-1

I'm just curious as to what is considered industry standard when it comes to doing DNS and authentication on an environment with mainly linux machines?

  • Do people use Windows DNS & Windows AD to do it all if they have at least one windows server (well - a lot might, but should they)?
  • Does ANYONE use hosts files or local only user accounts on each server?
  • What would people like Facebook/Google use for their DNS and authentication on their servers?

We have an environment where we have about 10-15 linux servers and 1-2 windows servers.

We are currently using Windows AD and Windows DNS but it doesn't seem like it's the most secure/stable/scalable way to do it for a mainly linux environment?

We use RHEL as our linux environment.

1
  • 1
    What exactly do you mean "doing DNS and Authentication" ? They're two very distinct functions. Jun 24, 2011 at 3:56

2 Answers 2

3

The most common approach would be using BIND for DNS, and then using OpenLDAP or 389 Directory Server for authentication. Linux is very different to Windows in that there is a huge ecosystem and depending on which flavour of Linux you use different products may suit better. For example, in a SUSE environment eDirectory would be used instead of Directory Server.

Using /etc/hosts is commonplace for services that need to remain up in the event that the DNS fails. For instance Red Hat Cluster Suite recommends that you add all the nodes IP addresses to /etc/hosts (it may even require this, I'm not sure). This approach is not scalable for your internal DNS and has a lot of maintenance problems as I'm sure you are aware.

Windows DNS + AD is common in environments that already have a Domain Controller infratrustructure (normally for Desktops). I have worked in a number of different Government and Corporate environments and in my experience this setup is commonplace. It makes a lot of sense if you are leveraging the Domain Controller and doing all the Windows magic stuff - if you are not and prefer more hands on management, or lower cost, Linux is the way to go.

Linux will generally outperform Windows on cheaper hardware and scale better, and very large internet sites run BIND or Directory Server, however they require experienced administrators to configure them. Technologies per se are not more secure/stable/scalable - its all in how they are configured. Both approaches have merits and pitfalls.

Google and Facebook are doing something completely different to you, on a completely different scale, and with different requirements budget etc. Best to get advice from someone who has done this successfully in a small environment.

3

Stick with the Windows stack (AD, DHCP, DNS) for authentication and for DNS and DHCP. The "not scalable/not secure/not stable" arguments no longer hold water.

1/ I presume there are Windows PCs in the environment. You want to have them in the domain, and have PC users authenticate to the domain.

2/ DNS and DHCP are pretty tightly integrated into recent versions of AD.

3/ Windows DNS and DHCP are really simple and straight-forward, and they talk to each other.

4/ It is ubiquitous. Learning it will help your career, and using it will allow the company to easily find others to manage it if needed.

To answer your specific questions:

  • Folks with Windows generally use AD for authentication. It comes with Windows Server at no extra charge.
  • A few (masochistic) folks use hosts files and only local profiles. I would run from such an environment, or fix it.
  • I suspect that Google wrote their own authentication engine, and that Facebook uses customized variant of LDAP for authentication on the web. But I wager that both have Windows domains in their offices.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .