Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 9 down vote favorite
1

After working with linux for years in small networks, I've started in a company that maintains large windows networks. I know you can cobble a linux host onto an Active Directory network but is there a tidy linux-y way of handling it if you didn't have to deal with Windows hosts. Purely hypothetical.

share|improve this question

migrated from security.stackexchange.com Sep 12 '12 at 15:45

5 Answers

up vote 11 down vote accepted

The closest equivalent to Active Directory for Linux is FreeIPA. FreeIPA is made by Redhat, and provides both LDAP and Kerberos based authentication to a Linux network...

FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System). It consists of a web interface and command-line administration tools.

Bear in mind, FreeIPA is largely Redhat only, and would take a good bit of work to get up-and-running on Debian/Ubuntu/whatever...

http://freeipa.org/page/Main_Page

share|improve this answer
I think you're saying Ubuntu FreeIPA server would be hard work? Setting up a Ubuntu client should not be as difficult. – Not Now Sep 12 '12 at 17:04
i dislike the fact this is a Redhat only solution (trusting the poster on this subject, 0 experience with it), but this is definitely the closest thing to an answer to parent's question. – ItsGC Sep 12 '12 at 17:29
@ItsGC It is Redhat only on the IPA/Ldap server side. – Not Now Sep 12 '12 at 18:34
@NotNow On a client, it's easier with Redhat because there is one command that configures everything from LDAP to NTP in one step... That command does not exist on Ubuntu (AFAIK), and so you would have to do everything yourself from scratch... – Kevin Soviero Sep 12 '12 at 20:49
For anyone interested, there is this package in Ubuntu 12.04 LTS: packages.ubuntu.com/precise/freeipa-client – Kevin Soviero Sep 12 '12 at 20:56
show 1 more comment
up vote 4 down vote

LDAP is an application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

Directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

share|improve this answer
LDAP is also an integral part of Active Directory. – SvW Sep 12 '12 at 15:51
1  
Guys, I don't think he asked what LDAP was... – Ryan Ries Sep 12 '12 at 15:58
2  
LDAP is the answer for the question. I merely provided additional information about LDAP to further illustrate that. – KayakJim Sep 12 '12 at 16:04
It wasn't the answer, I was looking for a more practical, what hardware and software would you use answer. – Keith Loughnane Sep 17 '12 at 9:43
That should have been specified in your question then. – KayakJim Sep 17 '12 at 13:18
up vote 0 down vote

I have seen large networks of over a thousand Linux servers with no centralized user authentication or management. Every single server had only local accounts that all had to be maintained individually.

That makes me cringe. Something like Puppet can probably help in that department of synchronizing accounts across systems, but it won't help you join the hosts to an AD domain.

I don't believe your question is about an Active Directory equivalent for Linux, such as FreeIPA. I think your question is about integrating Linux hosts into an existing Microsoft Active Directory such that your Windows machines and Linux machines are all commingled in there in the same directory.

You already know, as you said, that the Linux hosts can be "cobbled in there." I agree with that metaphor, as it's a messy process in my opinion.

Then, there also exist professional solutions such as PowerBroker (formerly Likewise) that is install-able on your Linux hosts and makes joining them to an AD domain much more reliable. It even incorporates some group policy capabilities.

I think you're likely to see something like that in a large enterprise that wants to join its Linux machines to a Windows domain.

share|improve this answer
Title: In a large Linux only network how would you handle Authentication and User management? In the question: Purely hypothetical. He described a real situation that sparked his wondering of an hypotetical situation. He really meant "how do i manage many unix hosts the same way you would manage many windows hosts with AD"? – ItsGC Sep 12 '12 at 17:28
1  
I'm taking my ball and going home! :`( – Ryan Ries Sep 12 '12 at 17:58
1  
/hug. here is a cookie. – ItsGC Sep 12 '12 at 18:03
"if you didn't have to deal with Windows hosts" Thanks anyway Ryan. I was really wondering if there was a better linux native way of managing at least the accounts and security. – Keith Loughnane Sep 17 '12 at 9:47
There is; see my answer, and the suggestions about LDAP. – MadHatter Oct 5 '12 at 15:27
up vote 0 down vote

I would recommend OpenLDAP + Kerberos (MIT or Heimdal). It involves getting your hands a little dirtier than you would using a product like FreeIPA, but performance-wise, you can't beat OpenLDAP.

This link is really old, but it highlights some of the performance differences between OpenLDAP and 389 Directory server (included in FreeIPA):

Some Numbers: Fedora Directory Server vs OpenLDAP

Of course, I'm sure both products have improved since then. I know OpenLDAP's numbers are a lot better, especially with the new mdb memory-mapped backend.

share|improve this answer
An article so old you had to use the Wayback Machine? Well written article, but the numbers at this point would have to be considered anecdotal. – Aaron Copley Oct 5 '12 at 15:30
up vote 0 down vote

If I wasn't in a particularly security-conscious environment, I'd use NIS. It's lightweight, works on many Unices, deals well with server failure (ie, provided each client is either configured to use multiple NIS servers, or can find multiple servers by broadcast, it's robust against the failure of the currently-bound server), and has been used for years (as in, I remember configuring NIS servers in 1991) so its idiosyncrasies are pretty well understood.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.