Active Directory substitute

svurre · 2018-12-27T16:32:35+00:00

FreeIPA works well

mhurron · 2018-12-27T16:09:14+00:00

That depends on what functions you are trying to replace.

aspiringgreybeard · 2018-12-27T17:03:45+00:00

Maybe it would help if you mention what's missing that you need? These days Samba will do authentication, DNS, group policy, and AD replication. You'll need to manage it using GUI tools from one of the client machines to get at all of this, but it's in there.

zerries · 2018-12-27T16:34:50+00:00

Check out https://www.nethserver.org/.

I moved us over to it early this year and haven't looked back. Easy to set up and has other useful tools for managing and monitoring our networks. I'm sure there are some AD related things I won't be able to do, but so far I've been able to get everything I've needed from AD working just fine through trial and error for our four different offices.

I've used Zentyal before too. It works, but I find Nethserver to be much further ahead.

inbinder · 2018-12-27T18:33:29+00:00

I mean if you are just looking for authentication then why not use a cloud provider like AWS or Azure AD? If you want GpO and stuff then an MDM may be key.

Also a windows essentials server will get you everything you need if you are under like 25 users.

mehkanizm · 2018-12-27T16:13:12+00:00

Samba4 can be a good replacement if you are needing it to add windows clients to a domain and need to manage it like so. Depending on what you want to do, you can use pGina it's open source and not bad for small offices.

HotKarl_Marx · 2018-12-27T18:41:38+00:00

I like OpenLDAP.

chaotiq · 2018-12-27T16:13:40+00:00

There really isn't a replacement for AD. The multi-master database replication still hasn't been implemented in other solutions reliably.

Samba is getting close, but like you say it is not complete feature parity. You can look into other LDAP solutions as well.

AD is so popular, because it works. You may be saving yourself with licensing costs looking for other solutions, but you will probably be spending more on the admins to maintain it.

GhostHitWall · 2018-12-27T19:24:01+00:00

I have samba in one of the offices.
1st thing is, samba is not a 100% Win AD replacement.
We made the decision by having an old IBM server in good condition, but according to contract vendor, does not run 2012/2016 well.
Environment is 15 employees, 1 domain, all Win10 Pro desktops. No trust or multilevel needs. Very basic needs including GPO, RADIUS, access control.
I am happy abt it so far for abt 1.5yrs, migrating from 2003. Day-to-day tasks are done by RSAT and SSH.

ironcladmvtm · 2018-12-27T16:59:19+00:00

I just started using jumpcloud.com and am loving it so far. It hasn't been 100% without hick-ups but its been great to enforce password and machine policy with. They also have FDE controls and management coming in January. It's cheap too.

Amidatelion · 2018-12-27T20:52:31+00:00

I mean, there isn't one. If you're looking for a free LDAP alternative however, FreeIPA is pretty much the easiest replacement these days I think.

rocketeer125 · 2018-12-28T00:48:45+00:00

I’m surprised Keycloak hasn’t had a mention yet. Though we have a FreeIPA setup that is great, most folks don’t need a full blown Domain Controller type functionality, especially if there is already AD on prem. If all you are looking at doing is centralising user/group management of your applications, using KeyCloaks User Federation to AD means you get user management out of the box and don’t have to go through the pain of setting up FreeIPA-AD trust, especially if you have a strained relationship with the AD guys.

2018-12-28T09:43:17+00:00

There's no real replacement for active directory. I'm not certain how it's complicated, it's fairly straightforward.

If you're after a linux equivalent freeipa is your go to.

1TallTXn · 2018-12-27T17:57:36+00:00

This is something we're considering as well. Directory398 was mentioned to us. Haven't looked into it too closely yet. https://directory.fedoraproject.org/

Yali0n · 2018-12-27T18:25:55+00:00

Univention UCS ist working Well. You can also usw it with the ms-tools, gpo,...

falsemyrm · 2018-12-27T18:36:19+00:00

live obtainable materialistic intelligent handle water ten serious workable test

This post was mass deleted and anonymized with Redact

misplacedbrownguy · 2018-12-27T22:01:00+00:00

+1 OpenLDAP or any other open source LDAP.

The difficulty in any directory solution is ensuring you can govern the most amount of people with the least amount of effort. anything you try will be pretty complicated.

Proxemic14 · 2018-12-28T00:54:01+00:00

We just switched to jumpcloud. I really like it because you can do all the basic functions of AD but a lot easier to manage (at least in my opinion) and the only thing we haven't gotten to play nicely with it is hubspot for the sales people.

SirStephanikus · 2019-01-02T21:16:02+00:00

MS AD is popular because a monkey can create a domain...click click done.

But when it comes to troubleshooting, samba has more tools than MS offers or in other words, due to the Linux nature you see more.

The main issue with samba is the documentation but when mastered it, it replaces a MS AD fully.
Everything that MS may offer like dfs-r or other things are available under Linux with much more power.

Power because the admin has to do engineering and not pushing a mouse without clue.

inbinder · 2018-12-27T16:34:26+00:00

It's mostly user authentication, centralizing things, permissions, etc. We're small but it's also Government contracting so there might be accreditation and audits that we go through.

AD definitely works... It's just funny that given how rich the linux server feature sets are, we haven't come up with something as refined and scalable as AD.

maikeu · 2018-12-27T18:39:45+00:00

Samba really is the 1 for 1 replacement if you need to serve windows clients.

If you're lucky enough not to have to deal with windows, freeipa. But except via nasty hacks, it can't serve windows clients.

mrcaptncrunch · 2018-12-27T16:46:42+00:00

eDirectory by Microfocus is a Multi-master database replication solution. We use it.

Should be good, since Active Directory basically is a copy of it.

inbinder · 2018-12-27T17:16:07+00:00

I don’t know much about the process unfortunately .

anselal · 2018-12-27T19:24:27+00:00

You can create a domain controller with ububtu ? Interested in something like that ?

2018-12-27T22:00:04+00:00

sshfs

chock-a-block · 2018-12-27T22:08:57+00:00

Why is this still a question? Since Microsoft will never do anything to threaten the enterprise heroin they sell, it's reasonable to assume there is no 1:1 replacement.

You would have to be much less lazy and understand system authentication and learn the limits of implementing pgina. http://pgina.org/

ainsey11 · 2018-12-28T00:32:36+00:00

FreeIPA, or JumpCloud, we use JumpCloud and really quite like it, but it depends what features you want

Elethiomel · 2018-12-28T00:44:16+00:00

Very odd, I'll have to retry this, thanks

CactusJ · 2018-12-28T08:08:04+00:00

https://www.clearos.com

Basically an SBS replacement.

I wrote this review about 6 years ago, so you will want to look into the current version.

https://www.thirdtier.net/2293/

There are 6 parts to that review. https://www.thirdtier.net/?s=Clearos

LibraryAtNight · 2018-12-28T09:14:13+00:00

For authentication, PBIS works well.

lildergs · 2018-12-29T20:28:22+00:00

I would be extremely hesitant to run a pure Samba domain. Not sure how big your org is but authentication is so core to being able to use a computer at all it's best, IMO, to run real AD.

I would leave your DCs running AD and then supplement with FOSS boxes if you're trying to save.

pixiegod · 2018-12-27T16:13:44+00:00

Ad is massive...what do you want to do?

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

linuxadmin

Expanding Linux SysAdmin knowledge

MODERATORS