Slashdot Mirror
A Run Through Windows Server 2008
amcdiarmid writes "Tom's Hardware has a review of Windows Server 2008 RC0 up on their site. It has a few good points, and at 19 pages is certainly 'in-depth'. From the article's conclusion: 'Microsoft has used the time since the release of Windows Server 2003 very well. The new Server Manager simplifies system administration immensely. Unlike Windows Vista, whose new dialogues still confuse even experienced users, Windows Server 2008 makes the admin feel right at home and in control ... However, it's not all sunshine, either. Although our test system used a beefy Intel Core 2 Duo E6700 with generous 2 GB of RAM, the Server's user interface felt sluggish with Windows being drawn very slowly ... Microsoft also gets low marks for failing to include SSH support in the operating system. On Linux servers, working without SSH is simply unthinkable. At least the Redmond company includes its encrypted remote shell WinRS. However, secure FTP is still a missing feature. The FTP client is being treated like an unloved stepchild, to the point where it is not even included in the Server Manager.'"
It needs all that memory for the new Windows Server Aero features!
Without SSH and SFTP, does it seem as if Microsoft is trying to build a wall between itself and Linux? To what end I'm not sure, but this is starting to seem deliberate.
"We can categorically state we have not released man-eating badgers into the area." - UK military spokesman, July 2007
> "and at 19 pages is certainly 'in-depth'."
19 pages - more pages to serve adverts. A few paragraphs on each page, and on "print" so you can't just read the whole thing in one page.
Come off it - take away the pictures, and the whole articles is a couple of paragraphs. In-depth? For people who never read anything harder than a comic book, maybe.
Kevin Smith on Prince
Windows Server 2008 takes up 10 GB of hard drive space.
10?! What the hell's taking up all the space?!
Perhaps there's a 1080p movie of Balmer chanting "Developers Developers Developers"
Summation 2
Although our test system used a beefy Intel Core 2 Duo E6700 with generous 2 GB of RAM, the Server's user interface felt sluggish with Windows being drawn very slowly
That's what happens when you try to use beefy hardware with a cheesy interface to a porky OS.
I'm waiting for a "-1 somepeoplejustshouldn'tgetmodprivileges" meta-moderation.
"That would mean that a two-processor (=socket) license would allow the use of up to eight cores with current processors!"
How generous of Microsoft!
It does however make me wonder if my graphics card was pushing the speed of the interface, how am I going to justify to my department head that I need the latest gaming card for my server? I have been trying that excuse for years to no avail :)
CS: It is all sink or swim...oh and did I mention there are sharks in that water?
Now it is a problem if MS is not bundling software? Last time I checked, that was a good thing. At least it allows excellent third party products such as putty and pscp to thrive.
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
Lacking support for ftp, ssh etc are some vague attempt to create "value" to the non portable skill set developed by the windows admins. If the sys admins develop these skills and could easily run either linux or windows, then the switching cost for corporations to switch from windows to linux will decrease. Since the maximum revenue MSFT can extract from its existing installed base is capped by what it would cost its customers to switch to an alternative system, this is a very rational business strategy to keep them following a straight and narrow road to Redmond. And let us not blame just MSFT for this attitude. It is the customers who should realize the value of reducing their switching costs and demand better support for ftp, ssh and other linux side expertise they have in house. If customers don't demand it, why would a profit centered corporation deliver it?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
"Microsoft has used the time since the release of Windows Server 2003 very well."
2003, 2004, 2005, 2006, 2007, 2008...tick tick tick tick
In contrast to all that dicking around BEFORE 2003?
I think one thing that needs to remembered is that 2008 will also contain "Server Core", which is essentially Windows without a GUI. I haven't played with 2008 since the early candidates, but I'd bet good money that a lot of the performance issues and disk space usage can be minimized when running in Server Core mode.
If you post as Anonymous Coward, don't expect a reply.
The most widely used operating system, TRON, does not have SSH out of the box...
Palm trees and 8
I just use the Remote Desktops app, which has all our servers listed. One click and a password and I have a console with a GUI, allowing me to do any administration tasks I need. Plus with the admin pack you can do a whole bunch of tasks straight from your workstation. Why would ssh make this process any easier?
"Microsoft also gets low marks for failing to include SSH support in the operating system. The FTP client is being treated like an unloved stepchild, to the point where it is not even included in the Server Manager."
No problem - check back, say 2013...?
I know that Redmond is paying bonuses for every article and press release shotgunned out during the release of Leopard, but this is one of the most blatant snow-jobs in recent history.
"WS2008 really sucks and all, but it doesn't totally TOTALLY suck, you know, because, like, it could have been worse...much worse...mostly. And we're the experts, so that's a good thing!"
Oh please. If you work remotely, you can use Remote Desktop. Its encrypted. Ssh isn't the end all be all of server products, and not having it hardly qualifies as "crippling" an OS.
Goddamn year-as-version-number bullshittery.
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
although that said, i've been doing windows admin since before 2000 and I've never had need of ssh on a wondows server and i've not met another admin who has.
Working for the (other) man
Check out the section on file transfers. It's considerably faster than Win2k3.
Printable view -- http://www.tomshardware.com/2007/10/25/windows_server_2008_reviewed/print.html No ads either :P
That's what happens when you try to use beefy hardware with a cheesy interface to a porky OS.
It looks like Microsoft has already put Windows on the Atkins diet!
By 2010 Windows will either suffer a heart attack, or it will be nice and svelte!
Windows Server Philly Cheesesteak Edition?
I do have to admit that it would be silly of them to include SSH/SFTP by default, but this is what every other OS is able to do, at least for X apps -- ssh with X forwarding.
Not that there are that many GUI tools to make you want it -- and most of the GUI admin tools you'd care about are either a web interface or already provide their own client/server model, thus making it possible to admin them via the same native interface on your own Linux desktop.
Don't thank God, thank a doctor!
NIH Syndrome... Microsoft wants you to use Remote Desktop or Terminal Services.
> The FTP client is being treated like an unloved stepchild, to the point
> where it is not even included in the Server Manager.
Oh, so I guess people want MS to bundle up apps when it's convenient, but not when it serves their political interests to tear MS down loudly and publically.
