versions 1, 2, and 3 as well as any other platform (OpenLDAP included). IDM (another Novell product) uses XML for connecting to third-party systems (even if the third-party doesn't necessarily have an XML connector, Novell made those too). eDirectory, GroupWise, Zen, IDM, etc etc all run on Windows, NetWare, Linux, HP-UX, AIX, and Solaris... Not many products on earth can say that.

Top that off with awesome support from Novell (really, it is great, and they have free forums for all their products searchable by Google Groups) and what else is there? Sure, you could do it all with OpenLDAP (no directory partitioning, though, and painful replication compared to eDirectory) and Samba (eDirectory/NetWare/Linux support Samba in Novell's world too) and Postfix (integrated into OpenLDAP even, maybe) but I think in this case, for ease of mind (ever seen a NetWare viruses/worm/etc ever in the wild?) I would go with a Novell solution.

While your at it . . .

[bigbend]

I'm considering which I want to register as -- Republican or Democrat.

Can somebody give me an unbiased opinion about which is better?

Re:3. Mac OS X Server

[macphile84]

These guys have saved more bacon than I've eaten in my life, and I live in the Southern US!

Fedora Directory Server

[tuxpert]

Formerly Netscape Directory Server, also the base for iPlanet/SunOne Directory server , Fedora Directory Server is the best OSS directory service out there today. Check These links for reviews.

Novell eDirectory ?

[morcego]

I would not entirely discart Novell eDirectory.
It is specially interesting on a mixed environment solution, and it does provide some interesting possibilities when coupled with Novell Client.

The pricetag is also VERY attractive.

Stark and Clear?

[clarkeb]

What do you base your stark and clear choices on? Banyan was the first company to come up with directory services. Novell really took directory services to the next level when it came out with NDS and NetWare 4. Wow one place to manage users, servers, printers, file system, DNS and DHCP, pretty cool. Well, Microsoft not to be outdone started calling NT's domain a directory so that they could compete with Novell. Novell threatened to sue MS about the false information on the MS web site about NT's "directory" and MS had to pull it. So, you guessed it MS had to have a directory and eventually after years, came up with Active Directory. Novell's NDS has evolved and MATURED, key word here, to eDirectory. eDirectory is a very scalable, over one billion objects, robust, LDAP v3 compliant directory services. Novell's Identity Manager product gives one the abililty to manange identities in a mutli directory/database environment. eDirectory runs on NetWare, Linux, AIX, HPUX, and Windows. There are other directories to consider including Sun, IBM, Seimens. Novell also has Groupwise email and groupware, and a pretty awesome desktop management suite, Zenworks, both managed in eDirectory. If I were you I would talk to the vendors and better yet talk to sites who have implemented AD, eDirectory and the others to do some due diligence and help make a good choice. Lot's of people think that Novell is dead. This is not true. Check it out.

Why not Novell?

[koamana]

OK. You didn't mention Novell's eDirectory. AD works for small networks. It might even work for medium sized networks. If you want something that is going to scale, Novell wrote the book on directory services. They have their Small Business Suite of products. If you want to cobble(?), kludge it together, well you can look at open source solutions. In my opinion, directory services from open source isn't quite baked.

Whatever

[sohp]

Look at this way. The folks who were your predecessors at the other companies probably thought the same things you're thinking now. They figured they'd "do it right", and now you're the one who is saying they all stink so bad that starting from scratch is better. You think that 5-10 years down the line anyone is going to appreciate what you did and think, "wow, whoever set up this infrastructure sure was smart"? Hell no they won't. They'll curse you and try to justify their jobs and make their lives easier using the same arguments you want to use now.

My advice -- save yourself a lot of angst. Just buy whatever the vendors tell you will work, from whoever will treat you to the best negotiation perqs, and throw it out there. Take the accolades and raises from your management who think you worked miracles with their IT stuff because you have all the best powerpoint slides and slick glossy brochures from vendors, and cut out, move on to the next job, and start over again.

Nobody will care when the technology moves on and whatever solution you thought you were so elegantly rolling out is now the biggest, smelliest pile of steaming...

Re:You are fucking morons

[handy_vandal]

I fucked your mother's ass with a spike strip

Fortunately, my mother is safely dead, and cremated. And you'd better not make "cream" jokes about her ashes. (Or "ash" jokes, for that matter.)

But the really important thing is, you're not an Anonymous Coward -- hats off to you, Sir/Madam/Other.

-kgj

Hula project...

[Anonymous Coward]

http://hulaproject.org/Hula_Server

From their site:

"Hula is a calendar and mail server whose goal is to be fun and easy to use, while scaling effortlessly from small groups to large organizations with thousands of members.
Hula is an open source project led by Novell."

Novell is all-in-one

[digidave]

Their directory far surpasses AD. You can also look into Netscape Directory.

For groupware, check out Zimbra (http://www.zimbra.com/). The Flash demo is great.

What's Missing?

[RichiP]

A solution which is free and satisfies all your requirements would be a no-brainer. OSS is definitely free, so i'm guessing it lacks something. Could you outline what the OSS solution needs or is missing?

Look at @Mail - atmail.com

[blackhaze]

Take a look at another good option, @Mail - http://atmail.com/
A nicely wrapped up mailserver/groupware and Webmail solution - Perfect for a userbase of 100+ people.

After the hangover...

[threedognit3]

Think about MS Biz server. Nice package coupled with MS apps...cheap and easy to support. You'll get a big raise and all the employees will thank you. I've put this out there for several small/medium size companies and they love it. MS is just now starting to focus on the medium range companies so you'll get the benefit of that. Anything else and you're asking for trouble. Yeah, I use to like Novell but they went south for awhile and are just now coming back, however, they're pushing SUSE and that's going nowhere.

