3 ms·

I do get the political nature for this but this is really easier said than done. Desktop Linux does not have good 'enterprise' group policy support compared to

I do get the political nature for this but this is really easier said than done. Desktop Linux does not have good 'enterprise' group policy support compared to Windows. Neither does Mac. I think ChromeOS comes pretty close though. And to be honest the need for this is as big if not bigger than on Windows. To take a random example - Control + Alt + F[1-6] switches you to a terminal with no explanation of how to get back. If you are a non technical user hitting that by mistake probably means a call to IT Support which is not advantageous to say the least. In Windows you'd set a group policy to disable that kind of thing, but there isn't a clear group policy 'standard' for Linux. You'd have to write a script that patches xorg.conf to disable it. That's just one tiny example, I think there will be thousands of these small things. The other big blocker is support for Word/Excel docs. LibreOffice gets you so far there but I suspect there will be thousands (millions?) of complex docs/excel sheets with macros and what not that tend not to play ball. This is a huge job to migrate them all. Ironically this is a much bigger blocker I suspect than software itself as apart from this nearly everything is web based. It's all very doable but requires a lot of work to get right. Basically someone needs to come along with something like Omakub but for non technical users, with a central server for managing it all. I haven't really seen any polished projects for this, though maybe the 'enterprise' version of Ubuntu has this kind of stuff nailed? And perhaps this Danish project actually ends up with something very usable for this. But it is very far from just installing YOLO installing Ubuntu.

antihysteresis 1y ago
Maybe I'm just naive, but... who needs group policy when you have other tools that can accomplish the same goals? With Linux, it's possible to do periodic image-based deployment (ie roll out preconfigured, immutable core OS images to all managed machines) and then set up the FS to "overlay" any per-machine customisations on top of the base image. User files / home directories can be kept in their own partition, entirely separate from the OS image. If desired, one could even set up a system for overlaying generated customization images (based on a template) on user partitions - allowing IT to systematically override particular files in user trees with immutable versions, if they so choose. As for managing subgroups of machines which need different software/settings, or dealing with revisions? Use git to manage everything that goes into the deployed OS images. If a subgroup of machines just needs a few different configs, that can be a patchset. If the changes are more significant, it might make more sense to implement a branch. Then IT gets to control, at a fine-grained level, the update status and configuration of every machine they manage - and easily make organisation-wide changes by pushing new images, while also having the ability to cleanly roll back to an older revision of the image if showstopper regressions are found. Most likely you'd push image deltas (no sense wasting bandwidth routinely sending whole images if it can be avoided) once per diem, in the middle of the night. Once the tooling is in place, I'd imagine a system like that ought to be far slicker / more convenient, not to mention more powerful and (albeit dependent on implementation) secure than Windows' Group Policy could ever hope to be.
raxxorraxor 1y ago
You have to provide the correct distribution. Look to China as an example. That would require work to maintain, but comparatively this wouldn't make a blip on the radar in any budget, hell smaller businesses are able to afford something like this. If the distribution is set, it is easier to distribute group policies. You also might want an identity provider that distributes login configuration to all systems, an equivalent to a windows domain.

antihysteresis 1y ago

Maybe I'm just naive, but... who needs group policy when you have other tools that can accomplish the same goals? With Linux, it's possible to do periodic image-based deployment (ie roll out preconfigured, immutable core OS images to all managed machines) and then set up the FS to "overlay" any per-machine customisations on top of the base image. User files / home directories can be kept in their own partition, entirely separate from the OS image. If desired, one could even set up a system for overlaying generated customization images (based on a template) on user partitions - allowing IT to systematically override particular files in user trees with immutable versions, if they so choose. As for managing subgroups of machines which need different software/settings, or dealing with revisions? Use git to manage everything that goes into the deployed OS images. If a subgroup of machines just needs a few different configs, that can be a patchset. If the changes are more significant, it might make more sense to implement a branch. Then IT gets to control, at a fine-grained level, the update status and configuration of every machine they manage - and easily make organisation-wide changes by pushing new images, while also having the ability to cleanly roll back to an older revision of the image if showstopper regressions are found. Most likely you'd push image deltas (no sense wasting bandwidth routinely sending whole images if it can be avoided) once per diem, in the middle of the night. Once the tooling is in place, I'd imagine a system like that ought to be far slicker / more convenient, not to mention more powerful and (albeit dependent on implementation) secure than Windows' Group Policy could ever hope to be.

raxxorraxor 1y ago

You have to provide the correct distribution. Look to China as an example. That would require work to maintain, but comparatively this wouldn't make a blip on the radar in any budget, hell smaller businesses are able to afford something like this. If the distribution is set, it is easier to distribute group policies. You also might want an identity provider that distributes login configuration to all systems, an equivalent to a windows domain.