Samba 4.0 Released: the First Free Software Active Directory Compatible Server

Jeremy Allison - Sam writes "We released Samba 4.0 today, containing the first compatible Free Software implementation of Microsoft's Active Directory protocols. 'Samba 4.0 comprises an LDAP directory server, Heimdal Kerberos authentication server, a secure Dynamic DNS server, and implementations of all necessary remote procedure calls for Active Directory. Samba 4.0 provides everything needed to serve as an Active Directory Compatible Domain Controller for all versions of Microsoft Windows clients currently supported by Microsoft, including the recently released Windows 8. The Samba 4.0 Active Directory Compatible Server provides support for features such as Group Policy, Roaming Profiles, Windows Administration tools and integrates with Microsoft Exchange and Free Software compatible services such as OpenChange.'" Full release notes are available, and you grab the files from the download page.

Comments

If only it were samba-ng

[bluefoxlucid]

We got a giant monolith instead of a bunch of core libraries and services.

Re:If only it were samba-ng

[Jeremiah Cornelius]

Gates is forked.

This will be embeddable on ARM appliances, and baked into VM management software, etc.

It only took 12 years... :-)

Re:If only it were samba-ng

[Anonymous Coward]

Ballmer must be furiously throwing chairs at this announcement.

Re:If only it were samba-ng

[Anonymous Coward]

The bitter tragedy is that Microsoft stole an open source standard like Kerberos, modified it, and used it to lock down corporate networks to prevent the intrusion of open source on their turf successfully during that time.

Re:If only it were samba-ng

[Jeremiah Cornelius]

Tell it to the BSD license troll, who gave me his sophomore, libertarian rant on the FreeBSD funding thread... ;-)

Re:If only it were samba-ng

[Anonymous Coward]

LOL
First: linux is cool but it can't do smb/cifs
Then: linux is cool but it can't do the domain controller
Now: linux is cool but the domain controller is shipped as a giant monolith.
Future: linux is cool but the domain controller source's variable names contain too few vowels.
Yeah brother I know that feel.

No more licensing fees :)

[somersault]

Oh hell yes

Re:No more licensing fees :)

[jhoegl]

Shhhhh, they will hear you.
BTW, licenses will still be required for these machines/users, but not for the OS.

Re:No more licensing fees :)

[somersault]

Having said that, or accounts software (shudder) requires SQL server, but it will be nice to move that off to a VM and have all other network services running on Linux at last. Thankyou SAMBA team :)

Re:No more licensing fees :)

[somersault]

I already have loads of client licenses, but this means no more server licensing, so it will be significantly cheaper for small businesses to build a small network with full redundancy, and massively cheaper to build out large networks. Get this onto Ubuntu Server with a friendly interface, and MS will be close to dead in the water as far as servers go.

Re:No more licensing fees :)

[wonkey_monkey]

SQL may be SQL, but MSSQL is not MySQL is not PostgreSQL.

Re:No more licensing fees :)

[kagaku]

Spoken like someone who has NEVER done SQL development. SQL most definitely is not SQL, it's a world full of vendor specific dialects of SQL, each varying in subtle and incompatible ways. Not to mention each requires a different method of connection, protocol, authentication and integration.

Re:No more licensing fees :)

[na1led]

All we really need now is a Free SQL equivalent. Doubt that will ever happen.

Re:No more licensing fees :)

[X0563511]

ODBC? JDBC?

Re:No more licensing fees :)

[Anonymous Coward]

Good thing there's already plenty of free open source SQL servers.
Oh, you meant Microsoft SQL Server? I don't see how I could've misunderstood you, given the clear and unambiguous naming policy of this Microsoft product.
I can't wait until they release Microsoft Operating System and Microsoft Web Browser.

Re:No more licensing fees :)

[somersault]

By retarded monkeys yes. Their installation CD requires IE. The software items had the worst designed interface I have ever seen. I really doubt it will work with any other SQL server.

If you try porting an app from one DB server to another you'll find out that there are some significant differences between SQL implementations too in terms of available functions, data types, etc.. it's possible to keep things generic, but I doubt most developers do so.

Re:No more licensing fees :)

[Synerg1y]

Client licenses, what? Are you talking about windows OS keys? Why would anybody think those are suddenly not required?

Then again, reading through this discussion, I'd have to say most of the posters don't have a clue what they're talking about in regards to active directory and the relevance of what samba supposedly did here. I'd still wait 1/2 a year to put it into a test environment & another year to go production. AD isn't something that can error out sometimes without consequence.

On that note, to all the businesses who can't / don't want to afford windows SBS, this should like getting free money. Otherwise AD is just a role on a modern windows server... Notice how this is not a stand alone server , 99% of the time it's better to leave it stand alone.

Also, another thing I was looking for from the article was MISMO, there is no mention of it, AD will not integrate right without it. Hopefully, those roles are handled properly if we were to integrate it with an MS AD server.

Re:No more licensing fees :)

[Tailhook]

ODBC? JDBC?

Neither of these normalize vendor specific dialects. Both of these require vendor specific drivers to implement vendor protocols. All of this leads to costly subtleties.

The grandparent is correct, both in its assertions about SQL and of you.

Re:No more licensing fees :)

[TheNinjaroach]

ODBC / JDBC takes care of the connection, protocol and authentication, but it definitely doesn't take care of vendor-specific dialects.

Most good databases support ANSI SQL standards, but those specifications are lacking in too many ways to build a completely functional application without having to poke around with implementation-specific hacks.

Re:No more licensing fees :)

[erroneus]

Wait what?

I get that the client OS (presuming it is Microsoft Windows) must be licensed, but why the user?

This is the kind of thing I have been waiting for. A means to wedge other OSes into an AD oriented business network. Microsoft can just change a few things and make it required to run this or that server. They have played that game before where F/OSS has to catch up with changes Microsoft makes, but in the end they will lose because they can only make so many tweaks and changes before they risk compatibility with their existing software and clients.

So to set up an AD domain based off of this and be able to manage devices other than Windows clients would be a classic example of embrace and extend which could work against Microsoft. I know... it's just a dream now...

Re:No more licensing fees :)

[Bill Dimm]

There are a ton of differences that are not normalized away by ODBC, including really basic functionality like the SQL code to drop or add multiple columns (and the need by some to manually drop indexes before dropping the columns, or the need to do a REORG TABLE after dropping columns). And, in spite of how incredibly old the ODBC standard is, ODBC drivers still don't implement some things or implement them incorrectly, so you really can't expect things to work with different DBMSs without testing.

Re:No more licensing fees :)

[bigstrat2003]

I'd still wait 1/2 a year to put it into a test environment...

Why? Isn't the whole point of a test environment to find out if something has issues? I think that interested parties should put it into a test environment immediately, cause that's why they have a test environment. But yes, wait some time to put it into production.

Re:No more licensing fees :)

[erroneus]

Sorry, but no. There are bunches and bunches of PHBs out there who will perpetually doubt that anyone can make a Microsoft server as good as Microsoft and would be more than a little afraid that by doing this, they would be in violation of some sort of license requirement. At the very least, it would void any support services if an exchange server were to connect to a Samba 4 AD domain. PHBs care a lot about stuff like that even if people rarely if ever use Microsoft's support.

For that dream to become a reality, a big player out there would have to step up and put their branding and reputation behind it. For example, IBM might be a great candidate for that. PHBs still know who IBM is. RedHat might not get the reception Linux users might think they deserve. Oracle, as much as I would like to see them die in a fire, might also be able to pull it off.

For now, the IT world is ruled by PHBs and one must always consider what things they might believe regardless of how ridiculous it may actually be.

Re:No more licensing fees :)

[Bill Dimm]

ODBC? JDBC?

Neither of these normalize vendor specific dialects...

Minor nitpick, but that should be "Neither of these completely normalize vendor specific dialects." ODBC function substitution (e.g. "{fn CONCAT(x,y)}") normalizes out some basic things, but probably won't cover everything you might want to do.

Re:No more licensing fees :)

[Charliemopps]

That's not true. You can write code that can use all 3 interchangeably. I do it all the time, as my queries hit tables stored in all 3 formats and it's just way easier to go generic that try and keep your code strait between data sources. Generally if you can do MySQL then you can do everything else with ease. It's the people that have been working in an oracle shop their whole lives and they come out and work with us in the real world with dozens of mixed formats that they have to really learn how to code SQL. PLSQL and other "Fancy" versions are nice because they have little tricks that make some actions easier. But when it comes down to it, if you code it correctly you can drop the same code into any of those formats and it will return the same results. Can you write stuff in one that wont work in the other? Yes, but you don't have to do it that way. There's always a way to do it that will work in all 3, and in truth, that way is likely the best way (although maybe not the easiest).

Re:No more licensing fees :)

[X0563511]

Why would you be adding/dropping fields outside of installation/upgrading?

Re:No more licensing fees :)

[gorzek]

Tell me about it. MS SQL supports this, but doesn't support that, but MySQL supports it, and Postgres supports it slightly differently, and let's not talk about Sybase.

Standards sure are awesome when every implementation of it is non-standard.

Re:No more licensing fees :)

[Synerg1y]

You should try NoSQL, and as a guy who's done A LOT of sql development, they're all more or less the same, the syntax may vary, especially with oracle, and so may the licensing fees.

Also, somewhere between ODBC & OLE DB, which as far as I know are supported by any worthwhile SQL "flavor", you can connect SQL to SQL in any form.

Re:No more licensing fees :)

[Synerg1y]

JDBC... lol, don't java'ers use hibernate now? Shit even got ported to .NET for some reason I'll never fully understand.

Re:No more licensing fees :)

[Synerg1y]

Nope, enjoy MS licensing fees. Don't google mysql... don't do it...
...
...
...
What did I just say? Now forget everything you've read here and enjoy MS licensing fees, don't forget to buy those CALs.

Re:No more licensing fees :)

[somersault]

You don't sound like you have much of a clue either to be honest; when you buy server licenses, you also need to buy "client" licenses to go with them. These are in addition to normal desktop Windows licenses (as far as I'm aware at least). Though if you're using a non-MS implementation of the server, I don't see why you should need the client licenses too. If you do, that's still a hefty cost, but at least you shouldn't need to upgrade them every few years when running SAMBA.

Re:No more licensing fees :)

[MightyMartian]

It may very well make a difference in smaller and medium sized companies where Microsoft's CAL pricing increases means that replacing aging Server 2003 AD networks could potentially become A LOT cheaper. Obviously you will need someone with the expertise to run a Samba system, but I don't see anything about Samba 4 that's any more complicated than Samba 3.

Re:No more licensing fees :)

[Anonymous Coward]

Of course you'd need OS keys, but now you wouldn't need device or seat CAL's, or the server license for that AD server.

Re:No more licensing fees :)

[jeffmeden]

You are right, but the bottom line (to steal the adage) is that "no one gets fired for choosing microsoft". Yes you are locked in, but you are locked in to an ecosystem that 90%+ of the world's businesses run on, so it is seen as the safest of all choices (and cost is a small factor compared to job safety).

This will take off when Samba can integrate with Google Apps and let companies throw away anything microsoft-related (but still be microsoft-like)...

Re:No more licensing fees :)

[aquarajustin]

This is why I don't work for a PHB. In fact, he's balding a bit. I have the best boss ever. He just gave me the green light to be early adopters and run this in production (once it passes a few sanity checks). We've been running the alphas and betas with much success. Samba team ftw!! Thanks guys! I've been waiting for this for so long.

Re:No more licensing fees :)

[Anonymous Coward]

Since when is SQL server a generic term for a dbms?

Re:No more licensing fees :)

[Anonymous Coward]

No. While ANSI SQL is 'SQL'... every database implementation has a) extensions on top of that and b) differing behaviour in areas of the standard that are open to interpretation.

Re:No more licensing fees :)

[Bill Dimm]

Why would you be adding/dropping fields outside of installation/upgrading?

I'm not sure whether you intend "you" in the above to mean the person who wrote the "accounts software" referenced at the beginning of this thread, or me personally. My personal experience was with writing document clustering software (groups related documents together based on analysis of the content) that could analyze the text stored in virtually any SQL database with an ODBC driver and export the cluster results back into the database as a set of additional columns. It would add a Cluster ID column (rows with the same ID would be in the same cluster), a column indicating whether the document was the representative document (i.e. approximately the center) for the cluster, and a few other columns. If the user ran multiple calculations on the same database and wanted to replace some old results instead of adding new columns, the old columns would be dropped and replacement columns would be added -- this was done because sizes needed for the columns may vary between different calculations, so simply overwriting the old ones wouldn't necessarily work. Getting everything to work across all test databases (Oracle, MSSQL, DB2, MySQL, PostgreSQL) was a major pain.

Re:No more licensing fees :)

[datapharmer]

nonsense. how about upsert in mysql? Has to be done as a merge in mssql. Kinda killed your code for mysql and it works for everything argument. Not to mention the inefficiency of not being able to implement vendor specific options. sure you can limit yourself to vanilla sql, but if you want to get work done you pick a tool and use it. If you can get all the vendors to agree I'd be happy as pie, but claiming that is reality now is disingenuous.

Re:No more licensing fees :)

[Kjella]

Sorry, but no. There are bunches and bunches of PHBs out there who will perpetually doubt that anyone can make a Microsoft server as good as Microsoft and would be more than a little afraid that by doing this, they would be in violation of some sort of license requirement. At the very least, it would void any support services if an exchange server were to connect to a Samba 4 AD domain. PHBs care a lot about stuff like that even if people rarely if ever use Microsoft's support.

If PHBs ran the world we'd still be browsing with IE on an IIS server - or more likely, banging rocks together - but fortunately there's the "I don't know what you just said, just make it happen" and "There's no money in the budget for that, so we'll try the shoestring solution" PHBs that get enough out of the way to not entirely choke IT. (Or more likely, make IT not choke the PHBs...)

Re:No more licensing fees :)

[Em Adespoton]

The problem is that SQL is all about the query language formalized structure. It says nothing about the procedures or how to control the backing server.

Think about SWL (structured written language). There are a few standards, one of which is the Roman standard. Using this standard, we can use the same character set to represent many different spoken languages. We can store meaning using the Roman SWL and anyone else who knows the structure can extract it.

However, the transforms and functions, cliches and linguistic interlinks all exist outside of that structure. As a result, a lexicon is also required in order to put in IItalian and have it usable by someone in the Philippines. The information stores just fine, but updating and making sense of what you've retrieved takes more work.