Re:After the hangover...

[Anonymous Coward]

30% (and growing) of the market in China is nowhere? Damn, some would kill for that chunk of the market over there. Novell's SUSE push is just getting started. They've made all the right moves up to now - learning about the OSS community rather than trying to take it over, and now are working with that community.

It would've been SO easy for Novell to fuck their Linux move up by moving too fast and trying to dictate terms to the community. They didn't - they acted with intelligence and respect for the community, and are now starting to see the benefits of their approach to moving into the OSS space.

Re:After the hangover...

[Anonymous Coward]

Damn, some would kill for that chunk of the market over there.

Or at least throw a chair or two while cursing a CEO's name....

Open-Xchange

[Anonymous Coward]

"Some people think that Open-Xchange is a GPL'd version of SLOX (SuSE's Groupware Server). This is not true. It's just the other way round. SuSE has made a ready-to-use server called SLOX, which is based on SuSE Linux and open-Xchange which is not a product of SuSE but of Netline Internet Service GmbH, Martinstr. 41, D-57462 Olpe, Germany. It allows for much of the functionality of MS Exchange"

http://gentoo-wiki.com/HOWTO_Open-Xchange

Devil's advocate here...

[Anonymous Coward]

You only have 100 employees. You don't need an "IS infrastructure." What you need is a POP/IMAP server with 100 accounts. Get a single 300 MHz linux box and hook it up inside your firewall -- that's all most universities had as of 5 years ago, and they did fine with 1000s or even 10000s of students sending tons of mail daily. You're done, and you only spent about $300 for the box, even after buying a pair of brand spanking new hard drives to RAID. Shoot. You probably even already have a server or two that would exceed your needs. Go spend the rest of your $10,000 hardware budget (estimated by your post) on a massive beer party, and then hire 2 new devs with the payroll you'll be saving on admins.

Quit trying to justify something that nobody needs or wants.

STOP....

[Alystair]

Hammer Time!

That's not a knife. This is a knife.

[Anonymous Coward]

Whenever you say Directory Services, you need to throw eDirectory in the ring. Lucky for you, you can get groupware from the same vendor. And it can all run on Enterprise Linux.

Oh ya, it comes with a pretty nice desktop offering, too. It includes a decent office suite, excellent web browser, the works. But it will integrate resources on Windows, Linux, Mac, whatever.

And during the transition, it can tie into LDAP, Kerberos, or whatever exists in the three merging disparate offices.

For a small expense, you can even wrap it in a bow.

Easy: Novell

[ImaLamer]

Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult.

Not true, you can use Novell's NDS (eDirectory, the LDAP server software) right on top of Linux, Unix, or Windows. The admin tools are almost all Java based or otherwise accessible so you aren't locked in there (clients and management tools for Linux, Unix and Windows). Novell can manage the rights, er permissions, er privileges for clients of any flavor (because a directory services solution is about managing the resources on the network) - and has less bloat and more security than Active Directory.

Novell is my choice hands down. It isn't the nightmare product it used to be. Quite flexable, scalable and for all intents and purposes "open". This product actually follows standards! In my experience it also prices cheaper for clients than Active Directory, although you never know because I'm sure it has changed.

The person who asked this question initially said that the only other option to Active Directory was A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists)

This simply isn't true. There is eDirectory and it's better! (PDF) Wake up people! It's 2005 and there is a better option out there and to top it all off they are a Linux company too.

Re:Easy: Novell

[ocbwilg]

Novell is my choice hands down. It isn't the nightmare product it used to be. Quite flexable, scalable and for all intents and purposes "open". This product actually follows standards! In my experience it also prices cheaper for clients than Active Directory, although you never know because I'm sure it has changed.

The problem there is that you cannot directly compare the two. Active Directory is part of the server OS and isn't licensed separately, so I'm not sure how you can quantify "cheaper". If you're buying any Windows servers at all AD would be cheaper than licensing eDirectory.

Re:Easy: Novell

[JourneymanMereel]

This simply isn't true. There is eDirectory and it's better! Wake up people! It's 2005 and there is a better option out there and to top it all off they are a Linux company too.

NDS and its superiority has nothing to do with it being 2005. It was superiour in 1999... oh, wait, there wasn't even an ADS yet in '99, that's right. But IIRC Novell was on version 8 of NDS. At that point they were just starting to branch out into the cross platform territory instead of being windows centric for clients and Novell centric for servers. ADS, however, is still a windows only solution (for officially supported purposes) and isn't likely to change in the near future.

Re:Easy: Novell

[Blakey Rat]

Does Groupwise still suck ass? Last time I tried using Groupwise I wanted to pull my own teeth out with a rusty pair of pliers because the interface was so goddamned awful.

Ditto with Lotus Notes. Actually, Notes is quite a bit worse.

To be honest, I'm with the original submitter, because out of all the groupware products out there, only Exchange/Outlook has a half-decent email component. And you'll find that email is what your employees are using 99% of the time.

Remember: It's not just about making the admins happy, you have to make the employees happy. Unless Groupwise and Notes have been improved *A LOT*, people are going to be unhappy using them.

Re:Easy: Novell

[Qube]

The 6.5 Groupwise client is great - apparently it's had the bulk of the work and improvements on this version. It's a lot more outlook-like in many ways, and certainly much tidier and more modern looking.

GW7 is yet more polished, but I haven't spent any significant amount of time using it yet. There's proper, native PDA syncing support and these days the Blackberry server-side stuff supports GW6.5+ too. I don't think the typical email user who was used to Outlook/Exchange would find much to complain about these days.

