I have Windows and Linux clients and I want to provide Active Directory authentication for both but keeping DHCP and DNS on Linux servers. Is this possible ? I have very little experience in administration and I'm kind of lost here on how I should implement this so it all works together.
What is the best way to do this ? I'm free to choose linux distributions and windows server version as long as it's 2003 or more recent
I have Windows and Linux clients and I want to provide Active Directory authentication for both but keeping DHCP and DNS on Linux servers. Is this possible?
It's really a PITA to use Linux servers for AD DNS, since AD and DNS are so tightly integrated. You can do it, but good luck getting support. What I would recommend is pointing all of your clients and servers to the AD DNS servers for DNS and putting a global forwarder on your AD DNS servers to point to your Linux servers that host the rest of your infrastructure. As long as your AD namespace doesn't overlap with an existing namespace (it shouldn't), this will work just fine.
I'm free to choose linux distributions and windows server version as long as it's earlier than 2003
Um. If I were you, I wouldn't do this at all with this restriction. This leaves you with Windows 2000, which won't install on most modern hardware (no drivers, etc). It's also end-of-life meaning that there are zero patches of any kind.
"I really have to leave DNS and DHCP on the Linux servers" Why?
Sep 16, 2012 at 16:58
The main issue you are going to have is making ActiveDirectory happy with the DNS as AD uses DNS for its service location protocol (via the SRV record type). However, using Linux DNS and DHCP (i.e. the BIND DNS server and the standard dhcpd daemon) in large-scale Microsoft environments is fairly easy to support and there are a number of large Microsoft customers who do insist on using the Unix services for DNS and DHCP.
For DHCP, you will want to make sure that you are passing all the options required in your environment. As options vary considerably, I will leave you to the mercy of Google, although there is a nice Microsoft Technet article that will give you the basics ( http://technet.microsoft.com/en-us/library/cc958929.aspx ). Just make sure you have dhcpd configured to serve the mentioned parameters appropriate to your environment (and an okay dhcpd tutorial can be found at https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-dhcp-configuring-server.html)
DNS is the more important part. All servers in your organization should have proper forward (A record) and reverse (in-addr.arpa record) lookup entries. Additionally, each Windows server will want several service (SRV) entries to let clients know which services can be found on that server. You can go about creating server entries in two ways. The first way is to create them yourself manually, and you can find a fairly good discussion of that by Googling "Active Directory BIND DNS" (for example http://technet.microsoft.com/en-us/library/dd316373.aspx and http://itsjustanotherlayer.com/2009/11/running-20008-active-directory-with-bind/ are the top two searches).
There is another way, however, that I recommend. Before you set up the Windows servers, I would give their IP addresses the right to write and update entries in your Linux BIND DNS server. Then, when you set up (or refresh) your Windows servers, make sure that under the advanced networking control panel you specify the domain suffix and check the box to have the server try to update its entry. Thereafter, the server will attempt to create its own entries in DNS for any services that are configured on it. In theory this is a security hole, since you are letting a server that may be compromised write arbitrary DNS records. In practice, however, we have found that it makes maintenance of AD much, much simpler.
You will likely also want to set up Dynamic DNS (DDNS), which allows dhcp servers to pass on client hostnames to the DNS server to be added as forward and reverse entries. A failry good tutorial on that can be found at http://www.semicomplete.com/articles/dynamic-dns-with-dhcp/
Once you understand the DNS and DHCP concepts you are working with, having AD configured via Linux DNS and DHCP is not hard, and easy to maintain. On the whole, though, I wish that Microsoft hadn't shoehorned service discovery into DNS and had used an actual service protocol like SLP.