Annoyingly (to me anyway), almost every SQL server vendor out there has hard-coded a way of handling this extra meta-data and interfacing it with the data itself. Some of their solutions are similar enough that ODBC and OLE DB can handle basic procedure calls -- but anything written to take advantage specifically of the strengths of a specific SQL-backed service tends to be incompatible.

So yes, you can connect SQL to SQL in any form, but actually managing the data and preserving context in a way an existing application wants to... that's another kettle of fish altogether.

Of course, once it's done, it's done -- so someone could easily re-tool a Postgres DB to act enough like a MySql DB *for a specific DB instance* that the samba service should function "mostly" as expected -- and the actual structured data should migrate just fine once the re-tooling and testing is complete.

Re:No more licensing fees :)

[Synerg1y]

Oh, this crap: Windows server CALS There's typically ways around this for larger organizations through more expensive, but open licensing models. Never had to deal with it thankfully, also it's really hard to enforce for MS, so some people don't bother. You are technically right though, as per the MS licensing model, these are required.

Re:No more licensing fees :)

[plover]

JDBC... lol, don't java'ers use hibernate now? Shit even got ported to .NET for some reason I'll never fully understand.

Revenge. Java guys hate .Net guys.

Re:No more licensing fees :)

[poetmatt]

They had the documentation forced into existence thanks to the courts. Without a doubt it is 100% accurate.

I wouldn't be worried about anything here - nothing MS can do can fix this, and the timing is as perfect as it gets considering windows 8 adoption is poor and businesses are sticking with windows 7.

Re:No more licensing fees :)

[somersault]

Exactly :) I'd rather not have me or my employer fined or given a criminal record for this kind of thing, so I want to ensure that we are fully legal. Of course all the licensing BS and cost just makes it a royal PITA to upgrade, so our network is still running 2003 Server/Exchange. I was considering Server 2008 soon as 2003 will be out of maintenance in a few years, but.. I like this better! Still have to decide what to do with email, but there are some nice mature options out there compared to last time I seriously considered switching (~6 years ago).

Re:No more licensing fees :)

[Anonymous Coward]

http://xkcd.com/927/

Re:No more licensing fees :)

[Shoten]

Why? Isn't the whole point of a test environment to find out if something has issues? I think that interested parties should put it into a test environment immediately, cause that's why they have a test environment. But yes, wait some time to put it into production.

Actually, most of the time the point of a test environment is to iron out the snags. You usually assume you can fix whatever foibles and quirks there are when you make the effort to build something in a test environment...because even if the software's free, the time ain't. And if you want to cut down on the amount of pioneering you may have to do, you're better off waiting 6 months so that most problems you encounter will have already been solved by someone else. I've never seen someone put something into a test environment, run it, and then just give a thumbs-up or thumbs-down. They try to make it work, before they bail on it if it fails.

Re:No more licensing fees :)

[Anonymous Coward]

He said equivalent. So yes, don't google MySQL.

Re:No more licensing fees :)

[Shoten]

SQL is SQL, yes. But Oracle speaks PL-SQL. Microsoft SQL Server speaks T-SQL. MySQL speaks neither. Just look at how SQL injection attacks need to vary based on which database server is on the back end, and you'll get some idea of just how NOT interchangeable "SQL" is in the real world. Being able to spell a 3-letter acronym does not a DBA make, apparently.

Re:No more licensing fees :)

[erroneus]

Actually, I have read right here among the commentary that one can still use the Microsoft tools for managing a Samba server. Getting Samba set up initially might require some level of ability, but you know? As much as it pains me to admit it, you have to have at least as much ability to do it with Microsoft. Anyone who thinks they can't learn to do it under Linux is simply limiting themselves needlessly.

Re:No more licensing fees :)

[Anonymous Coward]

JDBC... lol, don't java'ers use hibernate now?

Not if they can help it.

Re:No more licensing fees :)

[shutdown -p now]

MySQL is not a drop-in replacement for MSSQL from the perspective of any app that uses it as a data store. The SQL dialects are different, and the feature set is vastly different in some cases.

What he's talking about is something like that old Firebird fork that changed it to use Oracle syntax as much as possible. One could probably take PosgreSQL and fork it that way (I very much doubt that MySQL is sufficiently feature-complete for that), but it's still a lot of work.

Re:No more licensing fees :)

[DragonWriter]

SQL is SQL, yes. But Oracle speaks PL-SQL.

PL/SQL isn't the Oracle dialect of SQL, its the SQL-based procedural language supported by Oracle for triggers/procedures, etc. An application talking SQL to Oracle doesn't need to use PL/SQL, but it does need to use the Oracle dialect of SQL.

Re:No more licensing fees :)

[Billly Gates]

I will also add the comments about replacing a perfectly good working infrastructure with freeware that is untested is also spoken as someone who has never had to loose $200,000 an hour of downtime!

I am not bashing SAMBA as it works great on Macs and Linux PCs for connecting to a Windows network. But people act like that and SQL are something you can pickup and replace and move on.

Even opensource software which is much better as they do not have a financial interest in vendor lockin mean steps and changes from moving to mysql to Postgresql as an example.

Re:No more licensing fees :)

[Anonymous Coward]

it is not it is worse

Re:No more licensing fees :)

[Anonymous Coward]

It's more pity than hate.

Re:No more licensing fees :)

[LurkerXXX]

MySQL is utter crap. It's not a replacement for MS SQL, it's not a replacement for any decent SQL server. It took those bozos YEARS to finally get MySQL to not recognize Feb 31st as a valid date.

PostgreSQL is a potential replacement, but certainly not a drop-in replacement. Lots and lots of work would need to be done to convert between the different lingo's they speak and way features are implemented.

Re:No more licensing fees :)

[ozmanjusri]

Since 1979.

Re:No more licensing fees :)

[dgatwood]

Just as long as you don't have to create a table, add any sort of triggers, or do anything interesting like automatic time stamping on modification/creation, choosing a random n entries out of the matches without shipping the entire huge set over a slow network, etc., then yes. As soon as you have to do something even slightly nontrivial, the difference between SQL dialects becomes the tenth circle of hell.

Re:No more licensing fees :)

[Anonymous Coward]

Since the 2nd SQL rdbms came out?

MSSQL or SQL Server is Microsoft. SQL server, is an SQL server, be it MS, Oracle, IBM DB2, PostgreSQL, etc, etc.

Re:No more licensing fees :)

[Anonymous Coward]

Sorry, but I use 5 different RDBMS's every week, have done so for years, and it's obvious you don't know what you are talking about if you think it's easy to drop the same code from one to another. You must be running some really crappy un-optimized code that runs like crap on most of the systems and doesn't do anything other than the very very basics.

Re:No more licensing fees :)

[LurkerXXX]

As a rule, MS SQL and Sybase are going to be pretty similar for most things, so it's fine to include it. (MS SQL was based off of Sybase until a few versions ago)

Re:No more licensing fees :)

[Pav]

Actually there's a problem for Linux shops - if you've got an OpenLDAP based infrastructure already, perhaps with a nice GUI like FusionDirectory or GOsa or Suse's or Redhats etc... you must either wait until Samba4 eventually gets an OpenLDAP backend (1yr, 2yrs, Xyrs???) or wait for someone to develop some kind of sync between OpenLDAP and Samba4's internal LDAP. Before anyone suggests moving to Samba4 LDAP, an OpenLDAP infrastructure can support just about everything eg. email/groupware (SOGo, Kolab, whatever), Squid, Kerberos, Asterisk, DHCP, deployment of clients (via OPSI, FAI, puppet et al.) and much much more.

Re:No more licensing fees :)

[Pav]

ie. you don't want to mess with a complex setup like that. Besides Samba4 will have to spend many years in the field to earn enough of a reputation for anyone to want to base the backbone of a Linux/LDAP infrastructure on it.

Re:No more licensing fees :)

[sbditto85]

to bad there isn't a mod depressing ... i would of given it to you as you rained on my "yay for no MS" parade I was having. The truth sucks.

Re:No more licensing fees :)

[ArsonSmith]

My anecdote: 5 years ago we were a 95% Windows shop with only 15 Linux servers. Today we are a 90% Linux shop with near 1000 Linux servers. We went from 5 Windows Admins and 1 Linux admin to 6 Linux admins and 3 Windows Admins. Yet we are unlikely to convert AD to this for the exact same reasons. It's not just AD it's the plugins to AD the monitoring and the fact that, while it rarely breaks anyway, if something does break the amount of repair tools and articles on how to fix it are numerous. As that original 1 Linux admin I would like to see this as an option. But it's not very likely.

Re:No more licensing fees :)

[ArsonSmith]

NIH? I haven't followed this, but is there a reason Samba didn't base itself off of existing tools? OpenLDAP, BSD Kerberos etc...

Re:No more licensing fees :)

[Anonymous Coward]

pardon my ignorance, but what is a PHB ?

Re:No more licensing fees :)

[jhoegl]

Because if it authenticates users against the AD for security purposes (logging in/shares/etc), it requires a CAL.

Re:No more licensing fees :)

[cheesybagel]

Nah. MySQL is better than MSSQL.

Re:No more licensing fees :)

[Yosho]

JDBC is an API for connecting to databases; Hibernate is a specific implementation of JPA, which is a persistence framework that provides object-relational mapping. The two are not incompatible at all; in fact, Hibernate uses JDBC under the hood.

Re:No more licensing fees :)

[Anonymous Coward]

From the Dilbert cartoons - the Pointy-Haired Boss.

Re:No more licensing fees :)

[Radworker]

Waitta minnit! i AM the phb where I work. The same PHB that kicked MS into the corner. The same PHB that brought Proxmox into the datacenter. The same PHB that switched from Ciscos offerings to Asterisk. The only two MS servers one virtualized (because an app vendor won't wise up and use a SQL product that is platform agnostic) and one aging DC. The old bucket of bolts will be exiting as soon as my gateway distribution of choice works the last of the kinks out of their Samba4 integration. We aren't very big with only 150 employees so the conversion should go very smooth.

Re:No more licensing fees :)

[mjwx]

Actually, I have read right here among the commentary that one can still use the Microsoft tools for managing a Samba server. Getting Samba set up initially might require some level of ability, but you know? As much as it pains me to admit it, you have to have at least as much ability to do it with Microsoft. Anyone who thinks they can't learn to do it under Linux is simply limiting themselves needlessly.

Now I'm not saying setting up Samba is hard but I think you're underestimating how dead easy it is to set up AD and Windows shares. I mean trained monkeys could set it up (I'm convinced this is how many SMB servers get built).

To do it properly in either environment requires an understanding of the underlying concepts of permissions and network shares. To fully understand how everything works in either Samba or AD requires a degree and a half.

Re:No more licensing fees :)

[Anonymous Coward]

Also, if this final 1.0 is anything like the betas I tried about 2 months ago, you're not likely to be able to easily migrate an existing infrastructure over unless it's a purely AD environment already.

Specifically, there appears to be no mechanism for retaining the use of a non-Samba4 DNS server. From where I'm sitting, Samba4 may have been a good option to get existing not-on-a-domain Windows machines to authenticate along with the Linux and UNIX systems which are already using BIND for DNS. Apparently, only the "small windows shop running Samba 3 or Windows 2000 exclusively" were really considered here.

(Unless, of course, a lot has changed in the past two months.)

That said, I'm not holding my breath for it to be mature. I hit entirely too many other 'incidental' bugs (reverse records not taking into the Samba4-internal DNS mechanism) and incompleteness (documentation, what's that?) for it to be worth looking at seriously yet.

Re:No more licensing fees :)

[mjwx]

You are right, but the bottom line (to steal the adage) is that "no one gets fired for choosing microsoft". Yes you are locked in, but you are locked in to an ecosystem that 90%+ of the world's businesses run on, so it is seen as the safest of all choices (and cost is a small factor compared to job safety).

They used to say "no-one gets fired for buying IBM". Is that still true?

Re:No more licensing fees :)

[dbIII]

"no one gets fired for choosing microsoft"

That's a misquote of an old thing about IBM. Guess what one of the platforms IBM are selling support for is? A clue is it (and probably all the other platforms IBM supports) can run SAMBA.

Re:No more licensing fees :)

[dbIII]

I get that the client OS (presuming it is Microsoft Windows) must be licensed, but why the user?

A while ago I saw a book called "Licencing Windows Server For Dummies", initially thought that was funny that somebody was making a joke "For Dummies" book having a go at how complex the licencing is, then opened it up and found out it was real!
Their licencing system is a complex and contradictory sick joke that relies on such weirdness as objects instead of people owning licences.

Re:No more licensing fees :)

[1s44c]

If you are posting on slashdot about Asterisk and Samba4 you are most certainly not a PHB, you are a knowledgeable boss.

A lot of us dream of having a boss who actually knows his shit.

Re:No more licensing fees :)

[Anonymous Coward]

If MySQL is crap then MSSQL is something unspeakable. Either that or you just show your ignorance. If you do not run MySQL in strict mode it will allow dates such as Feb 31 because it does not perform validation of the data, if you want to validate the data then run in strict mode, how hard can it be...

Re:No more licensing fees :)

[L4t3r4lu5]

We switched to Zimbra around a year ago, and haven't looked back. It doesn't offer as much of the integration that Exchange / OWA does, but it's capable enough for email, calendaring, contact management etc. If there's some specific functionality that you require, check that it's supported.

Sadly, we have Windows-only MIS, and I'm not in a position to decide on an alternative, so we have to stick with Windows servers with all the licensing headaches that entails. Still, at least I'm not paying to license Exchange too.

Re:No more licensing fees :)

[hairyfish]

Yeah because MS's entire product portfolio consists only of Active Directory. Do you Linux guys seriously believe your own bullshit? This is good news let's not ruin it by making insane claims based on extremely poor logic.

Re:No more licensing fees :)

[Anonymous Coward]

(Admit that it's been a few years since I left the db arena, but anyway)
If you got lots of transactions in Oracle you'll kill performance if you don't bind your variables, e.g. I see the LAMP people do "select foo from bar where id = $tehid", something that could hurt performance really bad in Oracle. In Oracle there is not an autoincrement option but a generic counter that you have to poll before the insert. The list goes on

Re:No more licensing fees :)

[hairyfish]

So let me get you straight. As a PHB I have MS server infrastructure (AD, Exchange, SQL, IIS, sharepoint etc) that all works well. You want me to introduce a new product from another vendor that requires different sets of skills just for one or two servers to save me zero dollars (look up how Datacentre licensing works in virtual environments), even though I have existing server that do the job with the skill sets I already have in my team? Have I got that right? Just because you don't understand how management decisions are made doesn't make them wrong.

