German Foreign Ministry Migrates Desktops To OSS

ruphus13 writes "Here's another example of 'German Engineering' — The Foreign Ministry in Germany is migrating all of its 11,000 desktops to GNU/Linux and other open source applications. According to the article, 'this has drastically reduced maintenance costs in comparison with other ministries. "The Foreign Ministry is running desktops in many far away and some very difficult locations. Yet we spend only one thousand euro per desktop per year. That is far lower than other ministries, that on average spend more than 3000 euro per desktop per year ... Open Source desktops are far cheaper to maintain than proprietary desktop configurations," says Rolf Schuster, a diplomat at the German Embassy in Madrid and the former head of IT at the Foreign Ministry ... "The embassies in Japan and Korea have completely switched over, the embassy in Madrid has been exclusively using GNU/Linux since October last year", Schuster added, calling the migration a success.' The Guardian has additional coverage of the move."

Comments

Good for them

[Vskye]

Well, at least Germany had the balls to stand up to Microsoft and actually go with the GNU/Linux solutions vs most other countries and corporations that just do this to get a discount from Microsoft. Here's a good quote from the article:

The conversation between Ude and Ballmer was confidential, but anyone who knows the Microsoft CEO can guess how it went. Let us say negotiation is not his forte. Ballmer is no more designed for the art of persuasion than the Abrams tank is for delivering meals on wheels.

Common sense to become common again

[Yogiz]

Interesting. Does that mean that there are still reasonable people in the world? Even in politics?

Why this will never happen in other countries

[jeevesbond]

From the Guardian article:

Another interesting aspect of the Munich decision is that it was not driven simply by cost savings, because industry gossip has it that Ballmer offered heavy discounts on Microsoft software to stave off the threat. This was also the case in the Ministry decision to plump for open source. According to a BBC report, Interior Minister Otto Schily said the move was motivated by a desire to improve security in the nation's computer networks as well as to save public money. 'We are raising computer security by avoiding a monoculture,' he said, 'and we are lowering dependence on a single supplier. And so we are a leader in creating more diversity in the computer field.'

(emphasis mine)

And this is why, ladies and gentlemen, we won't be seeing this in many countries outside Germany. They have a politician who knows what he's talking about, and doesn't pander to the whims of industrial lobbyists.

Re:so..

[rubycodez]

puppet http://reductivelabs.com/projects/puppet/

Never underestimate foreign ministries

[Kupfernigk]

In Europe, these have traditionally been where the most intelligent graduates went. They wrote the book on security. They are bright enough to realise that if they open a branch office in Obscuristan it is going to be easier to get a version of OO customised for the Obscuristani dialect than persuade MS to do it, and know their successors in 100 years time will still be able to read the files. And perhaps they have the smallest concern that the CIA might be able to get information via Windows backdoors.

The real story would be if they got the Interior Ministry to convert. In Europe, that (and the Agriculture Ministry) is usually where the deadbeats end up.

Re:so..

[IgnoramusMaximus]

How do you centrally manage software installs and permissions on thousands of machines with oss?

This is a joke, right?

Where the fuck do you think Microsoft stole Kerberos and LDAP for their AD from?! We've been using the stuff AD is made of years before it was even a wet dream in Microsoft's diseased minds.

As to automated installs, every damn Linux distro has a package management system capable of being remotely scripted, and designed for mirroring via localized caches!

What a dork.

Re:so..

[IgnoramusMaximus]

I haven't been able to find guide on deploying active directory-like system with free software which would offer group policy features. When I already have groups deployed in LDAP, why do I need to script installers instead just defining policy to install software to that group?

That is because of fundamental differences in the entire philosophy of Linux/FOSS vs. that of Microsoft. Microsoft aims to provide cookie-cutter, one-size-fits-all "solutions" whereby some doofus MSCE can read "AD for Dummies" and then click his way through system administration. It works, to a degree, in homogeneous environments which do not deviate in any way from "Microsoft Approved" designs.

Linux on the other hand is built around small, specialized components out of which a competent admin is supposed to construct a solution tailored to a specific environment. And the glue which links all of these components, which can be combined in a very large number of ways, is scripting.

That is why one cannot be a competent Linux admin without being also competent with a number of scripting languages. That is the price, but it is also the advantage as more demanding the deployment parameters grow, the more such approach becomes superior over the one-size-fits-all method.

