12:40 p.m.
This is not specifically a Fedora question, but there are a lot of smart
people on this list ... hopefully somebody can point me in the right
direction.
I would like to switch my organization from Windows 2000 professional to
Linux on the desktop. I am satisfied enough with the performance of
OpenOffice.org to substitute it for MS-Office, and we already use
Thunderbird and Firefox for email/web. I'm not worried about the apps,
in other words. What we have that is Windows-only can be run on our
Terminal Servers.
It's authentication that worries me. Our servers are a mix of Windows
2000/2003 and Linux, and our primary authentication is against Windows
2000 Active Directory servers. What we are having difficulty replicating
under Linux is the ease of domain logins on the workstations, where
essentially there are no local accounts; the workstation is a member of
the domain and it trusts domain accounts for local login. So
authentication is almost entirely centralized; anyone can login to any
workstation (within limits we set) on the domain, and we don't have to
do anything to copy accounts to each workstation. While we may
eventually dispense with the Active Directory servers, they will be with
us through the transition period (1.5 to 2 years, I estimate) and maybe
longer, so some system that allows compatible, shared auth between
Windows and Linux workstations is a requirement for our transition.
Xandros Desktop Linux has done a lot of work, starting back when they
were Corel Linux 1.0, in creating a system of Windows domain login that
works under Linux. See
http://www.desktoplinux.com/articles/AT4559768996.html
for details of how this should work, and does work under Xandros. But
Xandros is uncomfortably proprietary for me and I would much prefer a
more open solution. As far as I can tell, Xandros does not make it easy
to use their domain auth system generally, with other distros for
example. In the interview at the link above, the Xandros rep claims
there is no other distro that does this--while I don't know of any that
do, it seems like such an obvious goal that I'd be very surprised if
nobody else is at least working on it.
Has anybody done this on their system with more open tools? Or another
option seems to be maintaining an NIS server that somehow replicates
accounts with the AD servers, so that NIS handles Linux login, while AD
handles only Windows--anybody tried that? Or if anybody else has come up
with other solutions to this or similar problems, please write in. We
have looked at all the PAM options--kerberos, LDAP, etc.--and none of
them look quite as good as what Xandros has done; but if they work for
you, I'm very interested in hearing your stories.
Thanks,
Matt Morgan
Manager of Information Systems
Brooklyn Museum
1:12 p.m.
On Fri, 2004-05-28 at 19:40, Matt Morgan wrote:
[snip]
I would like to switch my organization from Windows 2000 professional
to
Linux on the desktop.
[snip]
It's authentication that worries me. Our servers are a mix of Windows
2000/2003 and Linux, and our primary authentication is against Windows
2000 Active Directory servers. What we are having difficulty replicating
under Linux is the ease of domain logins on the workstations, where
essentially there are no local accounts; the workstation is a member of
the domain and it trusts domain accounts for local login. So
authentication is almost entirely centralized; anyone can login to any
workstation (within limits we set) on the domain, and we don't have to
do anything to copy accounts to each workstation. While we may
eventually dispense with the Active Directory servers, they will be with
us through the transition period (1.5 to 2 years, I estimate) and maybe
longer, so some system that allows compatible, shared auth between
Windows and Linux workstations is a requirement for our transition.
[snip]
Thanks,
Matt Morgan
Manager of Information Systems
Brooklyn Museum
Hi Matt,
I know these are not free solutions but Novell has products like Account
Management, eDirectory and Novell Modular Authentication Service (NMAS)
with single sign-on functionality. Maybe they are a solution.
Good luck and (imho) please keep this list informed of any solutions you
may find.
Regards,
Patrick
1:21 p.m.
On Fri, 2004-05-28 at 10:40, Matt Morgan wrote:
This is not specifically a Fedora question, but there are a lot of
smart
people on this list ... hopefully somebody can point me in the right
direction.
I would like to switch my organization from Windows 2000 professional to
Linux on the desktop. I am satisfied enough with the performance of
OpenOffice.org to substitute it for MS-Office, and we already use
Thunderbird and Firefox for email/web. I'm not worried about the apps,
in other words. What we have that is Windows-only can be run on our
Terminal Servers.