We now return you to your regularly scheduled outrage sessions. [/sarcasm]
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
"This new version of Windows will make things simpler and safer."
"Industry shows acceptance of 2k8 slow to start..."
"Now get Fred's Antivirus: now for 2K8!"
"This'll do us until Longhorn is released."
The code changes, yeah...but don't expect the problems to go away.
And it's interesting how each release requires VASTLY more power, just to sit still, isn't it? And because of that, dual-core P4's will be on the market and give me SO MUCH CPU in Linux I won't know what to do with it all.
--- For a good time mail uce@ftc.gov
According to the article, server 2008 is built on Vista and includes product activation. o_0
Well that pretty much guarantees it's not coming on this network any time soon.
Your missing out..
On unix machines, SSH is absolutely invaluable...
RCP/Rlogin could do the same job, but it's horrendously insecure.
I quite often pipe data over ssh connections, or remotely mount systems using sshfs.. I have a lot of logfiles tailed over ssh, I script things up to log on via ssh, i even stream video/audio off my servers using ssh and play them on my workstations...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
The OS will also be used to "power" web servers (I use the word with some reservation). SSH would allow users to upload sites with a degree of control instead of cleartext FTP which also discloses passwords.
So maybe you don't use it as a sysadmin, but for external end users I think using SMB is a little bit too much of a risk, and https PUTs won't allow you to upload a whole site or scripts.
Insert
quite the opposite actually, can you actually point out day to day situations where ssh would be useful when performing admin on a wondows server? i'm more than happy to use one on linux or solaris, but haven't encountered a need for it ever on a wondows server. I'm sure you can give examples where it would make my life more fulfilling.
Working for the (other) man
I think the issue is more related to resources and security. Microsoft likely doesn't want to develop their own SSH code base, and they don't want to rely on a third party one because the third party doesn't confrom to their new security processes. While OpenSSH is good, it's had a number of security flaws in recent years as well.
When it boils down to it, SSH isn't needed to do Windows administration, so why would MS want to add to their security liability by including it?
If you need web hosting, you could do worse than here
but that is on unix machines, the nature of admining windows servers at the moment means that most of this is unnecessary. Although that will change a great deal with powershell with more power being moved to the cli from guis. Which i personally think is a step in the right direction and it's a shame FTA didn't focus on this more than the headline fluffery.
Working for the (other) man
The Microsoft philosophy is that you'd use Remote Desktop/Terminal Services to log in to do any administration task you need. I don't see it as inferior to SSH, just a different way of doing things. (And it's definitely a hell of a lot faster than the Unix equivalent SSH+VNC.)
Comment of the year
Remote desktop is a flawed protocol...
/var/log/messages | grep ALERT
Although it's encrypted, it does nothing to authenticate that the host your connected to is the one it's supposed to be, by contrast SSL uses certificates and SSH uses host keys.
It also discloses information about the OS running and all the usable authentication domains *BEFORE* you have authenticated! It's been years since unix machines displayed the OS version in their remote banners (telnet did, SSH never has by default).
Also remote desktop takes over your local workspace, you end up with multiple isolated gui instances running instead of your single local gui with multiple administrative tools running inside it.
You also can't pipe data over a remote desktop session the same way you can with ssh, eg:
ssh user@host tail -f
cat file | ssh user@host processingcommand >newfile (takes file, feeds it to stdin of processingcommand on host and saves the output to the local file newfile, example on next line)
cat file.wav | ssh user@fastserver mp3encode >file.mp3
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
It's crippled because every other server os or networking device will have SSH by default nowadays...
Unless your network consists SOLELY of windows boxes (ie you dont have any unix servers, switches, routers or misc networking kit) you'l need SSH sooner or later. Sure for most of the routers you *can* use telnet but that's hardly appropriate for this modern age is it.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
AIX. It comes, buried somewhere the installation CD's. But it is not installed by default; unless you build a NIM image.
Oh? You asked for a 'modern' operating system. Sorry about that. Carry on.
Although it's encrypted, it does nothing to authenticate that the host your connected to is the one it's supposed to be, by contrast SSL uses certificates and SSH uses host keys.
I guess you haven't use the newest RDC then...
It also discloses information about the OS running and all the usable authentication domains *BEFORE* you have authenticated! It's been years since unix machines displayed the OS version in their remote banners (telnet did, SSH never has by default).
Proof?
Also remote desktop takes over your local workspace, you end up with multiple isolated gui instances running instead of your single local gui with multiple administrative tools running inside it.
That's a personal preference. Also, outside of remote desktop (for more trusted locates) you can install the Admin Pak and use the MMC snap-ins to configure servers just if you were configuring it locally.
You also can't pipe data over a remote desktop session the same way you can with ssh, eg:
Um, who cares? Like I'm gonna use a server to encode mp3s.. Can you present a case where you would absolutely HAVE to be able to pipe the data over RDC like you could in SSH?
While it wouldn't necessary be "required" for Windows administration, it would easy bandwidth requirements at least somewhat. That aside, I think the biggest reason that MS should want it is due to standardization (which Microsoft is not exactly known for adhering to).
Another solid reason why they may believe it is not necessary is due, in part, to the lack of fully trained sysadmins that work on their products. Many System Admins that work in a Windows environment expect that they can administer everything from the GUI... when it is usually faster to do most things from a command prompt (assuming you already know what you are doing / what you are looking for), and more efficient for reuse of procedures (wsh scripting, et al).
Don't get me wrong, I just think that Windows has less reason not to do it than to do it. In this case, I believe it comes down to a matter of political pushback.
Developers: "It would make our fully trained and certified system administrators life easier, Steve!"
Steve: "Yes, but we don't want them out of our GUI. Who knows! Next, they might want to try something with an even more powerful command line! We can't have that. Next!"
Use what works.
How does it compare to Mac OS X 10.5 server? At least a feature-wise comparison should be possible. Hope they follow up on the article.
Bert
They want to differentiate themselves from Unix, in that you should never need such things
This is complete Orwellian nonsense.
Windows Remote Desktop is crippleware. Beyond the second Windows remote login, it costs money to use remote desktop. How much are those remote desktop licenses?
