5 ms·

As probably one of the more AD-focused participants on HN, I have to approach this with a good dose of skepticism w.r.t. large companies adopting Samba for comp

by sk5t 14y ago

As probably one of the more AD-focused participants on HN, I have to approach this with a good dose of skepticism w.r.t. large companies adopting Samba for complex AD environments. AD + DFSN + (DFSR|NTFRS) + LDAP + SSL + RPC + NTP + GPO + CIFS + NTFS + SDDL + WMI + ADWS + etc., is an extremely complex set of stuff to implement, and the cost of supporting a third-party version could, IMHO, easily dwarf the cost of a few Windows licenses to run the domain controllers. So many examples come to mind that it is hard to pick just one or two... consider an organization that configures access to Windows event logs (audit trails) and SMB signing requirements via GPO; will Samba 4 Domain Controllers honor that? What does it even mean to have access to modify the security auditing policy on a Samba DC without totally reimplementing the eventing system (syslog is not even close)? In other words, AD sits on top of a ton of mature but sophisticated Windows services, the failure of any of which could be a critical problem, and make for a tough sell unless one has a pathological hatred of Microsoft yet still wishes to use AD anyway.

tptacek 14y ago
... and if you have enough control over your environment to replace Windows Server as a domain controller, why would you be using the AD stack to begin with?
- sk5t 14y ago
  Aye, if one has that much motivation to chuck Windows for AD, then it's only logical that Windows on the desktop, Exchange, etc., are not on the scene. I've done a lot of work with other directory servers too, and AD does the best job of any when it comes to multimaster replication and a few other things. However, using it purely for LDAP for an environment full of Linux and OS X machines is a tough call...
  - rufugee 14y ago
    Why? I have such motivation, yet I have no intent on eliminating Windows from our desktops. That would be very disruptive to our 2.5K users, and Windows does a pretty decent job there. However, AD is very pricey due to CALs, and what it gives me is IMO not worth the price if I can replace it with Samba 4. That said, we're only beginning to explore this option, so it may not be viable or wise.
- JoshTriplett 14y ago
  Just like many existing development companies have Windows-based infrastructure with both Windows and Linux on end-user systems, it makes sense to have Linux-based infrastructure while still supporting Windows end-user systems. Linux support for AD also allows incremental migration of this infrastructure.
brokenparser 14y ago
Rsyslog is way beyond Windows Event Logger. Audit trails should still work but I don't know if your GPO maps to server configuration automatically. It's easy to test, though. If you want to get started with Samba quickly, you can use Zentyal.
- sk5t 14y ago
  I didn't mean to say that the Windows Event Log is better than syslog or Rsyslog, but it has a particular structure that is really dissimilar, as well as access patterns (WMI, WinRM) that lack an analog.
  - brokenparser 14y ago
    That's MSFT and their NIH syndrome for you. Fortunately, there are several projects which allow you to map Event Log to syslog such as the aptly named "Eventlog To Syslog" ( http://code.google.com/p/eventlog-to-syslog/ http://code.google.com/p/eventlog-to-syslog/ ). This allows you to replace WMI with actual SQL (as Event Log can't use an SQL backend itself), and leverage all of the functionality of an RDBMS.
    - sk5t 14y ago
      Similarly, my employer offers a product[1], which I have worked on, that can subscribe to Event Logs, syslog, ZMQ, etc., and do whatever you like with them. The inspiration to write this was the near-impossibility of getting the interesting, mostly AD-related stuff before all the super-chatty, useless crap pushes it out of the circular logs. [1] http://zetetic.net/software-combine-index http://zetetic.net/software-combine-index
      - brokenparser 14y ago
        Imagine the revenue if you were actually selling it on that website.
rufugee 14y ago
It's not the cost of a few domain controllers...it's the $50-60/user cost of client access license (CALS). I have 2500 users...that's quite a pricey (approx. $62K) system for directory services. I personally am going to give Samba 4 a look.
- sk5t 14y ago
  If getting AD Domain Services off of Windows will actually avoid the need to buy any Windows Server CALs, then it certainly makes the proposition more interesting. But, this presumes that nearly all the other services (file sharing, http, etc.) are also not Windows.
  - rufugee 14y ago
    We use Windows Server for three things: 1. Directory services/DC 2. Windows file shares 3. Exchange I have to buy user CALs for #1 and #2. One CAL gives me the right to connect that user to any of our file shares and to AD. IIRC, that cost when we last purchased was around $50/user. We also have to buy a separate CAL for Exchange. I would love to replace AD and our Windows file shares with Samba 4, provided that it was a stable, viable replacement which didn't add a lot of overhead for our admins. Exchange is a separate issue, and one we're currently exploring Zimbra as a possibility. It's early days yet there. Almost everything else in our environment is Linux.
    - cryptomilk 14y ago
      For 3. you should take a look at OpenChange. It implements Exchange using Samba 4.0 libraries.
      - rufugee 14y ago
        Do you know of any success stories with OpenChange? Thanks for the info.
  - sbuk 14y ago
    I have to say that Microsoft convincing businesses that they need to pay to connect to servers that they've already paid for is a shear piece of economic genius. Morally abject, but still brilliant financially none the less.
illumin8 14y ago
I think you don't really understand what Samba is for: OEMs. There are several very large companies selling rock solid enterprise NAS devices that need a rock solid implementation of CIFS on top of the seamless ability to join an AD domain. When large companies want to setup Windows file servers, they don't exactly want to stick a bunch of hard drives in a server and pray it doesn't go down - even clustered Windows file servers are extremely complex and have all kinds of failure modes that can cause hours or even days of downtime. Large companies simply want to buy a NetApp or some other enterprise class NAS storage device and have it integrate seamlessly with their Windows AD infrastructure. Samba now offers that. Storage companies that are experts at building highly redundant no single point of failure systems can now use open source software to deliver technology to the enterprise.
- sk5t 14y ago
  Hmm, you're arguing against a point I didn't make... my concerns are around replacing AD Domain Controllers with Samba. I think Samba's core bits do a fine job as a SMB/CIFS server along with krb5/PAM and Winbind.
  - lhnn 14y ago
    Sounds like you were arguing against a use case which the other fellow doesn't believe is a target use of the product.
    - xuhu 14y ago
      I counted 21 references to "Active Directory" in the release announcement (out of 26 paragraphs). Judging from this, AD may actually be a primary target use.
  - lloeki 14y ago
    > my concerns are around replacing AD Domain Controllers with Samba. Here for us (not OEM) the whole AD stack you mentioned is completely overkill, and the stuff implemented by this Samba release looks terribly like covering 99% of what we use and need in our half windows (customer TSE access, networked file store), half linux (web hosting + many services) infrastructure.

