4 ms·

Its been a very long time since I was a Sysadmin, but I'm curious what managing a fleet of Linux desktops is like today? Has it vastly improved? When I last tr

Its been a very long time since I was a Sysadmin, but I'm curious what managing a fleet of Linux desktops is like today? Has it vastly improved? When I last tried in a small pilot program, it was incredibly primitive. Linux desktops were janky and manual compared to Active Directory and group policy, and an alternative to Intune/AAD didn't even seem to exist. Heck, even things like WSUS and WDS didnt seem to have an open version or only had versions that required expensive expert level SME'S to perform constant fiddling. Meanwhile the Windows tools could be managed by 20 year old admins with basic certitifcations. Also, GRC and security seemed to be impossible back then. There was an utter lack of decent DLP tools, proper legal hold was difficult, EDR/AV solutions were primitive and the options were limited, etc. Back then it was like nobody who had ever actually been a sysadmin had ever taken an honest crack at Linux and all the hype was coming from home users who had no idea what herding boxen was actually like.

finchisko 11mo ago
I really don’t get why there’s always this group of people who feel the need to constantly manage everything for others—like sysadmins, for example. Sure, there are valid scenarios where management makes sense, like printing or shared drives, but most of the stuff is just over the top. As a developer, I’m sick of all the constant restrictions—broken VPNs, stealth monitoring, and antivirus software that slows everything down. These "security measures" are supposed to help, but they just kill performance and cause frustration. At the end of the day, I just want my system to work smoothly without constant interference.
- mapontosevenths 11mo ago
  > I’m sick of all the constant restrictions I think everyone hates it, but they're often legally required. Even when they aren't legally required, they usually are by insurance companies. Nobody wants to be on the news the first time Becky in Marketing opens an email attachment she shouldn't. *EDIT* I left out one of the biggest benefits: Dummies & Newbs. The world is filled with people who have never used a mouse before they started this job Last week and people who actually NEED the stupid warning stickers on their toasters. If you don't lock down their desktops your support costs will be astronomical and downtime will be constant. We know this because there was a time before these tools, and it largely sucked for everyone. Did you know that you can bypass the windows 98 login screen by just clicking 'Cancel' instead of 'OK' at the login prompt? Nice and simple, right? That stupid button not only wrecked security it caused 10's or 100's of thousands of hours in lost work because people forgot their passwords, clicked Cancel, and then would call the help desk wondering why network shares didnt work. It would sometimes take hours to figure that all they had to do was reset the password and login properly.
Nextgrid 11mo ago
This is my concern with all those "success" stories about Linux as an enterprise desktop OS. Run it for 10 years and show me the actual cost savings/improved productivity. Microsoft is trash and is getting worse day by day, but at the very least it's the same trash everyone has to deal with, so people mostly got used to the smell, and you can get economies of scale in tools used to deal with said smell. MS is trash because of incompetence. Linux is dozens of different flavors of trash, so you don't even get economies of scale dealing with it. It's trash because of ideology - the people involved would often reject the functionality you mentioned for ideological reasons, and even for those who do accept them, won't agree on the implementation meaning you now have a dozen of different flavors, and will take up arms if someone tries to unify things (just look at the reaction to systemd). Linux works well for careers where shoveling trash is already part of your work, in which case all the effort doubles as training for the job and experience makes this a non-issue. But for non-IT careers where the computer is just a tool that is expected to work properly, it's nowhere near there, and will never get there because everyone's instead arguing on the definition of "there" and which mode of transportation to use getting there.
- deleted 11mo ago
  [deleted]
- morshu9001 11mo ago
  Google gave its employees a Linux laptop option for well more than 10 years, but in the past few years they started steering everyone away from it, before formally announcing they want to scale it back. This is despite them being a tech company, and despite them having already invested in their single Linux flavor (gLinux). Wayland migration was also a pain.
  - Lapel2742 11mo ago
    I'm not an expert and that still might be the case but you have to understand that for many Microsoft as an American company is simply no longer an option for critical infrastructure. It's a matter of trust.
  - pjmlp 11mo ago
1718627440 11mo ago
I think this comes primarily from trying to add a separate management tool on top, instead of leveraging the OS structure themself. There is a reason, why most directories are specified to be readonly. Also writable XOR persistent is mostly true. The only things required to be writable are /tmp, /var and /home. /tmp is wiped at least on every boot or is even just a ramdisk. /var can be cached or reset to the predefined settings on boot. /home needs to be managed, that is true. But you wouldn't want every users directory on every host anyway, instead you want to populate them on login. That is typically done by libpam. /usr is expected to be shared among hosts, host-specific stuff goes into /usr/local for a reason, and as a sysadmin you can decide to simply not have host specific software. EDR/AV is basically unnecessary, when you only mount things either writable or executable. And you don't want the users to start random software or mount random USB-sticks anyway. > Back then it was like nobody who had ever actually been a sysadmin had ever taken an honest crack at Linux and all the hype was coming from home users who had no idea what herding boxen was actually like. Unix has over 50 years of history of being primarily managed by sysadmins instead of home users. While Linux is not Unix, it has inherited a lot. The whole system is basically designed to run a bunch of admin configured software and is actually less suitable for home users. I would say the primary problem was accessing it with a Windows mindset.
- mapontosevenths 11mo ago
  > EDR/AV is basically unnecessary, No, its not and never will be. Even if it were technically unnecessary (in some hypothetical future where privilege escalation became impossible?), legal, compliance, and insurance requirements would still be there.
  - 1718627440 11mo ago
    The problem is that EDR is basically a rootkit, by using it you enable a huge attack surface instead of being able to have stuff e.g. immutable. That tradeoff only makes sense, when you don't trust and control the OS itself. This is more of a problem with proprietary OSes like Windows. Otherwise you would rather integrate this into the OS itself.
Lapel2742 11mo ago
AFAIK they use Open-Xchange, Univention Corporate Server and other specialized (maybe customized?) an open solutions for telephony, interoperability and other tasks. https://euro-stack.com/blog/2025/3/schleswig-holstein-open-source-digital-sovereignty https://euro-stack.com/blog/2025/3/schleswig-holstein-open-s...
- mapontosevenths 11mo ago
  I've never used it. Does this actually replace AD and group policy effectively? Does it manage updates properly? Can it handle compliance tasks? I've used other things that claimed to in the past and none came anywhere close in practice. They all turned out just to be LDAP with some NT4 style policies for windows and very little at all for the Linux clients. It was like traveling back in time to the Windows 2000 era of management.
  - Lapel2742 11mo ago
    > Does this actually replace AD and group policy effectively? I do not know. They probably evaluated the solution before they made the decision. In any case, continuing to use AD seems out of the question. Relying on US based software in 2025 and beyond is simply not a viable option for any administration that values its sovereignty. The US isn’t even hiding its hostility.
  - switknee 11mo ago
    There never will be a 1 for 1 replacement because the two systems have different approaches. Why would you want a direct replacement when you could have something better? GPOs are a windows thing and don't apply to other systems. The generic equivalent is configuration management, for which there are many solutions. Linux updates are much easier than windows updates, and many linux systems now use immutable and atomic updates by default, which further reduces risk. For directory, openLDAP just does LDAP. DNS is done with Kea or Unbound. Fundamentally the issue is a lack of familiarity. The only way to become familiar with a system is... to use it.
einpoklum 11mo ago
I would disagree with you both about the past and the present and what's "janky", but - that's actually beside the point: LibreOffice works just fine on _Windows_ - and that's what the majority of its users are running. So, Schleswig-Holstein can switch to Linux, or not switch, or let specific agencies or individuals choose.