In Linux I've got all the remote desktops I want on Linux with no license restrictions on those remote desktops either.
If your average windows admin actually audited their logs, they would discover the constant remote desktop dictionary attacks and no method by which to manage them within the remote desktop server.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
You just said it yourself. on Unix and Unix-Like machines, SSH _IS_ invaluable. On Windows, this is not how remote administration is done period. You either use remote management tools locally to talk to the server remotely, or you use RDP. And its perfectly fine.
You really can't compare RDP to anything in Linux these days. It is a lot more responsive than X over the majority of network conditions, and MILES more usable than VNC.
That doesn't mean SSH would not be a nice thing to have. But it does mean that this is not a deal-breaker. And it isn't as if you have no choice - use copSSH or something similar. Or use WinRS.
Unless of course you require two connections with the same username. Not possible with remote desktop.
Stop the insane moderation! You would be the worst kind of system administrator to deploy Server Core. Once you have one running, there's NO WAY OUT!
Known issues for deploying a Server Core installation
There is no way to upgrade from a previous version of the Windows Server operating system to a Server Core installation. Only a clean installation is supported.
There is no way to upgrade from a full installation of Windows Server "Longhorn" to a Server Core installation. Only a clean installation is supported.
There is no way to upgrade from a Server Core installation to a full installation of Windows Server "Longhorn". If you need the Windows® user interface or a server role that is not supported in a Server Core installation, you will need to install a full installation of Windows Server "Longhorn".
Please, post the EULA to server core. I'm sure there are plenty of other handcuffs in there too.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
An alternative, if you use Kerberos for authentication, is to use kerberized telnet. It does some nifty things that SSH don't, such as server authentication without you manually accepting a server key by checking a fingerprint. Of course, SSH has some significant advantages at the protocol level, such as using a single port for everything (makes it easier to use through firewalls), so a kerberized SSH would be best. Fortunately, people are working with this for OpenSSH, although the OpenSSH maintainers have so far (AFAIK) refused to include it in the mainline distribution.
But is it faster than win2000? In my experience this version is the fastest for file transfers.
I know we love a good MS bash here, but c'mon - a Core 2 Duo E6700. With two gigs of ram.
And it has a sluggish interface.
There really is no honestly viable excuse.
Here's a mips count on the T5600. It's claiming 22305 Mips. (The T5600 is a good comparison point according to pricewatch, they're within maybe twenty bucks of each other - couldn't find a mips report on the E7600. Close enough for my point though. And yes, I know the Mips count from Dhrystone isn't exact either. But it's good enough for a ballpark discussion.)
Ok, so that's 22,305,000,000 instructions per second. Let's say we have a 1024x768 screen. That's 786432 pixels. Let's say we're refreshing 60 times per second. That's a total of 47185920 pixels to give a good user experience. And that's if you're drawing them with the cpu, manually. And let's say it takes two commands to move a pixel. Fetch from memory, and put to memory. That means you'll need 94371840 instructions to update the screen per second to do it. Please note that this is a worst case scenario - you're drawing everything by hand. Your graphics card isn't a GeForce 8800, it's a VGA card from the early 80's.
So looking at the instruction count, that's only 47185920/22305000000*100% = .42% of the total cpu's processing ability.
What the fuck could possibly be taking so much attention from the processor that it can't spare a measly half of a percent to refresh the damn screen?
Honestly, the cpu power we have these days is nothing short of staggering. We shouldn't have these kinds of problems at all, ever.
Weaselmancer
rediculous.
First of all, SSH isn't included in any other version of Windows, so why would you think it needs to be specifically mentioned on Wikipedia? In other news Windows Server 2008 also does not ship with support for ext3, or X.org.
And secondly, why do people actually care so much? Even if there was SSH access to it, its not as if it would magically become some sort of a Linux box. All of the commands would be the same. And you can still access server core through remote desktop to get to the command line (it just takes you to the command line instead of starting non-existent Explorer). And if you want to use SSH so much, there are plenty of third party SSH servers that will run on Windows.
Every time you post an article on Slashdot, I kill a server. Think of the servers!
I don't know that much about SSH, so I was under the impression that you can't really access anything without a direct client in SSH. Terminal equivalent would not be restrictive, so that would work. But seeing as how SSH is important, of course you should include it in Wiki. Just have a part of "optional components not included by default".
Wikipedia is ideally not meant to be biased, it is meant to document things, such as what is and isn't supported barebones on the OS, otherwise it is being abused for marketing instead of as an encyclopedia as intended. I am not saying that this is the case now, but if only "positive things" were included for a wiki article, then it heads more towards the "cia editing their own entries to remove bad things" type stuff.
Your argument is silly, considering that PowerShell is probably the most advanced and powerful shell for any platform today. So your "but they might want a powerful command line" argument really doesn't work.
Microsoft has secure means, like the article mentions. Both RDP and Secure Shell.
If you need web hosting, you could do worse than here
Maybe not so relevant now, however gaining relevance quickly: Try running Windows remote desktop on a wireless phone. Sure, remote desktop may be convenient if you're on a good connection and more comfortable administering with the UI, but SSH is much more accessible.
Similes are like metaphors
What do you mean by the newest RDC? I have used the one shipping with windows 2003, it behaves as i describe and every deployment where i've seen it being used. If the version in 2008 behaves more securely you can't really consider that until it comes out of beta.
/dev/audio etc /dev/sda over ssh, i can save to an image file (optionally compressing on the fly) and restore in the same way - every livecd has ssh
Proof? Open up a remote desktop client and connect to a server, it displays a windows login prompt that gives away the OS version and if the machine is part of a domain, gives you a list of accessible domains or the name of the local system.
A few years ago i often used servers to encode mp3, because they were much faster... Nowadays you could use it for video, or any other situation where you have a dataset you need to upload and do a lot of processing on. I can have a 4 socket quad core server running away nicely in a server room, i wouldn't want such a big noisy machine on my desk.
Any program that produces textual output could be executed on the server and piped over ssh, for the results to be parsed locally, or on to another server for instance.
I can also download files with SSH, and if the file isn't already compressed i will typically make the server compress the file on the fly (eg bzip2 -9), pipe over ssh and then have my client decompress locally, works great over slow links.