Re:No more licensing fees :)

[hairyfish]

If you have other MS servers then it saves you nothing. A user or device CAL is still required for the other MS servers so replacing one MS server in your farm with Linux will save you precisely nothing in CALs. In fact it will cost you more because you now need a new skill set you previously didn't need for zero added benefit (ie what does this offer that you don't already have with your current AD servers?)

Re:No more licensing fees :)

[Anonymous Coward]

And yet thousands of enterprise companies use it in full ACID compliant live deployments. I suppose they could all be wrong... Or it could be you.

Re:No more licensing fees :)

[somersault]

I said "as far as servers go". There are already perfectly viable alternatives to SQL Server, Exchange, Sharepoint, IIS, etc. Now there's an easy route to migrate Active Directory to a more secure, reliable and free OS. I'm not making insane claims, just pointing out the facts.

I'm not saying it will happen overnight, but if SAMBA 4 can do what it claims, there's no reason to think that it will simply go unnoticed, from small businesses to organisations with massive multi-tree setups. MS' licensing is expensive.

Re:No more licensing fees :)

[T_Tauri]

Exactly the same situation I'm in. We still have SBS2003 partly because it does everything we need but also partly because upgrading the licencing is a complex and expensive pain. Half our server licences are for 2008 (eopen) but we downgrade them all to 2003 because those are the user CAL's we have. Given the end of support for MS Server 2003 in April 2014 I've been looking at upgrading all the servers next year. Given we have virtualised most of our servers we then have to consider how many licences we need for the host hardware depending on how many VM's run on it - and you can't move the licence between hardware more frequently than every 90 days unless you also buy software assurance. Therefore you loose the benefit of moving VM's between hosts easily unless you buy extra licences so the destination hardware already has a licence.

We have already decided to move all our email to the cloud so with the local domain just being for local authentication and group policy this new version of Samba is seriously interesting to me. Will still need a few real MS servers for specific things that have to run on Windows (phone system, Sage accounts etc) but this would let us be far more flexible and have multiple domain controllers etc for far less cost and licencing complexity.

Re:No more licensing fees :)

[somersault]

What part of SAMBA having been around for 20 years, being in use in many commercial products, SAMBA 4 having been based on Microsoft specifications and having been tested at Microsoft's labs makes you think that this is in any way "untested".

When you've been developing a new version of your software for 10 years, I don't think you're in a rush to release it until it counts as "tested".

A direct Active Directory replacement based on Microsoft specs, and multiple incompatible SQL dialects based on whatever the hell the vendor wanted to do, have basically nothing in common.

Re:No more licensing fees :)

[jp10558]

So far so good for me on buying IBM anyway...

Re:No more licensing fees :)

[Anonymous Coward]

You would not the CAL's if you are using this. Not for connecting to these servers. If you are using Samba for your AD and for your file servers, you have reduced your licensing significantly. If you still have exchange, you would still need the exchange CAL's. If your servers are all linux using samba and openchange, then you have no CAL requirements.

Re:No more licensing fees :)

[Anonymous Coward]

Funny, when I was doing software development in an enterprise support group at Xerox, our Database Administrators always referred to SQL Server as the "Toy Database". Of course, they all preferred Oracle for the real muscle databases, but when they didn't need something that big, their second choice was PostgreSQL or MySQL. We had a couple of smaller application servers running SQL Server, and they were forever trying to convert them to some other database because they were such a pain to maintain.

No, NONE of them are drop-in replacements, unfortunately because all databases have hugely different ways of doing things (even their "standard SQL" is different). I'll never forget the day we tried to count the number of rows on a SQL Server database, and it reported "Integer overflow" because the table had over 2B rows...

Re:No more licensing fees :)

[squiggleslash]

Yeah, I used to write "runs the same way" Javascript for all available JS supporting browsers back in 2001. It was possible. I mean, without doing browser checks and writing big long if(MSIE) {} else {} crap. The same code would "work" on both Netscape 4 and IE4.

Was it a good idea? Did the website look decent under either? Do I need to answer that question?

By limiting yourself to a strict subset of SQL you can, kinda, sorta, if you know every pitfall, avoid something breaking on one or two of the implementations out there. It's hard. The reality is you're trying to speak the same language when actually there are multiple dialects out there, and you end up, inevitably, limiting what you're capable of doing.

SQL is not one language. It is not, in any real sense, standardized. DBMS programs are not actually interchangable in the real world.

Re:No more licensing fees :)

[ncc74656]

You can write code that can use all 3 interchangeably. I do it all the time, as my queries hit tables stored in all 3 formats and it's just way easier to go generic that try and keep your code strait between data sources.

Perhaps if you're just doing basic select/insert/update/delete queries with nothing too fancy, you can get away with that. Try doing anything even slightly more advanced than that (like pushing your database logic into stored procedures and/or functions instead of leaving it mixed in with your PHP, C#, or whatever) and things start getting interesting. Even something as seemingly simple as returning just part of a result set (select top 10 * from tbl in SQL Server vs. select * from tbl limit 10 in MySQL) can get in the way if you're looking to do something cross-platform. (You could return the entire set and have non-SQL code extract the subset you want, but that would be lame.)

Re:No more licensing fees :)

[LurkerXXX]

I'll never forget the day we tried to count the number of rows on a SQL Server database, and it reported "Integer overflow" because the table had over 2B rows...

You'll never forget the day you tried to count the number of rows using a function that returns an INT instead of using the function that returns a BIGINT? Congrats, you don't know the functions in the language you are using. Bravo. Try count_big() next time.

Re:No more licensing fees :)

[bad-badtz-maru]

Generally, the exact opposite is true - coming from mysql leaves you at a severe disadvantage. You'll struggle to understand basics like how to get a primary key in a row of data under PG or Ora. Just the fact that you're mentioning SQL and PLSQL as if they were interchangeable means you're clueless, it's like comparing TCP with PHP. Hint: PL/SQL is Oracle's name for their procedural language. Mysql's procedural language doesn't even have a name, yet it is just as incompatible with MSSQL, Oracle, Postgres, etc as they are with each other.

Just to pick the low hanging fruit, tell me how you get the current timestamp on mysql, postgres, and oracle in a database-agnostic way.

Re:No more licensing fees :)

[jelle]

I'm sure that there are applications that would wish to put February 31 into a date field in a database, so why restrict them?

http://en.wikipedia.org/wiki/February_31

Re:No more licensing fees :)

[hairyfish]

I have over 100 windows servers in my farm, only 2 of which do AD. Assuming SAMBA4 has a 100% penetration rate then it's still less than 2% impact. The most likely case of course is that SAMBA will make no impact because if I have to run 100+ windows servers for all my apps, why would I bother with something new and different just for 2 servers? Also you clearly don't understand the MS licensing model with virtualisation these days. My MS license covers my 8 physical ESXi servers. Whether I run 8 Windows servers or 800 it cost me the same. Also for a business that turns over hundreds of millions of dollars in revenue, $100k in licensing is not even worth worrying about. If linux people want to beat MS in the enterprise then they need to think more like business people and less like nerds looking for free stuff.

Re:No more licensing fees :)

[badkarmadayaccount]

Server side licensing?

Re:No more licensing fees :)

[somersault]

I don't really care what "enterprise" wants to do as long as I don't have to deal with MS products myself tbh.

Re:No more licensing fees :)

[hairyfish]

The way VMs are licensed these days, you license the hardware and you get unlimited VMs. ie additional MS servers cost you zero license fees

Re:No more licensing fees :)

[badkarmadayaccount]

Can you license terminal server that way? Or even the basic server edition.

Re:No more licensing fees :)

[hairyfish]

A Windows Server Data Center Edition license (licensed per socket on the hardware) allows unlimited Windows server VMs (Standard, Enterprise or Data Center). This may have changed with 2012, I haven't looked at that licensing yet. Terminal Services is a different license however you wouldn't run a Domain Controller as a Terminal Server so not so revelant in this context.

Samba Slashdotted

[sergioag]

Slashdot does it again....

Re:Samba Slashdotted

[alphatel]

Slashdot does it again....

I have a feeling that Microsoft slapped them with RIAA, MPAA and a few federal agents before anyone could finish downloading. What a shame, I got cutoff at "Active Director ".

fsck yeah!

[Netdoctor]

Oh My Gawd.

I have been waiting literally *years* for this.

This just made up for an otherwise very crappy day. No, this just fixed my whole year.

Re:fsck yeah!

[neokushan]

I'm going to take a wild stab in the dark and assume you're a sysadmin.

Re:fsck yeah!

[danomac]

Couldn't you have waited until January to say that? With only 21 days left in the year the statement doesn't have much impact!

Re:fsck yeah!

[MightyMartian]

Or he's into some really bizarre porn.

"Ooh yeah baby. That's it. Shove that NTFS ACL into a Posix ACL. Come on, harder... deeper... Oooh yeah! Map it to that sticky bit, baby! Map it!"

Re:fsck yeah!

[berashith]

its getting warm in here !

Re:fsck yeah!

[Anonymous Coward]

Only 10 days left in our lives... Say yer prayers, varmit!

Re:fsck yeah!

[Anonymous Coward]

Let's replicate, baby.

Re:fsck yeah!

[MrHanky]

Ah, POSIX porn. Most people never even thought it existed, yet there it is, already a standard.

Re:fsck yeah!

[swilly]

I'll be in my bunk.

Re:fsck yeah!

[MightyMartian]

Actually, the most disgusting part is that when I was writing it, I kept hearing the line being read by the Mad Bomber Was Bombs At Midnight.

Re:fsck yeah!

[Anonymous Coward]

I don't know what to be more afraid of - you for coming up with that or me for laughing so hard at it!

Re:fsck yeah!

[Anonymous Coward]

Well, Ballmer's head just exploded into a giant ball of fire so that could splain it.

Re:fsck yeah!

[Anonymous Coward]

omfg I came

Re:fsck yeah!

[Anonymous Coward]

Yes! I'm with you. It has been years waiting!

Re:fsck yeah!

[Anonymous Coward]

rule 34 =]

Re:fsck yeah!

[http]

Nah, probably just the more mundane cable porn.

Oh, and that's a totally safe for work link. Really.

No, really, I mean it.

Damn you, goatse, for making everybody suspicious. Nobody's going to click on that link.

Re:fsck yeah!

[Anonymous Coward]

Well, if you spend too many consecutive hours, days, and years at a location where NSFW stuff isn't allowed, I guess sysadmins have to get creative. They have powerful, compulsive urges that have to be satisfied just like everyone else, the urge to standardize being one of them.

Re:fsck yeah!

[Anonymous Coward]

Rule 34

Re:fsck yeah!

[Calabacin]

Or he's into some really bizarre porn.

"Ooh yeah baby. That's it. Shove that NTFS ACL into a Posix ACL. Come on, harder... deeper... Oooh yeah! Map it to that sticky bit, baby! Map it!"

Rule 34 at it's best haha

Re:fsck yeah!

[Anonymous Coward]

But only 9 days until the end of the world.

Re:fsck yeah!

[Anonymous Coward]

POSIX_ME_HARDER baby!

Re:fsck yeah!

[Anonymous Coward]

Rule 34 proven true again.

Re:fsck yeah!

[Anonymous Coward]

unzip;strip;touch;finger;mount;fsck;more;yes;fsck;fsck;fsck;umount;sleep

Wow

[Anonymous Coward]

I'll be interested to see the reviews on this over the next several months. I'm interested to see how well this performs under different levels of load, and how it utilized group policy. Kind of exciting in an extremely nerdy sort of way.

Re:Wow

[Anonymous Coward]

I'm trying to gather some specifics on this, but I've seen a LOT of people on the Samba mailing lists who have actually been using Samba4 in production, in some cases for several years.

What I'm interested in seeing is what appliance vendors are going to start using Samba4 in their packages. Things like FreeNAS and ClearOS and whatnot. Maybe even IBM on some of their solutions. These guys have been using Samba for 10 years or more. Now it will be interesting to see how quick they jump on the bandwagon.

Re:Wow

[tanati]

I've seen Samba4 productive since several month (based on Univention Corporate Server). It was stable and easy to use even with a few hundred clients. Thanks to the Samba-Team for the good work!

Re:Wow

[SirKron]

Time to put it into the lab until service pack 1 is released...um, wait.

Seriously, I cannot deploy this version with most of my known AD environments because:
- Replication of AD integrated DNS zones not fully supported
- DFSR not supported, NTFRS and DFS are not good enough
- The fact that I cannot have a single operating system standard for the forest/domain which governs all security, audit, and governance policies. In short, it makes AD more complex

The only advantageous deployments I can clearly understand are for a resource forest/domain where all servers in the domain are not Windows. Why? Because as soon as you add a single Microsoft Windows server which authenticates users you are required to purchase Windows Client Access Licenses for each real person or an Internet connector license.

So unless I am replacing all of the Windows servers with linux, I am not saving any money, only making the environment more complex to manage.

How does Microsoft feel about this?

[gstoddart]

I'm assuming if Microsoft could legally stop this, they would.

Likely the interfaces aren't copyrightable and this is probably a clean implementation -- but I'm sure if Microsoft could trot out a patent or something else to stop people they would.

I can't imagine they want implementations of their stuff out there. (Granted, they mostly started out by implementing other people's stuff, so there may not be much they can do about it.)

Re:How does Microsoft feel about this?

[Anonymous Coward]

How does Microsoft feel about this?

They hate it. They think it's criminal. But for the legal precedents regarding implementing public interfaces and Microsoft's criminal convictions in both the US and the EU they would sue the dickens out of everyone involved with Samba, including you.

Re:How does Microsoft feel about this?

[mcl630]

Microsoft provided them with documentation and helped them with interoperability testing. From TFA:

The Samba 4.0 Active Directory Compatible Server was created with help from the official protocol documentation published by Microsoft Corporation and the Samba Team would like acknowledge the documentation help and interoperability testing by Microsoft engineers that made our implementation interoperable.

"Active Directory is a mainstay of enterprise IT environments, and Microsoft is committed to support for interoperability across platforms," said Thomas Pfenning, director of development, Windows Server. "We are pleased that the documentation and interoperability labs that Microsoft has provided have been key in the development of the Samba 4.0 Active Directory functionality."

Re:How does Microsoft feel about this?

[Jeremy Allison - Sam]

Ahem. Microsoft provided a positive quote for the press release, and were involved in bug fixing to ensure interoperability.

So no, I don't think they hate it :-).

Jeremy.

Re:How does Microsoft feel about this?

[gstoddart]

Microsoft provided them with documentation and helped them with interoperability testing.

