samba - Apr 2004 - AD<->Linux: Thoughts

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have a small planning problem...

I built an environment for a customer about six (or so) months
ago based on RH8 which authenticate and mount homes from an
AD server... The Linux stuff was straigt forward - using LibNSS/LDAP
and LibPAM/{LDAP,Krb5} for authentication and samba (2.x something)
to mount the home directories.

Unfortunatly, this required the SFU (M$ 'version' of the AD4UNIX). This
was proven to be _EXTREAMLY_ unstable! We managed to get it working,
but as a long-time Linux/UNIX administrator, all I can do is shrug my
sholders for the stability of this system.... It sucks, to be frank.

But it's not much I can do about this. Windows clients are a majority,
only some of the clients are Linux...


Now, the customer seems to be bitten by the "must upgrade because
there's
newer versions" bug (as opposed to the 'standard' UNIX way -
"only upgrade
if you'r absolutly forced" I'm used to :). The Linux version this
time
is open for discussion (SuSE have been mentioned - have no opinion there).


But the SFU part is the main problem. Quite naturaly, the customer have
also grown weary about this. To many problems, to many 'unexplained'
(Doh! :) crashes.

I personaly would like to replace the AD with OpenLDAP/Kerberos V on
a Linux/UNIX box, but then we'd get into (some) trouble with the rest
of the network. There's to much softwares and services that depend on
the AD, it would be very difficult to switch.


My initial idea was to put a Samba server in between the Linux clients
and the AD, but that still needs the SFU (for the RFC2307 stuff) from
what I can tell.

Another idea would be to setup a OpenLDAP/Kerberos V/Samba box, which
will replicate (manually or automatic) any AD accounts to the 'Linux
auth server'...


Does anyone have an opinion on how to proceed, because I'm lost.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.6 <http://mailcrypt.sourceforge.net/>

iD8DBQFAhMKkmlWzPKccHgARAmCsAJ4850r2O0skXtWTMhLzlZM8y7njkACfcBy4
JUttrZSsjjrwF9Lzs19Xkug=XSym
-----END PGP SIGNATURE-----

Turbo Fredriksson wrote:

<snipped>
>Now, the customer seems to be bitten by the "must upgrade because
there's
>newer versions" bug (as opposed to the 'standard' UNIX way -
"only upgrade
>if you'r absolutly forced" I'm used to :). The Linux version
this time
>is open for discussion (SuSE have been mentioned - have no opinion there).
>  
>
<snipped>

I can't comment on your Samba problem, but as for a choice for a server, 
Gentoo makes a very nice server.
You only install packages as you need them ( security bonus ).
It's also very easy to keep the box up-to-date, so your customer will be 
able to get what he wants in terms of continual upgrades without too 
much effort on your part.
Gentoo's upgrade system is pretty cool. I assume you've heard about
it's
'portage' system and 'emerge' script, so I'll tell you about
the
lesser-known  'etc-update' script... It merges in any simple changes to 
config files that come with the version upgrade you've just done, and 
notifies you of config files with large changes that it can't deal with 
so you can decide what to do with them.
I've done everything from glibc updates to compiler updates to xfree86 
updates to apache updates with no problems as all.

Anyway, it's worth a thought if you will have to keep the box up-to-date.

-- 
Daniel Kasak
IT Developer
NUS Consulting Group
Level 5, 77 Pacific Highway
North Sydney, NSW, Australia 2060
T: (+61) 2 9922-7676 / F: (+61) 2 9922 7989
email: dkasak@nusconsulting.com.au
website: http://www.nusconsulting.com.au