I can also pipe files over and decompress/unarchive them on the fly, instead of downloading and then decompressing (wasting local storage and taking longer as the disk heads thrash back and forth).
I can do audio conferencing over SSH without having to install extra apps (between workstations obviously) with cat
I can do disk copies by piping contents of
I can pipe video files off my server and direct into a video player on my laptop (my laptop has very little spare hd space)
I can have ssh login to servers automatically and tar up directories, and pipe the output to a backup device. I can have a central server retrieve backups from any number of other servers and store them. I dont need to backup the whole machine, i can selectively do partitions or directories without needing any third party apps.
Sure most of this could be done using third party apps, but you wouldn't have the flexibility, and you'd be running lots of extra services increasing the attack surface of your machine, and if you had a sudden ad-hoc requirement you'd waste a lot of time installing a server/client, and it wouldn't be much use to access from arbitrary machines/livecds (all of which have ssh except windows)
The beauty of SSH is that it offers you the flexibility, once you get used to it you'll find that you use it regularly for all kinds of things, and if you use something less flexible you'll often get frustrated. Conversely, if you're not used to the flexibility offered by SSH you won't miss it.
My grandfather drove cars without air conditioning for the past 50+ years and was perfectly happy. His latest car had aircon, and now that he's used to having it he would never consider buying another car without it.
The mp3 encoding was just an example btw.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Well, hopefully it's sufficiently different from Vista or we'll all feel a bit run through after having to use it.
Actually, it may be launched in 2007 even. SQL Server 2008 and Visual Studio 2008 are "officially" launched in 2008, but will be RTM (and will be able to be purchased through regular means) at the end of 2007, and it was hinted Server 2008 may do the same.
...becoause everyone is different and special in their own way!
.NET and make a sparkly, glassy 3-D GUI and elabourate DRM technology. Meanwhile, the REAL promising technology remain mired in the research department or stumble out barely half-baked.
Historically, Windows hasn't been command line oriented anyway, and remote access is done with Remote Desktop.
Well, historically the rest of the server OS universe HAS bee command-line-oriented and script-heavy, and remote access has been through RSH, Telnet and then SSH when encryption and strong authentication were needed. Nonetheless, int the Linux/BSD/UN*X world there has been a good amount of effort to accommodate the "Windows way". We have VNC, tunneling xwindows over SSH, and yes, there are even clients for Citric and Remote Desktop freely available (and sometimes included as part of an OS distribution).
Things aren't really character stream oriented in Windows, and for security you are supposed to use IPSec.
But Microsoft? Nooooo. Microsoft cannot tolerate differences. It insists we all play the game by their rules and if we don't, they take their marbles and go home. MS doesn't want mixed platform to be easy--they want it to be possible but annoying. The hope is that they can leverage their total desktop dominance to infiltrate the pointy-haired-boss-managed server market enough to hit critical mass, where managers get annoyed at having to maintain two different sets of administration tools, procedures, training resources, etc.
There is no technical reason whatsoever for Microsoft choosing one approach whilst barely acknowledging established practices. It happens quite often where someone bellyaches about "I can't do x in Windows without the GUI" or some such thing and quickly gets a reply from a seasoned Windows admin to just open up a command prompt and type some-such arcane command which is undocumented, or buried deep within the bowels of the MSDN knowledgebase beast. Obviously Windows IS capable, but MS consciously chooses to neglect such practices. SSH is part of the same problem--they could AT LEAST put in a proper SSH-supporting client fer cryin' out loud! A server would be nice too--not everyone wants to dedicate the bandwith for remote desktop connections. There are servers or other machines that require remote admin out in very remote locations sometimes, accessible only by low-speed cellular modems or packet radio. Remote GUIs at 9600 baud tend to be quite impractical compared to ssh, sftp and such. GUIs make a very poor interface for large-scale admin of, say large server farms and clusters.
Microsoft's model might be a "better UNIX than UNIX" within some narrow scope, but Microsoft continues to suffer from severe tunnel vision. It takes them a long time to bring things into focus that aren't right in front of them. Microsoft could've put a more concerted effort into WinFS and Monad and componentised Windows and interoperability tools but it didn't. It had instead to make 3 major releases of
I'd send MS to the corner for its lousy behaviour.
This link explains at a very high level why there is no SFTP out of the box, but it is a downloadable option.
Sorry, I misread the original post as a complaint that Windows didn't have an ssh server, rather than a client, which didn't make much sense to me. In that case, I agree that it's an oversight, but hardly anything worth getting worked up about. It takes a couple of minutes to install something like Putty.
None of Microsoft's software requires SSH to administer, so why would they bother supplying it? Given that everyone complains bitterly about Microsoft bundling software with its OS, I find it amusing that they're now complaining it doesn't.
RDP in 2008 is also getting quite a decent boost, both in security (though that was backported), and in usuability. You can now share specific applications instead of entire desktop.... the app seems like its on your desktop (like X can do, but with the nifty advantages of RDP), so that makes it even better :)
reminds me of the ol ITRON from Japan. a paragraph or two from a Linux News article (http://www.linuxinsider.com/story/31855.html): "mpact Deferred The TRON Project is not new; in fact, it was poised to its mark more than a decade ago, in Japan's PC industry, but the U.S. government intervened. In 1989, Japanese electronics giant Matsushita introduced a BTRON PC, a machine that stunned the industry with its advanced capabilities. The BTRON PC had an 80286 Intel (Nasdaq: INTC) The HP ProLiant DL380 G5 Server with Systems Insight Manager (SIM). Latest News about Intel chip running at 8 MHz and a mere 2 MB of memory, but it could display moving video in color in a separate window. Also, it had a dual-booting system that could run both the BTRON OS and MS-DOS. When the Japanese government announced it would install BTRON PC in Japanese schools, the U.S. government objected. It called the Japanese initiative "actual and potential market intervention" and threatened the move with sanctions. The Japanese, dependent on the U.S. export market, quickly dropped the plan. The U.S. government later withdrew its threat, but the damage had already been done. Nearly all Japanese companies involved in TRON-related activities had canceled their projects." This is a little different situation, so what will Microsoft do now in order to seize the issue?
