Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There's a Windows network of about 60 workstations I am going to be responsible for. The network is in a terrible mess, so I decided to rebuild it from the ground up. Currently, there are some Windows Server installations running, one of which takes the role of a Primary Domain Controller (PDC). I do not have any experience with Windows domains, so I would like to run Debian servers instead.

So I started looking for tools that would allow me to use Debian as PDC. It seems that Samba can take care of central authentication and authorization of users.

I have rewritten this post several times and settled on the following list of services I need, put in simple words:

  • I need to tell who can do what on the workstations. I believe that this is called Local Policy Management in the Windows world.

  • I need to share printers and files over the network.

  • I need to keep a list of users and their groups somewhere. I would like to be able to tell that "users who belong to group G have the following set of rights".

  • As we are a high school, there are hundreds of accounts created every few months and hundreds are deleted at the same time. If I could store all this information about users, groups and permissions in MySQL tables, that would be great.

  • I would like to be able to specify which scripts should run after the user has logged in, on a per-user basis (to map network folders, to connect printers and the like).

  • I need to run some elementary network security, such as Radius, and a PXE boot server that will provide different installation images for different machines based on their MAC address.

Samba seems to be a full-blown alternative to the Windows PDC and I do not quite like that. Would it be possible to use Samba with, for example, pGina? Is there any way to force Samba to read information about users and groups from a MySQL database? How do I use Samba to enforce Local Policy Management?

I know this is a lot of questions, but I am not looking for complete answers. I would love to get some basic overview of how these - very common, I believe - requirements can be met.

Thanks a lot!

share|improve this question

closed as too broad by Wesley, Rex, Ward, mdpc, Falcon Momot Apr 17 '14 at 23:22

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

What you're doing in heading down a route that will bring you nothing but pain, heartache and absolutely no sympathy from any support personnel. While you can join a Microsoft PC to a non-Windows Domain, there are few scenarios when this is actually a good idea.

So, basically, what I'm saying is - don't do this. Build a Windows Server Domain Controller, not a Linux one.

share|improve this answer
I have to agree with Dan. While it is possible to do what you are trying to do, I would not recommend it considering you are managing a bunch of windows boxes. I would imagine that you cannot manage Group Policy from a Linux domain controller, which seems like it might be a good thing to have considering the setup you have described. – Richie086 Apr 17 '14 at 19:47

Do not even bother trying to use an old-style domain. No reason.

Samba 4 running as an Active Directory Domain Controller is a perfectly viable setup that works without problems. We have it running in quite a few locations now without problems.

There is support for group policies, and the various management tools from Windows work for managing the users, directory, GPOs, etc.

Don't get crazy about putting users into a MySQL database - why would you need to do such a thing? AD/LDAP is already a directory that can store all this information.

share|improve this answer
The problem I am trying to solve is that we have a lot of system for which I would like to use a single username and password (for the domain account, for lunch ordering, student printing, class registrations). I have no idea how I can query AD for this information about students from these varios systems, while MySQL is a straightforward solution that I "see into". – David Apr 17 '14 at 14:49
Why not put the accounts for student into AD? Group membership into AD? That's already a perfectly sensible place to put it. Nearly everything already knows how to talk to AD. Seriously, use an existing, perfectly sensible solution rather than trying to roll your own. – MikeyB Apr 17 '14 at 14:55
Fair enough, this makes sense :). – David Apr 17 '14 at 14:57
Samba 4 is available in Debian jessie, or wheezy-backports. Don't use anything prior to Samba 4. – Michael Hampton Apr 17 '14 at 18:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.