Re:Easy: Novell

[Blakey Rat]

That's good to hear. I'll have to see if I can find a Novell shop and play around with it for a few minutes. It couldn't possibly be worse than Notes.

The saddest thing about all of this is that Outlook pretty much sucks also. You wouldn't think it would be so hard to create a product like this, but three of the largest software companies have consistantly produced crap.

SME and NIS

[bing212553]

ive done it with SME server and NIS to repicate users. Does everything, very simple and the new verison in beta is looking very slick. contribs.org

What about Red hat Directory .?

[gmiga]

Hi all, A.Directory is not so bad for an LDAP made in MS , and if your boss want MS exchange (too bad ...). Nevertheless I'll have a look at Redhat Directory. What about Redhat Directory http://www.redhat.com/software/rha/directory/ . I think it can help you. See some of the features. # Centralizes management of people and their profiles, thus reducing administrative costs # Acts as a central repository for user profiles and preferences, enabling personalization # Allows 4-way multi-master replication of data across the enterprise, providing a centralized, consistent data source available to enterprise applications # Enables single sign-on access with a partner solution # Provides scalability for massive numbers of users by containing the information control required for developing extranet applications # Provides full support for 64-bit HP-UX and Solaris platforms. # Provides the foundation for strong certificate-based authentication when used in conjunction with a Red Hat Certificate System Regards. Guillaume.

Try Zoho Virtual Office

[Rajuv]

You can try Zoho Virtual Office (www.zohovo.com) for your groupware solution. It works on Linux and Windows. A demo is available @ http://demo.zohovo.com/ Raju Zoho Team

Answer.

[Anonymous Coward]

Windows Server System. End of Discussion.

Re:3. Mac OS X Server

[hyc]

As far as I recall, the Apple Password Server is only provided for backward compatibility with previous MacOS releases. I don't wish to denigrate what Apple has achieved in shipping OpenDirectory with their OS, but anybody can install Heimdal Kerberos, OpenLDAP, and Cyrus SASL and get automatic integration of Kerberos principals with LDAP accounts and Cyrus passwords. All of these three packages support each other directly, out of the box. And likewise, since you can create a single LDAP user object with all of their Kerberos info, Unix info, and SASL info in one place, they naturally all replicate together. So there's nothing magic about OpenDirectory here. (Nevertheless, OpenDirectory is good stuff, and I'm sure it will be even better in the future.)

And yes, I'm on the OpenLDAP core team, and I wrote a lot of the code that makes Heimdal, OpenLDAP, and Cyrus SASL play together. It's been working well in the field for years. And for those people who have trouble getting configure scripts to connect everything the way they want, my company Symas Corp. offers pre-built binaries of all of these packages, already integrated, ready to run.

CommuniGate

[ivlad]

Give a try to CommuniGate. trial is free. It provides more, than ordinary user needs, and may be suitable for your case.

Re:Novell's/Suse's SLES 9 + Kolab

[thinkfat]

... plus, in case you need to equip desktops, too, I suggest looking at KDE and Kolab (http://www.kolab.org/). Kolab is a nice, integrated groupware solution which includes a server and a smart client based on KDE's "Kontact".

If you need to deploy user desktops, the "Kiosk" framework in KDE makes it easy to lock down the workstations and guarantee an easy job for the administrators.

OK, perhaps I'm stating the obvious, but...

[g_lightyear]

Communigate.

Full exchange compatibility with an exchange connector you install - but it *does* work, and has for ages.

Does everything well, on any OS you want. Sorry - I can't see *any* reason to run Exchange. None. Not when the competition is just *so* much faster.

Are you sure you want to run it yourself?

[Ngwenya]

For a company with about 100 employees, hosting an entire AD/Exchange infrastructure sounds very wasteful. The cost per mailbox tends to be much higher than seeking messaging as an external commodity service.

It might make sense to run an internal directory server for accounts and IT asset tracking, but it's not at all clear that you need to run the messaging internally. Companies like Outblaze will do this sort of thing for you, or folks like IBM and HP (ObDisc: I work for HP) offer these sorts of managed services.

Actually, there's so little information in your original requirements list that it's very hard to recommend anything. It has to be said that phrases like "cobbled together" rather than "tailored integration" make it sound like you want justification for your already-made decision; if I'm wrong on this one, I do apologize.

What will you be managing in the directory? Are you likely to be buying off-the-shelf LDAP aware products. Is LDAP 2000 branding important to your organisation? Are your applications Kerberised? What's the expected expansion/contraction of the company. What sort of R&D budget have you got? What is the target cost per user per mailbox? How important are shared calendars versus personal time trackers?

Sorry to be negative - but without that sort of information, anything you see here is likely to be "I use X, and like it, so I say use X".

--Ng

Did you consider an Apple solution?

[barbarus]

If you do not have any client software that is dependant on Windows, you might consider an Apple solution. That allows you to minimise personel costs, while maintaining a high security level and full functionality for any client OS you can come up with. Look at license and storage cost and an Apple Server solution suddenly comes out really cheap, certainly when you count in the hours you will need for maintenance and setup.

AD is no silver bullet

[Alioth]

Additionally - Active Directory et al. isn't as easy as people would lead you to believe ("It's Windows! It has a GUI! Therefore it's easy!")

We just had Active Directory rolled out here. Our performance problems were so bad we had to hire Microsoft consultants to try and figure it out - and these people from the company that makes the product took over a month to actually come up with a solution that ran only half as quickly as our old Novell system. Admittedly, it's a much bigger system than 100 users (and I'm glad I have absolutely nothing to do with it, it's a nightmare) but Microsoft Active Directory and Windows aren't some sort of ease of use silver bullet. In fact after seeing what trauma they went through, it's not actually any easier than a "cobbled together" OpenLDAP/Samba installation and a great deal more expensive.

