12

After working with linux for years in small networks, I've started in a company that maintains large windows networks. I know you can cobble a linux host onto an Active Directory network but is there a tidy linux-y way of handling it if you didn't have to deal with Windows hosts. Purely hypothetical.

0

5 Answers 5

14

The closest equivalent to Active Directory for Linux is FreeIPA. FreeIPA is made by Redhat, and provides both LDAP and Kerberos based authentication to a Linux network...

FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System). It consists of a web interface and command-line administration tools.

Bear in mind, FreeIPA is largely Redhat only, and would take a good bit of work to get up-and-running on Debian/Ubuntu/whatever...

http://freeipa.org/page/Main_Page

7
  • I think you're saying Ubuntu FreeIPA server would be hard work? Setting up a Ubuntu client should not be as difficult.
    – Not Now
    Sep 12, 2012 at 17:04
  • i dislike the fact this is a Redhat only solution (trusting the poster on this subject, 0 experience with it), but this is definitely the closest thing to an answer to parent's question.
    – ItsGC
    Sep 12, 2012 at 17:29
  • @ItsGC It is Redhat only on the IPA/Ldap server side.
    – Not Now
    Sep 12, 2012 at 18:34
  • @NotNow On a client, it's easier with Redhat because there is one command that configures everything from LDAP to NTP in one step... That command does not exist on Ubuntu (AFAIK), and so you would have to do everything yourself from scratch...
    – Soviero
    Sep 12, 2012 at 20:49
  • For anyone interested, there is this package in Ubuntu 12.04 LTS: packages.ubuntu.com/precise/freeipa-client
    – Soviero
    Sep 12, 2012 at 20:56
4

LDAP is an application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

Directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

5
  • LDAP is also an integral part of Active Directory.
    – Sven
    Sep 12, 2012 at 15:51
  • 1
    Guys, I don't think he asked what LDAP was...
    – Ryan Ries
    Sep 12, 2012 at 15:58
  • 2
    LDAP is the answer for the question. I merely provided additional information about LDAP to further illustrate that. Sep 12, 2012 at 16:04
  • It wasn't the answer, I was looking for a more practical, what hardware and software would you use answer. Sep 17, 2012 at 9:43
  • That should have been specified in your question then. Sep 17, 2012 at 13:18
0

I have seen large networks of over a thousand Linux servers with no centralized user authentication or management. Every single server had only local accounts that all had to be maintained individually.

That makes me cringe. Something like Puppet can probably help in that department of synchronizing accounts across systems, but it won't help you join the hosts to an AD domain.

I don't believe your question is about an Active Directory equivalent for Linux, such as FreeIPA. I think your question is about integrating Linux hosts into an existing Microsoft Active Directory such that your Windows machines and Linux machines are all commingled in there in the same directory.

You already know, as you said, that the Linux hosts can be "cobbled in there." I agree with that metaphor, as it's a messy process in my opinion.

Then, there also exist professional solutions such as PowerBroker (formerly Likewise) that is install-able on your Linux hosts and makes joining them to an AD domain much more reliable. It even incorporates some group policy capabilities.

I think you're likely to see something like that in a large enterprise that wants to join its Linux machines to a Windows domain.

5
  • 1
    Title: In a large Linux only network how would you handle Authentication and User management? In the question: Purely hypothetical. He described a real situation that sparked his wondering of an hypotetical situation. He really meant "how do i manage many unix hosts the same way you would manage many windows hosts with AD"?
    – ItsGC
    Sep 12, 2012 at 17:28
  • 2
    I'm taking my ball and going home! :`(
    – Ryan Ries
    Sep 12, 2012 at 17:58
  • 2
    /hug. here is a cookie.
    – ItsGC
    Sep 12, 2012 at 18:03
  • "if you didn't have to deal with Windows hosts" Thanks anyway Ryan. I was really wondering if there was a better linux native way of managing at least the accounts and security. Sep 17, 2012 at 9:47
  • There is; see my answer, and the suggestions about LDAP.
    – MadHatter
    Oct 5, 2012 at 15:27
0

I would recommend OpenLDAP + Kerberos (MIT or Heimdal). It involves getting your hands a little dirtier than you would using a product like FreeIPA, but performance-wise, you can't beat OpenLDAP.

This link is really old, but it highlights some of the performance differences between OpenLDAP and 389 Directory server (included in FreeIPA):

Some Numbers: Fedora Directory Server vs OpenLDAP

Of course, I'm sure both products have improved since then. I know OpenLDAP's numbers are a lot better, especially with the new mdb memory-mapped backend.

1
  • An article so old you had to use the Wayback Machine? Well written article, but the numbers at this point would have to be considered anecdotal. Oct 5, 2012 at 15:30
0

If I wasn't in a particularly security-conscious environment, I'd use NIS. It's lightweight, works on many Unices, deals well with server failure (ie, provided each client is either configured to use multiple NIS servers, or can find multiple servers by broadcast, it's robust against the failure of the currently-bound server), and has been used for years (as in, I remember configuring NIS servers in 1991) so its idiosyncrasies are pretty well understood.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .