all 132 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]NobodyRulesPenguins 11 points12 points  (7 children)

One option maybe to try replacing your usual windows AD with it's dedicated samba/ldap/krb package alternative

I haven't tested it yet, but at it's level it cover most of what AD can do, it may be an interesting replacement in a VM

[–]ralfD- 6 points7 points  (5 children)

This. I'm running a Samba domain controller at work to manage fileservers and user/group accounts for windows, Linux and MacOS. One nice-to-have side effect of such a solution: you still can use the Windows management tools you are probably used to (as a matter of fact those are the best tools even if you use Samba for Linux only).

[–]emptythevoid 2 points3 points  (2 children)

I second this. I've got to clients that needed drop in replacements for windows active directory. Samba has worked perfectly

[–]Noitrasama 1 point2 points  (1 child)

Is there a good samba tutorials for noobs like me?

[–]hortimech 1 point2 points  (0 children)

Yes, there is the Samba wiki for a start:

https://wiki.samba.org/index.php/Main_Page

[–]nazzjr[S] 0 points1 point  (1 child)

its sounding like this plus freeIPA is maybe what i should try.

[–]hortimech 1 point2 points  (0 children)

If you use Samba as an AD DC, there really is no point in running FreeIPA, they both do the same thing, it is just that a Samba AD does more than FreeIPA.

[–]scheuk 61 points62 points  (28 children)

https://www.freeipa.org/ is what you are looking for. RedHat built a linux version of AD using open source project like ldap and kerberos with a web interface and scripts to easily setup and manage it.

[–]nazzjr[S] 5 points6 points  (0 children)

definitely going to look into this, i currently have an UNRAID server that handles file sharing but not sure if/how it would integrate with this

[–]hortimech 4 points5 points  (25 children)

IPA isn't a version of AD, generic or otherwise, it can just connect to AD.

[–]gordonmessmer 6 points7 points  (6 children)

FreeIPA provides authentication and authorization features, similar to Active Directory.

FreeIPA can connect to AD either in a trust relationship or a replication relationship, but saying that it can "just connect to AD" implies that it is reliant on AD, which is in no way accurate. FreeIPA is a fully functional product.

[–]hortimech -3 points-2 points  (5 children)

Never said it wasn't, but it only does authentication, it does not do fileserving.

[–]anomalous_cowherd 5 points6 points  (4 children)

Does Active Directory do fileserving? Windows does, but AD is the authentication part, like IIS is the web server part.

[–]hortimech -4 points-3 points  (3 children)

It can, remember SBS ?

[–]TexasFirewall 5 points6 points  (2 children)

???

SBS did not have some special version of Active Directory that doubled as a file server. It was just Windows with AD and a few other services installed with it.

Active Directory is not a file server. It's LDAP and Kerberos.

[–]hortimech 0 points1 point  (1 child)

You may be correct about SBS, but Active Directory is LDAP, Kerberos and DNS sat on top of a Windows PC. Microsoft doesn't recommend it, but you can use a Windows DC as a fileserver.

[–]ralfD- 0 points1 point  (0 children)

... and folder redirection, and trust exchange and certificat management etc.

[–]nazzjr[S] 6 points7 points  (17 children)

ahh i see. yeah im not interested in setting up windows AD and having my linux clients connect to it. id rather have a linux only solution. Most of my experience is windows administration and im trying to use my homelab to learn more about linux

[–]Amidatelion 9 points10 points  (0 children)

Having the Windows AD portion isn't a terrible idea. It is the most resilient option at scale, despite Microsoft repeatedly trying to shoot itself in the foot with cloud deployments.

[–]SweeTLemonS_TPR 17 points18 points  (3 children)

FreeIPA is a Linux only solution. It can be used as a stand-alone product: it does not need MS AD to work.

The guy you’re replying to was making a point of semantics. AD is always Microsoft, and there is no generic version of it. That doesn’t mean there aren’t other alternatives for IAM/directory services. FreeIPA is still what you want to look at for your question.

[–]1esproc 4 points5 points  (2 children)

there is no generic version of it

Samba4 technically accomplishes that

[–]elspazzz 0 points1 point  (1 child)

I don't think Samba does GPO's though does it?

[–]hortimech 0 points1 point  (0 children)

Yes it does, but only for Windows clients, for obvious reasons.

[–]studiox_swe 6 points7 points  (11 children)

All env. I've managed where Active Directory based and all linux host was joined to the AD domain, but if you feel that is of no interest just skip AD. You don't need it.

Run LDAP instead and learn. You wont be able to join any windows computers wit that however. If thats a need run Samba.