It's authentication that worries me. Our servers are a mix of Windows
2000/2003 and Linux, and our primary authentication is against Windows
2000 Active Directory servers. What we are having difficulty replicating
under Linux is the ease of domain logins on the workstations, where
essentially there are no local accounts; the workstation is a member of
the domain and it trusts domain accounts for local login. So
authentication is almost entirely centralized; anyone can login to any
workstation (within limits we set) on the domain, and we don't have to
do anything to copy accounts to each workstation. While we may
eventually dispense with the Active Directory servers, they will be with
us through the transition period (1.5 to 2 years, I estimate) and maybe
longer, so some system that allows compatible, shared auth between
Windows and Linux workstations is a requirement for our transition.
Xandros Desktop Linux has done a lot of work, starting back when they
were Corel Linux 1.0, in creating a system of Windows domain login that
works under Linux. See
http://www.desktoplinux.com/articles/AT4559768996.html
for details of how this should work, and does work under Xandros. But
Xandros is uncomfortably proprietary for me and I would much prefer a
more open solution. As far as I can tell, Xandros does not make it easy
to use their domain auth system generally, with other distros for
example. In the interview at the link above, the Xandros rep claims
there is no other distro that does this--while I don't know of any that
do, it seems like such an obvious goal that I'd be very surprised if
nobody else is at least working on it.
Has anybody done this on their system with more open tools? Or another
option seems to be maintaining an NIS server that somehow replicates
accounts with the AD servers, so that NIS handles Linux login, while AD
handles only Windows--anybody tried that? Or if anybody else has come up
with other solutions to this or similar problems, please write in. We
have looked at all the PAM options--kerberos, LDAP, etc.--and none of
them look quite as good as what Xandros has done; but if they work for
you, I'm very interested in hearing your stories.
-----
samba / winbind
if you need documentation
www.samba.org -> documentation, samba-3 howto
Craig
2:14 p.m.
On 05/28/2004 02:21 PM, Craig White wrote:
On Fri, 2004-05-28 at 10:40, Matt Morgan wrote:
>[snip]
>
>Xandros Desktop Linux has done a lot of work, starting back when they
>were Corel Linux 1.0, in creating a system of Windows domain login that
>works under Linux. See
>
>http://www.desktoplinux.com/articles/AT4559768996.html
>
>for details of how this should work, and does work under Xandros. But
>Xandros is uncomfortably proprietary for me and I would much prefer a
>more open solution. As far as I can tell, Xandros does not make it easy
>to use their domain auth system generally, with other distros for
>example. In the interview at the link above, the Xandros rep claims
>there is no other distro that does this--while I don't know of any that
>do, it seems like such an obvious goal that I'd be very surprised if
>nobody else is at least working on it.
>
>[snip]
>
-----
samba / winbind
if you need documentation
www.samba.org -> documentation, samba-3 howto
Craig
According to that interview:
"Basically, on a technical level, the authentication in the domain is
performed by a package called Winbind that is part of Samba. But we do a
lot more -- we provide the login dialog that allows them to enter the
user name and password, not from the local machine but from the domain."
(which is specifically the problem I'm trying to solve). Are you using
samba/winbind? If someone were actually using it and could tell me how,
in practice, it works out, I'd buy him or her a beer :-). But I will
check out those docs, thanks.
2:54 p.m.
On Fri, 2004-05-28 at 15:14 -0400, Matt Morgan wrote:
...snip...
(which is specifically the problem I'm trying to solve). Are you
using
samba/winbind? If someone were actually using it and could tell me how,
in practice, it works out, I'd buy him or her a beer :-). But I will
check out those docs, thanks.
We have been using this for several years, but can't speak specifically
to FC2 as the server is running WBEL - was previously on RH7.3 and
earlier. You need to read the docs and decide how you want to handle
passwords - can use Samba-specific passwords or *nix passwords, but
after that, the basic items in /etc/samba/smb.conf we use (simply
uncomment) are:
# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
os level = 33
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
domain master = yes
# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
preferred master = yes
# Use only if you have an NT server on your network that has been
# configured at install time to be a primary domain controller.
; domain controller = <NT-Domain-Controller-SMBName>
# Enable this if you want Samba to be a domain logon server for
# Windows95 workstations.
domain logons = yes
Phil
6:10 p.m.