So in effect you are asking for Linux to abandon all of its advantages and become "like Windows" just because you are too lazy to learn how to deploy it properly. And by this I do not mean reading some idiotic 20-step "how to" which cannot cover even a fraction of the possible configurations. By "learning" I mean understanding all the fundamentals of the system operation, learning all the involved scripting languages and being able to modify all the essential system scripts with thorough understanding of all the involved components.

And that is why such "how tos" are of a very limited use. There are "shortcuts", some of which were already pointed out to you - such as Samba, but they are intended for simplified scenarios whereby the scope of possible configurations is very narrow.

Once any serious sized Linux deployment is considered, a huge number of possible scenarios exists, beginning with basic considerations such as if to run the client systems via network mounted root file systems (in which case no home directory "roaming" exists) or if to deploy terminal servers or X-terminals etc and so on, all of which have impact on how users are authenticated and how their resources are allocated on the network, not to mention that LDAP and Kerberos are amongst many other ways of maintaining centralized user information. No "how to" guide is going to cover all of these complexities.

Re:so..

[canuck57]

I haven't been able to find guide on deploying active directory-like system with free software which would offer group policy features. When I already have groups deployed in LDAP, why do I need to script installers instead just defining policy to install software to that group

First, quit thinking like Microsoft, their methods are ass backwards and overly complex. Look at a script as a hyper intelligent policy where you are in total control and not bound by the options presented to you.

Re:Thats bloody beautiful

[jbolden]

Short answer: yes.
Long answer: They paid much more than they expected and got more than they originally planned. Being on the bleeding edge is expensive. On the plus side Munich's development is now plugged in to the broader community so they are able to take advantage of open source in the "if you don't like it change it" sort of way. Moreover, Munich has become a test case for lots of open source software so many other cities will end up having to do "Munich's way".

Comment: Once Munich finishes the big issue will be the rest of Germany switching over. That should take much less time and cost less per head.

Re:so..

[IgnoramusMaximus]

So what people really need, are simple ways to migrate from windows to linux and achieve equivalent functionality. Yes, this will lose many of the benefits of linux, but it's a start. Once linux deployment is far more widespread, more people will be motivated to learn it and companies will see the benefits of using more highly skilled staff to set things up properly.

Unfortunately there is no way to do it. That is by trying to migrate the "functionality" of Windows to Linux one essentially has to ... emulate all of the Microsoft "technologies", which destroys bulk of the advantages of Linux. Efforts in doing so invariably result in sad, crippled, barely compatible, unwieldy "solutions" which do not conform to even the most basic of the best practices of the Linux world, and which serve only as an aid to Microsoft's marketing drones in pointing out that Linux cannot even hope to match Microsoft in all the Microsoft's most drooling of idiocies.

Examples of these include things such as Mono, various mis-guided "Exchange replacements", "universal" Windows/Linux "management solutions", etc and so on.

The hard truth is that there is no practical way to "easily" migrate from Windows to Linux (or to anywhere else for that matter). And that is so by Microsoft's design. Your only viable option is to re-design the system from scratch to take full advantage of your new platform.

Re:"Computer" in German is "Rechner"

[dreamsofcaffeine]

If you wanted only German, and no Anglicisms, it'd be something like ``Das Jahr des Linuxschreibtischrechners'' (hyphens are optional); still, `Desktop' got quite popular and many Anglicism-hating Germans I know of use it anyway, 'cause `Schreibtisch' has a much broader denotative (and connotative) meaning. `Desktop''s pretty clear on that part.

Re:Thats bloody beautiful

[Anonymous Coward]

"If you don't like it change it" is the crap that most linux fans don't get - Very few people want to write code - programming is a waste of time for most users.

Maybe programming is indeed a waste of time for most users - but TFA and TFC (the fine comments) are not dealing with programming language illiterate users, but with a government paying programmers to get things done the way the government likes.

So, while it is true that it makes no sense to tell Joe the average plumber "if you don't like it, fix it", this plumbability is still a strength of F/OSS. I, for one, don't fix my Iceweasel installation myself (that is, beyond changing personal settings), but I still do benefit from its free nature, because others do fix Iceweasel for me.