Slashdot Mirror
Active Directory Comes To Linux With Samba 4
Da Massive writes in with another possible answer to a recent Ask Slashdot about FOSS replacements for Microsoft AD server. "Enterprise networks now have an alternative choice to Microsoft Active Directory (AD) servers, with the open source Samba project aiming for feature parity with the forthcoming release of version 4, according to Canberra-based Samba developer Andrew Bartlett. Speaking at this year's linux.conf.au Linux and open source conference in Hobart, Bartlett said Samba 4 is aiming to be a replacement for AD by providing a free software implementation of Microsoft's custom protocols. Because AD is 'far more than LDAP and Kerberos,' Bartlett said, Samba 4 is not only about developing with Microsoft's customization of those protocols, it is also about moving the project beyond just providing an NT 4 compatible domain manager."
After the headaches Active Directory has caused the company I work at over the last couple weeks (things like Windows telling the backup software that it wasn't allowed to backup anything to do with AD except the transaction logs), I can't wait!
Nice features, but when will it be released?
Anybody want my mod points?
You don't block ads?
In the land of the blind, the one-eyed man is king.
jX [ Make everything as simple as possible, but no simpler. - Einstein ]
I'm also surprised it has taken this long. Which is why I'm not waiting.
While i appreciate that this will be very usefull, I'd rather they worked on not requiring samba to run as root (or at least not the networked part) as it seams to be the victim of an increasing number of attacks because of this. Perhaps SELINUX and apparmour have me protected but seeing a network demon running as root always seams like a dumb idea to me.
IranAir Flight 655 never forget!
Look, you seem like the average unbiased poster so I'm going to give you a few tips even though I'm going to be modded off topic.
If you're going to defend Microsoft or one of their products on /., you need to observe a few simple rules:
Don't ask for proof of Microsoft malfeasance. You'll just get proof, and that doesn't serve your goal. Read the series of Halloween documents for an introduction to how much we know. It's scary.
Don't ask questions you don't know the answer to. That's good guidance for lawyers, too. You'll get answers you don't want.
Don't ask about someone else's experience. Their experience isn't going to help your cause, and you'll get replies from the least helpful people.
Do brag features, but do it with some understanding of the features. Don't just list the marketing babble. Don't brag more than three features at a time because it's then obvious you're typing them from a list. Do brag features that seem important to the parent poster.
If you must employ "anecdotes are not proof" be prepared for a swarm of people who confirm the anecdote. Nearly a billion people use MS software. Given enough experience, every failure mode is common. Every anecdote is common here and you would be surprised how selection bias draws people with shared anecdotes to slashdot just in time to skew the replies.
If it's allowed in your contract, do be specific: What platform worked well on Vista, how much RAM did you have? What video card? If you must avoid vendor bias, split the vendors by market share and let the astroturfers brag up proportionate systems - if they work. And if they don't work, leave it alone.
Slashdot has a grand bullshit detector, so don't lie. If you lie, the lie is not just going to be modded down - the responses to the lie are going to be modded up and be the only thing that people see, so the lie does more damage than silence would.
There are more rules, but this should help quite a bit for now.
Help stamp out iliturcy.
Clearly you havent priced the full costs of a full set of servers (and addons) for Exchange. AD etc. Not to mention all the client licenses you need (CALs or whatever they are).
I am sure there are quite a lot of people who would LOVE to be able to replace a windows server machine with a linux machine running Samba + OpenChange + whatever else
Easy. You're "Anonymous Coward". You're anyone and no one.
Well, even posting under my Slashdot "handle" I could be everyone and no-one too ;)
A novice administrator would know this. I think you've been talking to the average joeish end users.
No, the person I had to correct that issue for considered himself an "experienced" Linux Administrator (and Zealot - "Linux should be used for EVERYTHING"), having worked with various distros for 3 or 4 years. He was also employed by the Victorian Department of Education at the time - the problem he was having was at a client he was moonlighting for. I was the poor Bastard who had to drive on-site when he eventually called me for help at 8pm on Saturday after he'd spent a good 10 hours working on the issue (mind you, I walked away with $100 in cash for typing 'chmod -R ug+w [directory]', so it was inconvenient, but lucrative).
The assumption you're making is that just because someone uses Linux, they also understand the underlying design of the technology that it is integrated with... not everyone understands filesystem permissions, you'd probably be surprised, like I always say... Computers/Operating-Systems/Applications are a "tool" - to be the most effective, you need to understand the function of the tool in addition to it's application.
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
Or a freak.
I like Samba 4 except it doesn't have $RANDOM feature :)
davecb5620@gmail.com
It is not very comforting to read the following statement:
"My Russian connection has had Samba 4 running in production since last June and has discovered a few missing features. They also discovered that machines would stop working after 28 days which was something to do with password expiry."
It goes on to say:
We spent a week at Microsoft and discovered Windows would use a call with a string and fill it with random crap. Samba just sent a password of zero to the string and this is probably not the best for security! Samba now has a conversion logic that handles random characters and is then doing normal Kerberos functions on it"
davecb5620@gmail.com
The costs for AD/Exchange, etc. pale in comparison to the administrative salary costs associated with supporting an IT infrastructure and the lost productivity costs of down time.
I've found Samba in a Domain environment to be kind of flaky, and while it's useful for accessing the file system on a Linux server (though I prefer scp) there's no way I would look at replacing any Windows file server that had an SLA with a Samba server. The licensing costs for a Windows server (especially virtualized) are negligible.
On the other hand, there's still no great solution for something similar to AD on Linux. NIS+ is old and sucks. Going through the whole LDAP rigmarole only gets you part of the way and requires a hell of a lot of upkeep depending on the server. Winbind against AD isn't bad though again it's flaky and requires way too much work to setup. I supposed there's the tried and true method of rsync-ing passwd, group and shadow files around.
The combo of AD and Group Policy is pretty killer, It would be really nice to see something similar for Linux, or at the very least improved AD integration would be awesome.
Fsck the millennium, we want it now.
Millennium Crisis Line: 0890 900 2000 [calls cost 50p/min]
Microsoft isn't accountable for windows doing anything. Red Hat, by the other way, will work at your place to solve every little problem that your unique configuration causes. But your CEO doesn't know that, he thinks that it is MS that solves all Windows' problems, and that those guys that run around every time your computers have problems are just making some cooper. So, don't expect him to understand. To make things worse, every time you try to point that MS support never did something useful for your company, somebody will come with an event where they called MS support and could get some kind of answer. You can't contest the usefulness of such an answer on a non-technical meeting, so you will lose the argument.
To keep matters simple, forget about accountability and focus on the GP's list. It is a great one.
Rethinking email