A lot of people are saying Novell...

[xaoslaad]

But I would implore you stay away, especially if you are interested in the possiblity of having users use VPN services to log into your network. We found Novell's VPN solutions to be disgustingly expensive.

Two way overkill Nortel Networks Contivity Switches behaving in a fully redundant setup, both hardware and software, cost us significantly less than Novell's software solution alone. That didn't even count the hardware to run it on. When we decided to go with an alternate, it became necessary to use an alternate RADIUS solution, because Novell's solution once again turned up to be decidedly expensive.

We're talking in excess of $10,000 for RADIUS services that I ended up setting up for free using FreeRADIUS on preexisting hardware running Linux.

Even after that it took significant tweaking of the Novell Client to work properly. Primarily this was due to the clients default behaviour of caching information about the network, that as far as I am concerned is totally absurd in a modern environment where laptops accessing a network by multiple methods should not only be considered possible, but likely. And in the end we did get it to work quite nicely, to the point where we no longer had any user complaints, but Novell's technical support was COMPLETELY useless, and it took us reading, making educated guesses, and experimenting to acheive this.

Novell's response was that we should have just used their software. They were as into locking us in, in a similar fashion to Microsoft. Sure that IS what I got paid the big bucks for, but then why was the company also paying big bucks for support from Novell.

Novell likes to talk Linux, and talk low costs, and talk simplicity, talk open source, and talk interoperability, but my experience was that in practice, they were phoney on all counts.

The way I see it you are best to seek open source alternatives, or lock yourself into the beast whom everyone's third party applications should reasonably be expected to work with. That might seem like a very much falacious argument, but the way I see it the middle road is not so middle, and you are asking to cause yourself considerable headaches trying to get their solutions to work with software and solutions, you would feel that you should be able to reasonably expect your windows client computers to work with at first glance.

Just my not so humble two cents.

Re:A lot of people are saying Novell...

[Anonymous Coward]

I forgot to mention that those FreeRADIUS servers simply queried the Novell LDAP services securely over port 636 (if I recall) and returned the response to the VPN switch, continuing to use the Directory service for authentication as one would want to, but without spending a per user dollar amount for using something as basic as a RADIUS service. Novell could have suggested using SuSE with FreeRADIUS under their support, but why do that when they can bilk us for $10,000.

Re:3. Mac OS X Server

[afd8856]

Firstclass sucks. What do they have so special? It's just a message board without the web interface. And, btw, where's the linux client that they've promised and they're "testing" for the last 3 years?

AD

[1s44c]

Don't go near AD for unix authentication.

It's not even nearly stable in large environments. I've seen replication stop for no reason, servers crash for no reason, the performance is shockingly bad. It can also tarpit the ldap port when it gets busy, leaving your clients hanging.

It also takes microsoft around a month to fix bugs that cause random reboots, even then private fixes can cause more problems than they fix.

Local passwd files are better than AD. Way better.

Red Hat Directory Server

[PMoonlite]

For a supported version of the highly-regarded LDAP formerly known as Netscape Directory Server that runs on Linux, see Red Hat Directory Server. And to try before you buy, you can check it out on Fedora as the parent suggested.

Re:3. Mac OS X Server

[medazinol]

Apple's OpenDirectory system is a joy to use and easy to setup. However their lack of a groupware system is truly a shame.

Having said this, I would have a look at CommuniGate Pro from Stalker.com It integrates with OpenDiretory and you can use Outlook as the client front-end and get pretty close to an Exchange system for less money and the hardware requirements are much less hoary.

FreeBSD Mail : Toaster

[Anonymous Coward]

I for one have found that all groupware services can be given to MS Outlook Users over FreeBSD and Mail : Toaster (http://www.tnpi.biz/). The toaster is effectively a mail deamon, LDAP store, support IMAP, POP, SMTP, WebMail, with spam and AV scanning and also is quite well documented. Set it up on a old dual PII server and you will be home free for years.

Mostly Easy.

[wildjim]

I was involved in setting up a similar system in a prev. job.
Basically, if you're expecting to use A.D anywhere, you're really advised to stick to all-MS.

We worked hard on getting A.D. to play nicely with a Unix LDAP system, Bind (DNS), Samba, etc. and it just wasn't even slightly fun. There's quite a few hacks that they use, and they seem to expect an ability to dynamically-update quite a few things (e.g. in DNS) which was tricky to get going with Unix tools. On top of that, it will be expensive.

However, if you avoid A.D, and even Windows PDC's, it's actually fairly easy. OpenLDAP is mostly only tricky for Access-Controls, Samba 3 can do pretty-much everything SMB/CIFS file/print-related, and can auth. against LDAP easily.
We preferred Exim over Sendmail, Postfix, and QMail, but just pick the one you like best as they all do LDAP.
We installed Dovecot for the IMAP server -- does LDAP, too.

I think the main point is: if you use some decent (read: fully-compliant) LDAP server, or X.500 + LDAP shim, the rest of it can be whatever you like best.

I would like to put in a couple of other points:

• For what you're aiming for, OSS will do it all. (e.g. OpenLDAP, Samba, Exim + DSpam + ClamAV, Dovecot/Courier, SquirrelMail...). If you're prepared to give your staff time to test-drive and learn the products, it's probably money better spent rather than giving away in licenses.
  
• Pick OSS s/w that has decent docs. I find that to be a reasonable bench-mark for both its popularity and likelihood for it to stick around.
  
