0

Our company runs mostly linux server but mostly windows clients.

I'm looking for a solution that would allow all of our web applications to have a login portal (and once you're logged in you don't have to log into the next application) plus have the same username and password for server logins and email log ins.

The other concern is permissions. An idea setup would allow me to give people different access rights for different resources. So for example people that have Administrative rights for Source control don't aren't able to login as root on the linux servers.

Currently the root password is the same on all the linux servers, and we do not use public keys for SSH (I know I should it is something I'm researching)

I know that Exchange requires the use of ActiveDirectory, so I'm wondering if there is a solution that would allow me to add all of those features on top of ActiveDirectory.

I've done a bit of research and this will probably deal with the web portal for our web apps. I'm still at a loss for the rest however.

I know this is asking a lot, I just want to get a feel for what's out there.

Improve this question
1
  • Product and service recommendations are off topic on SF per the FAQ.
    – sysadmin1138 ♦
    Jan 15, 2012 at 3:33

2 Answers 2

Reset to default
1

I think you are on the right track there. We have a very similar setup, although we also have a fair few Windows server in the mix. And our user base is 70% Linux (mostly Debian) and 30% MS Windows.
We use Active Directory for (almost) everything. ADS has an LDAP interface built-in, and there are client libraries available for user authentication on Linux machines (you will need the Windows Services for Unix).
You can add "Application" entities to your Active Directory, and then define specific security groups within these. Then configure the various clients to use these groups to gain very fine grained control over access to your various applications and portals. (use the "AD Users and Groups" plugin on a Windows domain controller to do this).
You can user the above linux libraries (foremost libnss-ldap and pam_ldap) together with some changes to your PAM configuration to enable Windows user accounts on Linux servers (this can also be linked through Kerberos, which will allow linux users to update their AD passwords and their local passwords at the same time).
If you need more info, let me know and I can forward a whole raft of sample files on how to make this work. Works a treat for us.

Improve this answer
0

CAS is a nice solution

Improve this answer

Not the answer you're looking for? Browse other questions tagged .