Well, then allow me to say ... holy crap. As much as I have a hard time believing "Microsoft is committed to support for interoperability across platforms". They haven't historically been interested in that.

Re:How does Microsoft feel about this?

[MooMooFarm]

I'm assuming if Microsoft could legally stop this, they would.

Likely the interfaces aren't copyrightable and this is probably a clean implementation -- but I'm sure if Microsoft could trot out a patent or something else to stop people they would.

I can't imagine they want implementations of their stuff out there. (Granted, they mostly started out by implementing other people's stuff, so there may not be much they can do about it.)

Well if this article is still valid, then I would say they don't mind Samba. http://linux.slashdot.org/story/08/10/23/1441200/microsoft-working-for-samba-interoperability

Re:How does Microsoft feel about this?

[ArhcAngel]

O_o

You've never seen two politicians who couldn't stand each other stand together and say nice things about one another in front of a large enthusiastic crowd?

Or are you just really bad a sarcasm?

Re:How does Microsoft feel about this?

[Xtifr]

Really? I was about to post a snarky reply when I noticed the name and the low-enough-to-be-convincing slashdot ID, so I'll make it more of a simple question.:Given that Microsoft was required to publish the documentation by the EU, and the fact that this basically proves they did comply with the courts orders, can you really be sure they don't hate it? Sure, it gets them off the hook, which is reason enough for them to have helped with the effort, but they can still hate it.

Re:How does Microsoft feel about this?

[leoxx]

Of course what you failed to mention is that Microsoft only did this because the European Commission forced them to:

December 20th 2007. Today the Protocol Freedom Information Foundation (PFIF), a non-profit organization created by the Software Freedom Law Center, signed an agreement with Microsoft to receive the protocol documentation needed to fully interoperate with the Microsoft Windows workgroup server products and to make them available to Free Software projects such as Samba. Microsoft was required to make this information available to competitors as part of the European Commission March 24th 2004 Decision in the antitrust lawsuit, after losing their appeal against that decision on September 17th 2007.

Re:How does Microsoft feel about this?

[Anonymous Coward]

Microsoft of today does not have the same dominance it had in the 1990s. Microsoft of today reminds me of IBM right before IBM took a multi-billion dollar charge and everything changed for them.

I think Microsoft (at least in some departments) can see the writing on the wall and can see how IBM had to become more flexible towards open source in order to remain relevant in a number of markets.

Re:How does Microsoft feel about this?

[Anonymous Coward]

They tried to stop this years ago but lost and settled with the SAMBA team over the remaining issues.

Re:How does Microsoft feel about this?

[Aaden42]

Wasn't Microsoft *required* by a court judgement or two to provide documentation and interoperability for several of their protocols? I don't think this was entirely out of the goodness of their hearts

See the heading "February 2008 fine" here: http://en.wikipedia.org/wiki/Microsoft_litigation

Re:How does Microsoft feel about this?

[Tailhook]

Microsoft provided them with documentation

As per European Commission order and enforced with massive punitive fines levied over a decade. It had to be beat out of them. Don't think for a moment this is volitional. They just can't tolerate any more shareholder meetings where another billion euro fine is on the agenda.

Re:How does Microsoft feel about this?

[Jeremy Allison - Sam]

In the words of Francis Urquart:

"You might think that. I couldn't possibly comment.." :-).

Re:How does Microsoft feel about this?

[Jeremy Allison - Sam]

Possibly their marketing and senior exec's hate it (although I doubt that - Thomas Pfenning is at director level in the Windows org and he think's it's pretty cool.

But I know their engineers think it's cool :-).

Jeremy.

Re:How does Microsoft feel about this?

[Anonymous Coward]

That's fine and all, but it only covers the documentation.

Now where's the court-ordered or governmentally-enforced requirement for them to help test it? It wouldn't surprise me if there isn't one. Microsoft these days isn't the old "Micro$oft" that everyone loves to hate.

Re:How does Microsoft feel about this?

[Anonymous Coward]

They can't. But they will release a new Service Pack, with "updates" that will little by little will make newer version of windows incompatible with samba 4....

Re:How does Microsoft feel about this?

[Xtifr]

But I know their engineers think it's cool :-).

Hmm, yeah, that part certainly makes sense. :)

Re:How does Microsoft feel about this?

[Frosty Piss]

Of course what you failed to mention is that Microsoft only did this because the European Commission forced them to

Perhaps this is so NOW. But it will be interesting to see what direction Microsoft takes after Steve Ballmer's departure in 2013.

Re:How does Microsoft feel about this?

[Anonymous Coward]

In 2007, MS was forced by the EU to do that, since SMB & co were based on open industry standards, and you can't just add features to those and not release the docs, because that would mean you’re doing anti-competitive "embrace, extend and extinguish" strategies, which the EU kicked MS's ass for before. Big time!

So to call the convicted serial killer (yes, if you know the whole history, you know that that is exactly what they are) named Microsoft a good guy for this, is like calling somebody a good guy because he didn't beat his kids this year, after being convicted for it, five years ago.

Re:How does Microsoft feel about this?

[Bengie]

Microsoft actually invited several of the SAMBA team over, had 2 senior engineers on hand to answer any questions they had about SMB and even gave the SAMBA team their own VM environment complete with Win7/Win8/Linux to run SMB2/3 compatibility testing. Lots of questions about RDMA, Interface teaming, and multi-pathing.

The SAMBA team said they received a lot of insight and understanding from their time with the MS engineers and were impressed and excited.

I'm not sure Microsoft is too concerned about SAMBA 4 being released.

Re:How does Microsoft feel about this?

[erroneus]

From the Groklaw article, the documentation for active directory was sold to the Samba project. The Samba project then went about using the documentation as a reference. Microsoft did not want to sell this documentation to the Samba project and were required to do so under court order. So no. They weren't all that willing to help out.

And if Microsoft starts playing "undocumented features" games again to break compatibility, they will find themselves in court again.

Re:How does Microsoft feel about this?

[AlphaWolf_HK]

Active directory is mostly built around LDAP, Kerberos, and SQL, all of which are open standards.

Re:How does Microsoft feel about this?

[erroneus]

They would not be able to protect themselves from law suits if they didn't have inside knowledge about whether or not their documentation matches the implementation. If Microsoft's documentation is not accurate, they owe the Samba team a revision. This keeps them close to their enemies and out of anti-trust court rooms.

Re:How does Microsoft feel about this?

[Bengie]

Seems the source from which I was remembering was a bit slanted. After a hair bit of digging, it seems MS was forced by the EU to work with SAMBA because of anti-trust issues.

Yes, MS is probably quaking in their shoes.

Re:How does Microsoft feel about this?

[MightyMartian]

Are you kidding? SMB/CIFS and AD/GPO is now going to be completely entrenched into the *nix world, likely killing off any potential open directory alternative. Embrace... extend... extinguish.

Re:How does Microsoft feel about this?

[Jeremy Allison - Sam]

There isn't a court-ordered requirement for them to test it. There's a market enforced requirement :-).

Go into Frys (or local Geek store). Look at all the NAS boxes on the shelf. That's all Samba. Every one.

Now imagine you're Microsoft. A new version of Windows comes out and it doesn't work against all the "home NAS media servers" people have. Ooops :-(.

They test against Samba *all the time*, as it's good for their business to do so.

They also go a little above and beyond by helping test the AD server part of Samba (which isn't in wide production use yet) - they do that in their interop labs up in Redmond.

They provide free food for the engineers working late up there. It's not as good as the free Google food (but then again, hey - what is ? :-) :-).

Jeremy.

Re:How does Microsoft feel about this?

[Anonymous Coward]

Not really. Integrated Linux clients into an AD authentication framework is a bit of a pain in the bum, because ADs view of the world is different to the POSIX view of the view, so any implementation (I.e. nslcd/pam_ldapd) goes to a lot of effort to map Microsoft-y concepts to POSIX-y concepts.

If you need a centralised authentication framework for POSIX clients, OpenLDAP or NIS+ is a better bet. The only real reason to use AD for POSIX clients is because the AAA in AD is miles above anything like OpenLDAP: I use AD for several thousand Linux clients because the auditors would never sign off on OpenLDAP, for example. Samba4 doesn't solve the AAA problem (as far as I am aware) so it's still not a drop in replacement for lots of places where AD is used for POSIX clients.

Re:How does Microsoft feel about this?

[jamesh]

Microsoft provided them with documentation and helped them with interoperability testing.

Well, then allow me to say ... holy crap. As much as I have a hard time believing "Microsoft is committed to support for interoperability across platforms". They haven't historically been interested in that.

The whole reason you would implement a Samba server is to support your Windows desktops... I know Microsoft don't make a great deal of money on each desktop OS license (vs what they make on server products) but there sure are a lot of them.

It also makes them look good in any future antitrust suit - they have a written endorsement from a competitor.

As long as doing something makes good business sense they'll do it. I don't think they are inherently evil, we just have to make sure an environment exists where _not_ being evil is good for business.

Re:How does Microsoft feel about this?

[Anonymous Coward]

Have you noticed MS gets more money from Activesync licences for iOS than any other platform? They actually make more money from patents in iOS than their own windows mobile.

Re:How does Microsoft feel about this?

[Anonymous Coward]

Open Source invented the Web.

Re:How does Microsoft feel about this?

[andydread]

Wait! didn't the samba team license access to that documentation for sum of some $10000US ?

Re:How does Microsoft feel about this?

[andydread]

Not only that but the SAMBA team had to PAY Microsoft $10,000 for access to the documentation.

Re:How does Microsoft feel about this?

[mcl630]

Of course what you failed to mention is that Microsoft only did this because the European Commission forced them to:

I answered GP's question with a simple quote from TFA. I didn't think it was necessary to go into the history of how/why Microsoft became involved.

Re:How does Microsoft feel about this?

[Anonymous Coward]

You know, for all of this kind of banter I hear from the OSS community about MS doing this, that and another thing the fact of the matter is that MS has been pretty open, it's just your bigotry that keeps the old memes alive. But I expect you'll continue to sing the same song the next time MS proves you wrong, again.

There's truth to this. Microsoft has been better in recent years. However, they have much to atone for.

Re:How does Microsoft feel about this?

[Forty Two Tenfold]

Meh, somebody fed Ballmer shrooms.

Re:How does Microsoft feel about this?

[Anonymous Coward]

You should read https://www.samba.org/samba/PFIF/PFIF_agreement.html

Re:How does Microsoft feel about this?

[tibit]

All of that is of course built on top of laws of nature, which are to be found in any half-decent technical/academic bookstore. So, what was your point, again?

For those too thick to get the point: Even products designed for exact adherence to standards sometimes fail at compliance, or you run into poorly specified corner cases, etc. That "mostly" qualifier in your sentence makes all the difference. IOW: You've never had to work with such "mostly" standards-following products. All I can tell you it's a nightmare.

Re:How does Microsoft feel about this?

[daffmeister]

You do know who you're replying to don't you?

Re:How does Microsoft feel about this?

[Anonymous Coward]

Yeah, only when several national governments worldwide held a gun to their head.
That documentation is a result of many anti-trust cases.

Re:How does Microsoft feel about this?

[dgatwood]

Go into Frys (or local Geek store). Look at all the NAS boxes on the shelf. That's all Samba. Every one.

In much the same way that every Apple TV is an OS X workstation, yes.... Given the complexity involved in even simple contact syncing between AD and other systems, I'd expect that the portions of Samba those NAS servers don't use are probably bigger than the portions they do use. And although there's a market-enforced requirement that they not break basic SMB file sharing, the market as a whole couldn't care less about Linux boxes running as AD domain controllers.

Re:How does Microsoft feel about this?

[Lennie]

Microsoft publishes the specifications of their protocols so other business and organisations can implement them, because the EU made them do so.

Re:How does Microsoft feel about this?

[Guspaz]

No, CERN invented the web, and released the relevant tools under an open source license later.

Re:How does Microsoft feel about this?

[moonflower1]

What does "AAA" mean with respect to this topic?

Re:How does Microsoft feel about this?

[Lennie]

I don't think it's true (anymore).

As an example most of the networking research, like CoDel to fight Bufferbloat, is done and implemented first on Linux.

Same for ARM64, USB3 and other things, first implementation was in Linux.

Re:How does Microsoft feel about this?

[Lennie]

Active directory does not use SQL.

Re:How does Microsoft feel about this?

[miknix]

From the Groklaw article, the documentation for active directory was sold to the Samba project. The Samba project then went about using the documentation as a reference. Microsoft did not want to sell this documentation to the Samba project and were required to do so under court order. So no. They weren't all that willing to help out.

And if Microsoft starts playing "undocumented features" games again to break compatibility, they will find themselves in court again.

Please mod parent up.

Re:How does Microsoft feel about this?

[somersault]

ActiveSync/DirectPUSH is one of the few things that MS has done right on mobile. It helped to get rid of Blackberries, so that's fair enough. RIM make MS look like tech Jesus.

Re:How does Microsoft feel about this?

[shutdown -p now]

The points are not contradictory. I would imagine that the whole exercise was indeed forced by EU court deal, but once it was to be done, the actual engineers that worked with Samba folk could well provide a lot of insight and understanding etc. You'd be surprised about how much the companies become pedantic and thorough about cooperating when being accused of not doing so can result in major (on the order of billions) fines. No-one wants to be that guy whom they can point at and say, "we got fined a billion dollars today because he didn't answer the questions properly".

Re:How does Microsoft feel about this?

[somersault]

I don't think you're trolling there, but I don't think you can speak for the "market" in its entirety. If SAMBA 4 works as advertised, it would be dumb to not care. At any level.

Re:How does Microsoft feel about this?

[SmurfButcher Bob]

Seeing how MS is in a fight for its life to stay relevant on the enterprise side... and knowing that a linux stack will likely happen on every enterprise they're in... having a good interop is a good thing for them.

If the linux boxes I deploy do NOT talk nicely with my MS stuff... it is MS that loses value, not the little toasters I'm deploying. The game is about Apple and Oracle. Apple and Oracle are things that compete against MS in many areas. Linux is something MS can allow to fill voids they don't cover, without giving traction to the two competing for-profits.

Re:How does Microsoft feel about this?

[Dr_Barnowl]

That's how all open source works.

Someone writes software. It's copyright is owned by them.

It's not open source code until it's distributed under a open source license.

Open source doesn't invent anything. People invent things, and give them to other people as open source.

I'm sure commercial software copies ideas from other software just as much as open source does.

Re:How does Microsoft feel about this?

[myowntrueself]

Of course what you failed to mention is that Microsoft only did this because the European Commission forced them to

Perhaps this is so NOW. But it will be interesting to see what direction Microsoft takes after Steve Ballmer's departure in 2013.

What? Is he getting hit by an asteroid??

Re:How does Microsoft feel about this?

[Xtifr]

I dunno. There's a big difference between the dreams of controlling the web, which I think MS probably realizes is out of reach, at least for the moment, and the dreams of controlling the office LAN, which still seems to be very much a part of MS's plans.

All the Linux server farms have gotten by without AD just fine, so interoperability there is clearly not crucial, and I doubt we'll see all that many deployments of Samba on the existing farms. It's the IT department and their internal networks that are going to be affected here, and I have a hard time believing that MS is really all that happy about this erosion of their control over that domain.

On the other hand, the license fees they get from the intranet servers is probably miniscule compared to the license fees they get from all those desktop boxes running Windows+Office, so maybe they really do see this as more good than bad, on the whole. And, of course, they'll still presumably be selling Exchange servers and whatnot.

Re:How does Microsoft feel about this?

[Anonymous Coward]

I think you will find that Microsoft is smart enough to know that Samba4 is specifically designed to operate in a windows based environment - this will not migrate the user base off windows, it will merely allow some organizations to enhance infrastructure which they probably already have in place. As such it will not be seen as a competitive risk to the windows platform as a apple based solution would be targeted at migrating the user base off windows. So ultimately this type of product strengthens windows position in the market place.

Re:How does Microsoft feel about this?

[Anonymous Coward]

Authentication, authorization and accounting. Specifically, Open Source implementations tend to fail the last one.

Re:How does Microsoft feel about this?

[19thNervousBreakdown]

Authentication (who are you), Authorization (what are you allowed to do), and Accounting (what did you do).

Re:How does Microsoft feel about this?

[dgatwood]

Not trolling, just cynical. To better explain my logic, I'm going to break down the market by segment.

A sizable chunk of the PC market is bought by individuals. I suspect that exactly none of them care about AD except for the folks who are sysadmins for their day job. Therefore, this will have essentially no effect on those sales.

The majority of the remainder are PCs purchased by businesses. Within that market segment, the vast majority are for use by an individual. These are purchased by businesses to get a job done. The job requires Windows, so they buy Windows. If the Linux servers can't support AD, the people making the purchasing decisions tell the IT folks, "Find a way," and the Windows boxes get purchased anyway. Thus, the availability of Linux-based AD servers is unlikely to result in additional purchases of these machines, either.

That leaves the tiny fraction of a percent of computers that are being purchased to serve as domain controllers. Within that narrow space, for all but the largest and/or most tech-savvy organizations, most of them buy a Windows Server box, because they have a single IT person who already has to support Windows, so why bother adding a second OS into the mix?

By the time you ignore all the purchases that are absolutely guaranteed to be unaffected by this, you're down to probably tens of thousands of machines worldwide that are purchased for use as domain controllers... out of somewhere on the order of 140 million computers sold. So yeah, the computer market as a whole doesn't care. And although the business IT market cares a bit, it doesn't care enough to dump Microsoft on the desktop, hence their caring doesn't actually matter all that much.

Re:How does Microsoft feel about this?

[gmueckl]

Hardware support isn't a good example. These guys really want to sell their fancy new electronics and the software changes are just a necessary inconvenience. With the Linux kernel developers taking any driver source code they can legally get their hands on and running with it, it's easy for hardware devs to write a first driver that's good enough to be accepted into the kernel and let others maintain it from there. With Windows you have to update your drivers for (almost) each new OS release that gets released. There's usually no other developer ready to do it for you without sending you the bill afterwards.

With good new software it's different. There are few OSS applications that started as open source and pioneered in some field. The more specific and specialized an application or tool gets, the less interest is there and the more the relevant OSS project(s) is out for just copying some of the good commercial software. I don't like to admit it, but in many fields the commercial software guys have the advantage and they push hard to keep it. For example, I haven't yet seen an OSS project that hired a couple of full time researchers in order to get an edge on the competition.

Re:How does Microsoft feel about this?

[Anonymous Coward]

microsoft won't stop it even if they can... at least NOT NOW..

they will wait for a few large companies to implement and then bury them (and the project) in the ground

Re:How does Microsoft feel about this?

[ArhcAngel]

I had a few hints...yes

Nudge, Nudge, Wink, Wink

Re:How does Microsoft feel about this?

[abartlet]

I do have to say, the AD interop labs were some of the most fun I've had in IT. And yes, it was great having the food brought in as we worked late into the night, night after night.

The best bits were being able to work side-by-side with their engineers solving some of the trickiest parts of the puzzle, or working over the results of running their testsuite. These things made Samba much better, and I'm happy to say how much we appreciate these opportunities.

Andrew Bartlett
Samba Team

Re:How does Microsoft feel about this?

[Anonymous Coward]

You might think that it is a wonderful bit of Free software, but anyone using it has their network ready to have a "real AD" server dropped in by some company tool.
If OTOH you have a working LDAP setup, no one wants to suggest a stressful and expensive migration.

Re:How does Microsoft feel about this?

[AlphaWolf_HK]

My point? Well, there's nothing for them to really copyright or sue over, as GP conjectured.

Also, they fully comply with those standards (and DNS too, by the way.) When I say mostly, I mean they have added some things beyond those, like forests, FSMO, GPO's, and others.

Re:How does Microsoft feel about this?

[Anonymous Coward]

All of which is, of course, marketing boilerplate and, as is the rule with such things, complete and utter nonsense.

At best, AD mimics LDAP, has some cursory association with SQL, and has their own implementation of Kerberos which does not effectively pair up with pretty much anyone else's implementation. But otherwise, yes, that is and has always been correct information. :)

Re:How does Microsoft feel about this?

[somersault]

If the Linux servers can't support AD

You'd only need a Windows box to administer the rest to start with, but better tools will be made - the current Windows administrative tools may actually work on WINE I suspect. If not, I'll consider making some myself. Which probably means that someone more involved is already on the case :p

Re:How does Microsoft feel about this?

[Anonymous Coward]

They probably originally did. But as others have pointed out, the cat's out of the box, there are two many Samba-installations out there, including in their customer's homes as NAS boxes.

If they could have nipped it in the bud and stopped Samba before it really took off, they would have, but credit to Microsoft where it is due, it seems they took the sensible route here and decided they may as well be as helpful as they can, since Samba started to become relevant to them ages ago.

Re:How does Microsoft feel about this?

[Alioth]

Never ascribe to malice that which can adequately be explained by incompetence.

The reason it had to seemingly be beat out of them was because the documentation didn't actually exist. Microsoft were busy writing the documentation as fast as possible by reading the source. I'm certain that the internal documentation on Windows is (or at least was) terrible to non existent.

I have actual evidence to support this. A few years ago I was working on a bespoke product that had to basically hide Windows from the user, it was essentially a custom cash register that had to do a lot more than just sell stock items. We needed to write a full replacement GINA (the GINA is the thing that up to and including Windows XP handled the login, basically winlogon.exe loads msgina.dll, and msgina.dll contains all the stuff needed to present the user interface and get everything set up right so you log in correctly. It also handled the secure attention sequence - ie ctrl-alt-del on most people's boxes). The documentation was lightweight and that's making an understatement. The documentation only had the most basic coverage of how to write a stub GINA (i.e. continue using msgina.dll but adding some of your own authentication stuff). But we were writing a replacement GINA which basically had to do everything that msgina.dll did. In the anticipation of needing support, we had quite an expensive support contract with Microsoft, at the time I think it was on the order of US$40K per year.

When we used our support contract, we ended up talking to the actual Windows devs. It turns out they had exactly the same nearly useless Windows help file that we already had. There was *no* other documentation on the GINA within Microsoft as far as we could tell, and with such an expensive support contract, I would hope the devs weren't flat out lying to us - I suspect they were being 100% honest when they said they had no more documentation than we did (well, other than the source code). The support contract was actually pretty useless, we ended up having to reverse engineer the msgina.dll (we didn't go quite as far as disassembling it, but it wasn't far from our minds - we managed to find out enough by looking at registry and environment changes and comparing it to what our GINA was doing). A year later, we weren't entirely surprised to see the GINA documentation significantly expanded, probably written by the guys who were trying to help us as they discovered how the code worked.

Re:How does Microsoft feel about this?

[tibit]

Copyright is one thing, patents are another. The issue here would be patent infringement.

The open standards are a red herring. The truth is: you want to implement AD, you need to fork out real money ($10k in case of the Samba project), and pray they sell them to you. It doesn't matter that the base standards are open -- the MS-developed spec is what you design and implement to, not some nebulous openthisorthat, unless the MS spec includes some other standards by reference, as may be the case. As I've said, in real life even solely strict adherence to an open standard may be hard to achieve. Here we not only have a closed spec, but a spec that so far was only shaken down by one project, as far as we know (MS probably developed to a separete internal set of documents). In real life, anyone who works with standards will know that they are pretty much useless unless there's a large implementer base that participates in the standardization process. That way anything that's not clear, or where the standard diverges from leading implementation, is amended over time. Yet here we have only one project (samba) that can't really change anything in the MS spec. I'm dealing with industrial communication protocols and it usually takes well over a decade, with participation of a dozen active vendors, to arrive at a standard that's somewhat "implement and you're done". Microsoft would have needed to achieve a feat never done before for their spec/internal standard to be that good.

Sometimes the fact that there is a standard doesn't even mean that anyone who implements has much in the way of getting it right. There are standards out there where a key property of compliant implementations, a property that should be front and center in the standard, is buried in one sentence somewhere as if it was an afterthough, and if you miss it you're not compliant. It's par for the course, a way of keeping competitors at bay. Yes, technically it's an open standard, but in practice you need to cross out every sentence in the standard once you've implemented it, otherwise you'll miss something important. IETF documents are not written that way, BTW, so it's not like there's any reason to be so obtuse.

When you implement, the fact that it's "based" on open standards is wholly meaningless. Those "added" things are absolutely necessary for interoperability with AD systems. Usually, in the industry, when a standard is extended, the sole adherence to the base standard is sufficient to provide some or even most functionality. Say, a never version of the standard may give you improved synchronization across data acquisition devices. If all you have is a CIFS server, an LDAP server and a KDC, you can't interoperate with AD. You won't get reduced functionality or anything, it simply won't work at all. Microsoft's extensions aren't optional, thus any based-on-open-standards-thing is hogwash. Looks good on paper only. End of story right there.

Re:How does Microsoft feel about this?

[Anonymous Coward]

Yes and no. From what I've heard from the Samba development team, they were quite surprised at the level of real, helpful, timely cooperation they got from Microsoft. The Samba team was even able to help Microsoft write some of the documentation.

That being said, I think the original impetus was the huge interoperability court case they lost several years ago in the EU. They almost got MS Windows banned from being sold in the EU. No, I don't think Microsoft is "turning over a new leaf" in their desire to cooperate with other players in the industry, but at least in this case, they must believe it's in their best interest to support other players, as long as they are playing by Microsoft's rules in the protocols under AD. Remember -- as long as it walks and talks like an "AD" domain controller, it supports people buying more of their client licenses.

Re:How does Microsoft feel about this?

[homesteader]

Sometimes the problem with doing market analysis(armchair or otherwise) is that you may miss what people could do by focusing too much on what people have done.

3 or 4 years ago, IT dorks using Hulu and ditching their DishNetwork/DirectTV/Cable were an anomaly, today they are on the fringe, in a few years it may be the norm. Currently I have 9 functional computers in the house(FreeNAS, AppleTV, 3 Laptops and a Mac Mini, 2 iPhones, 1 DSi). On any given day, compared to the rest of my family I'm fringe in terms of numbers, anomaly in terms of interconnectedness and setup. Any time we have a family gathering at mom and dads, suddenly I'm mainstream in terms of numbers(2 Parent computers, avg 2 ipads, 5 iPhones, 2 android phones), but still anomaly in terms of interconnectedness and setup.

What's the point? The point is that home users don't care because "domain/realm authentication" (as a generalized term) isn't worth it because it's hard, not because there is nothing to be gained from it. And by hard I mean harder than a toaster. So, as far as I'm concerned, the computer market as a whole doesn't care NOW, but a robust, unencumbered implementation of a domain/realm authentication framework that supports/integrates with an industry standard and eventually makes it's way onto every $200 shared storage devices sold at your local grocery store . . . matters quite a bit.

Re:How does Microsoft feel about this?

[squiggleslash]

Why would you build something on open, well documented, standards (even with a compatible proprietary extension or two) if your intent wasn't interoperability?

Microsoft could have produced a much easier to use system if they'd gone their own way with a proprietary directory system and associated secure identification system. It wouldn't have been hard to match Kerberos and LDAP feature for feature while making something friendlier (wo=and,wo=if,wo=you,wo=think,wo=ldap,wo=can't,wo=be,wo=friendlier,wo=you,wo=haven't,wo=used,es=it)

They didn't. Microsoft chose publically available standards and built a system upon those standards. They made some minor changes that didn't actually prevent interoperability with existing servers and clients, but documented them - albeit initially only making the documentation available to people who were willing to pay for it.

I know people keep pointing at the EU ruling, but my instinct tells me that the EU merely pushed Microsoft to do what it had originally not realized it had to do, not that the EU forced Microsoft to be open about something it had intended to keep secret.

Re:How does Microsoft feel about this?

[gstoddart]

I believe that took a court order to make that happen.

Let's not pretend there's any altruism here. If Microsoft hadn't been compelled to license this, they sure as hell wouldn't have.

Re:How does Microsoft feel about this?

[AlphaWolf_HK]

Regardless, microsoft has an API specifically for this purpose, and if you read the discussions here, one of the lead samba developers has had extensive contact with both Microsoft engineers and sales people, and they all enthusiastically support it.

Consider making your posts less wordy btw, it was WOT TL,DR.

Re:How does Microsoft feel about this?

[StuartHankins]

No, he's scheduled to go on a hunting expedition with Dick Cheney.

Re:How does Microsoft feel about this?

[tibit]

That's fine, but the whole "based on open standards thing" is wholly meaningless.

Re:How does Microsoft feel about this?

[Anonymous Coward]

Have you heard about the Mono Project? Or their MVC framework that they just open sourced?

What's new?

[AlphaWolf_HK]

I did a network integration capstone course where we had linux and windows in a single active directory domain, with single sign on and all users and objects in one database. How is this different?

More power to them though, active directory is HUGE in the enterprise space. If you could integrate its security controls and policies into android tablets and smartphones, windows 8 and its lame tablet UI will never see the light of day in big business.

Re:What's new?

