3 ms·

I've managed Windows servers since the NT4 era, and it would never occur to me to make a public-routable domain controller. If the requirement came up, I would

I've managed Windows servers since the NT4 era, and it would never occur to me to make a public-routable domain controller. If the requirement came up, I would go to the n-th degree to make it "Internet safe", but how could you guarantee something like that!? It has dozens of protocols enabled, most of which were designed for private networks in the 1990s! Microsoft has just recently made SMB safe for the Internet (Azure File Shares), but that's just one of many protocols on a Domain Controller...

hansel_der 4y ago
i kind of share your sentiment about putting windows machines on the internet, but otoh ther are a lot of companies doing it and azure ad is almost dominant. > Microsoft has just recently made SMB safe for the Internet cifs anyone?
- jiggawatts 4y ago
  You're mixing up your products. Azure Active Directory has almost nothing in common with Active Directory, other than the name. Amongst other things, it uses HTTPS almost exclusively. CIFS is an older protocol that Linux admins use incorrectly to refer to SMB, which is the file sharing protocol used by Windows.
  - wokkel 4y ago
    MS called SMB 1.0 CIFS. <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc939973(v=technet.10) https://learn.microsoft.com/en-us/previous-versions/windows/...> . So it seems windows admins are using the old monikker.
    - jiggawatts 4y ago
      SMB 1.0 isn't even included in Windows any more. Is Linux UNIX?
Stranger43 4y ago
And yet people don't consider AD to be an dangerous legacy technology on it's own. The enterprise world have a huge problem with it's addiction to legacy Microsoft technology that Microsoft is both aware of but also unable to fully address as their modern stuff just aren't all that competitive without the legacy compatibility. And the "domain controllers" it's at the very core of this problem. In the unix ecosystem most of the old vulnerable legacy(which was never as bad as windowsNT) is actually dying out but for some reason most of the traditional wintel ecosystem seems to be partying like it's still 1999.
- iostream25 4y ago
- arminiusreturns 4y ago
  Before I made the career switch to pure GNU/Linux, back in my MSP startup days, I made good money ripping out horribly run ADs leftover from the great sysadmin layoffs of the late 2000s. Samba 4 came later and was a godsend. AD and MS in general has stockholm syndromed many people. Really and truly the problem is executives not seeing the value in hiring for their actual IT problem space. Too many companies, especially ones that are more physical and have people who like to proudly claim computer ignorance, refuse to admit that with advances in technology that IT is an integral and vital part of the business. Instead they don't even hire for positions they really need, or if they do, they hire for peanuts and get subpar gui-ninjas... and that's how you end up with a bunch of AD servers on the internet.
hackeraccount 4y ago
If your DC isn't public-routable how do you get updates?
- Dave3of5 4y ago
  Do you mean the clients connected ? Most DC's I know are firewalled from the internet basically on an internal company network. If you want to get group policy updates and suchlike you connect to the internal company network via VPN. If you are talking about how the DC itself gets updates then it has outbound access normally via a proxy server or something like that. You wouldn't put the DC on the internet that would be really insane.
  - Stranger43 4y ago
    But how then does people working from home logon to their AD joined computers? if you cannot expose the AD server to the public internet, can you then actually use windows in remote first organization? Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication.
    - robertlagrant 4y ago
      You can use Okta, AAD, etc to front your AD with OAuth2 and secure your VPN with that.
    - Dave3of5 4y ago
      > But how then does people working from home logon to their AD joined computers? I work in this exact type of environment. Your laptop is joined to the domain in office before being sent to you. You can of course logon to the laptop even though it cannot connect to the domain. You just have to connect to the VPN and domain periodically to get gp updates if there is some mandatory software it'll install when you connect. So you connect to the VPN after you logon locally. You also have to connect to the domain to change your password. > Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication. No you can logon to a computer with your domain credentials even when it's not connected to the domain.

hansel_der 4y ago

i kind of share your sentiment about putting windows machines on the internet, but otoh ther are a lot of companies doing it and azure ad is almost dominant. > Microsoft has just recently made SMB safe for the Internet cifs anyone?

jiggawatts 4y ago
You're mixing up your products. Azure Active Directory has almost nothing in common with Active Directory, other than the name. Amongst other things, it uses HTTPS almost exclusively. CIFS is an older protocol that Linux admins use incorrectly to refer to SMB, which is the file sharing protocol used by Windows.
- wokkel 4y ago
  MS called SMB 1.0 CIFS. <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc939973(v=technet.10) https://learn.microsoft.com/en-us/previous-versions/windows/...> . So it seems windows admins are using the old monikker.
  - jiggawatts 4y ago
    SMB 1.0 isn't even included in Windows any more. Is Linux UNIX?

Stranger43 4y ago

And yet people don't consider AD to be an dangerous legacy technology on it's own. The enterprise world have a huge problem with it's addiction to legacy Microsoft technology that Microsoft is both aware of but also unable to fully address as their modern stuff just aren't all that competitive without the legacy compatibility. And the "domain controllers" it's at the very core of this problem. In the unix ecosystem most of the old vulnerable legacy(which was never as bad as windowsNT) is actually dying out but for some reason most of the traditional wintel ecosystem seems to be partying like it's still 1999.

iostream25 4y ago
arminiusreturns 4y ago
Before I made the career switch to pure GNU/Linux, back in my MSP startup days, I made good money ripping out horribly run ADs leftover from the great sysadmin layoffs of the late 2000s. Samba 4 came later and was a godsend. AD and MS in general has stockholm syndromed many people. Really and truly the problem is executives not seeing the value in hiring for their actual IT problem space. Too many companies, especially ones that are more physical and have people who like to proudly claim computer ignorance, refuse to admit that with advances in technology that IT is an integral and vital part of the business. Instead they don't even hire for positions they really need, or if they do, they hire for peanuts and get subpar gui-ninjas... and that's how you end up with a bunch of AD servers on the internet.

hackeraccount 4y ago

If your DC isn't public-routable how do you get updates?

Dave3of5 4y ago
Do you mean the clients connected ? Most DC's I know are firewalled from the internet basically on an internal company network. If you want to get group policy updates and suchlike you connect to the internal company network via VPN. If you are talking about how the DC itself gets updates then it has outbound access normally via a proxy server or something like that. You wouldn't put the DC on the internet that would be really insane.
- Stranger43 4y ago
  But how then does people working from home logon to their AD joined computers? if you cannot expose the AD server to the public internet, can you then actually use windows in remote first organization? Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication.
  - robertlagrant 4y ago
    You can use Okta, AAD, etc to front your AD with OAuth2 and secure your VPN with that.
  - Dave3of5 4y ago
    > But how then does people working from home logon to their AD joined computers? I work in this exact type of environment. Your laptop is joined to the domain in office before being sent to you. You can of course logon to the laptop even though it cannot connect to the domain. You just have to connect to the VPN and domain periodically to get gp updates if there is some mandatory software it'll install when you connect. So you connect to the VPN after you logon locally. You also have to connect to the domain to change your password. > Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication. No you can logon to a computer with your domain credentials even when it's not connected to the domain.