Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We've implemented an LDAP to NIS solution and have begun transitioning some systems to native LDAP binding for authentication and automount maps. Unfortunately we have a very mixed environment with more than 20 *nix environments. The setup for each variant is of course unique and has required various workarounds to get full functionality. We're now at the point where we're willing to revisit the solution and possibly migrate toward something like Likewise (http://www.likewise.org), but would like to know what others are using to solve this problem.

share|improve this question
    
I think the big unnamed question hanging over people's answers here is - are you needing file services for Windows clients, aka. Samba services? If this is a pure-play *nix setup then there are a wild number of options that might work for you. I've revised my answer with some useful info... –  Avery Payne Jun 3 '09 at 4:29
    
The domain for likewise would be likewise.com, not .org. –  Martijn Heemels Jun 10 '09 at 22:43

4 Answers 4

@Avery,

This is essentially what Likewise Open does. It makes use of Kerberos (via PAM) to authenticate the user. It also provides NSSWITCH modules to perform SID->ID mapping (using various algorithms, some LDAP based, some hash based).

It has several advantages over plain old pam_krb5:

  • Support for AD "sites" including smart DC failover to the nearest DC
  • Support for offline authentication (if the network is down or you're on a disconnected laptop)
  • Automatic configuration of PAM and krb5.conf

Cheers,

Manny Vellon CTO, Likewise

share|improve this answer

I used to have 40ish Linux servers, all with local authentication. Life was hell.

I finally solved the problem by building an Active Direcotry infrastructure and implementing Likewise Open to authenticate all of my machines (plus samba, ftp, jabber, and half a dozen web apps).

Now I've got 80-100 servers all using the same authentication and my users love it (but not nearly as much as I do).

I have never once regretted using Likewise. I talked about it so much on my blog that they sent me a T-shirt!

share|improve this answer
    
How is the performance? Have you had any experience with the non-Linux variants? We've got 5,000+ hosts globally and LDAP performance has been lacking. –  Matt Jun 2 '09 at 16:03
    
Our performance has been very good. The only minor quibble that I have is that I find myself occasionally clearing the cache after a user's information changes in the directory. It sounds like your infrastructure is a little more advanced than mine ;-) –  Matt Simmons Jun 2 '09 at 16:20

We have "solved" the problem by standardizing on RHEL/CentOS. That solves a boatload of other portability problems as well.

As for LDAP, we use it too, but the interface between ldap and NSS is far from perfect (same goes for any other network service). If I had the time, I'd look into deploying nsscache instead of nss_ldap. Or maybe even replace pam_ldap and nss_ldap with winbind, to better integrate with our windows environment (likewise is a variant of winbind, no?).

share|improve this answer
    
I'm jealous, I wish we could solve the problem in that way. –  Matt Jun 2 '09 at 17:11

many companies are using Likewise and it is working very well. We had around 20 Servers using native users and we moved to Likewise and life is a lot simpler.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.