• If you don't care about OSS, I personally have had good experiences with Lotus Notes. It is fairly straight-forward to use and Admin, tries hard to use standard protocols (e.g. IMAP, LDAP, NNTP...) for non-Notes clients and the document-management abilities will make you wonder why you never thought about it before!
  However licenses start at £150-ish/user, and £3000-ish/server... (sorry if I mis-remembered those prices!)

I agree with the LDAP part...

[The Last Gunslinger]

- the problem with IBM's directory is that it sits on top of DB2. This abrogates one of the coolest parts about directories - that you don't need a DBA. And a mistuned IBM directory is an ugly, ugly thing.

But I take issue with this mythology...I work with IBM's Tivoli security solutions, most of which use the LDAP Directory Server under the hood (and, illustrating the beauty of *standards*, also tend to support the use of Novell, Sun, & MSAD). The underlying DB2 engine doesn't require independent tuning, maintenance, or administration in the vast majority of deployments. It isn't until you get into user populations of several hundred thousand that you start tweaking the DB2 parms...and the solution actually includes a detailed LDAP tuning guide that explains how and when you should tweak the DB2 and OS-level parms.

The notion of needing a DBA just to deploy the IBM LDAP is just silly...any tech capable of RTFM can handle a moderate implementation on his own.

Here's the kicker: Which would you prefer for performance and scalability? A directory that uses flat or proprietary file structures for data storage, or one that uses a scalable and reliable relational database engine? Seems like a big "duh!" to me.

And, as you mentioned...it's free. Go download it from IBM and try it out. If it doesn't work for you, or if you decide you can't do it without a DBA, well...you aren't out any expense. Export it all to an LDIF and bring in the next vendor.

Re: The term LDAP

[xocp]

The parent poster (as with many other posters) refer to the term LDAP. Correct me if I'm wrong, but isn't LDAP simply a protocol?

If you (i.e. the collective you) speak of an LDAP implementation, do you mean you implemented the protocol? It would seem more accurate to say We are implementing an OSS based, LDAP-enabled directory service.

Active Directory is also implements LDAP, so this term would equally apply to this Microsoft product.

Don't STOP....

[wildjim]

All the A.D. advantages you've mentioned are avail. under OSS, long before A.D. had them.
Perl modules for LDAP are old news. They're very useful.
In fact, I've made Perl update PDC data a lot more easily than anything else I've used.

You can easily create multiple hierarchies under one LDAP Base DN, and apply your ACLs based on the Base DN. You can even create multiple Base DNs running on different servers, and teach them how to pass clients off to each one.
If you really need strong auth and auth-domains, you should be looking at Kerberos. Even A.D. is based on it, and many, many products can use it (i.e. Samba, PAM libraries, etc).
I'm not too sure how it interacts with LDAP, but I believe it can with little pain -- in fact I vaguely remember OpenLDAP can auth. against Kerberos somehow...

And the thing about being able to use it "out of the box" implies a workable set-up as soon as it's installed, which just doesn't happen in the real world:
You read the docs/go on your course
You adjust your expectations
You install
You configure it properly for your environs
You test
You add some power-users
You fix
You get it signed-off
You deploy

(You fight off complaining users who are never satisfied)

Re:3. Mac OS X Server

[qwertphobia]

Apple's Password Service is the authentication database for Open Directory. All other services reference the Password Server database for authentcation services.

They don't really call it Password Server anymore, they just talk about it as a part of Open Directory.

Novell's Open Enterprise Server

[Anonymous Coward]

Cheaper, more robust, easier to manage than either Microsoft or pure OSS software. Well, cheaper than MS anyway - more robust and easier to manage than either of the choices you mention.

SunONE Directory Server

[CrudPuppy]

While I would normally say use OpenLDAP, Sun has recently made a version of their Directory Server free and open source. Their GUI management is excellent, and it supports Multi-Master Replication.

In case you're not familiar with MMR, think about your normal scenario. Maybe you have 1 master server and 2 slaves, one for each physical location. with MMR, you quite literally have 3 master servers, all of which can be updated and will push the changes to the others. This means no more worrying about losing the "most important" server--they are all equally unimportant if lost!

Re:SunONE Directory Server

[Ath]

Wow. MMR sounds great. But it isn't. It's nothing more than a half-baked feature set compared to Novell's eDirectory. Since its release in 1993, eDirectory has supported partitions and replicas of the directory with full backlink support for all resources.

What that means is that you don't tie up your WAN link with unnecessary directory traffic sending sync messages when they aren't necessary.

What I find amazing is that people just reject eDirectory too often because it is from Novell. It is fully LDAP v2 and v3 compliance, so even if you don't use applications that support eDirectory natively, you can still get all the benefits with no downside. Active Directory, by the way, is not fully RFC compliance for LDAP v3. If you think it is, you haven't bothered to actually try using it in a scenario where v3 functionality is required.

In addition, if you really need a serious directory solution then Novell's Identity Manager really shows the strengths of their directory offerings. There is absolutely no such thing as an enterprise environment with a homogenous directory. With IDM, you can publish and subscribe between just about any "directory" available. Active Directory, LDAP, Notes, Exchange, other eDirectory trees, SQL databases, and just about any JDBC-compliant database.

For collaboration look at Desknow

[Anonymous Coward]

http://www.desknow.com/
Java based, platform independent and decent support. also AD/LDAP integration. Outlook synchronization tool.
From their site: A full-featured and integrated mail and instant messaging server, with webmail, secure instant messaging, document repository, shared calendars, address books, message boards, web-publishing, anti-spam features, Palm and PocketPC access and much more. Very inexpensive.

User base?

[Anonymous Coward]

You never mentioned the type of organization and users.