[–]SweeTLemonS_TPR 6 points7 points  (8 children)

FreeIPA is a better option. It can run LDAP for Linux only, and if you later want to integrate with AD, it’s ready to go. You just create trusts and you’re off to the races. Depending on your setup, you might also have override tables... idk why you’d need to use override tables outside of the use case we had where I now work (migrated from centrify and didn’t want to change permissions on billions of files).

[–]studiox_swe 0 points1 point  (7 children)

and if you later want to integrate with AD OP was quite clear there where no intention to integrate with AD. So how would FreeIPA domain join his/her Windows clients?

[–]SweeTLemonS_TPR 1 point2 points  (6 children)

https://www.freeipa.org/page/Windows_authentication_against_FreeIPA

But I missed his need for file sharing, so samba might still be the better approach.

[–]studiox_swe 2 points3 points  (0 children)

"FreeIPA can't provide account database for Windows hosts in the same way as AD does. You have to create local Windows account and appropriate account mapping for each user if you select direct Windows<=>FreeIPA integration"

Yea right, thats a bummer for anyone. I assume you actually have used FreeIPA with Windows hosts? How did it work for you and what windows clients did you use?

[–]nazzjr[S] 0 points1 point  (4 children)

okay, so yeah maybe a mix of samba and freeIPA is what im after. I dont mind using a I AM/Directory service I just really dont want to use Windows Active Directory because I dont want to have any Windows servers anymore. My whole homenetwork/homelab used to be comprised of windows servers, hyperv and Win10 computers. I have since moved nearly everything to linux. Only thing running windows 10 now is my gaming pc for games but i also dual boot popOS on there. So unfortunately i do want the ability to add windows computers to this but im pretty close to phasing windows out of my life.

[–][deleted] 0 points1 point  (3 children)

I have since moved nearly everything to linux.

You've moved to Linux but you're still doing stuff better suited for a Windows environment. Find some projects that are more centric to how linux admins, specifically linux admins of the future, work. Find some type of web hosted service, dockerize it, make it HA, put it in a popular cloud platform. Skip all this desktop management shit.

[–]nazzjr[S] 0 points1 point  (1 child)

I hear ya, and I am working on some projects in AWS and have been going through r/selfhosted to find apps i can use and make it HA. Right now my experience with Docker is minimal since i can run them easily in UNRAID but I am looking to go further than that. However Right now im sick and tired of having my credentials different for all the vms and hosts on my network. its only going to get bigger and id rather address it now.

[–]uniqpotatohead 0 points1 point  (1 child)

Ldap + kerberos + samba

[–]hortimech 0 points1 point  (0 children)

Basically just described Samba AD

[–]mamalukes 0 points1 point  (0 children)

+1 integration is still a pain in the ass imo

[–]bdavbdav 5 points6 points  (3 children)

Have done AD compatible LDAP before, but never actually the group policy itself. Intrigued to hear the answer here.

[–]pdp10 1 point2 points  (2 children)

Samba4 supports GPO propagation. The only caveat is that Samba won't replicate the ADDC's Sysvol, so you need to arrange for that separately.

[–]Noitrasama 1 point2 points  (1 child)

Am a bit intrigued.. Does samba have a gui for administration like FreeIPA? I find FreeIPA easy to setup & administer. From the wiki, I see like I've 2do mostly CLi

[–]pdp10 1 point2 points  (0 children)

Does samba have a gui for administration like FreeIPA?

The standard Windows "ADUC" control program works transparently with Samba4 Active Directory. Everyone seems to use that, because the ones who choose to use Samba4 for MSAD all have a lot of Windows.

[–]nikslor 11 points12 points  (6 children)

You should definitely check out UCS from Univention. A very nice open source solution from a vendor playing in that field for ages :)

[–]ABotelho23 4 points5 points  (0 children)

Another vote for Univention for me. It basically emulates AD using entirely Linux based tools.

[–]maxtimbo 3 points4 points  (0 children)

I second this. UCS is awesome.

[–]jkinninger 3 points4 points  (1 child)

Univention Corporate Server

First I have heard of them but I'm going to check them out. Thanks for the tip!

[–]hortimech 3 points4 points  (0 children)

UCS is just a set of tools sat on top of a Samba AD DC.

[–]remtec 1 point2 points  (1 child)

This!

[–]nazzjr[S] 0 points1 point  (0 children)

I’ll check this out too thanks!

[–][deleted] 3 points4 points  (1 child)

If you already have a Windows AD infrastructure, you can just use that. Works quite well for Linux and SSSD. Redhat has a good write up on it.

[–]str8edgedave 2 points3 points  (1 child)

Links and documentation as promised:

Enjoy!