[bluefoxlucid]

The domain is run by Samba straight on Linux, not by an Active Directory Domain Controller on Windows 2008 Server.

Re:What's new?

[jon3k]

This didn't require a windows DC.

Re:What's new?

[X0563511]

This new Samba release is the DC.

Re:What's new?

[jon3k]

Which is why I specified "Windows DC"

Re:What's new?

[simplexion]

How did you manage Windows clients? Could you lock them down and make changes to the machine depending on who logged on?

Re:What's new?

[Anonymous Coward]

Then you didnt have active directory, you had nt style domain single sign on etc.. was all possible, even to a limited extend you could push via batch files application installs all with samba 3.

Re:What's new?

[Anonymous Coward]

Umm, yeah, that's what he said.

Maybe spend more time on reading comprehension, and less on servicing cock.

Administrative UI

[Anonymous Coward]

Does swat still suck sweaty donkey balls?

Re:Administrative UI

[Jeremy Allison - Sam]

Yes :-). That's why you can use the Windows tools to administer Samba4.0 AD server :-).

Jeremy.

Re:Administrative UI

[erroneus]

REALLY?!??!

OMG, that's huge!!

Re:Administrative UI

[Anonymous Coward]

Many thanks Jeremy! I've genuinely appreciated your work for years!

Re:Administrative UI

[Anonymous Coward]

obligatory "that's what she said"

Re:Administrative UI

[Anonymous Coward]

You might try UCS (includes Samba4 for about 1 Year now):
http://www.univention.de/en/products/ucs/screenshots/

Re:First post

[HaZardman27]

I'm not a sysadmin, but I believe the whole point is that you can avoid running Windows servers (and all the high costs associated with them) and retain communication and sharing over a non-homogeneous network.

I wouldn't jump the gun just yet

[na1led]

This might work for small networks, but what about Virtualization environments, Hyper-V, Multiple AD servers, Proxies, etc. I'm sure it's going to have limitations.

Re:I wouldn't jump the gun just yet

[Jeremy Allison - Sam]

It's just an AD server. Why would running under Virtualization environments, Hyper-V, Multiple AD servers, matter ?

Jeremy.

Re:I wouldn't jump the gun just yet

[PlusFiveTroll]

You're going to have to catch me up why Hyper-V and Visualization matter in your sentence. If your V-Server depends on AD which is on the V-Server you're going to have an issue.

http://www.vmware.com/files/pdf/Virtualizing_Windows_Active_Directory.pdf

People have already setup Samba4 and W2K8 ADs working together

http://admingeeks.blogspot.com/2011/05/samba-4-domain-controller-part-4-adding.html

The other issues are potentially a problem as there are thousands of different AD configurations out there, and all of them have not been tested.

Re:I wouldn't jump the gun just yet

[na1led]

Oh I don't know, things like OU, Group Policies, scripts, etc. How is Linux going to handle those?

Re:I wouldn't jump the gun just yet

[Xtifr]

Didn't most of that stuff already work with OpenLDAP and Kerberos? Wasn't the only remaining issue the MS-specific bits of the protocol? I mean, yes, those are questions worth asking, but you seem to be assuming the answer is no; I would tend to assume the answer is, mostly, yes.

This is not some upstart, fly-by-night system. Samba has been in heavy use in the enterprise space for many years. I've been amazed at some of the companies I've stumbled across that were using Samba servers even before the AD support was available.

Re:I wouldn't jump the gun just yet

[Anonymous Coward]

More importantly why would you have a DC function as a HyperV Host as well? That's NOT the ideal way to utilize virtualization to segregate systems. Your hypervisor should run by it's lonesome on the "host" OS.

Re:I wouldn't jump the gun just yet

[na1led]

We use Hyper-V at our work, and sometimes VMs won't start if by chance there is an issue with the DC, that's why we have multiple AD servers. Plus I doubt Samba would integrate with System Center. There is a whole list of unsupported features and known issues - https://wiki.samba.org/index.php/Samba_4.0_Whitepaper

Re:I wouldn't jump the gun just yet

[Anonymous Coward]

Oh I don't know, things like OU, Group Policies, scripts, etc. How is Linux going to handle those?

You are really doing a fantastic job at broadcasting the fact that you haven't used or even read much about Samba4. It is a *complete* Active Directory replacement and as such does ALL of the things you have mentioned.

In case you don't get it yet, if you are running a Samab4 domain controller you use exactly the same Windows-based tools to administer things like OU and group policies as you would if the domain controller was a Windows server running Active Directory.

Not sure why you even mention scripts. Client side you can do all the usual Windows fun- powershell, vbscript, batch files etc. Server side, Samba4 allows you to use Python to do almost anything.

Re:I wouldn't jump the gun just yet

[na1led]

Have you looked at all the known issues and unsupported features? Who in their right mind is going to ditch their AD server at work, in a production environment for something that isn't fully compatible. When something goes wrong, will Microsoft assist you? I think not. This is fine for small networks, those on a budget, or maybe someday when it has fully matured.

Re:I wouldn't jump the gun just yet

[bigstrat2003]

You mean things that are either essential parts of AD and can be assumed to be implemented, or things which were specifically called out in TFS as being supported? Granted: saying they support it is not the same as actually supporting it. But unless you've already installed and tested this thing, it's a bit early to be calling bullshit on their claims.

Re:I wouldn't jump the gun just yet

[Zombie Ryushu]

Samba 3+OpenLDAP+Heimdal Kerberos created what were often termed "Open Directory Services" by the Apple Crowd. They were mutant NT 4.0 Domains that had broken a bunch of the limitations of NT4, (such as multiple PDCs and levels of trusts.) provided LDAP and Kerberos, but to Windows, they were still just NT Domains to Windows. Not true ADs. XP and 2000 would disable Kerberos because it thought it was talking to NT4. Windows 7 dropped support for NT4 EXCEPT there was a special mode just for Samba 3 to work, and you had to edit the registry to get it working.

Re:I wouldn't jump the gun just yet

[Zombie Ryushu]

OUs are an LDAP Concept that even OpenLDAP supported with Samba 3.

Re:I wouldn't jump the gun just yet

[X0563511]

I think he's asking how things like group-policy would apply to linux clients.

It is a good question.

Re:I wouldn't jump the gun just yet

[Anonymous Coward]

(pats him on the back) yeah, right. People will take your word, you seem so informed about this stuff ;-)

Re:I wouldn't jump the gun just yet

[na1led]

I wouldn't. I would have my DC running as a VM, or a physical server. We also use System Center which integrates with Hyper-V and our DC. I'm almost positive System Center wouldn't work with a Linux DC.

Re:I wouldn't jump the gun just yet

[Vanders]

They wouldn't, obviously. Linux has tools like Puppet & Chef.

Re:I wouldn't jump the gun just yet

[na1led]

Maybe you've been living under a rock for some time, but Linux hasn't made much of a dent compared to Microsoft. Not that I enjoy Micro$oft's monopoly, but I doubt we will see any breaking headlines about Linux taking Microsoft anytime soon.

Re:I wouldn't jump the gun just yet

[Anonymous Coward]

Have you even read TFS?

Again: Why would running under Virtualization environments, Hyper-V, Multiple AD servers, matter for those things?

Re:I wouldn't jump the gun just yet

[Anonymous Coward]

Linux hasn't made much of a dent compared to Microsoft.

Are you insane? On the client, perhaps. On servers? All over the place. Linux runs ~50% of the web (and more than that when you consider "The Internet" as a whole). All those Cloud platforms? Those are Linux, too. Super computers? Linux. How about Mobile devices? That's pretty much Linux on top at this point, with Microsoft not even a distant 5th. Small appliances? Your WiFi router isn't running Windows, that's for sure, and I've yet to see anyone selling enterprise network equipment with Windows Server powering it.

About the ONLY place Windows still dominates is desktop & laptop clients, and arguably small businesses. That's not a big market to be in, but not as big as servers, mobile & embedded systems combined.

Re:I wouldn't jump the gun just yet

[na1led]

What I mean, is that Samba is not going to be replacing Windows AD servers anytime soon, and Linux hasn't taken away much of what Microsoft has already dominated. I know Linux is popular in many areas, but a lot of is not open source either.

Re:I wouldn't jump the gun just yet

[Anonymous Coward]

Why would we be interested in "taking" something that is in the process of destroying itself at an exponential pace, and is targeted at the dumbest and lowest life that ever touched a computer?

Linux is the opposite of that, and proud of it!

Re:I wouldn't jump the gun just yet

[jimicus]

Because getting the time reliably synchronised on virtual servers is, AFAICT, not a problem that's completely solved right now. ISTR Server 2012 actually made changes to AD to cope with this.

Re:First post

[MachineShedFred]

Because if you have several hundred VMs in an organization that do nothing but act as local domain controllers for AD, you can now not spend that money on Windows licensing and instead do it with Linux?

But I guess that wasn't incredibly obvious.

Re:First post

[Jerslan]

Because Windows isn't always the best tool for the job? Because having a diverse ecosystem of IT appliances that can all share authentication and other such services is a VERY valuable thing?

Microsoft helped

[Gazzonyx]

Stop them? Microsoft helped the Samba team. Microsoft even uses the samba torture testing framework internally for their own products as I understand it. The torture tests catch crap that their own testing wouldn't since it tries to send packets that Windows clients would never send.

The EU is still a bit angry at Microsoft (remember when they had to release all of the documentation on their implementation of the SMB protocol?) and they don't need to be stoking that flame.

Re:Microsoft helped

[AlphaWolf_HK]

By the way, if anybody asks, it IS Microsoft's intent that other non-MS clients connect to AD. They specifically built a framework and API to allow 3rd party apps add their own schema to the database and query for user permissions. A few things I've worked with that do this are VMware vCenter and Cisco ACS firewall.

And no, that isn't because the EU made them, they've been doing this since the earlier days of active directory (at least, Server 2003 has this functionality anyways.)

Re:Microsoft helped

[Anonymous Coward]

Microsoft helped the Samba team... I think you mean had their arm twisted by the EU.

Re:Microsoft helped

[moogla]

I'd like to think that the whole Active Directory ecosystem is moving in a positive direction because of efforts like these. I have no problem with the LDAP + Kerberos + DNS + "Forests" and standardized structures model that Microsoft has championed; it is a very successful, flexible, and apparently extensible model and technology stack.

Re:Microsoft helped

[Anonymous Coward]

PROTIP: http://linux.slashdot.org/comments.pl?sid=3309205&cid=42253907 (A couple of comments above yours right now.)

MS "helped" as much as somebody was "nice" because he didn't hit his kids this year, after being convicted for it, five years ago.

Coincidental timing?

[HaZardman27]

It's funny that this happens (and gets posted on Slashdot) today, not long after the announcement of the live interview with Luke Leighton, who started the Samba TNG fork.

Re:Coincidental timing?

[Anonymous Coward]

It's funny that this happens (and gets posted on Slashdot) today, not long after the announcement of the live interview with Luke Leighton, who started the Samba TNG fork.

Nothing coincidental about it- Samba4 development really took off this year (the RCs have been coming thick and fast for a while now) and the release date has been scheduled for today for some time now.

Re:Too Late

[X0563511]

Where the fuck do you think all that web-based administration plugs into, a unicorn?

Re:Too Late

[bigstrat2003]

Uh-huh. Right...

I hate to be the one to burst your bubble, but cloud-based services complement traditional computing environments, they do not replace them. If you're in certain situations (e.g., a small business with only 10 employees), the cloud can indeed be your entire IT infrastructure... but that won't work for everyone. Different needs for different organizations.

GPLv3

[psergiu]

Unfortunatelly they kept the GPLv3 licence so it will never get used in any corporation large enough to have a "normal" legal team. :-(
I looks like Microsoft "educated" most of the lawyers that GPLv3 means trouble.
So Samba will be used by either small companies where the owner/CEO is smart enough that it does not care or by Google-level companies where the engineers have a word to say.
All the rest will have their lawyers say: "GPLv3 does not allow you to use Samba to manage protected information so we better buy some proprietary software without those limitations"

Re:GPLv3

[Jeremy Allison - Sam]

Oh you mean corporations like IBM, EMC, Netgear, WDC,Google ? Yeah, the GPLv3 really scared them :-).

Listen to my presentation here:

http://www.softwarefreedom.org/podcast/2011/may/10/why-samba-switched-to-GPLv3/

to explain why GPLv3 is a *better* license for commercial use the GPLv2.

Jeremy.

Re:GPLv3

[Anonymous Coward]

GPLv3 may stop them selling samba solutions without providing the source but I'm not sure how this causes any problems with utilising it internally?

Re:GPLv3

[erroneus]

Wait, what? Tell me more. I'm dumb about these details.

Why would the GPLv3 prevent anyone from running this anywhere on any scale?

Re:GPLv3

[AlphaWolf_HK]

You seem to know a lot about Microsoft's position on Samba, are you part of the Samba team? I used to have a lot to do with Tridge during his TiVo hacking days.

Re:GPLv3

[Jeremy Allison - Sam]

Yes, I'm Jeremy Allison - the original poster. I created Samba along with tridge (he was there first, and is much smarter than me though :-). I thought that was obvious, sorry :-).

Jeremy.

Re:GPLv3

[Anonymous Coward]

Because people are morons.

Re:GPLv3

[AlphaWolf_HK]

Yeah he's a master at reverse engineering filesystems. The majority of the tools we had were based on his vplay sources. I think samba.org still hosts them, not sure though because the server isn't responding (tivo.samba.org)

Re:GPLv3

[Anonymous Coward]

I *hope* that GPLv3 not only means "trouble" for the organized crime (Content Mafia), but completely *obliterates* it!

Re:GPLv3

[daffmeister]

It was obvious to at least some of us. Perhaps the grumblers are right and /. is not what it once was.

Re:GPLv3

[Jeremy Allison - Sam]

/. is not what it was, but then again it never was :-).

I miss the .bruce.perens/bruce.perens/bruce.perens./ wars.. and the "information wants to be wiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiide" guy :-). And who could forget sig11's "will the real Bruce Perens please stand up" ?

But Tim Potter (old Samba Team member) and I loved the trolls :-).

Jeremy.

Re:GPLv3

[Anonymous Coward]

> Listen to my presentation here: [...]

It starts 9 minutes in, to save those who're interested the random babbling by the radio hosts.

Re:GPLv3

[Anonymous Coward]

Yep, thinking the same thing. Well, at least the ACs are still around.

Donkey balls.

Re:GPLv3

[psergiu]

especially the lawyers ...

