Slashdot Mirror
Samba 4 Enters Beta
rayk_sland writes "Progress is being made on the long awaited Samba 4 release. On Tuesday the Samba 4 team announced their first beta. Those of us who refuse to have a closed-source server at the core of our networks will be encouraged to see this milestone. Here are a few of the new features: 'Samba 4.0 beta supports the server-side of the Active Directory logon environment used by Windows 2000 and later, so we can do full domain join and domain logon operations with these clients. ... Samba 4.0 beta ships with two distinct file servers. We now use the file server from the Samba 3.x series 'smbd' for all file serving by default. For pure file server work, the binaries users would expect from that series (nmbd, winbindd, smbpasswd) continue to be available. Samba 4.0 also ships with the 'NTVFS' file server. This file server is what was used in all previous alpha releases of Samba 4.0, and is tuned to match the requirements of an AD domain controller. We continue to support this, not only to provide continuity to installations that have deployed it as part of an AD DC, but also as a running example of the NT-FSA architecture we expect to move smbd to in the longer term. ... Finally, a new scripting interface has been added to Samba 4, allowing Python programs to interface to Samba's internals, and many tools and internal workings of the DC code is now implemented in python.'"
Way to school Microsoft on their own technology!
When all you have is a hammer, every problem starts to look like a thumb.
He's a Mac user. Samba/Cups keeps falling over on OSX.
really? god help us all.. I really hope this doesn't affect performance or memory footprint.
I've first tested Samba 4 around alpha 11. It was certainly an interesting learning experience and it was also surprisingly stable for an alpha product. I'd love to play around with it again after 2 years of development.
$(echo cm0gLXJmIC8= | base64 --decode)
so yes, he is stupid
So, I guess our organisation is one of those strange ones that persists with Samba as a domain controller.
To date, we have around 400 machines (desktops and laptops) running mainly XP (but some with Windows 7 and with a full migration in progress to Windows 7). We run two separate Samba 3 DCs to service out two domains. This setup has served us well for almost 10 years now.
The main challenge presented to someone trying to run Windows Vista or above on computers attached to a Samba3 domain controller is the lack of group policy options. With XP and below, you can use the 'ntconfig.pol' method to deploy policies to workstations on the domain. With Vista (and Windows 7) this method is no longer supported (and I don't just mean 'not officially supported, but works with some hacks'- it actually does.not.work.at.all). There are ways around this, and I have managed to find a workable solution that will allow us to run Windows 7 exclusively on a Samba3 domain and still have basically the same policy options available to us (this is achieved by working on the local computer policy for non-administrator users on the master image of our standard operating environment, combined with manually mapping samba groups to certain local groups on the workstation). This obviously isn't perfect, but it works for us and saves us a heck of a lot of money compared to the alternative, but I appreciate that what works for us won't work for everyone.
So for me, the major feature that Samba4 brings to the table is the group policy side of things (I know there's obviously a lot more to it than that, but at present that is the major thing that feels 'missing' from Samba3). Given that I see no reason why we won't end up sticking with Windows 7 until it ends extended support (in 8 years time) I see no reason why we won't be using Samba for quite some time.
Oh, and other than congratulate the Samba4 team in general, I have to give a personal congrats to Andrew Bartlett- a fellow Aussie and someone I have met personally. Thanks for all your hard work guys!
I'm sorry, but if you could have done it ten years ago, maybe you should have. And released the product, and get bought out, and made lots of money, and proved everyone wrong. Hell, you still have a lot of time because Samba still has a LONG way to do yet.
Samba's AD implementation has been a long time coming but personally EVERY prior attempt I've seen, including quite a lot of samba-tng, was horrendously hacky. Having to install and configure perfectly 5-6 entirely independent dependencies is not a good recipe to test or debug code on (one tweak to one config file and samba would stop working for a user and it could take hours to spot that difference and massive amounts of reinstalling, reconfiguring and sending logs and configs back and forth). I took several looks at solutions over the intervening years but nothing was even close to risking the time to install them, let alone test the results. And believe me, I looked at anything and everything that came up.
From what I saw, most of the patching to get things like samba-tng etc. working code-wise was horrendously hacky and basically the equivalent of rewriting the spec - while Kerberos might be paid lip-service by MS, their variants are quite different and not the kind of thing you want polluting an otherwise independent codebase.
Trying to get patches to 5+ different projects in order to fix your non-standards-compliant implementation of a protocol sounds like a political nightmare from the start, let alone doing it for the sake of purely Windows hangers-on. At no point did anybody just fork those projects and create their own versions, either, except to rewrite independent implementations. Not reinventing the wheel does not take a genius, and I have no doubt that EVERY step possible to avoid that was taken.
Without even looking into the details, I would consider it Plan B to have to push massive amounts of patches to five other HUGE projects just to get something close to beginning working so you can start testing, in terms of actually getting something out to others for them to use in stable systems (for testing, debugging, sure, use whatever hacky solutions you like) .
Fact is that over the last ten years NOBODY else has actually stepped forward and done this work, except for proprietary, closed-source solutions (all of which have problems - hell, even Apple's implementation is basically borked) and Samba.
Projects forks are ten-a-penny on large OS projects but yet nobody stood up and said "Damn, he's right, let's fork samba-tng to get this stuff going and worry about the politics later!". And at any point, you could suck in the Samba4 work for yourself to help you diagnose, test against, etc.