finchisko 11mo ago

I really don’t get why there’s always this group of people who feel the need to constantly manage everything for others—like sysadmins, for example. Sure, there are valid scenarios where management makes sense, like printing or shared drives, but most of the stuff is just over the top. As a developer, I’m sick of all the constant restrictions—broken VPNs, stealth monitoring, and antivirus software that slows everything down. These "security measures" are supposed to help, but they just kill performance and cause frustration. At the end of the day, I just want my system to work smoothly without constant interference.

mapontosevenths 11mo ago
> I’m sick of all the constant restrictions I think everyone hates it, but they're often legally required. Even when they aren't legally required, they usually are by insurance companies. Nobody wants to be on the news the first time Becky in Marketing opens an email attachment she shouldn't. *EDIT* I left out one of the biggest benefits: Dummies & Newbs. The world is filled with people who have never used a mouse before they started this job Last week and people who actually NEED the stupid warning stickers on their toasters. If you don't lock down their desktops your support costs will be astronomical and downtime will be constant. We know this because there was a time before these tools, and it largely sucked for everyone. Did you know that you can bypass the windows 98 login screen by just clicking 'Cancel' instead of 'OK' at the login prompt? Nice and simple, right? That stupid button not only wrecked security it caused 10's or 100's of thousands of hours in lost work because people forgot their passwords, clicked Cancel, and then would call the help desk wondering why network shares didnt work. It would sometimes take hours to figure that all they had to do was reset the password and login properly.