Assuming a mix of technical staff and business operations (not a health organization or lawyers office etc.) You'll have to anticipate that you will have to deal with a lot of user desires for different clients etc. "Groupware" users are largely business folks due to the shared calendars, contacts, etc. However, when you add IM, online meetings and other SIP-based services, you'll end up with an incredible communication tool for the entire company.

I've been running Communigate Pro (http://www.stalker.com/ for a loong time, and it will do everything above at a very good price. It will also give you an LDAP server and the groupware you want. It has class-A support for IMAP, MAPI, POP whatever, in addition to webmail. It does SIP, meaning IP telephony and instant messaging and can provide microsoft meeting etc. support out of the box. The next version will be an IP PBX as well so you can build your phone system around it too.

Communigate Pro administration is incredible:
1. Setup takes about 30 minutes
2. Version upgrades take about 5 minutes.
3. A simple web interface for most tasks
4. Uses standard unix mailboxes or maildir
5. runs on just about any platform
6. has a CLI and a scripting interface
7. Aids you in solving all sorts of compliance issues etc.
8. Supports the essential virus scanning, spamassassin, and automated rules.
9. Users web-mail is a great tool for users to self-administer
10. Beautiful quota handling!

Your cost with CGPro is much lower than Exchange, and still you have much better support for open standards while providing good support for Outlook users.

You should really check it out.

Johan

I recommend Redhat Directory Server over OpenLDAP

[C_Kode]

http://www.redhat.com/software/rha/directory/

It's just a better product.

Novell eDirectory!!!

[Anonymous Coward]

If you're buying any Windows servers at all AD would be cheaper than licensing eDirectory.

Coversly, if you are buying an Novell servers at all you get eDirectory as part of the OS. That's right, eDirectory is included in Netware 6.5 which allows you to install either the Netware kernel or the Linux kernel.

Novell also offers GroupWise a fantastic groupware platform that easily rivals Exchange and in many cases, GroupWise blows it away!

In my opinion the choices are Novell and eDirectory or Microsoft and Active Directory. My preference would be Novel but, certain circumstances could make Microsoft a better choice.

Re:Novell eDirectory!!!

[ocbwilg]

Coversly, if you are buying an Novell servers at all you get eDirectory as part of the OS. That's right, eDirectory is included in Netware 6.5 which allows you to install either the Netware kernel or the Linux kernel.

But the reality is that most companies will end up buying at least one Windows server for some application or other that requires Windows. Once you've taken that step, from a cost perspective there's no point in even looking at Netware.

lots of novell love

[glsunder]

There's a lot of Novell lovin going on here. As someone who's main file server is Novell, I can certainly understand that.

What I can't understand is how many of them are marked trolls. Looking at the mod points, it looks like it's not just one rogue modder, it's serveral (or one person with several accounts). Are the MS fanboys so insecure that that can't even deal with someone mentioning Novell? Or do people actually get off by trolling via mod points?

MHO

[jav1231]

There just is simply no reason to bite the Microsoft bullit anymore. The whole "support" issue is largely a myth. Anyone can support Linux and UNIX if they are technically inclined. If you have a technician who feels they can't learn Linux then they are really not technically minded. They've merely learned to support Microsoft products. There is a big difference and learning that difference will better prepare your company. Given the conveluted licensing scheme Microsoft uses, the cost of renewing, the fact that you be having to make compulsory upgrades at a cost, and the fact that OSS is just outright cheaper, I can find no reason to move to Microsoft if I were launching a new infrastructure.

Have you looked at Groove for groupware?

[peter hoffman]

If you are going to be a Windows desktop shop then you might want to consider Groove http://www.groove.net/ for your groupware.

For our organization Groove has done what we needed and provided a nice side effect in that important files are automatically "backed up" if they are in a shared workspace. Since we work from laptops the off-line usage has also been an important feature.

Groove was already integrated with Office and Project. Now that they have been bought by Microsoft I expect that integration to deepen.

A quick list of features is available at http://groove.net/index.cfm/pagename/VO_Compare/

To ask my own question here: does anyone know of an OSS alternative to Groove? Anything like it at all?

What about Fedora Directory Server (RHDS)?

[Anonymous Coward]

Fedora Directory Server was bought from AOL. It was called then Netscape Directory Server. So I think it is robust.

It has a graphical interface: AdminUtil and SetupUtil.

http://directory.fedora.redhat.com/wiki/Main_Page

Have anyone tested this?

XAD - a third alternative

[SWood]

You should take a look at XAD: http://www.padl.com/Products/XAD.html

It is basically the cobbled together solution you mention, only nicely integrated into one supported package.

Missing information - what do you have already?

[ejoe_mac]

There is a missing piece to this puzzle, and it would greatly help us propose solutions. There were 3 companies before, what software licenses did they already have. Do you already have an Exchange license, or 5 copies of Novel 6.5, or a bunch of Mac's?

This needs to be taken as two pieces. What is your desktop platform, and what can you do to make that desktop the most secure and provide the most services to your company. Why do some people implement Exchange when there are OSS products out there? Easy, Exec's like those fancy pda phones that can get their emails and calendar from anywhere (and it replaces laptops).

Find out what the business needs are, figure out what you have, then look at the software that will support that.
-Joe

Novell?

[OiBoy]

Never thought I'd be saying this, but have you looked at Novell lately? I recently got pulled in to be the Linux consultant on a classic Netware to Novell Linux (SuSE) migration. eDirectory/Identity Manager are really nice.

Re:3. Mac OS X Server

[macshome]

The password server is there to securly handle any authentication that is _not_ covered by kerberos.

Users don't always have a tgt.

