Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In a small office setup (5-6 employees) we have seven Windows XP and Windows Vista clients, as well as a couple of linux servers.

Is it possible to set up a linux machine to act as the domain controller to provide single signon and AD-like capabilities for the network?

share|improve this question
add comment

7 Answers

up vote 16 down vote accepted

With the versions of Samba found in current versions of common distributions you can certainly have a Linux machine act as an NT-style domain controller (this has been the case for some time).

I believe that taking part in an AD based domain is being actively worked on but not yet ready for production use, though it isn't something I've looked at recently so the support may have moved on.

share|improve this answer
    
+1, spot on. Coming to Linux Real Soon Now(tm). –  Avery Payne Jun 21 '09 at 3:58
    
One clarification to my post: a samba as found in recent releases of Linux distributions (certainly Debian Etch+) can join an AD based domain as clients/servers, I have Linux file servers that do just that, just not act as any sort of controller on the domain. –  David Spillett Jun 21 '09 at 9:15
    
Does it actually make an NT domain controller, or just a Master Browser? –  Mark Henderson Jun 21 '09 at 11:47
    
I'm pretty sure it can be a full PDC (or BDC too if the PDC is also samba based). –  David Spillett Jun 21 '09 at 12:10
    
The current (3.x) versions of Samba make it a full NT4 style PDC. –  Avery Payne Dec 18 '09 at 22:45
add comment

Samba4 is going to be able to do that, but it's still in alpha. If you're adventurous you can play with the latest releases.

share|improve this answer
add comment

If you don't mind commercial linux software, Novell's Open Enterprise Server 2 (SP1 and later) has a component called Domain Services for Windows that'll do exactly that. Cost-wise, however, it'd probably be cheaper to purchase a Windows 2003 server and create your own AD tree. But if you really want a Microsoft-free solution OES2 will do it for you.

share|improve this answer
    
It wasn't an MS-free solution so much as a cost-free solution that I was looking for. I'll have a look through the SMB stuff, but you and mh may be right about just biting the bullet and using the OOB MS solution. –  kdmurray Jun 25 '09 at 1:23
add comment

Of course you can! Just read a bit some tutorials at samba.org Samba by example is great for a start

share|improve this answer
add comment

If the "AD-like capabilities" you want are basically group policies, I recommend looking into Nitrobit Group Policy, which allow to simulate this function in a samba domain.

I have running this in my network and it's a great piece of software, although not free.

share|improve this answer
add comment

Until Samba 4 arrives, you can use Likewise Open. We have had a great experience with this on Ubuntu. Another option that provides a lot of the advantages of AD is Novell's eDirectory. I have zero direct experience with it so I can't personally vouch, but it's something more than one of my sysadmin friends have raved about -- one using with Linux servers and an all-WindowsXP client base.

share|improve this answer
add comment

My answer is going to be "why would you want to?" You're probably far better off implementing a Windows DC; it won't cost you that much, and you'll be on a supported and more predictable environment. AD isn't difficult - there's a lot in it, but it's not difficult. So long as you don't do bizarre or wacky stuff with it, it's incredibly robust and has low maintenance overhead. If you want the Linux boxes to authenticate against it, you can set it up in Mixed Mode and it will present itself as an NT4-like DC where appropriate.

share|improve this answer
    
You make a good point. We've been looking at both options, and I'd been asked to find the most economical solution... –  kdmurray Jun 25 '09 at 1:22
add comment

protected by Iain Jan 27 '12 at 8:58

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.