Slashdot Mirror
Active Directory Comes To Linux With Samba 4
Da Massive writes in with another possible answer to a recent Ask Slashdot about FOSS replacements for Microsoft AD server. "Enterprise networks now have an alternative choice to Microsoft Active Directory (AD) servers, with the open source Samba project aiming for feature parity with the forthcoming release of version 4, according to Canberra-based Samba developer Andrew Bartlett. Speaking at this year's linux.conf.au Linux and open source conference in Hobart, Bartlett said Samba 4 is aiming to be a replacement for AD by providing a free software implementation of Microsoft's custom protocols. Because AD is 'far more than LDAP and Kerberos,' Bartlett said, Samba 4 is not only about developing with Microsoft's customization of those protocols, it is also about moving the project beyond just providing an NT 4 compatible domain manager."
After the headaches Active Directory has caused the company I work at over the last couple weeks (things like Windows telling the backup software that it wasn't allowed to backup anything to do with AD except the transaction logs), I can't wait!
Finally an alternative to Microsoft's insane licensing model.
It brings one step closer for those who want to move to linux or least convert some windows to linux.
I've got a line of outfits that can benefit from this!
There are so many companies I know that have little to know real dependence upon AD other than the fact that it's all they're really known...
Nice features, but when will it be released?
Anybody want my mod points?
Can someone tell me how AD is licensed? I thought it was a part of server 2003 and once you buy that there should be no additional costs right? Our Sys Admin is planning to install ad for our office (we used never had AD before) and I am trying to figure out what if any the advantages of getting AD will be.
My last tussle with samba was yet another try with ubuntu on this old macbook.
Samba refused to accept proper config messages through gnome's graphical tools, I had to go in and edit the config manually, and samba did not respond properly to the config.
Why not just create a front end for samba and distribute it with the server and client software rather than depend on distributors?
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
According to TFA FOSS AD is not here yet by a long shot, in early alpha, many missing features. Summary is *terrible* in suggesting non-M$ AD is already here.
Those are my principles, and if you don't like them... well, I have others.
"A new year... A new hope?" "Let us know your predictions for 2009".
And, right on par with my hope of seeing Half-Life 2 Episode 3 in "early 2009", my hope of seeing a fully working, easy to set up and maintain, "it just works" Active Directory server for Linux this year has diminished due to the fact that this same exact story was posted here over 3 years ago. (or on Digg)
I'm also surprised it has taken this long. Which is why I'm not waiting.
While i appreciate that this will be very usefull, I'd rather they worked on not requiring samba to run as root (or at least not the networked part) as it seams to be the victim of an increasing number of attacks because of this. Perhaps SELINUX and apparmour have me protected but seeing a network demon running as root always seams like a dumb idea to me.
IranAir Flight 655 never forget!
mark my words, it'll have bugs which will result in 1000's of "RTFM n00b" or "it's ms's protocol that sucks" responses.
Just as Slashdot is full of trolls and OT comments help forums often have people posting unhelpful comments. Just ignore them. Life is too short for arguing with idiots.
I find the Samba help forums are generally excellent if you take the time to ask a sensible question instead of just posting the first problem that comes up. Often the task of formulating a sensible question solves a problem without actually having to ask on the forums at all. I also generally find my query has already been answered in the forum and all I need to do is search.
The Samba documentation is an excellent resource and generally answers most of the questions you may have. Try starting with John Terpstra's Samba 3 by example which is a practical guide to implementing Samba 3. I don't know if John is working on a Samba 4 update to the book, but there is a WIKI, HowTO and a FAQ available. If you are risk averse you may not want to use Samba 4 in production just yet :)
It is not very comforting to read the following statement:
... thing). I would at least expect that the Samba developers have experience in installing, running and maintaining a "realistic" Active Directory environment (read: more than 1000 client machines) before delving into the real messy details. I am not sure I even want to know how they are going to handle disaster recovery (one of the fun parts of AD, rest assured).
"My Russian connection has had Samba 4 running in production since last June and has discovered a few missing features. They also discovered that machines would stop working after 28 days which was something to do with password expiry."
"Something to do with...". This is in every AD 101 book (machine accounts, password renewal,
Honestly, I cannot imagine why anyone would want to run a FOSS equivalent Active Directory. After having spent months in setting up a full mixed Windows/Linux environment (OpenLDAP, Kerberos, Samba, the works), I can say that setting up AD is a breeze: for me, it is a prime example where Microsoft took existing technologies (LDAP, DNS, Kerberos) and actually turned it into something useful without the typically associated configuration nightmares. And it works very stable indeed.
And please, cost is not a reason for not going with Active Directory. The cost of a single Windows Server license is absolutely peanuts compared to what *you* cost your employer. The operational costs are what matter in long term and I am pretty confident that Microsoft's AD will do much better than that for the years to come.
Wait, you're referring to the Apple, whom ships broken stuff and trying to fix it during only major versions for their server OSes?
Past examples of things which were not fixed until the next major version:
Samba (numerous times, numerous issues)
Apache (first few kb of files would only be sent)
Squirel mail that was shipped with OS X server being incompatible with the shipped version of PHP with OS X server
Apple's VNC server (numerous issues)
Numerous exploits in daemons (sshd, apache, samba, bind etc.)
This is unacceptable for a server operating system. No, you can't spin this, having to wait for a entire major release after just getting a major release for a fix is completely unacceptable.
Here is the reason why I would use Linux over Windows for some domain usage:
Faster file servers
Cheaper licensing
Offering FUSE access though Samba to certain remote data.
Does OS X fit any of these scenarios?
OS X server from my past experiments is not faster than Linux or Windows on the same hardware for file server usage.
OS X server is not cost effective against Windows and certainly not against Linux.
OS X server is unpredictable with FUSE support.
If the version of OS X server you're using has some AD intergration issues (even though the issue is not located in the official Samba version), Apple will likely not fix the issue until next major release - before you even mention that they will, I will remind you that they have not in the past and have showed no better behaviour towards fixes recently either.
So I can't even recommend OS X for AD intergration.
Change is certain; progress is not obligatory.
Easy. You're "Anonymous Coward". You're anyone and no one.
Well, even posting under my Slashdot "handle" I could be everyone and no-one too ;)
A novice administrator would know this. I think you've been talking to the average joeish end users.
No, the person I had to correct that issue for considered himself an "experienced" Linux Administrator (and Zealot - "Linux should be used for EVERYTHING"), having worked with various distros for 3 or 4 years. He was also employed by the Victorian Department of Education at the time - the problem he was having was at a client he was moonlighting for. I was the poor Bastard who had to drive on-site when he eventually called me for help at 8pm on Saturday after he'd spent a good 10 hours working on the issue (mind you, I walked away with $100 in cash for typing 'chmod -R ug+w [directory]', so it was inconvenient, but lucrative).
The assumption you're making is that just because someone uses Linux, they also understand the underlying design of the technology that it is integrated with... not everyone understands filesystem permissions, you'd probably be surprised, like I always say... Computers/Operating-Systems/Applications are a "tool" - to be the most effective, you need to understand the function of the tool in addition to it's application.
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
I like Samba 4 except it doesn't have $RANDOM feature :)
davecb5620@gmail.com
It is not very comforting to read the following statement:
"My Russian connection has had Samba 4 running in production since last June and has discovered a few missing features. They also discovered that machines would stop working after 28 days which was something to do with password expiry."
It goes on to say:
We spent a week at Microsoft and discovered Windows would use a call with a string and fill it with random crap. Samba just sent a password of zero to the string and this is probably not the best for security! Samba now has a conversion logic that handles random characters and is then doing normal Kerberos functions on it"
davecb5620@gmail.com
Samba runs as root for a few different reasons that I know of:
1. bind to privileged ports (1024)
2. set{e,r}{u,g}id for the user being authenticated
3. RPC-based system administration
If it was just the first, I bet it could prolly drop root soon after startup. If it was just the first and the second, it might be able to drop root after authenticating, since each connection gets its own process. Samba may already do some of this, for all I know. Alternatively, implementing this may be difficult for architectural reasons, which may or may be solvable via code restructuring.
But for the third, it has to run as root all the time. What this refers to is the ability to perform system administration tasks (like adding/changing/deleting users, groups, computers, etc.) via Microsoft's RPC mechanism. This is how Windows does this, and Samba supports quite a bit of it. Notably, if you're doing to support Windows domains on Samba, it needs to be able to create host OS (Unix) accounts for users and machines.
It's probably theoretically possible to develop some kind of frontend/backend layer for process privilage separation, but at that point, you're basically just implementing all the protocol work Samba has to do all over again, in an internal protocol. If you couldn't get it right the first time, I wouldn't expect this try to be much better.
Remember, Samba aims to be bug-for-bug compatible with Microsoft Windows, which means inheriting any brain damage present in SMB/CIFS. If you want a clean design, this is the wrong place to look.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.