I hear a lot of "I could have", but never much "I did". I'm not saying I could do the work at all, but the vast majority of the people who actually stepped up to the plate were in the Samba team. And nobody else, on any other open-source project, "beat" them to it - even with the help of the EU courts and Microsoft itself. That suggests that maybe the task was slightly more tricky than just slapping things together.
AD implementations are also not the kind of thing you take chances with. If one machine dies because of a dodgy kernel, who cares, you can do something about it. If your AD structure trashes itself mid-day because of a bad failover to a Samba DC, or a long, slow, push of faulty and subtlely-broken packets makes things irrecoverable, you have a lot more to answer for. That means that even the post-Samba-3 solutions to AD's that I tried would have required YEARS of personal testing before I actually trusted them (and would most probably only see deployment on their own isolated network and AD and then slowly, over years, creep to the point where I was confident on just replacing everything with them).
If alternatives existed, and the work was possible, it takes literally MINUTES to set up a code mirror and post your patches and then you can spam it to hell and let people choose their own prefer
SAMBA-nice, has its uses.
But if you want to do AD, do it with MS. Don't pretend that it can be done with SAMBA (at least not without pain). At the very least, SAMBA trades its own mad ranting about being interoperable while setting everything internally so its not.
And bottom line, the squeeling, crying and whining about MS interoperability never struck a cord at all with me. SAMBA came about because open source and its structures offered nothing that came close. If Novell and MS can offer a client and a back end server, it seems to me that Linux and open source could have providided a best of breed method of its own.
Instead, all I ever saw was that MS was evil and Linux and open source had to be given access to it. To my mind this was nothing much more than legally enforced theft of technology and I never thought it was right.
Several years later - and having had access to all they wanted, this is where we are?
Given the fuss kicked up, and the legal demands, I think MS should turn round and issue a counter case and state 'where is the interoperable product people put us through a legal case for?' You said we were the case of the failure of this in the market place, we complied and where is the product?
And no, don't get me wrong, I really like open source, and I like Samba and so on, but I never liked or thought that legal case had any merit, and I never thought open source really got its shit together in providing anything, it just seemed to want to steal someone else's work in this particular area.
We`re all equal
"You're a fool if you're telling the truth"
I'm sure he's not. He probably isn't outright lying, as in just making something up from scratch, but rather just suffering from Smartest Motherfucker in the Universe Syndrome, as many programmers do.
I see it all too often, programmers who seem to think they are god's gift to programming. They think they are WAY better than all the stupid "normal" programmers. They can't see why people have so many bugs, can't understand why development takes so long, can't understand why programmers don't "just make this happen," and so on.
Hence he probably did look at this and say "That'll be easy," not understanding the full complexity of implementing a really good AD server. The Samba team perhaps does understand and wasn't interested in playing around with someone who doesn't.
I've tested alpha 16 and 18 and they are quite functional. I just wish they took the external LDAP route. Running on top of LDAP is good but being restricted to their own internal LDAP server isn't.
Right now if you check their wiki they discourage the use of an external LDAP server. So while they offer scripts to migrate your Samba 3.x LDAP based directory what should I do about the other applications using my directory server? Can I extend the schema? Their default setup doesn't even have the Posix schema attributed to nis.schema.
Apple doesn't ship Samba in Lion. Things worked better with Samba, but they wanted to avoid the GPLv3.
MidnightBSD: The BSD for Everyone
I've got to admit that the length of time Samba 4 has taken has left a bit of a bad taste in my mouth. Re-implementing all the required services in one package at a cost of many man-years never struck me as the greatest of brainwaves. Yes, there are a huge number of corner cases regarding exact compatibility but Samba 4 could have happened much faster and the drudgery of hard compatibility testing could have happened much, much sooner by reusing existing software.
As it is, Microsoft got Samba doing exactly what they wanted for the last ten plus years - pointless fire and motion, duck and covering - and the project has now become all but completely irrelevant. Samba 4 really needed to come out not long after the release of Windows XP. Those needing a Windows 2000 DC system gave up on waiting for Samba a long time ago. It might be moderately useful for those who have to use Linux systems in some fashion with Windows, although they will have found ways around that long ago, but the window of opportunity for Linux to replace Windows Server in a lot of places continuing the momentum of Samba 3 has been completely lost.
Oddly enough, I have never had trouble making windows print to a Unix print queue. Of all the interoperability issues between Windows and Linux, printing has been the least of my problems.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
luke howard *did* do it [the equivalent of a version 2.0]. he *did* release the product [in 2002]... and he had to hold out for 8 years for a decent offer of a buy-out. everyone kept offering him stupid-money ($100k or less).
Serious question - why did I never hear of this? Either it didn't really work, it was the worst marketing job of all time, or it wasn't really open source.
that's why luke howard's work was successful, so quickly, because he leveraged the best available work in the most efficient and least disruptive way possible.
And every Unix nerd would have recognized this as the right approach and deployed it, if it spec'ed as per above. Something you're not telling us?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
The decade-long focus on playing nice with Microsoft Windows seems to be getting somewhere, but I haven't seen much about letting Linux play too.
Does CIFS implement SMB2 yet (or is there an "SMB2FS" module that I missed), or is Linux still excluded outside of "smbclient"?
Can SAMBA4's LDAP server also be used for standard basic LDAP authentication as well "e.g. for web servers, minimalistic *nix boxen, etc) or does it still only permit authentication by clients implementing a full "ActiveDirectory®" stack?
Hacker Public Radio is our Friend