4 ms·

Wait... so there are thousands of Windows Domain Controllers just... "on" the Internet!? What are these people thinking?

hulitu 4y ago
Everybody is on "internet" now. These people are not thinking. Just like it is normal for your average phone user to have wifi, cellular data, bluetooth and location always turned on, so it is normal for these admins to have their DC on the internet.
- jiggawatts 4y ago
  I've managed Windows servers since the NT4 era, and it would never occur to me to make a public-routable domain controller. If the requirement came up, I would go to the n-th degree to make it "Internet safe", but how could you guarantee something like that!? It has dozens of protocols enabled, most of which were designed for private networks in the 1990s! Microsoft has just recently made SMB safe for the Internet (Azure File Shares), but that's just one of many protocols on a Domain Controller...
  - hansel_der 4y ago
    i kind of share your sentiment about putting windows machines on the internet, but otoh ther are a lot of companies doing it and azure ad is almost dominant. > Microsoft has just recently made SMB safe for the Internet cifs anyone?
    - jiggawatts 4y ago
      You're mixing up your products. Azure Active Directory has almost nothing in common with Active Directory, other than the name. Amongst other things, it uses HTTPS almost exclusively. CIFS is an older protocol that Linux admins use incorrectly to refer to SMB, which is the file sharing protocol used by Windows.
      - wokkel 4y ago
        MS called SMB 1.0 CIFS. <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc939973(v=technet.10) https://learn.microsoft.com/en-us/previous-versions/windows/...> . So it seems windows admins are using the old monikker.
        jiggawatts 4y ago
        SMB 1.0 isn't even included in Windows any more. Is Linux UNIX?
  - Stranger43 4y ago
    And yet people don't consider AD to be an dangerous legacy technology on it's own. The enterprise world have a huge problem with it's addiction to legacy Microsoft technology that Microsoft is both aware of but also unable to fully address as their modern stuff just aren't all that competitive without the legacy compatibility. And the "domain controllers" it's at the very core of this problem. In the unix ecosystem most of the old vulnerable legacy(which was never as bad as windowsNT) is actually dying out but for some reason most of the traditional wintel ecosystem seems to be partying like it's still 1999.
    - iostream25 4y ago
    - arminiusreturns 4y ago
      Before I made the career switch to pure GNU/Linux, back in my MSP startup days, I made good money ripping out horribly run ADs leftover from the great sysadmin layoffs of the late 2000s. Samba 4 came later and was a godsend. AD and MS in general has stockholm syndromed many people. Really and truly the problem is executives not seeing the value in hiring for their actual IT problem space. Too many companies, especially ones that are more physical and have people who like to proudly claim computer ignorance, refuse to admit that with advances in technology that IT is an integral and vital part of the business. Instead they don't even hire for positions they really need, or if they do, they hire for peanuts and get subpar gui-ninjas... and that's how you end up with a bunch of AD servers on the internet.
  - hackeraccount 4y ago
    If your DC isn't public-routable how do you get updates?
    - Dave3of5 4y ago
      Do you mean the clients connected ? Most DC's I know are firewalled from the internet basically on an internal company network. If you want to get group policy updates and suchlike you connect to the internal company network via VPN. If you are talking about how the DC itself gets updates then it has outbound access normally via a proxy server or something like that. You wouldn't put the DC on the internet that would be really insane.
      - Stranger43 4y ago
        But how then does people working from home logon to their AD joined computers? if you cannot expose the AD server to the public internet, can you then actually use windows in remote first organization? Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication.
        robertlagrant 4y ago
        You can use Okta, AAD, etc to front your AD with OAuth2 and secure your VPN with that.
        Dave3of5 4y ago
        > But how then does people working from home logon to their AD joined computers? I work in this exact type of environment. Your laptop is joined to the domain in office before being sent to you. You can of course logon to the laptop even though it cannot connect to the domain. You just have to connect to the VPN and domain periodically to get gp updates if there is some mandatory software it'll install when you connect. So you connect to the VPN after you logon locally. You also have to connect to the domain to change your password. > Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication. No you can logon to a computer with your domain credentials even when it's not connected to the domain.
justsomehnguy 4y ago
> What are these people thinking? They don't. MOre so - they don't even know what they are doing. NB there are people on the other side of the spectrum - I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe.
- iforgotpassword 4y ago
  Which is true? Most Linux distros don't open any ports by default on a fresh install. if you don't want some port to be reachable, don't install the software that opens it? Obviously in a more involved (enterprise) setup a firewall will make sense for several reasons, but on a small server you rent for yourself to run an httpd and let's say an ircd plus ssh, what exactly do you think a firewall does for you?
  - fomine3 4y ago
    It's easy to disable firewalld and groupinstall anything. Stupid things can be done.
  - justsomehnguy 4y ago
    > don't install the software that opens it? > but on a small server you rent for yourself Bwahaha! But what if I WANT to install software that opens it? Like MongoDB for example? What could be wrong if I just install some MongoDB to run $softwarename, right? Nothing wrong could happen, yes? Read my comment at [0], I don't want to repeat it here. [0] https://news.ycombinator.com/item?id=33411185 https://news.ycombinator.com/item?id=33411185
- Gordonjcp 4y ago
  > I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe. Why would it need a firewall running?
  - iostream25 4y ago
Neil44 4y ago
Sometimes you want LDAP open to other places for auth and directory sync, ideally it should be IP restricted but some people don't do that for various reasons.
Tangurena2 4y ago
> What are these people thinking? Probably something like "hey, my nephew is a computer nerd, why not hire him instead of $EXPENSIVE_CONSULTING_COMPANY?" Followed a couple months by: "Why is our internet so slow?" and "why aren't out customers getting our emails?"