On Fri, 2004-05-28 at 12:14, Matt Morgan wrote:
On 05/28/2004 02:21 PM, Craig White wrote:
>On Fri, 2004-05-28 at 10:40, Matt Morgan wrote:
>
>
>>[snip]
>>
>>Xandros Desktop Linux has done a lot of work, starting back when they
>>were Corel Linux 1.0, in creating a system of Windows domain login that
>>works under Linux. See
>>
>>http://www.desktoplinux.com/articles/AT4559768996.html
>>
>>for details of how this should work, and does work under Xandros. But
>>Xandros is uncomfortably proprietary for me and I would much prefer a
>>more open solution. As far as I can tell, Xandros does not make it easy
>>to use their domain auth system generally, with other distros for
>>example. In the interview at the link above, the Xandros rep claims
>>there is no other distro that does this--while I don't know of any that
>>do, it seems like such an obvious goal that I'd be very surprised if
>>nobody else is at least working on it.
>>
>>[snip]
>>
>-----
>samba / winbind
>
>if you need documentation
>
>www.samba.org -> documentation, samba-3 howto
>
>Craig
>
>
According to that interview:
"Basically, on a technical level, the authentication in the domain is
performed by a package called Winbind that is part of Samba. But we do a
lot more -- we provide the login dialog that allows them to enter the
user name and password, not from the local machine but from the domain."
(which is specifically the problem I'm trying to solve). Are you using
samba/winbind? If someone were actually using it and could tell me how,
in practice, it works out, I'd buy him or her a beer :-). But I will
check out those docs, thanks.
----
winbind allows Windows domain users (and their group memberships) to act
as if they had a local account, even going as far as creating their home
directory if necessary.
Not sure why you want another review when the official (and quite
outstanding) How-to for Samba is on their web site.
Craig
11:02 a.m.
On 05/28/2004 07:10 PM, Craig White wrote:
On Fri, 2004-05-28 at 12:14, Matt Morgan wrote:
>On 05/28/2004 02:21 PM, Craig White wrote:
>
>
>
>>On Fri, 2004-05-28 at 10:40, Matt Morgan wrote:
>>
>>
>>
>>
>>>[snip]
>>>
>>>
>>
----
winbind allows Windows domain users (and their group memberships) to act
as if they had a local account, even going as far as creating their home
directory if necessary.
Not sure why you want another review when the official (and quite
outstanding) How-to for Samba is on their web site.
Well, I'm sure there's nothing that I couldn't figure out all by myself
from the myriad of conflicting, incomplete, error-prone sources online
with a lot more work, trial-and-error, and existential pain than it
takes to solicit help from the list. If I had all the time in the world.
That how-to may be excellent, but it still confuses someone who's
starting from zero. I read it, and I have questions--it's not a be-all,
end-all for all my problems. And believe me, I've tried this before and
failed. It's just nice to hear from some people that it actually works
for them. Otherwise how do I know whether I just made a mistake, or
whether it really doesn't work the way I want it to? It's a lot of work
setting something like this up, and I /don't/ have all the time in the
world. Getting a step-by-step (Tarun's response, for example) was an
unexpected bonus.
Honestly, this whole thread, at least for me, was a confirmation of the
efficiency and value of the open-source support model. All of us are
smarter than some of us!
--Matt
2:13 a.m.
Matt Morgan wrote:
That how-to may be excellent, but it still confuses someone who's
starting from zero. I read it, and I have questions--it's not a
be-all, end-all for all my problems. And believe me, I've tried this
before and failed. It's just nice to hear from some people that it
actually works for them. Otherwise how do I know whether I just made a
mistake, or whether it really doesn't work the way I want it to? It's
a lot of work setting something like this up, and I /don't/ have all
the time in the world. Getting a step-by-step (Tarun's response, for
example) was an unexpected bonus.
Honestly, this whole thread, at least for me, was a confirmation of
the efficiency and value of the open-source support model. All of us
are smarter than some of us!
--Matt
Hi ,
This is precisely the problem for which I've been looking for a
"workable" solution for quite some time now. Though I have been
following up the thread very eagerly the solutions mentioned have not
worked for me personally. The best help I have got till now was from a
book by John H Terpstra from the samba team. He had led me to this link
book (not sure if you have already looked into it)
<snip>
Suggest you either buy my new book "Samba-3 by Example" or download it from:
http://www.samba.org/samba/docs/Samba-Guide.pdf
Check Chapter 9 - it should have all the answers you need.
