3 ms·

I really only have experience administering windows AD desktop - mostly LDAP/GPO/DNS, some Share and thankfully no Print I would really like some comparison fr

by jve 4y ago

I really only have experience administering windows AD desktop - mostly LDAP/GPO/DNS, some Share and thankfully no Print I would really like some comparison from administration effort: 1. How easy it is to tie those things together? Like installing that Linux AD server components 2. How easy from deployment POV it is to join computers to network and start using a networked user account? 3. How easy it is to use print server connected to domain? 4. How easy it is for member servers within domain to start accepting SSO connections from those clients/servers? 5. How easy it is to have centralized configuration for linux host and target them? I mean using Linux tools as I suppose linux env won't have gpmc.msc. Let's say you would like all your client hosts, all software to talk TLS1.2+ only. 6. How easy would it be to establish internal certification authority with certificate auto renewal? I'm aware of paid solutions, but just from marketing material, so no clue how it behaves in real life and how far it goes. Please don't assume I'm starting flamewars. I just see a great value within Windows AD environment that is easy to set up but as we see from article, takes effort to configure and maintain secure and consistent environment. My experience with Linux is limited in domain area, and I haven't been familiar with centralized configuration options - I just want to see if it takes 1x/2x/10x effort to do the same in Linux env.

neurostimulant 4y ago
OpenLDAP and Keycloack have docker images that can be used to deploy them pretty easily, at least if you're comfortable with container-based deployment. I knew nothing about both and able to deploy them in a few hours. Connecting individual servers / applications to OpenLDAP and Keycloack varies widely though, not all apps has OIDC support but you can put them behind an authenticating proxy like oauth2-proxy. Can't comment on how easy it would be to join desktops and print servers though as I never did it myself.
prmoustache 4y ago
It is really complicated to answer. There are things that are super easy. For example samba is a real dropin replacement for an AD, you can join windows computer to it very easily. Similarly, the bigger distros all have easy setup to enable joining a linux desktop to an Active Directory for auth. I have used centralized configuration management tool such as puppet, cfengine, saltstack and ansible for years. I did the exercise of managing desktops with them and it was fairly easy. Hey I even deployed windows servers with foreman and puppet. But for you it might be a nightmare to have to learn a new domain specific language.
- jve 4y ago
  > But for you it might be a nightmare to have to learn a new domain specific language. Not particularly for me :) Just seeing value proposition for Windows AD - in Linux world, you have to glue together different and competing things for good or worse IDK, but windows just bring that integrated experience OOTB. But good that there exist options in Linux world. It is probably twice++ the effort to manage Lin along Win desktops, so I see why corps don't bother... because you still have to have those windows boxes. And that translates into MS AD for easy management and vast, better or worse, talent pool. I see Windows corps, where appropriate, deploy Linux Servers within infra, for example webservers as that translates into saving $. Samba, yeah, it just really works and good that we have it. But it is only a part in corporate management toolbox. Even MS Active Directory is a part in corporate management toolbox as you still need something like InTune to manage endpoint installs, still some parts must be scripted, monitored, etc.

by jve 4y ago

neurostimulant 4y ago

OpenLDAP and Keycloack have docker images that can be used to deploy them pretty easily, at least if you're comfortable with container-based deployment. I knew nothing about both and able to deploy them in a few hours. Connecting individual servers / applications to OpenLDAP and Keycloack varies widely though, not all apps has OIDC support but you can put them behind an authenticating proxy like oauth2-proxy. Can't comment on how easy it would be to join desktops and print servers though as I never did it myself.

prmoustache 4y ago

It is really complicated to answer. There are things that are super easy. For example samba is a real dropin replacement for an AD, you can join windows computer to it very easily. Similarly, the bigger distros all have easy setup to enable joining a linux desktop to an Active Directory for auth. I have used centralized configuration management tool such as puppet, cfengine, saltstack and ansible for years. I did the exercise of managing desktops with them and it was fairly easy. Hey I even deployed windows servers with foreman and puppet. But for you it might be a nightmare to have to learn a new domain specific language.

jve 4y ago
> But for you it might be a nightmare to have to learn a new domain specific language. Not particularly for me :) Just seeing value proposition for Windows AD - in Linux world, you have to glue together different and competing things for good or worse IDK, but windows just bring that integrated experience OOTB. But good that there exist options in Linux world. It is probably twice++ the effort to manage Lin along Win desktops, so I see why corps don't bother... because you still have to have those windows boxes. And that translates into MS AD for easy management and vast, better or worse, talent pool. I see Windows corps, where appropriate, deploy Linux Servers within infra, for example webservers as that translates into saving $. Samba, yeah, it just really works and good that we have it. But it is only a part in corporate management toolbox. Even MS Active Directory is a part in corporate management toolbox as you still need something like InTune to manage endpoint installs, still some parts must be scripted, monitored, etc.