Nitrobit

[Jokkey]

We're in the middle of a Nitrobit deployment right now, and I'd have reservations about recommending it. It's a great idea (Group Policy without Active Directory), a reasonable price, and they seem to have a fairly fast release schedule and quick, helpful tech support, but we've had one problem after another getting it to work (so we've had to rely on that tech support more often than we'd like). I expect that we'll be able to get all of the bugs worked out, and it should be very nice once that's done, but it's been a headache getting there.

Nitrobit gives you a few limitations that you wouldn't have with a full fledged AD deployment. For example, AD allows laptops to have two separate firewall profiles, one for when it's connected to the domain and one for when it isn't. With Nitrobit, as far as Windows is concerned, it's never connected to a W2K/2K3 domain, so you only have one profile.

Feel free to drop me a message if you'd like any more details.

What about eDirctory?

[Petaris]

What about Novell eDirectory? It still is a valid option and it runs on Netware, Windows, and Linux.

I currently use ActiveDir but it just doesn't make cross authentication with Linux easy. I will most likely be switching to eDirectory next year.

Re:What about eDirctory?

[Petaris]

Sorry,

I should have read through the rest of the comments first as this option was already listed.

OpenXchange and Exchange

[colenski]

I have deployed both. The differences between the two are night and day:

Exchange: Easy to install, monkeys can administrate it, unparalelled 3rd party support, fully documented API.

OpenXchange: Fucked to install, you have to know exactly what you are doing to administrate it, almost zero third party support, largely undocumented API assuming one exists for what you are trying to do.

Still, to me, OpenXchange wins, hands down. Because the user paradigm of "you must use Outlook in X fashion" with Exchange is completely thrown away in OpenXchange and the web GUI is brilliant. Costs and hassles aside, to me, OpenXchange got the concept of groupware *just right* - trust me on this, OpenXchange is the best OSS groupware, and if it were not for 3rd party support, and the fucked installation and administration it would get my vote for best groupware ever (Notes, puh-leese, it's on crack). Oh ya, and it integrates with OpenLDAP so no prob there. Give it a serious look, it's really really good. Enterprise good.

Re:OpenXchange and Exchange

[knghtrider]

"Because the user paradigm of "you must use Outlook in X fashion" with Exchange is completely thrown away in OpenXchange and the web GUI is brilliant."

Sorry, but you're not *forced* to use Outlook at all. You *can* use OWA--you simply lose the functionality of 'Public Folders', or you can even give a go at POP Clients (like Thunderbird) if you so desire.

I so agree with you about Lotus Notes. I support the local offices of a fairly large client for my company. Recently, I had to deliver the bad news to a Senior VP that I would be unable to recover the 2000+ names in his Lotus Notes Address book from his failed hard drive. Granted you can teach your users to copy the names.nsf file to their home directory periodically to avoid this, but that's a hassle for most end users--even if you give them the tools to do it.

That is the one place where Exchange does shine--it's all on the Server and if the backup is good, you won't lose your data. Of course, if you are using those pesky .pst files, then you are in the same boat. Personally, I avoid .pst files like the plague, execpt for archiving old email, and go with Offline Storage/OWA. If you get REALLY daring, you can go for RPC over HTTP. Or, you could settle for Citrix/Terminal Services, and then not have to worry about OWA for remote users .

Just my 2 cents...

Re:OpenXchange and Exchange

[colenski]

owa is poopoo. hate it.

Nice troll, but uninformed...

[Ytsejam-03]

We're talking in excess of $10,000 for RADIUS services that I ended up setting up for free using FreeRADIUS on preexisting hardware running Linux.

I suppose you were not aware that Novell's RADIUS server has been available as a free download for nearly two years now.

And I guess you also didn't know that Novell has contributed code to the FreeRADIUS project to facilitate CHAP, MSCHAP, LEAP, and PEAP authentications against the eDirectory Universal Password. Novell even provides an administration guide for configuring FreeRADIUS with eDirectory.

Re:Nice troll, but uninformed...

[Anonymous Coward]

Thus my point that they like to talk up how they support their technologies, but which would they rather tout as a solution. The one we're there is a $200 per user price tag associated for its use alone, nevermind support. In addition the download you point out was NOT readily available almost two years ago (Posted: 28 Jun 2004 ) when we were looking to implement our solution, though by the posted date, it would have been available just a few months later. Maybe Novell IS changing their tune, but the song and dance they gave us, left a very sour taste in my ears.

Re:Nice troll, but uninformed...

[Ytsejam-03]

In addition the download you point out was NOT readily available almost two years ago (Posted: 28 Jun 2004 ) when we were looking to implement our solution

Actually, I remember first hearing that Novell was offering their RADIUS server as a free download just a few months after attending Brainshare in April '03. Novell has been pushing FreeRADIUS as their preferred RADIUS solution since then. The original pages (posted several months prior to 28 Jun 2004) that pointed to the free download seem to have been removed from Novell's site.

I should also point out that I have been running a VPN client in conjunction with Client32 on my laptop for several years now. I've never run into any problems with Client32, and I've never had to tweak any setting in Client32. It just works.

You don't need Client32 on your workstations to run a VPN client. Perhaps you didn't really need Client32 at all?

Re:3. Mac OS X Server

[Iriantuu]

This gets a little outside the scope of Directory Services, but it's a question I havn't found an answer to in a while.

One of the semi-popular management features of AD installations is its ability to push policies to clients, including the automatic installation of mandatory software, etc. From a sysadmin point of view, this seems like a good feature to me since it would allow me to force everyone to use basic protection (spybot, zonealarm, etc.).

Does Open Directory, OS X Server, or any of the other products discussed here also offer this kind of a feature?