Nextgrid 11mo ago

This is my concern with all those "success" stories about Linux as an enterprise desktop OS. Run it for 10 years and show me the actual cost savings/improved productivity. Microsoft is trash and is getting worse day by day, but at the very least it's the same trash everyone has to deal with, so people mostly got used to the smell, and you can get economies of scale in tools used to deal with said smell. MS is trash because of incompetence. Linux is dozens of different flavors of trash, so you don't even get economies of scale dealing with it. It's trash because of ideology - the people involved would often reject the functionality you mentioned for ideological reasons, and even for those who do accept them, won't agree on the implementation meaning you now have a dozen of different flavors, and will take up arms if someone tries to unify things (just look at the reaction to systemd). Linux works well for careers where shoveling trash is already part of your work, in which case all the effort doubles as training for the job and experience makes this a non-issue. But for non-IT careers where the computer is just a tool that is expected to work properly, it's nowhere near there, and will never get there because everyone's instead arguing on the definition of "there" and which mode of transportation to use getting there.

deleted 11mo ago
[deleted]
morshu9001 11mo ago
Google gave its employees a Linux laptop option for well more than 10 years, but in the past few years they started steering everyone away from it, before formally announcing they want to scale it back. This is despite them being a tech company, and despite them having already invested in their single Linux flavor (gLinux). Wayland migration was also a pain.
- Lapel2742 11mo ago
  I'm not an expert and that still might be the case but you have to understand that for many Microsoft as an American company is simply no longer an option for critical infrastructure. It's a matter of trust.
- pjmlp 11mo ago

1718627440 11mo ago

I think this comes primarily from trying to add a separate management tool on top, instead of leveraging the OS structure themself. There is a reason, why most directories are specified to be readonly. Also writable XOR persistent is mostly true. The only things required to be writable are /tmp, /var and /home. /tmp is wiped at least on every boot or is even just a ramdisk. /var can be cached or reset to the predefined settings on boot. /home needs to be managed, that is true. But you wouldn't want every users directory on every host anyway, instead you want to populate them on login. That is typically done by libpam. /usr is expected to be shared among hosts, host-specific stuff goes into /usr/local for a reason, and as a sysadmin you can decide to simply not have host specific software. EDR/AV is basically unnecessary, when you only mount things either writable or executable. And you don't want the users to start random software or mount random USB-sticks anyway. > Back then it was like nobody who had ever actually been a sysadmin had ever taken an honest crack at Linux and all the hype was coming from home users who had no idea what herding boxen was actually like. Unix has over 50 years of history of being primarily managed by sysadmins instead of home users. While Linux is not Unix, it has inherited a lot. The whole system is basically designed to run a bunch of admin configured software and is actually less suitable for home users. I would say the primary problem was accessing it with a Windows mindset.

mapontosevenths 11mo ago
> EDR/AV is basically unnecessary, No, its not and never will be. Even if it were technically unnecessary (in some hypothetical future where privilege escalation became impossible?), legal, compliance, and insurance requirements would still be there.
- 1718627440 11mo ago
  The problem is that EDR is basically a rootkit, by using it you enable a huge attack surface instead of being able to have stuff e.g. immutable. That tradeoff only makes sense, when you don't trust and control the OS itself. This is more of a problem with proprietary OSes like Windows. Otherwise you would rather integrate this into the OS itself.

Lapel2742 11mo ago

AFAIK they use Open-Xchange, Univention Corporate Server and other specialized (maybe customized?) an open solutions for telephony, interoperability and other tasks. https://euro-stack.com/blog/2025/3/schleswig-holstein-open-source-digital-sovereignty https://euro-stack.com/blog/2025/3/schleswig-holstein-open-s...

mapontosevenths 11mo ago
I've never used it. Does this actually replace AD and group policy effectively? Does it manage updates properly? Can it handle compliance tasks? I've used other things that claimed to in the past and none came anywhere close in practice. They all turned out just to be LDAP with some NT4 style policies for windows and very little at all for the Linux clients. It was like traveling back in time to the Windows 2000 era of management.
- Lapel2742 11mo ago
  > Does this actually replace AD and group policy effectively? I do not know. They probably evaluated the solution before they made the decision. In any case, continuing to use AD seems out of the question. Relying on US based software in 2025 and beyond is simply not a viable option for any administration that values its sovereignty. The US isn’t even hiding its hostility.
- switknee 11mo ago
  There never will be a 1 for 1 replacement because the two systems have different approaches. Why would you want a direct replacement when you could have something better? GPOs are a windows thing and don't apply to other systems. The generic equivalent is configuration management, for which there are many solutions. Linux updates are much easier than windows updates, and many linux systems now use immutable and atomic updates by default, which further reduces risk. For directory, openLDAP just does LDAP. DNS is done with Kea or Unbound. Fundamentally the issue is a lack of familiarity. The only way to become familiar with a system is... to use it.

einpoklum 11mo ago

I would disagree with you both about the past and the present and what's "janky", but - that's actually beside the point: LibreOffice works just fine on _Windows_ - and that's what the majority of its users are running. So, Schleswig-Holstein can switch to Linux, or not switch, or let specific agencies or individuals choose.