by sk5t 14y ago

tptacek 14y ago

... and if you have enough control over your environment to replace Windows Server as a domain controller, why would you be using the AD stack to begin with?

sk5t 14y ago
Aye, if one has that much motivation to chuck Windows for AD, then it's only logical that Windows on the desktop, Exchange, etc., are not on the scene. I've done a lot of work with other directory servers too, and AD does the best job of any when it comes to multimaster replication and a few other things. However, using it purely for LDAP for an environment full of Linux and OS X machines is a tough call...
- rufugee 14y ago
  Why? I have such motivation, yet I have no intent on eliminating Windows from our desktops. That would be very disruptive to our 2.5K users, and Windows does a pretty decent job there. However, AD is very pricey due to CALs, and what it gives me is IMO not worth the price if I can replace it with Samba 4. That said, we're only beginning to explore this option, so it may not be viable or wise.
JoshTriplett 14y ago
Just like many existing development companies have Windows-based infrastructure with both Windows and Linux on end-user systems, it makes sense to have Linux-based infrastructure while still supporting Windows end-user systems. Linux support for AD also allows incremental migration of this infrastructure.

brokenparser 14y ago

Rsyslog is way beyond Windows Event Logger. Audit trails should still work but I don't know if your GPO maps to server configuration automatically. It's easy to test, though. If you want to get started with Samba quickly, you can use Zentyal.