Re:GPLv3

[psergiu]

Thanks ... i'll forward-it to my company's "Open Source Approval Committee" next time i'll have to get an approval for instaling GNU-licenced software.
(that's not a joke, and my company is not the only one doing this)

Re:GPLv3

[Anonymous Coward]

Hot grits. Don't forget the hot grits.

Re:GPLv3

[russg]

/. is not what it was, but then again it never was :-).

I miss the .bruce.perens/bruce.perens/bruce.perens./ wars.. and the "information wants to be wiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiide" guy :-). And who could forget sig11's "will the real Bruce Perens please stand up" ?

But Tim Potter (old Samba Team member) and I loved the trolls :-).

Jeremy.

Indeed, and the many times we were able to push over servers simply by sharing some news.
Back when the /. effect was invented.

Occasion

[DaMattster]

This kind of a momentous occasion because it represents many, many man hours of work. I think Samba 4.0 has been under development since 2003. Nine long years and the fruits of the labor have been realized.

Re:First post

[gmuslera]

The main advantage isnt price, but at the very least flexibility (having the code available may not be an advantage for you in particular, but someone else could do an improvenment on it that you could need). Security, embedding it on routers or even cellphones, freedom in general of doing with it what you need, not what Microsoft think you should, are other potentially important points.

Re:Can someone mod this gentleman up please?

[jamesh]

Can someone mod this gentleman up please?

It's a sad reflection on slashdot if it's languishing at +2. Sort it out mods!

Will do.

wait... what?

[Anonymous Coward]

How the heck can samba.org be /.'d?

It's only the linked page not the whole org, but /still/ guys...

Hmmm

[AdmV0rl0n]

I've worked for a long time in MS land. And I've had variopus open source things on the go now for many years. I'd like to congratulate the Samba team on their work. This is obviously a lot of work, and a lot of digging, and some very serious work. I personally did not like the EU stuff, and I never agreed to much of the assult on MS about lack of innovation - or many of the other smears that get tossed around.

AD remains a tremendous quantity of technology, created at cost by innovative people. I always felt it was wrong that they were some how forced to pay for their innovation and development - in the end being forced to open it up because someone else said so. And I always pondered why open source, Linux, call the other parties whatever you like failed to actually innovate a true answer. Instead - while immitation is rather a compliment, its rather telling that SMB/Samba has in many cases ended up not merely being a file sharing tech for open source to share with windows - but in fact open source to share with open source. But this is just something of a personal feeling I have. Its more a pang than a deep set feeling, and very warm congrats are still in play for the SAMBA team for making this milestone.

I am somewhat surprised thos in reading the notes:

Known Issues
============

- Replication of DNS data from one AD server to another may not work.
    The DNS data used by the internal DNS server and bind9_dlz is stored
    in an application partition in our directory. The replication of
    this partition is not yet reliable.

As I say, I've been working in the area for a long time, and my take on this is it should not have been released as a .0 release with this being unreliable. If your AD DC servers don't get this working reliably - from where I sit, thats a serious problem. For absolute clarity - I have a view on this, and that view is that DNS not being right breaks AD. If you have fundamental breakage in the area - I am loathe to see the release. I hope that reliability can be found in due course, but think it should have been solved before this release.

It is said in thread that some MS engineers are happy/impressed by this release. I don't know any AD people who would be in any way happy with DCs having a gremlin at the DNS level. It is minor on single servers, its a major on any multiple DC AD setups.

Re:Hmmm

[Anonymous Coward]

mod this guy up!

Re:Hmmm

[Lennie]

I could be wrong but, I think the bind9_dlz uses which uses samdb which is based on ldb which supports LDAP and tdb or sqlite3 as a backend.

If LDAP is supported, then I guess it doesn't matter, it can still use LDAP as the storage instead of a directory with files. Thus no replication.

I wouldn't be surprised if tdb also supports ctdb, which is clustered trivial database (it uses a cluster filesystem to store it on) thus it would also not need to replicate any files.

Samba PAID Microsoft $15,000

[andydread]

for access to the said documents that allowed interoperabliity. After Microsoft was forced by the EU to release the docs.

Why?

[cormandy]

Following in the footsteps of a failing company...

Re:No more job security :)

[Billly Gates]

I can see it all right now

Somersault: Hey, boss!

Boss: Yeah

Somersault:Remember that perfectly good working Windows infrastructure we installed that we are still paying off? Where you will lose your job if I dare sneeze near them let alone touch or change anything, and any downtime will cost the company hundreds of thousands an hour?

Boss: Yeah

Somersault: I have a brilliant idea! I was at this site called slashdot and want to make a statement about proprietary software while saving mere thousands of dollars while changing our mission critical million dollar infrastructure ...

Boss:Uh, what?!

Somersault:You see! Microsoft SUX. We are slaves to this proprietary environment that has served us fine and works perfectly and want to use this freeware called SAMBA 4, which well should do what we already have. Think about the thousands saved and I we could be all so cool and the CEO will think WOW, what brilliant IT guys we have who swear by using only free software and not what works already that is well supported, documented, and tested!! It has to be soooo much better because it is not made by Microsoft and ...

Boss:Somersault! I am having a bad day as it is shouldn't you be doing something right now? No I do not mean reading slashdot either! Pffft kids today. Oh and go get me a cup of coffee while you are at it? Finish your work and I will sign your internship papers so you can get your first IT job when you get your degree?

To prove I am not a troll, I will say AD is atrocious! The real risk is anything that changes the scheme permanently changes AD itself. THe only remedy is to use ASDI edit which most respected IT professionals will rough you up in the parking lott for doing so. It also is why the companies pay $150 an hour to pay someone to install Exchange or Sharepoint. A botched installation will adversely impact everything company wide!

That my friend is why you do not touch these things! The price is worth every penny to the money making enterprise. A small business under 20 employees does need AD as a simple server on a share will work fine. The owner can tell the user how to use it on the first day. Samba is not perfect and people who have tried to use it university environments report issues like corruption, all of the sudden passowrds not being accepted, and other glitches that the $1200 server version of Windows just keeps on working.

SAMBA is great for linux and Mac computers connecting to an enterprise network. But to replace a server or DC?! oh FUCK NO.

Microsoft Don't support Shit

[Anonymous Coward]

Sorry to point this out so bluntly, but I'm sick to death of this argument. that Microsoft is better than open source, because they offer full support to business customers. As a sys admin with 15 years under the belt, I can tell you that I have never gotten anything from Microsoft past a link to a technet support wizard that asks 4 obvious, general questions and always ends with "Sorry we cannot provide a solution to this problem, Do you find this article helpful?"

NO I FUCKIN' DON'T.

Microsoft would be the last place I would ever call if there was a critical server failure where downtime is money.

In the real world, this kind of support is provided by 3rd party Managed Service Companies who are paid separately anyways, so you might as well pay for support on a nix based system, as they are well known to be much more stable (look at your average local nix admin with his feet up knitting or making chainmail, because he's got his systems singing and cron-grepping him hourly reports about how awesome he is and why he deserves a raise, compare this you your best of breed bad ass wizard windows admin, stressed as fuck, up till 4am fixing stupid shit for peanuts)

Re:Microsoft Don't support Shit

[hobarrera]

Support doesn't always end there.
Someone once told me that a really big lab he'd worked for used 100% MS stuff. They had a special support contract with MS, and the lab also had a nuclear reactor inside.

If something went wrong - and it wasn't a user error - it would have been pretty easy to make MS liable for it. That's the main reason they kept using MS, because of liability.

Again, I belive they had a special contract, but still, for big corporations, support also includes someone to blame and grab by the balls (or wallet) in case something goes really wrong.

Re:Microsoft Don't support Shit

[Anonymous Coward]

Actually. Microsoft paid per incident server support is pretty good. Or at least I had a very pleasant experience a couple years ago, when with their help, I made a bare metal recovery from backups that did not contain a recent system state. The guy on the phone knew how to resolve all the weird error messages I was getting.

Nonetheless, in the places where I am already running Samba 3 file servers, I will be upgrading to Samba 4, and in places that are looking to upgrade aging Microsoft servers, I'll be recommending Samba.

Re:Microsoft Don't support Shit

[Anonymous Coward]

Sorry to point this out so bluntly, but I'm sick to death of this argument. that Microsoft is better than open source, because they offer full support to business customers. As a sys admin with 15 years under the belt, I can tell you that I have never gotten anything from Microsoft past a link to a technet support wizard that asks 4 obvious, general questions and always ends with "Sorry we cannot provide a solution to this problem, Do you find this article helpful?"

NO I FUCKIN' DON'T.

Microsoft would be the last place I would ever call if there was a critical server failure where downtime is money.

In the real world, this kind of support is provided by 3rd party Managed Service Companies who are paid separately anyways, so you might as well pay for support on a nix based system, as they are well known to be much more stable (look at your average local nix admin with his feet up knitting or making chainmail, because he's got his systems singing and cron-grepping him hourly reports about how awesome he is and why he deserves a raise, compare this you your best of breed bad ass wizard windows admin, stressed as fuck, up till 4am fixing stupid shit for peanuts)

Not sure how you have been in the industry for 15 years if this is your view. The problem is obviously with your lack of experience and know-how.

Re:Microsoft Don't support Shit

[hairyfish]

I can only assume you've never had a proper MS support contract as you anecdote sounds a lot like you just Google for a solution and didn't find it. We can play the anecdote game all day, I don't consider myself a best of breed anything but I manage windows systems and go home at 5pm on the dot every day. How does your theory explain this?

Re:Microsoft Don't support Shit

[dbIII]

Microsoft would be the last place I would ever call if there was a critical server failure where downtime is money.

That's exactly what I had to do when a server died and I wanted to set up a new one from backups. On hold to Microsoft for God knows how long with three levels of management standing behind me, waiting for me to get that licence and get something running so that everyone in the building could get back to work. I've made sure never to have that single point of failure (needing a new MS licence in a hurry) ever since.

Re:Microsoft Don't support Shit

[dbIII]

Some people care more about getting shit done instead of finding somebody to blame when it all goes to shit. Finding somebody legally liable for something is a very long process taking years and should not be a consideration of day to day operations, in fact it's usually nothing more than an arse covering excuse so of little or no value to an organisation as a whole.

Re:Microsoft Don't support Shit

[Anonymous Coward]

Actually you are incorrect here. It is quite possible to get timely, useful and to the point service from MS. you do however need to pay an arm and a leg.
You need a contract and then you either buy a certain number of hours per year or pay per incident (other options may exist), either way it's expensive.

Re:Microsoft Don't support Shit

[Anonymous Coward]

Funny, my experience is exactly the opposite. I've generally had very good support from MS for weird issues. 3rd party support is generally pretty good, too.

"(look at your average local nix admin with his feet up knitting or making chainmail, because he's got his systems singing and cron-grepping him hourly reports about how awesome he is and why he deserves a raise, compare this you your best of breed bad ass wizard windows admin, stressed as fuck, up till 4am fixing stupid shit for peanuts)"

I'm a Windows admin...I play games at work for about half the day....and I'm not stressed the rest of the hours.

Best windows server experience I ever had was back in the early 2000s. Windows NT 4, SP6 server. Was PDC, file server, print server, exchange server, and had an uptime over a year and a half - would have been longer, except an Exchange update came out that I had to install and reboot for.

it's all about getting a stable system from the get go.

But you seem to exemplify that "i'm a bad-ass Linux admin, i'm better than you"....well, you're not.

Re:Microsoft Don't support Shit

[jp10558]

IDK, I have no problems with my basic windows servers. I find that Server 2008R2 is very similar to our RHEL6 boxes - once you get it going, it just keeps going until you fuck with it for some reason like an upgrade of software.

And MS doesn't provide any more or less support than RedHat - if you pay for a support contract, you get the help you paid for. But as far as I can tell, you get almost nothing from any proprietary vendor just because you bought the software - you still have to pay extra for actual support.

Which is why I agree with you that buying Microsoft products because they provide support is quite naive, you buy support from a vendor because they provide support - it has nothing to do with if you bought a license.

My cheap out slow option is Technet - it gets you 2 phonecalls and unlimited forum support where actual MS reps often reply, with reasonable solutions much of the time. That only works if you can spend days on the forum, but is very cheap. Price (and hopefully support speed) go up from there.

Re:Microsoft Don't support Shit

[jp10558]

I'm not adverse to Samba 4 DCs, but what I need to know is how does this work with the 3rd party AD tools? We use Netwrix to audit and provide granular roll back to our AD and GPOs - I can't see this working with SAMBA 4 unless it provides the event log data that Netwrix grabs from the Server 2008R2 DCs...

Anyway, I'm excited in terms of new deployments, but it's not dropping in to replace Windows AD quite yet.

Re:Microsoft Don't support Shit

[NoGenius]

Amen to that brother!

Re:Microsoft Don't support Shit

[hobarrera]

You don't care about stuff like that, I don't, but the ones who pull the strings in big corporations, regrettable, do.

Re:Microsoft Don't support Shit

[Anonymous Coward]

Oh hairyfeet, what a joker, you're just a hobbyist... we're talking about bigger systems here than mom n pop shops

Re:Microsoft Don't support Shit

[dbIII]

That's probably why some places go from startup to stagnation. Other places don't. Do you really think Rupert Murdoch cares about stuff like that? With enough lawyers any amount of shit can be shrugged off or damage minimised.

Re:Too Late

[Anonymous Coward]

Actually, I was thinking it plugs into the south end of a north-bound unicorn...

Congratulations!

[inglorion_on_the_net]

Congratulations to the Samba team on this major accomplishment! Great work, everyone!

Re:No more job security :)

[somersault]

Good thing I'm the boss then :p I don't hate MS as much as when I was a student, but I'm definitely going to look into this. I'm not going to completely get rid of our Windows servers right now either. But when Server 2003 goes out of support, I expect I won't be upgrading.

I've done Windows Server and Exchange installs and upgrades without assistance. I did need help the first time I messed up Exchange I'll admit, but it's not that bad once you figure it out and do your research.

This just makes it way, way easier to provide network service redundancy (all the VMs you can eat) and simplify backup/restore procedures without paying for extra licenses. I think it's great.

AD for VMWare View?

[DeathElk]

I realise it may not be officially supported by VMWare, but does anybody know whether Samba 4.0 can be used instead of MS Active Directory with VMWare View?

Re:No more job security :)

[Jeremy Allison - Sam]

You do realize that many enterprise storage servers made by companies like IBM, Symantec, EMC, Dell etc. are or have been based on Samba code, right ?

Nah, probably not... :-). After all, you know that only Windows storage servers work with Windows clients don't you :-).