hulitu 4y ago

Everybody is on "internet" now. These people are not thinking. Just like it is normal for your average phone user to have wifi, cellular data, bluetooth and location always turned on, so it is normal for these admins to have their DC on the internet.

jiggawatts 4y ago
I've managed Windows servers since the NT4 era, and it would never occur to me to make a public-routable domain controller. If the requirement came up, I would go to the n-th degree to make it "Internet safe", but how could you guarantee something like that!? It has dozens of protocols enabled, most of which were designed for private networks in the 1990s! Microsoft has just recently made SMB safe for the Internet (Azure File Shares), but that's just one of many protocols on a Domain Controller...
- hansel_der 4y ago
  i kind of share your sentiment about putting windows machines on the internet, but otoh ther are a lot of companies doing it and azure ad is almost dominant. > Microsoft has just recently made SMB safe for the Internet cifs anyone?
  - jiggawatts 4y ago
    You're mixing up your products. Azure Active Directory has almost nothing in common with Active Directory, other than the name. Amongst other things, it uses HTTPS almost exclusively. CIFS is an older protocol that Linux admins use incorrectly to refer to SMB, which is the file sharing protocol used by Windows.
    - wokkel 4y ago
      MS called SMB 1.0 CIFS. <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc939973(v=technet.10) https://learn.microsoft.com/en-us/previous-versions/windows/...> . So it seems windows admins are using the old monikker.
      - jiggawatts 4y ago
        SMB 1.0 isn't even included in Windows any more. Is Linux UNIX?
- Stranger43 4y ago
  And yet people don't consider AD to be an dangerous legacy technology on it's own. The enterprise world have a huge problem with it's addiction to legacy Microsoft technology that Microsoft is both aware of but also unable to fully address as their modern stuff just aren't all that competitive without the legacy compatibility. And the "domain controllers" it's at the very core of this problem. In the unix ecosystem most of the old vulnerable legacy(which was never as bad as windowsNT) is actually dying out but for some reason most of the traditional wintel ecosystem seems to be partying like it's still 1999.
  - iostream25 4y ago
  - arminiusreturns 4y ago
    Before I made the career switch to pure GNU/Linux, back in my MSP startup days, I made good money ripping out horribly run ADs leftover from the great sysadmin layoffs of the late 2000s. Samba 4 came later and was a godsend. AD and MS in general has stockholm syndromed many people. Really and truly the problem is executives not seeing the value in hiring for their actual IT problem space. Too many companies, especially ones that are more physical and have people who like to proudly claim computer ignorance, refuse to admit that with advances in technology that IT is an integral and vital part of the business. Instead they don't even hire for positions they really need, or if they do, they hire for peanuts and get subpar gui-ninjas... and that's how you end up with a bunch of AD servers on the internet.
- hackeraccount 4y ago
  If your DC isn't public-routable how do you get updates?
  - Dave3of5 4y ago
    Do you mean the clients connected ? Most DC's I know are firewalled from the internet basically on an internal company network. If you want to get group policy updates and suchlike you connect to the internal company network via VPN. If you are talking about how the DC itself gets updates then it has outbound access normally via a proxy server or something like that. You wouldn't put the DC on the internet that would be really insane.
    - Stranger43 4y ago
      But how then does people working from home logon to their AD joined computers? if you cannot expose the AD server to the public internet, can you then actually use windows in remote first organization? Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication.
      - robertlagrant 4y ago
        You can use Okta, AAD, etc to front your AD with OAuth2 and secure your VPN with that.
      - Dave3of5 4y ago
        > But how then does people working from home logon to their AD joined computers? I work in this exact type of environment. Your laptop is joined to the domain in office before being sent to you. You can of course logon to the laptop even though it cannot connect to the domain. You just have to connect to the VPN and domain periodically to get gp updates if there is some mandatory software it'll install when you connect. So you connect to the VPN after you logon locally. You also have to connect to the domain to change your password. > Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication. No you can logon to a computer with your domain credentials even when it's not connected to the domain.

justsomehnguy 4y ago

> What are these people thinking? They don't. MOre so - they don't even know what they are doing. NB there are people on the other side of the spectrum - I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe.

iforgotpassword 4y ago
Which is true? Most Linux distros don't open any ports by default on a fresh install. if you don't want some port to be reachable, don't install the software that opens it? Obviously in a more involved (enterprise) setup a firewall will make sense for several reasons, but on a small server you rent for yourself to run an httpd and let's say an ircd plus ssh, what exactly do you think a firewall does for you?
- fomine3 4y ago
  It's easy to disable firewalld and groupinstall anything. Stupid things can be done.
- justsomehnguy 4y ago
  > don't install the software that opens it? > but on a small server you rent for yourself Bwahaha! But what if I WANT to install software that opens it? Like MongoDB for example? What could be wrong if I just install some MongoDB to run $softwarename, right? Nothing wrong could happen, yes? Read my comment at [0], I don't want to repeat it here. [0] https://news.ycombinator.com/item?id=33411185 https://news.ycombinator.com/item?id=33411185
Gordonjcp 4y ago
> I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe. Why would it need a firewall running?
- iostream25 4y ago

Neil44 4y ago

Sometimes you want LDAP open to other places for auth and directory sync, ideally it should be IP restricted but some people don't do that for various reasons.

Tangurena2 4y ago

> What are these people thinking? Probably something like "hey, my nephew is a computer nerd, why not hire him instead of $EXPENSIVE_CONSULTING_COMPANY?" Followed a couple months by: "Why is our internet so slow?" and "why aren't out customers getting our emails?"