Not really, people just do not understand how to use VNC properly. VNC has a number of compression algorithms (SSH can also compress) which have to be selected for the type of connection you are using. Picking the wrong one (meant for faster links) will slow you down to a crawl. Most common mistake is to use VNC with a SSH redirect to localhost, which then makes VNC pick no compression as it thinks its connecting to ... localhost.
Then there are of course things like the NX protocol which offers yet additional level of smart compression for X11 based sessions and can even compress the RDP protocol for further speed boost.
Yes, it pretty much is Vista Server. When I was installing Server 2008 Beta 2 it actually said "Windows Vista" at one point in the installation.
I think the huge shortcoming is that SSH isn't integrated into VNC in the first place, which would take care of the concern you point out. I've tried "tunneling" VNC over SSH, and it's hard as hell to set up. In the end I just gave up and used Microsoft's protocol which not only does the encryption by default, but also "locks" the remotely-used desktop for additional security.
IMO, VNC is badly in need of an update. It should have encryption integrated and turned-on by default, and it should do more (or anything at all) to prevent screen peepers to see what you're doing.
Comment of the year
Microsoft would love it if the desktops and servers in any given office only ran Windows. the problem is that the same admins will be administering gear such as routers that quite decidedly don't, never will, and need SSH for proper security, etc.
Actually, as a Win2k3 admin, I can honestly say that there's nothing truly bad about the OS itself. It has held very solid for me. I say that in part because I don't have to use it for anything more than managing Active Directory.
I would be willing to look into purchasing a new version of the Exchange server if they could redesign it in such a way that it has a clean, easily backed-up pool. As it is right now, I really don't know whether or not my backups of the Exchange server would really be accepted in a system restore. And that scares me.
/* No Comment */
RC0?
What the hell does that even mean?
This would run against the Unix design phillosophy which counsels something along the lines of "small specialized tools, which do one thing well and can be connected together for more complex tasks".
I disagree that VNC is hard to setup over SSH because I do it all the time and I also disagree that VNC must include everything and a kitchen sink, Microsoft-style, to be useful. Microsoft way is the way of complicated, out-of-control, unmanagable balls of spaghetti code made up from a miriad of unrelated pieces of code with vastly different design phillosophies which results in an illusion of security.
For example, no one really knows if the MS RDP server process is secure at all. We have no way of verifying it, but it is also obvious that adding each additional layer of code to it increases its complexity and risk of fatal errors.
See above. Unless VNC is made to carefuly use an encryption system which is wholly separate from it and maintained by expert security professionals (via for example loadable SSL libraries) then they should NOT do it otherwise. All that will happen is that they will end up with yet-another poorly reinvented wheel producing the exact opposite of what was intended.
Proof? Open up a remote desktop client and connect to a server, it displays a windows login prompt that gives away the OS version and if the machine is part of a domain, gives you a list of accessible domains or the name of the local system.
If thats actually a concern of yours, then just set the group policy NoDomainUI.
RDP, yes. Not a standard, however. Unless you consider whatever M$ does as a standard (yes, I have some mild bias against them).
While admittedly I am not familiar with "Power Shell," it appears that it is not something that comes directly with Windows on a quick google search... and the fact that Secure Shell (aka SSH) does not come with Windows is what this whole debate appears to be over. It was never in debate whether or not you could get some external software to serve SSH. It's a matter of if they should include it with the distribution.
Use what works.
Even with SSH I think the real requirement is to have a remote cli access to useful commands combined with a decent scripting language , especially when administering a lot of machines or doing repetitive tasks.
Now WMI+vbscript covers a LOT of that, from an administrative POV, the problem I have with WMI is that it is a different interface to the one you use normally to administer windows at the CLI.
For example, to change the metric on a particular route, on one server, I can fire up the DOS prompt, do a few route commands , maybe craft a 'find' command to pull out the exact route I'm interested in , and then alter the route.
If I had to do 100 servers, each slightly different, Assuming I dont want to install additional s/w on the servers I have two choices (I think):
1) using psexec and the limited functionality of .BAT scripting, means I might just about do this, with a horrid .BAT file that does all kinds of nasty things because of how crappy DOS scripting.
2) The correct way, using WMI+vbscript, but now I have to approach my task with a different mindset (selecting objects from tables etc), which is neat , but its different enough to slow me down whilst googling, "how do I use WMI to add a route" , etc. (coming from C/Perl/Java background - using vbscript is also a PITA but that's partly my fault, I have to keep deleting my end-of-line semi-colons)
With good remote access to a CLI that has half-decent programming constructs, then my solution for multiple servers is the same as for one server (more or less), and that is more efficient for me.
This would run against the Unix design phillosophy which counsels something along the lines of "small specialized tools, which do one thing well and can be connected together for more complex tasks".
The one thing I want to do well is connect to my home computer from work with encryption. If it's hard to set up, hard enough that I give up on it and use a competing solution, it's not being done "well", is it?
There's nothing wrong with the Unix philosophy except that it's machine-centric and not user-centric. The machine-centric "one thing" is "take a string, encrypt it, then return the encrypted string." The user-centric "one thing" is "I want to check my bittorrent download progress at home from work, with encryption so nobody can snoop what I'm doing." Big difference.
I disagree that VNC is hard to setup over SSH because I do it all the time
What does the second part of that sentence have to do with the first? A lot of things I do all the time are hard; doing them often doesn't make them less hard. (It does make you more practiced at it, perhaps, but the difficulty of the task doesn't change.)
I also disagree that VNC must include everything and a kitchen sink, Microsoft-style, to be useful.
Obviously it's useful now. Duh. But it's not AS useful as solutions it's competing against, that's my complaint.
Microsoft way is the way of complicated, out-of-control, unmanagable balls of spaghetti code made up from a miriad of unrelated pieces of code with vastly different design phillosophies which results in an illusion of security.
For example, no one really knows if the MS RDP server process is secure at all. We have no way of verifying it, but it is also obvious that adding each additional layer of code to it increases its complexity and risk of fatal errors.
Nice anti-Microsoft rant, what the hell does it have anything to do with what we're talking about? Microsoft's Remote Desktop might be "unrelated pieces of code with vast-- etc etc" but it sure works well, and that's all I care about.
And I hate to break this to you, but I don't have any way of verifying whether *any* encryption or complex program is secure or not. I simply don't have the brain for it, or the education for it, so from my point of view, the choice is between "trusting the smart people at Microsoft who have millions of dollars riding on being correct" or "trusting some PhD who has a lot of free time and likes Stallman."
Unless VNC is made to carefuly use an encryption system which is wholly separate from it and maintained by expert security professionals (via for example loadable SSL libraries) then they should NOT do it otherwise.
Could you explain to me how "VNC should have integrated encryption" and "VNC should use SSL libraries" are mutually-exclusive, please?
Comment of the year
1. I'm not talking about some XP boxes. I've got a dozen production servers that upgraded from 2000->2003 beautifully. There isn't an XP box in the world I would upgrade, but on the server side it works.
2. If you think like an XP desktop administrator when it comes to servers, then you must lose quite a bit of sleep in production changes. Good luck with that.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
However with SSH+Unix Shell, remote administration of many machines via repetitive actions is almost the same as for one machine.
And Remote Desktop Administration only scales up to a certain point for some tasks. I'll admit I'd still rather spend 7 hours knocking out some WMI+vbscript than 3 hours flipping between msctl sessions. But then, if you make a mistake in a script you tend to notice during testing and a script is self documenting. Doing repeat manual actions in remote desktops can give rise to some weird and wonderful errors on your 11th server..
Obviously you haven't had much experience with either, or you would understand that isn't the case at all.
This is a silly argument. You could define "well" as demanding that your PC does everything you ever wanted a computer to do by pressing the "on" button and saying "Computer! do my stuff!". By that criteria, no software today is well written!
Clearly some balance between "user-centric" and "machine-centric" is needed, until at least we all have sentient computers.
You are right and that is why Microsoft is a champion of the latter approach and sacrifices nearly anything to adhere to it, while Unix/Linux/BSD are aiming for the former and provide the latter only if it makes sense from the perspective of the former. These are essentially opposing world-views and which one is more aligned with your psyche is up to you. Although in your case I sense you would lean towards the Microsoft way.
It does have the following relationship: I know that it is not hard from experience, by observing the actual relative simplicity of the process, compared to other tasks. It is neither conceptually difficult nor particularly hard to research.
Again, VNC does not "compete" against RDP. RDP "competes" against SSH + VNC + printer + sound + local file system redirector + ... who the heck knows what else?
See above. Your definition of "well" is different then mine. Mine includes my ability to trust the software I use.
Except that, of course, that first choice reads "trusting the smart people at Microsoft who have millions of dollars riding on on being able to ensure that they remain the dominant market player (direct result of their corporate imperative) and thus no one finding out if and when they are incorrect". Not entirely an "equivalent" position to what that PHD is all about.
By concocting their own "customized" implementation, for example. Then, even if SSL libraries are called, there is quite a large room to manouver involved in setting up the key echanges, initiating encryption, user authentication and all that other, very complicated, security rigamarole full of arcane pitfalls and gotchas.
*shrug* It's not their responsibility. "Responsibility" is beside the point.
Not providing a commonly used and needed tool (after all, they DO provide two ways to use telnet) which is provided in just about every other common dekstop/server OS is something to validly complain about.
Bluetooth, dock/undock, hibernate, gaming, it all works. And IE is completely declawed so you don't even if you accidentally open an untrusted URL in it, you're not going to get adware toolbars installed and your NDIS stack rejiggered.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
As you probably know, the "Server Core" edition comes without any GUI. This reduces the total amount of bits that needs to be patched later and this in turn needs to less reboot/hassle/downtime. The problem is that .NET depends on the GUI so .NET cannot run on Server Core. This in turns means that you cannot install MSSQL because it contains managed code (not only in stored procedures but in core product). It also means that while you could theoretically install IIS, why would you ever do that? You will not be able to run any dynamics content stuff (ASP.NET etc) on it. I've also heard (from an MS sales person!) that Exchange contains managed code. This means that to benefit from the lower footprint in Server Core, you better run only OSS software (because as you know, no open source server has hard dependencies on managed code). MySQL and what not will run just fine on Server Core. Then again, with no ssh the administration will be a pain in the ass; why not just use Linux instead? GUI is optional without massive loss of functionality.
I somehow doubt administrating a server via a phone will take off..
What do you mean by the newest RDC? I have used the one shipping with windows 2003, it behaves as i describe and every deployment where i've seen it being used. If the version in 2008 behaves more securely you can't really consider that until it comes out of beta.
/dev/audio etc /dev/sda over ssh, i can save to an image file (optionally compressing on the fly) and restore in the same way - every livecd has ssh
The version 6 client supports that authentication; Win2k3 SP2 adds support on the server side for that same authentication.
Proof? Open up a remote desktop client and connect to a server, it displays a windows login prompt that gives away the OS version and if the machine is part of a domain, gives you a list of accessible domains or the name of the local system.
Ok, how useful is that? You can get an account locked out for too many failed attempts, and you have no idea what updates are installed either.
A few years ago i often used servers to encode mp3, because they were much faster... Nowadays you could use it for video, or any other situation where you have a dataset you need to upload and do a lot of processing on. I can have a 4 socket quad core server running away nicely in a server room, i wouldn't want such a big noisy machine on my desk.
Any program that produces textual output could be executed on the server and piped over ssh, for the results to be parsed locally, or on to another server for instance.
Not very common to do though, and encoding video? I think any performance gains using a server to do the encoding are offset by the network time you need to send uploading it and the time spent encrypting it.
I can also download files with SSH, and if the file isn't already compressed i will typically make the server compress the file on the fly (eg bzip2 -9), pipe over ssh and then have my client decompress locally, works great over slow links.
I can also pipe files over and decompress/unarchive them on the fly, instead of downloading and then decompressing (wasting local storage and taking longer as the disk heads thrash back and forth).
