5 ms·
SSSD+LDAP is what we use in 2020. If you have an existing Active Directory backend you can use that. You can also do the reverse, which is an OpenLDAP or FreeIP
by nineteen999 6y ago
SSSD+LDAP is what we use in 2020. If you have an existing Active Directory backend you can use that. You can also do the reverse, which is an OpenLDAP or FreeIPA backend on Linux and use pGina to authenticate Windows boxes if needed.
We do this at work, and have everything from Windows desktops, Linux desktops and servers, and almost all our 3rd party applications using the same accounts and passwords.
- guerby 6y agoPlus one for pGina, a really nice piece of software, login auth on your LDAP, then script mounts of drive if any and you avoid having a full Active Directory. I was listening at a conference call about security in my area of work and someone said that 100% of the pen-tests done in the past year on various entities got full control of the Active Directory. At the conference call I mentionned that we do without AD and with pGina, the senior security officer said it was not a bad idea when possible :).
- nineteen999 6y agoYeah a full AD doesn't make sense for us, as we only have a handful of Windows VM's and the rest is Linux. But if you're running an environment with 100's or 1000's of Windows desktops/servers you're probably stuck with AD if you want to be able to manage that lot.
- egberts1 6y agoDoes that include AUTO-login on all systems? (That’s what I’ve been trying to do but cannot edit my original comment to reflect that).
- nineteen999 6y agoYou can store SSH keys in LDAP if you wish, which would enable fairly automated SSH logins if you're running ssh-agent on the client side. If it's for a home system where you want to be able to log in to everything without an SSH key or password, that sounds like kind of a bad idea.