6

There's a Windows network of about 60 workstations I am going to be responsible for. The network is in a terrible mess, so I decided to rebuild it from the ground up. Currently, there are some Windows Server installations running, one of which takes the role of a Primary Domain Controller (PDC). I do not have any experience with Windows domains, so I would like to run Debian servers instead.

So I started looking for tools that would allow me to use Debian as PDC. It seems that Samba can take care of central authentication and authorization of users.

I have rewritten this post several times and settled on the following list of services I need, put in simple words:

  • I need to tell who can do what on the workstations. I believe that this is called Local Policy Management in the Windows world.

  • I need to share printers and files over the network.

  • I need to keep a list of users and their groups somewhere. I would like to be able to tell that "users who belong to group G have the following set of rights".

  • As we are a high school, there are hundreds of accounts created every few months and hundreds are deleted at the same time. If I could store all this information about users, groups and permissions in MySQL tables, that would be great.

  • I would like to be able to specify which scripts should run after the user has logged in, on a per-user basis (to map network folders, to connect printers and the like).

  • I need to run some elementary network security, such as Radius, and a PXE boot server that will provide different installation images for different machines based on their MAC address.

Samba seems to be a full-blown alternative to the Windows PDC and I do not quite like that. Would it be possible to use Samba with, for example, pGina? Is there any way to force Samba to read information about users and groups from a MySQL database? How do I use Samba to enforce Local Policy Management?

I know this is a lot of questions, but I am not looking for complete answers. I would love to get some basic overview of how these - very common, I believe - requirements can be met.

Thanks a lot!

2 Answers 2

12

What you're doing in heading down a route that will bring you nothing but pain, heartache and absolutely no sympathy from any support personnel. While you can join a Microsoft PC to a non-Windows Domain, there are few scenarios when this is actually a good idea.

So, basically, what I'm saying is - don't do this. Build a Windows Server Domain Controller, not a Linux one.

1
  • 1
    I have to agree with Dan. While it is possible to do what you are trying to do, I would not recommend it considering you are managing a bunch of windows boxes. I would imagine that you cannot manage Group Policy from a Linux domain controller, which seems like it might be a good thing to have considering the setup you have described.
    – Richie086
    Apr 17, 2014 at 19:47
9

Do not even bother trying to use an old-style domain. No reason.

Samba 4 running as an Active Directory Domain Controller is a perfectly viable setup that works without problems. We have it running in quite a few locations now without problems.

There is support for group policies, and the various management tools from Windows work for managing the users, directory, GPOs, etc.

Don't get crazy about putting users into a MySQL database - why would you need to do such a thing? AD/LDAP is already a directory that can store all this information.

4
  • The problem I am trying to solve is that we have a lot of system for which I would like to use a single username and password (for the domain account, for lunch ordering, student printing, class registrations). I have no idea how I can query AD for this information about students from these varios systems, while MySQL is a straightforward solution that I "see into".
    – David
    Apr 17, 2014 at 14:49
  • 1
    Why not put the accounts for student into AD? Group membership into AD? That's already a perfectly sensible place to put it. Nearly everything already knows how to talk to AD. Seriously, use an existing, perfectly sensible solution rather than trying to roll your own.
    – MikeyB
    Apr 17, 2014 at 14:55
  • Fair enough, this makes sense :).
    – David
    Apr 17, 2014 at 14:57
  • 1
    Samba 4 is available in Debian jessie, or wheezy-backports. Don't use anything prior to Samba 4. Apr 17, 2014 at 18:30

Not the answer you're looking for? Browse other questions tagged .