I can do audio conferencing over SSH without having to install extra apps (between workstations obviously) with cat
I can do disk copies by piping contents of
I can pipe video files off my server and direct into a video player on my laptop (my laptop has very little spare hd space)
I can have ssh login to servers automatically and tar up directories, and pipe the output to a backup device. I can have a central server retrieve backups from any number of other servers and store them. I dont need to backup the whole machine, i can selectively do partitions or directories without needing any third party apps.
More who cares and dubious examples. These aren't common administrative functions. They're not administrative functions at all as far as I can tell.
The beauty of SSH is that it offers you the flexibility, once you get used to it you'll find that you use it regularly for all kinds of things, and if you use something less flexible you'll often get frustrated. Conversely, if you're not used to the flexibility offered by SSH you won't miss it.
My grandfather drove cars without air conditioning for the past 50+ years and was perfectly happy. His latest car had aircon, and now that he's used to having it he would never consider buying another car without it.
I had a Linux server running SSH. It was useful. I could do what I needed to...except that focusing on command line administration makes things way harder than they need to be, which is why I replace it with a Windows server. RD also allows me to do the same tasks though using the GUI tools. So I can actually get my work done.
The mp3 encoding was just an example btw.
I realize that, and its a poor one. We're talking about administering servers, and you're trying to claim that lack of SSH "cripples" the server so that you can't do that well. Its just not true.
It already has. I know at least two server admins who prefer remote administration via cell phone to actually going into the office to get to the VPN.
~ C.
It's amazing! This one single post demonstrates the basic difference between a *nix admin and a Windows admin.
:)
Basically Windows admins consider tasks that don't have a GUI interface "who cares" tasks and "dubious". A perfect example of people from a known *nix sysadmin proverb: "Shut up, or I'll replace you with a 10 line script"
OMG TWO!!!!1111!! Why someone would need to INTO the office to get to a VPN is also beyond me.. seems you would VPN to the office from home... and have a real computer, not a 2" screen.
You actually read his tasks right? Encoding an mp3 or a video? Are you REALLY claiming those are even administrative tasks??
Scripting has its place, no doubt. It shouldn't be the default way to administer most functions though.
As I spent the last week trying to untangle the mess of manifests, I realized one thing. Vista is NOT all crap.
:).
UI popup asking you to verify that you clicked something is not that great. But if you get a virus, you may stop and wander why you get popoup boxes all the time even if you didn't click it. Annoying but maybe effective? Don't know. This is the part of Vista I do not like at all.
manifest files - ughh! Well, if you understand them, they are not that bad. Still annoying to the developers but better than DLL Hell of yesteryears. If you want a different confusion for developers, look at OS X frameworks. Not exactly standard dynamic libraries there either.
The new folder locations are great. Vista is getting closer to what Linux/Unix had for years. Actually, they are easier to understand than Mac OS X stuff.
The real pain are the 64-bit/32-bit file/registry reflections. That is just stupid. Same application = Same key! The lack of manifest = registry reflection is also crap. Open a registry, and it opens a different one for you! Stupid!!
But the changes in Vista are not all bad. There are some good ones. (BTW, manifests and SxS execution was in place since XP or 2000, just no one used it until Vista is forcing it down our throats
Of course, I still find Gnome+Linux the most productive environment over Vista or XP or OS X. It just works.
PS. 2003 is not faster than XP. It will only be faster if you install crap on your XP box. What 2003 has is more throughput = less overhead. But that also means less interactivity. And people will not "transition" from XP -> 2008. If they do, then they have too much money in their pockets.
You may decide never to look at the second car's engine, but at least you could if you wished. That's not true of the first car.
How hard would it be to have the following items added to Windows 2008:
1). SSH Server (so I can remote into my machine over a slow connection or my blackberry)
2). A decent shell (powershell has a lot of potention, if they added powershell support for all management feature s in Windows and AD like they did for Exchange 2007, that would be awesome).
I love parts of Linux and I love parts of Windows and I just wonder why there is nothing that puts the good from both together.
Respect the Constitution
Yes, there are extremely good reasons for having the source available, but it being a substitute for good end-user documentation is not one of them. (Code should be well-documented and clearly written, but for the benefit of maintainers, not end users!).
In an absolutely desparate situation if you're prepared to put the time in, reading the source *might* save your bacon, but I'd already be severely pissed off if I had to resort to that. Particularly if the code was opaquely or just downright messily written.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
What advantages does RDP have? RDP always seemed like a kludge while X has always had remote display support as an integral part... Also X11 is a lot older, it's security and bandwidth usage problems are addressed by NX (www.nomachine.com), and the bandwidth use is more to do with the apps than the protocol.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
SSH is invaluable because of the flexibility it offers, flexibility you don't have on windows by default, and don't have to the same level if you install cygwin with ssh...
RDP is more responsive than plain X, but it's also 10+ years newer, try comparing to NX and it's a whole different story.
Also, SSH is more responsive than RDP or X if all your using it for is as an interactive terminal. Where SSH really shines is the ability to pipe commands and data back and forth, which you simply cannot do with RDP.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
PowerShell doesn't come with Vista, but it will come with Windows 2008 Server, which is what we're talking about.
And I was talking about the encrypted Windows Remote Shell (WinRS) when I said secure shell, not ssh. Both of those things are included with Windows 2008 Server standard.
If you need web hosting, you could do worse than here
You can get an account locked out for failed attempts? so what? the issue of knowing the os version has nothing to do with brute forcing of passwords... Knowing the OS means you have a much greater chance of success when trying to exploit a system, and often the patch level makes no difference. As a somewhat old example, the rpc dcom overflow from 2003ish. It had universal offsets for xp and 2000 regardless of service pack, but the 2000 offset would crash xp and vice-versa. If you can work out the OS your chance of success goes from 50% to 100%, and rdesktop makes it all too easy. Unix distributors learned their lesson years ago, telnet banners always used to give away the OS version.
Backing up is not an administrative function? I'd hate to have any important data on a server you admin...
Transferring files to/from servers is not an administrative function?
Copying disks is not an administrative function?
Monitoring logfiles is not an administrative function?
Video encoding and audio conferencing perhaps not.
Well for a better administrative example...
I can use SSH to pipe a script to several machines at once, the script could be doing *ANYTHING* and not just things which are within the framework of $MANAGEMENT_TOOL, and i can parse the output from the scripts and automatically act upon specific conditions. The flexibility is what matters, and it surpasses anything any graphical admin tools offer.
You clearly have never found yourself in a position where your trying to do something unusual that the authors of the graphical admin tools never considered.
And you can always script up SSH, to automatically perform tasks you do often, and you can verify the output to ensure everything went as expected. Can you write a script for RDP to simultaneously log in to 50+ machines, perform an arbitrary task and read the output from the arbitrary task to ensure that nothing unexpected occurred?
Also if you really want a graphical frontend, you can use X11 (piped over ssh for security), tho that would require all the X libs and graphical apps to actually be installed on your server, which is terribly wasteful. There are many small embedded devices which can be managed using ssh (routers/switches, nas devices etc)... How much more expensive would these devices be if they had the extra memory, cpu and flash memory required to run a full graphical environment you could admin them from?
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
There's no secure shell available because windows has no shell.
;-)
;-)
No, Power Shell does not count
Windows is not made according to the unix "onion" model.
Check it out with Cygwin developers.
Oh, for ssh I can recommend Cygwin
RDP (especially in 2008) is the best of both worlds. It is amazing speedy and responsive (better than X11, better than VNC, better than just about anything...), regardless of the app you use (give or take some direct stuff, but it even works with desktop compositing in Vista, so you get all the fancy effects, and its fast regardless), will happily work even with a 56k connection (albeit not at full settings, but still very responsive). You really don't need much bandwidth at all before you can't (or barely) tell apart if you're on the physical machine or not.
Now you can also have single apps remotely (as opposed to the entire desktop, which I realise was done before, but not in such a low bandwidth way), and the nature of the app is almost irrelevent on its bandwidth usage (thus best of both worlds). All around, its one of the very, very sweet things Windows has that I'd have issues living without. Its also stupidly easy to configure for pretty complex scenarios (the way single application sharing works in 2008 for example is pretty sweet).
or you could like, you know, log in from a pda across the mobile/some wifi network and do some damage control without having to move your fat ass out of maccas, but whatever floats your boat
This is a joke. I am joking. Joke joke joke.
People here are talking about different things - the *nix people are talking about doing a lot of stuff on a lot of hosts that may actually be very dissimilar while the MS Windows people are talking about doing a lot of stuff on just a few machines so not many logins. If you only log into six machines then six remote desktops or VNC sessions are not a huge pain - but with a lot of stuff you want to script things (eg. ssh and powershell or cygwin into the MS Windows hosts).
This is assuming the delays are cpu bound. If they're IO bound it wouldn't matter how fast your CPU is.
The unix way isn't SSH+VNC. It's SSH + compressed X forwarding like FreeNX. I've had much faster response times with FreeNX than with RDP.
The SSH client ships with Ubuntu. Only the server needs to be installed manually, and that's as it should be for a desktop OS. Win 2K8 server doesn't even ship with the client. That's kind of an issue since servers generally need to talk to servers, and every server OS except the Windows flavors ships with SSH as the primary remote interface.
Well, remote Desktop wasn't invented by MS either. They bought a crippled version from Citrix.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Mod me down, whatever... I can't believe how many well worded and legitimate complaints about the lack of SSH support got modded troll. We're talking about lack of both an SSH client and server. These are basic tools for an admin using most servers. I'm really surprised that even on /. a person saying "Come on, no SSH?" would get modded troll. That's a legitimate complaint. SSH is essential to my operation. If I bought ANY server OS that didn't support it out of the box I would seriously question its credibility.
MS wants you to use RDP for remote management. To do that, each server has to have the full GUI installed and running at all times.
In the Unix world, the server doesn't need to run X. So you can have a zoo of head-less servers and administer them from a desktop with all the GUI tools, since the desktop has the X server and you can use X forwarding over SSH to control the headless machine from anywhere in the world.
So, on Win2008, if you don't install the GUI, then you can *never* use any GUI tools, which is a distinct disadvantage compared to Unix systems.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
No. VNC *is* slower than RDP.
VNC polls the windows for updates, instead of event hooks. This alone gives considerable latency that makes it feel slow.
Don't quote me on this.
Scripting has its place, no doubt. It shouldn't be the default way to administer most functions though.
:)
Spoken like a true Windows admin.
The issue of bandwidth usage and security in X11 is addressed by NX...
I wouldn't say RDP is indistinguishable from local apps at all, there is a noticeable difference even over a LAN... Plain X11 over a LAN is quite speedy tho, as it was designed for.
X11 works with desktop compositing too, even if your window manager isn't running locally (ie diskless terminals etc) so long as you have opengl supporting hardware... You can even play games or full screen video over remote X11, since GLX sends opengl calls over the wire and they're rendered on the local displaycard (tho you could also do software rendering and stream the output over the network if you really wanted).
As for the new features you describe in 2008, it seems like it's starting to catch up to some of the features X11 has had for years.. Tho don't count it until there's a shipping non-beta product, remember all the features microsoft dropped from vista? Who's to say this stuff wont get chopped before 2008 is finalised?
As for ease of configuration, i wouldnt exactly call single applications complex, and such a configuration is trivial on X11.
As for "better than just about anything"... I always found Citrix to be much faster and more secure than RDP especially over slow links, and there's always NX which works very well even for a graphically heavy environment like KDE. Go try it, nomachine.com have some test machines running on 128kb lines with 30+ users connected.
Out of interest, does 2008 handle multiple screens yet? X11 has for years...
On another note, RDP is expensive, unless you buy extra licenses for it your limited to 2 sessions, which is pretty useless.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
You are referring to a Windows VNC server, which indeed is forced to do all sorts of underhanded trickery to get its information, since the access to the required data is secret and only available to Microsoft and its partners. In its native environment however, as an X11 server, VNC is simply a framebuffer driver, very much as that of the kernel framebuffer devices. No polling of any kind takes place. The VNC server simply reacts to changes of its buffer state and in this situation it can be on-par with (or exceed) RDP, given correct compression algorithm.
Think what you want; needing to drop into a console everytime I needed to fix something on my Linux server was one of the main reasons I moved my home computers from Linux to Windows. I actually want a life outside of administering my network.