Jeremy

How long did that take 16 17 years.

[Anonymous Coward]

LOL

Existing OpenLDAP setups

[abartlet]

I agree, existing OpenLDAP sites using Samba 3.x in cooperation with a host of other packages, using the traditional LDAP directory structure deployed on many Linux oriented sites are not going to migrate to Samba 4.0 as an AD DC any time soon. The change is just as big as the change to migrate to Microsoft's Active Directory, except that we provide a tested upgrade tool to handle the Samba-essential parts.

We want this to be easier, and the tools can certainly be extended to cover other schema items, and integration of these services can improve, because many of these can work well against a Microsoft Windows AD. However, we know this is a big leap, so we continue to support existing configurations (with the existing features. (For want of a better term, we call it a 'classic' domain).

The issue isn't as much being unable to use an LDAP server as a data store (but this became more difficult as we became more like AD), as that unless we were to implement on the fly schema translation, most of the same issues would remain (assumptions about AD or traditional schema and layout between Samba and the other tools on the LDAP backend), and so the result would not have be useful anyway!

As such, the LDAP backend has been put aside as an interesting technical modal that didn't work out. If a plausible use case ever comes up, then interested developers might revive some of it (the code and some tests remain where they are not impeding development), but for now there are no plans for support of anything other than local LDB files and native replication with other AD servers.

Andrew Bartlett
Samba Team

Re:Existing OpenLDAP setups

[jimicus]

So... let's say I've got a Samba 3 setup with an LDAP backend. Windows systems are using Samba to authenticate and authorise services; Unix systems are ignoring Samba and going straight to LDAP for this.

Does this mean I can't continue to have Unix systems authenticate & authorise against an LDAP backend if I migrate to Samba 4?

Re:First post

[Anonymous Coward]

>>>The main advantage isnt price,

wanna bet?

Not Invented Here

[abartlet]

Samba uses Heimdal Kerberos precisely because we did not wish to re-invent Kerberos. We bundle a known-working copy of that in the tree, and launch the KDC inside the samba process so it behaves as a seamless part of the AD DC. We provide plugins for the things that need to be AD-specific (such as PAC handling and reading the AD Database) for the Heimdal codebase to use.

For LDAP, we took a different approach, and instead wrote our own LDAP-like database on top of tdb. LDAP is in many ways much simpler at the core, and the hard parts are all the schema rules and special cases that are AD-specific anyway, and which we have special modules to handle (on top of LDB, which remains quite lightweight). That isn't to say that this would not have been possible - indeed, Luke Howard's XAD shows it is - but just that we decided to do that part in-house. I'm quite comfortable with that choice.

Andrew Bartlett
Samba Team

Re:Not Invented Here

[Anonymous Coward]

What I would really like to know is why SAMBA4 and IPA are not integrated?

Re:Not Invented Here

[Anonymous Coward]

Did you consider bundling another LDAP server? like OpenDJ maybe?

Re:Not Invented Here

[Anonymous Coward]

Thanks, all of you did a very good job! :D /Daniel Hedblom

woo hoo.

[Anonymous Coward]

Now to create a group policy to lock down the linux machines on my network!

Re:woo hoo.

[Anonymous Coward]

Group Policy doesn't make a whole lot of sense for non-Windows hosts. Learn to use tools like Puppet or Chef.

Samba 4.0 vs 'classic' NT4 like domains on LDAP

[abartlet]

Indeed, it was seeing the limitations of the NT4 modal that held back these domains that was one of the major reasons I started on the AD DC effort for Samba. I deployed (and indeed was involved in the creation of) a mixed Heimdal/Samba/LDAP domain, and saw how the lack of Group Policy caused real issues for a large network of Windows PCs. In my specialist area of Authentication, I also saw how NTLM authentication did and did not work, particularly in the load it put on the DCs. Kerberos is a much better authentication prototcol than NTLM, and I'm glad that Samba now not only can accept Kerberos authentication, but as the Domain Controller, it can now be the KDC too!

In the same way, I saw the writing on the wall for NT4 support for a long time, and I'm just very glad that the interoperability environment changed enough in time that we were able to get changes made to Samba and Windows to allow Samba NT4-like 'classic' domains to continue, long past when NT4 DCs became not only unsupported, but deliberately broken (in the name of increased security). As you mention it still requires a registry patch however, and so with the release of Samba 4.0 as an AD DC I look forward to Samba administrators being able to deploy a 'just works' solution again, even for the latest windows versions.

Andrew Bartlett
Samba Team

DNS replication

[abartlet]

You are correct that if things were as bad as that particular paragraph sounds, then we would have a serious issue. That particular note (which I wrote) is over-cautious, and represents where we were at a few months ago. The situation is that when administrators manually attempt to replicate the DNS partition onto another DC, it is difficult to configure everything so that as well as the initial replication, updates are correctly propagated.

The good news is that now, when we are setting Samba up as a second DC, we now do this correctly at join time. From all reports, this seems to work fine, but the warning is there because I want administrators who are having issues in this area to know that some challenges may remain.

Overall, while we have great faith in our DRS replication code, and a large number of users have deployed multiple Samba DCs, we are promoting the single DC case first and foremost. Other limitations include that we cannot replicate the files in the sysvol share (where group policies reside) using native protocols (many of our production sites use an rsync script instead). We are well aware of these limitations, and try to describe them to our users.

You may feel we should have waited even longer to release, but I'm quite happy with what we have achieved, and how our production sites find it in the real world. There is always one more feature, one more bug, but I'm incredibly proud of what we have achieved with Samba 4.0

Andrew Bartlett
Samba Team

Re:DNS replication

[AdmV0rl0n]

Andrew,

Thank you for answering my comment. I re-read my comment and perhaps it came across a little harshly. This was not my intent. I believe what you guys have doe is a tremendous thing, and a very worthy achievement. It deserves respect and much kudos.

On my notes about AD. I have to live with the thing, and fundamentally the reason why I said what I said was based around the worldy fact of if things go pear shaped within an AD, in my working with it, 95% of those things going wrong get back traced to DNS problems, be that planned or unplanned, mistake or cock up, or system problem. So - it was primary why I said what I said.

When it is said that Samba* is a drop in replacement, I make the mistake that many might and assume that is the case. I am aware that the Samba team often make it clear where issues arise, but the sysvol share problem is one of the type where I sort of wish there might be a simplistic 'Things you need to be aware of and do' in areas where the drop in level isn't quite there, and where an extra step or two might be required. I suspect the greatest challenge Samba might face is the gotcha senario where people trial it and come a cropper from what might be regarded as 'drop' in level function.

I still think what you have done is excellent and I wish you well on the road you are travelling.

Now, I have one last suggestion. On a Windows machine, an AD is setup with a simplistic wizard, where standard AD questions get asked. It seems that such a wizard might be a good idea - even if at the end the wizard advised where to make additional changes. (This might give you a leg up in selling to Windows ops)

Cheers
DS
   

Re:DNS replication

[Bilbo]

...

Now, I have one last suggestion. On a Windows machine, an AD is setup with a simplistic wizard, where standard AD questions get asked. It seems that such a wizard might be a good idea - even if at the end the wizard advised where to make additional changes. (This might give you a leg up in selling to Windows ops)

Cheers DS

To some degree, this is where the vendors like ClearOS and SMB Server come in. They attempt to wrap up the AD (Samba) functionality in a neat package with easy to use "wizards" and whatnot to make something that a reasonably good (ie., non-guru) admin can set up. This is one of the things I'm trying to research now.

Re:DNS replication

[abartlet]

Now, I have one last suggestion. On a Windows machine, an AD is setup with a simplistic wizard, where standard AD questions get asked. It seems that such a wizard might be a good idea - even if at the end the wizard advised where to make additional changes. (This might give you a leg up in selling to Windows ops)

I suggest you read our HOWTO when the server recovers, because you will see that our samba-tool domain provision command does exactly that, and the HOWTO covers things from top to bottom. Samba Administrators have been deploying Samba as an AD DC for a number of years now, and they consistently point to these two things as why they find it so easy to do so.

Andrew Bartlett
Samba Team

bind9_dlz and ldb

[abartlet]

The bind9_dlz backend uses the same database as the rest of Samba, and so suffers the same features and limitations as the overall DC.

As I said in the other post, while we are concerned about this area, so far this does not appear to pose an issue in practice.

Andrew Bartlett
Samba Team

Re:Too Late

[Nivag064]

You got it all wrong!!!

You plug the Unicorn into the Administrator!

Note that according to the Lore, this can only done by a duly certified Virgin - and by implication, a Woman.

Re:If only it were samba-tng

[abartlet]

The AD DC is actually is a bunch of core libraries and services. To make things easiest for our users, the services are linked into and started up by one binary, but internally each different task ends up in a forked process (if appropriate). But we do one better, and allow this to be controlled at runtime, so with '-M single' it essentially becomes a giant state machine, and can be handled with a single gdb. Inter-process communication is via a unix domain socket based messaging system or full DCE/RPC pipes.

External processes can register specific named pipes (when, as we do by default, we use smbd as the file server, this is actually a key part of the design), or DCE/RPC server modules can be loaded (the OpenChange project provides such a module).

We could discuss if more or less of Samba's internal communication should use one design pattern or another, but what is more interesting is that without fanfare or bother, some of those ideas, implemented pragmatically rather than dogmatically, have become an essential part of how Samba is implemented. That pragmatism has then brought us the AD DC that we are so proud to announce today.

I also love that the shared libraries that we now use internally make Samba much smaller as well, reducing the disk space overhead.

Finally, a surprising amount of the code is actually in modules on ldb, our ldap-like database at the core of the system.

I know you were hoping to troll with what has been a long-running design philosophy, but when you spend the time building the system, you find the pragmatism rules the day, and we use a variety of tools to get the job done, and to get it done is a way that is most seamless to our users.

Andrew Bartlett
Samba Team

Re:If only it were samba-tng

[bluefoxlucid]

All very pretty, but "pragmatism" is what got us all our broken systems. Windows is a load of doing what's "pragmatic" because it works, and the end result is when they need to change something it really doesn't work anymore. Have you finished a Windows port of Samba yet?

Re:If only it were samba-tng

[Anonymous Coward]

you find that pragmatism rules the day

FTFY

What vendors are using Samba?

[Anonymous Coward]

You do realize that many enterprise storage servers made by companies like IBM, Symantec, EMC, Dell etc. are or have been based on Samba code, right ?

Nah, probably not... :-). After all, you know that only Windows storage servers work with Windows clients don't you :-).

Jeremy

Actually, this is a question I just got from some of my IT friends: A lot of smaller shops are (perhaps justifiably) hesitant to custom build a Samba4 based AD server, but they would be happy to run a nicely boxed solution like ClearOS or FreeNAS or some of the other "enterprise storage servers" like you mention.

My question is, has anyone gathered a list of what Linux savvy solution providers are planning to move to Samba4?

Back in July, I made a partial list for a presentation I was doing on Samba4 at a technical conference. I don't know if this list is still accurate, or if more vendors have been added, but it's a starting point:

- Restara Server (AD replacement – recent Samba beta)
- ClearOS 6.x
- The ZEG (Zero Effort Groupware) edition of SOGo
- SerNet Samba 4 Appliance
- OpenChange (Open Source Exchange replacement)
- Zentyal 3.0 Beta

Re:What vendors are using Samba?

[Bilbo]

You do realize that many enterprise storage servers made by companies like IBM, Symantec, EMC, Dell etc. are or have been based on Samba code, right ?

Nah, probably not... :-). After all, you know that only Windows storage servers work with Windows clients don't you :-).

Jeremy

Arrrgh!! I just realized that I hadn't logged in, so I'm posting this again under my /. name, not as Anonymous Coward...

Actually, this is a question I just got from some of my IT friends: A lot of smaller shops are (perhaps justifiably) hesitant to custom build a Samba4 based AD server, but they would be happy to run a nicely boxed solution like ClearOS or FreeNAS or some of the other "enterprise storage servers" like you mention.

My question is, has anyone gathered a list of what Linux savvy solution providers are planning to move to Samba4?

Back in July, I made a partial list for a presentation I was doing on Samba4 at a technical conference. I don't know if this list is still accurate, or if more vendors have been added, but it's a starting point:

- Restara Server (AD replacement – recent Samba beta)
- ClearOS 6.x
- The ZEG (Zero Effort Groupware) edition of SOGo
- SerNet Samba 4 Appliance
- OpenChange (Open Source Exchange replacement)
- Zentyal 3.0 Beta

It's like the good ole days

[Jay]

Somebody announces something awesome, and the actual developers show up in the comment thread further enhancing the awesome, and now I have to go download some stuff and try things out just for the hell of it.

It's like Slashdot Circa 1998. Crazy.

Hey you kids! Git offen mah lawn!

You're making it deliberately difficult

[Anonymous Coward]

You're doing rather like using an Citrix 486 instruction code that isn't available on any others and complaining that not all x86 code is the same.

At the level you're talking about three things

1) You have just plowed yourself into lock-in. Maybe before you do that you should have picked a cheaper option (postres or MySQL).
2) At that level, you're not going to be using MSSQL, it doesn't work well enough to use in that complex an environment
3) You shouldn't be putting your business code on your database. For the reason of lock-in and also because you're limited to those options that your chosen vendor implements, not those that you wish to use.

Re:If only it were samba-tng

[segedunum]

Too little, too late I'm afraid. Active Directory is well, well over a decade old and Samba 4's inability to sensibly reuse existing components has contributed to the ridiculous amount of time it has taken. As such the momentum that Samba 3 had has all been lost.

I know you were hoping to troll with what has been a long-running design philosophy...

Meh. Most of us would call that reality. You're late and irrelevant, something that those who seek to interoperate and compete with Microsoft never seem to get into their thick skulls. While you're ducking and covering for over a decade they're getting ahead.

Re:If only it were samba-tng

[Anonymous Coward]

Andrew Bartlett
Samba Team

Really great job!

Re:Too Late

[Anonymous Coward]

http://imgur.com/AiBKG

Re:If only it were samba-tng

[randyleepublic]

Now, if you could just fork your team and do the same thing with Exchange. BTW, Exchange, unlike AD, is in dire need of some sane re-engineering. Just look at how it handles attachments!

OpenChange

[abartlet]

OpenChange, mentioned in the summary, handles the Exchange protocols. We are very proud of the close way we work with the OpenChange team.

Andrew Bartlett
Samba Team

Re:No more job security :)

[Anonymous Coward]

Any company that locked themselves into Microsoft deserve all the pain that they get.

You would have to be pants-on-head retarded to use anything from MS.