<snip>
This clip is from John's message to me. This book is by far the best
resource/help I have had till now. To be honest I have tried it but it
hasnt worked for me. I havent been able to login to the domain from the
login prompt using the scripts mentioned in the book. Maybe it could be
because of the n' number of differrent things that I have been trying it
out, that I have gone wrong somewhere. I plan to try it this time on a
fresh install of fedora maybe in a couple of weeks.
All the best to you with the same. Please do keep us all posted on your
findings and let us all know if this works for you. I for one will be
very interested to know how you get it working.
All the best.
Thanks,
PAG
12:25 p.m.
On Tue, 2004-06-01 at 09:02, Matt Morgan wrote:
On 05/28/2004 07:10 PM, Craig White wrote:
>On Fri, 2004-05-28 at 12:14, Matt Morgan wrote:
>
>
>>On 05/28/2004 02:21 PM, Craig White wrote:
>>
>>
>>
>>>On Fri, 2004-05-28 at 10:40, Matt Morgan wrote:
>>>
>>>
>>>
>>>
>>>>[snip]
>>>>
>>>>
>>>
>----
>winbind allows Windows domain users (and their group memberships) to act
>as if they had a local account, even going as far as creating their home
>directory if necessary.
>
>Not sure why you want another review when the official (and quite
>outstanding) How-to for Samba is on their web site.
>
>
Well, I'm sure there's nothing that I couldn't figure out all by myself
from the myriad of conflicting, incomplete, error-prone sources online
with a lot more work, trial-and-error, and existential pain than it
takes to solicit help from the list. If I had all the time in the world.
That how-to may be excellent, but it still confuses someone who's
starting from zero. I read it, and I have questions--it's not a be-all,
end-all for all my problems. And believe me, I've tried this before and
failed. It's just nice to hear from some people that it actually works
for them. Otherwise how do I know whether I just made a mistake, or
whether it really doesn't work the way I want it to? It's a lot of work
setting something like this up, and I /don't/ have all the time in the
world. Getting a step-by-step (Tarun's response, for example) was an
unexpected bonus.
Honestly, this whole thread, at least for me, was a confirmation of the
efficiency and value of the open-source support model. All of us are
smarter than some of us!
----
Personally, I think many of the 'step-by-step' descriptions are more
dangerous than helpful. At best, it will work, you will never know why
and you certainly won't know how to fix things when they break. All
worse options simply add to the complexity and confusion of the problem.
When you are specifically speaking about Samba, there has been a
tremendous effort to document all possible scenario's in the HOW-TO and
it is an excellent resource. If it fails to deliver the information
needed for your application, the best thing would seem to indicate this
to John Terpstra so that he can modify it. He also has a new book,
Samba-by-Example which is probably more of what you are looking for.
Craig
2:47 p.m.
I agree with Craig.
I'm using FC2 against Windows 2003 active directory servers very
successfully (well, minus one part).
However, note that system-config-authentication is woefully
broken/incomplete when it comes to winbind configuration.
But here are my general steps using FC2.
Install FC2 with "Windows File Sharing"
during firstboot, skip over creating an account
run system-config-authentication
click enable Winbind support
click the configure button
fill in:
winbind domain: <DOMAIN> (no .com/.org/etc here)
Security model: ads
winbind ads realm: <DOMAIN.COM>
winbind domain controllers: dc.domain.com (I put in my primary ADS
server)
Template shell: (your choice)
now as root edit /etc/krb5.conf
You'll see where the system-config-authentication has not replaced
anything correctly here.
You need to change EXAMPLE.COM -> DOMAIN.COM and .example.com to
.domain.com as needed
Also change kerberos.example.com to your ads server and admin_server
to your ads server.
Now open /etc/samba/smb.conf
search for password server. You'll notice two entries here. You should
only have your ads server here.
I've added below template shell line
template homedir = /home/%U
so I don't have to have /home/DOMAIN/USER as the location for my home
directory.
I also changed winbind use default domain to yes so that users can
login as USER instead of DOMAIN+USER.
The final step is to add the machine to the domain
as root
net ads join -w DOMAIN -S ADSSERVER.DOMAIN.COM -U Administrator
/etc/rc.d/init.d/winbind restart
/etc/rc.d/init.d/sshd restart
(or even safer reboot)
You will have to add the users homedirs by hand before they can login
and that's the final piece I'm trying to solve. samba's add user script
doesn't work for me.
Hope this helps,
Tarun
On May 28, 2004, at 12:21 PM, Craig White wrote:
On Fri, 2004-05-28 at 10:40, Matt Morgan wrote:
> Has anybody done this on their system with more open tools? Or another
> option seems to be maintaining an NIS server that somehow replicates
> accounts with the AD servers, so that NIS handles Linux login, while
> AD
> handles only Windows--anybody tried that? Or if anybody else has come
> up
> with other solutions to this or similar problems, please write in. We
> have looked at all the PAM options--kerberos, LDAP, etc.--and none of
> them look quite as good as what Xandros has done; but if they work for
> you, I'm very interested in hearing your stories.
-----
samba / winbind
if you need documentation
www.samba.org -> documentation, samba-3 howto
Craig
3:35 p.m.
I'm going to top-post this message to say THANK YOU to Tarun, Phil,
Craig, Patrick and Michael. Will try it all out. I had a feeling that
Xandros guy was being a little misleading.
On 05/28/2004 03:47 PM, Tarun Reddy wrote:
I agree with Craig.
I'm using FC2 against Windows 2003 active directory servers very
successfully (well, minus one part).
However, note that system-config-authentication is woefully
broken/incomplete when it comes to winbind configuration.
But here are my general steps using FC2.
Install FC2 with "Windows File Sharing"
during firstboot, skip over creating an account
run system-config-authentication
click enable Winbind support
click the configure button
fill in:
winbind domain: <DOMAIN> (no .com/.org/etc here)
Security model: ads
winbind ads realm: <DOMAIN.COM>
winbind domain controllers: dc.domain.com (I put in my primary ADS
server)
Template shell: (your choice)
now as root edit /etc/krb5.conf
You'll see where the system-config-authentication has not replaced
anything correctly here.
You need to change EXAMPLE.COM -> DOMAIN.COM and .example.com to
.domain.com as needed
Also change kerberos.example.com to your ads server and admin_server
to your ads server.
Now open /etc/samba/smb.conf
search for password server. You'll notice two entries here. You should
only have your ads server here.
I've added below template shell line
template homedir = /home/%U
so I don't have to have /home/DOMAIN/USER as the location for my home
directory.
I also changed winbind use default domain to yes so that users can
login as USER instead of DOMAIN+USER.
The final step is to add the machine to the domain
as root
net ads join -w DOMAIN -S ADSSERVER.DOMAIN.COM -U Administrator
/etc/rc.d/init.d/winbind restart
/etc/rc.d/init.d/sshd restart
(or even safer reboot)
You will have to add the users homedirs by hand before they can login
and that's the final piece I'm trying to solve. samba's add user
script doesn't work for me.
Hope this helps,
Tarun
On May 28, 2004, at 12:21 PM, Craig White wrote:
> On Fri, 2004-05-28 at 10:40, Matt Morgan wrote:
>
>> Has anybody done this on their system with more open tools? Or another
>> option seems to be maintaining an NIS server that somehow replicates
>> accounts with the AD servers, so that NIS handles Linux login, while AD
>> handles only Windows--anybody tried that? Or if anybody else has
>> come up
>> with other solutions to this or similar problems, please write in. We
>> have looked at all the PAM options--kerberos, LDAP, etc.--and none of
>> them look quite as good as what Xandros has done; but if they work for
>> you, I'm very interested in hearing your stories.
>
> -----
> samba / winbind
>
> if you need documentation
>
> www.samba.org -> documentation, samba-3 howto
>
> Craig
6:31 p.m.
On Fri, 2004-05-28 at 12:47, Tarun Reddy wrote:
I agree with Craig.
---
scary thought
---
You will have to add the users homedirs by hand before they can login
and that's the final piece I'm trying to solve. samba's add user script
doesn't work for me.
----
This is likely what you are looking for...
<http://www.google.com/linux?hl=en&lr=&ie=UTF-8&q=pam_mkhomedi...
sorry about the html - used it to hold long URL together in one line.
Craig
4:25 a.m.
Hi Matt
I have found a lot of useful information at
http://samba.vernstok.nl
A lot of examples are in
http://samba.vernstok.nl/Samba-Guide.pdf
Olaf
7289
days inactive
7294
days old
12 comments
7 participants
participants (7)
-
Craig White -
Matt Morgan -
Olaf Eichhorn -
PAG -
Patrick -
Phil Schaffner -
Tarun Reddy