sk5t 14y ago
I didn't mean to say that the Windows Event Log is better than syslog or Rsyslog, but it has a particular structure that is really dissimilar, as well as access patterns (WMI, WinRM) that lack an analog.
- brokenparser 14y ago
  That's MSFT and their NIH syndrome for you. Fortunately, there are several projects which allow you to map Event Log to syslog such as the aptly named "Eventlog To Syslog" ( http://code.google.com/p/eventlog-to-syslog/ http://code.google.com/p/eventlog-to-syslog/ ). This allows you to replace WMI with actual SQL (as Event Log can't use an SQL backend itself), and leverage all of the functionality of an RDBMS.
  - sk5t 14y ago
    Similarly, my employer offers a product[1], which I have worked on, that can subscribe to Event Logs, syslog, ZMQ, etc., and do whatever you like with them. The inspiration to write this was the near-impossibility of getting the interesting, mostly AD-related stuff before all the super-chatty, useless crap pushes it out of the circular logs. [1] http://zetetic.net/software-combine-index http://zetetic.net/software-combine-index
    - brokenparser 14y ago
      Imagine the revenue if you were actually selling it on that website.

rufugee 14y ago

It's not the cost of a few domain controllers...it's the $50-60/user cost of client access license (CALS). I have 2500 users...that's quite a pricey (approx. $62K) system for directory services. I personally am going to give Samba 4 a look.

sk5t 14y ago
If getting AD Domain Services off of Windows will actually avoid the need to buy any Windows Server CALs, then it certainly makes the proposition more interesting. But, this presumes that nearly all the other services (file sharing, http, etc.) are also not Windows.
- rufugee 14y ago
  We use Windows Server for three things: 1. Directory services/DC 2. Windows file shares 3. Exchange I have to buy user CALs for #1 and #2. One CAL gives me the right to connect that user to any of our file shares and to AD. IIRC, that cost when we last purchased was around $50/user. We also have to buy a separate CAL for Exchange. I would love to replace AD and our Windows file shares with Samba 4, provided that it was a stable, viable replacement which didn't add a lot of overhead for our admins. Exchange is a separate issue, and one we're currently exploring Zimbra as a possibility. It's early days yet there. Almost everything else in our environment is Linux.
  - cryptomilk 14y ago
    For 3. you should take a look at OpenChange. It implements Exchange using Samba 4.0 libraries.
    - rufugee 14y ago
      Do you know of any success stories with OpenChange? Thanks for the info.
- sbuk 14y ago
  I have to say that Microsoft convincing businesses that they need to pay to connect to servers that they've already paid for is a shear piece of economic genius. Morally abject, but still brilliant financially none the less.

illumin8 14y ago

I think you don't really understand what Samba is for: OEMs. There are several very large companies selling rock solid enterprise NAS devices that need a rock solid implementation of CIFS on top of the seamless ability to join an AD domain. When large companies want to setup Windows file servers, they don't exactly want to stick a bunch of hard drives in a server and pray it doesn't go down - even clustered Windows file servers are extremely complex and have all kinds of failure modes that can cause hours or even days of downtime. Large companies simply want to buy a NetApp or some other enterprise class NAS storage device and have it integrate seamlessly with their Windows AD infrastructure. Samba now offers that. Storage companies that are experts at building highly redundant no single point of failure systems can now use open source software to deliver technology to the enterprise.

sk5t 14y ago
Hmm, you're arguing against a point I didn't make... my concerns are around replacing AD Domain Controllers with Samba. I think Samba's core bits do a fine job as a SMB/CIFS server along with krb5/PAM and Winbind.
- lhnn 14y ago
  Sounds like you were arguing against a use case which the other fellow doesn't believe is a target use of the product.
  - xuhu 14y ago
    I counted 21 references to "Active Directory" in the release announcement (out of 26 paragraphs). Judging from this, AD may actually be a primary target use.
- lloeki 14y ago
  > my concerns are around replacing AD Domain Controllers with Samba. Here for us (not OEM) the whole AD stack you mentioned is completely overkill, and the stuff implemented by this Samba release looks terribly like covering 99% of what we use and need in our half windows (customer TSE access, networked file store), half linux (web hosting + many services) infrastructure.