-J

If you are 100% MS use Active Directory

[Deviant]

I preface this with the disclaimer that if you have a large enough amount of unix/linux and Mac clients that you loose alot of the reasons for and functionality of AD.

When it comes down to it, in a Windows enviornment, Active Directory is second to none. With W2K3 they let you get much more fine-grained with your replication, site-links and routing than in 2K which caused some companies with many sites some slowness and issues (as some of the other posters have mentioned). It has gotten to the point where, when you have at least 2 servers for replication/redundancy, it is bulletproof, well understood, tested and trusted in the industry.

As with any other product you need to get the manuals and see the best practices for how MS would have you configure the tree, the sites and the security groups and permissions. I have seen people try to wing it because it has a GUI and the results are rather poor. Done right AD is a near flawless solution to the directory services problem. It lets you configure almost any setting on a 2K or XP workstation through Group Policy. It lets you implement a software deployment/management system (MS SMS) that will install/upgrade softare either on a user or a PC basis. It is cheaper than most of the other corporate solutions that lack this level of ease of control over the workstations.

People here talk about forced upgrades but I have clients still using NT4 domains, servers and workstations after 10 years and they have not been forced so that is rather BS. MS supports their solution and will keep it viable and steady far longer than many of these open source projects may well. It is something that, if your organization grows, it is easy to hire somebody to help maintain and interact with as it is the industry standard.

As a previous poster said, if you are a MS house already, just buy it already. If you are going to use Exhange even more so you need AD. It seems to be the clear choice.

Apache Directory Project/Triplesec

[sbillard]

Check these out: Apache Directory Project

Triplesec

Triplesec is geared toward acting as a resource/ACL repository and can be accessed via the Guardian API (on the same site).

These are still works in progress, but I know one of the developers - a very smart guy - one of the smartest people I've ever met.

Re:3. Mac OS X Server

[tbo]

Yes, OS X Server supports "pushing" policies out of the box for OS X clients. There's a range of methods you can use for managing OS X clients, including NetBooting, managed clients, and mobile home directories.

There may be a way to hack in management features for other OSs, but there's nothing simple I'm aware of.

We run OS X Server 10.4.2 on an Xserve G5 to provide directory, authentication, and home directory / file sharing to about 15 Linux and Windows clients. We used to use FreeBSD instead of Linux, but switched due to a variety of hassles with BSD (didn't play nice with our hardware, nor with OS X Server's NFS). The Xserve G5 might sound like overkill, but there's some light scientific computing / numerical work that happens on these machines, which can generate substantial loads.

MS quick, easy and cheap?

[jotaeleemeese]

Why do you need to lie?

Honestly.

It is not cheap. Monopolies, in case you did not know, raise the costs of the goods and services you use because they stiffle any meaningful competition/

In any case, it is a well nknown fact in the industry, specially when it comes to directory services, that, technical merits aside, MS solutions are more expensive per seat. Also you need more System Administrators given the restrictions of MS operating systems and tools (when handling directory services the posibility of using proper scripting languages can be all the difference in the world, saving you real money).

Also aparent spped sacrifices flexibility, as well as apparent ease of use does.

Ease of use is fine for desktop users, for systmes administrators it is an straight jacket better avoided (and in today's regularoty climate, documenting point anc click colutions is becoming a nightmare, nothing compared with a few clean, fully codumentable scripts and configuration files about how you are implementing your name services).

Novell good out of box, MS AD broken, OL tricky

[Medievalist]

The subject line pretty much says it all.

Novell has a fine product that I used for many years. Their eDirectory is cross-platform compatible, can be made RFC-compliant with little effort, is strongly supported, and scales far beyond what AD can handle in real-world use.

Active Directory is another "embrace and extend" powerplay that doesn't scale to the level of Novell's eDirectory or integrate to the level of Open Source. It's non-RFC-standard to the point that I just call it "broken" and use OpenLDAP to ameliorate its deficiencies.

We run an OpenLDAP infrastructure that securely unifies our identity and attribute management across HPUX, Red Hat, Slack, Solaris, and Windows. But it was very tricky to build (took years, literally) so I cannot recommend it as a quick or easy solution, even though it is tremendously robust, powerful, and cost-effective.

My employers have purposely chosen to invest in really smart people who can handle an Open Source solution instead of really smart software that works out of the box. You may find it better to go the other way; it depends on your business model really. We need those smart people for other reasons, so it makes sense to spend lots on salaries and little on software (please don't take that to mean we are freeloaders - we pay for our OSS, just far less than Novell or Microsoft charges for the same functions).

Hahaha

[LordMyren]

I laugh at you!! There IS NO SOLUTION... sucker! Just a pile of code you're welcome to string together yourself.

F/OSS you are truly pathetic.

Love,
Myren

Novell like a secret cult... so funny

[HackerAce]

Re:Easy writes:

"- Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult."

Being a Novell shop (and Microsoft, and Sun, and OpenLDAP, blah blah blah) eDirectory is less like a belonging to a "secret cult" and more like being part of a revolution. We use eDirectory as our "Identity Vault" with DirXML to syncronize all of our other directories and databases. It rocks!

Re:3. Mac OS X Server

[plsuh]

Sorry for the late reply, but it's been busy here.

Open Directory has provisions via the Workgroup Manager settings from Mac OS X Server to completely manage clients. In conjunction with Apple Remote Desktop and NetBoot it gives you the ability to manage almost anything on a client machine.

There are also third-party packages that can help with this process, such as NetRestore and Radmind.

Some URLs:

http://www.apple.com/server/macosx/features/workgr oupmanagement.html
http://www.bombich.com/
http://eq.rsug.itd.umich.edu/software/radmind/

--Paul