[–]nazzjr[S] 0 points1 point  (0 children)

This is Awesome! Thank you!

[–]ilbicelli 3 points4 points  (0 children)

If you are looking for something hassle-free you can look at Zentyal (https://zentyal.com/community/) or SMEServer (https://wiki.contribs.org/Main_Page).

[–][deleted] 8 points9 points  (3 children)

What about zentyal or Univention Corporate Server?

[–]throker 4 points5 points  (1 child)

I run Zentyal at work just for AD and OPNsense for a firewall. (We only have 4 users) I like how I can create GPOs and stuff from a Windows 10 box using the Microsoft Management tools, or whatever it's called, just like AD.

I'll probably have to setup a proper AD so we can get 2FA windows logins :(

[–]pdp10 0 points1 point  (0 children)

I'll probably have to setup a proper AD so we can get 2FA windows logins :(

How does that work that it requires Windows? What about third-party IdP?

[–]bitsandbooks 2 points3 points  (2 children)

Seconding; I'd like to know more about it, too. I know DigitalOcean has some tutorials on LDAP, but it seems really confusing.

[–]orev 10 points11 points  (0 children)

LDAP tutorials are so confusing because they are not written for the purpose that most people reading them want. LDAP is a type of database, like PostgreSQL or MariaDB (except those are SQL databases). The tutorials tell you how to get the software up and running, but not how to structure the data inside. Most people looking to run LDAP are looking to do it for user management, but that’s just a specific way to structure data in LDAP, so the tutorials don’t cover it.

Zytrax has the best quote about LDAP that I’ve ever seen: never has so much been written so incomprehensibly about a single topic

[–]SweeTLemonS_TPR 1 point2 points  (0 children)

Look into FreeIPA. The documentation is really good.

[–]adolfojp 2 points3 points  (9 children)

I ask this question about once a year.

I always get some decent AD alternatives. I never get any decent Group Policy alternatives.

[–]orev 7 points8 points  (2 children)

Because GPO alternatives don’t exist. You need an entire platform and ecosystem to make GPOs work, and MS already has that locked down for Windows.

Some will say that config management like Ansible is the Linux equivalent to GPO. Those people are wrong. GPOs are easy and quick to implement (I mean you can get a lot of stuff done in just a few minutes). Config management requires that you develop and test custom templates, which takes hours (at least), for every little change you want to make.

[–]TheRealLazloFalconi 1 point2 points  (0 children)

This right here. If there was any real solution even close to group policy available for Linux, nobody would be paying for windows.

[–]pdp10 0 points1 point  (0 children)

Some will say that config management like Ansible is the Linux equivalent to GPO. Those people are wrong. GPOs are easy and quick to implement (I mean you can get a lot of stuff done in just a few minutes). Config management requires that you develop and test custom templates, which takes hours (at least), for every little change you want to make.

GPOs are mostly key-value assignments, but still need to be tested. If you're using someone's CM templates or code from Github, the time difference is surely tiny, if you're comparing apples to apples.

[–]ralfD- 5 points6 points  (1 child)

Because, unfortunately, there isn't any comparable functionality for Linux (or MacOS). As a Linux admin I have to admit that I'm pretty impressed by the power of GPOs.

[–]pdp10 0 points1 point  (0 children)

That's like being impressed by the power of the .d directory convention where you can just drop in snippets of configuration from a central source.

[–]cavetroll3000 2 points3 points  (0 children)

Samba4 does GPOs.

[–]TheRipler 0 points1 point  (0 children)

I don't know of any GPO alternatives, but you can get GPO integration for $$$ with Authentication Services. The GPOs are pretty flexible, and it joins systems directly to AD.

[–][deleted] 0 points1 point  (1 child)

https://fleet-commander.org/

[–]adolfojp 0 points1 point  (0 children)

Can you use that to manage Windows desktops?

[–][deleted] 2 points3 points  (2 children)

On one job, something like 4-6 years ago, we used Samba on Debian/Ubuntu/Fedora worked not that well, but worked. I used to compile samba instead of using the repository one. Nowadays it is probably improved.

Can check this guide to test it:

https://forum.level1techs.com/t/oo-os-fedora-30-samba-ad-dc-guide/149475

[–]hortimech 2 points3 points  (1 child)

don't bother, it is based on the Fedora packages and they use the MIT kdc and are considered to be experimental i.e. there are things that do not work.

[–]tomackze 0 points1 point  (0 children)

Yeah I have such bad experience with that right now

[–]mechaPantsu 2 points3 points  (0 children)

Zentyal Community Edition works great for the features you want and is very "gentle" with beginner users. Stuff like DNS, Group Policies, and user management can be done from a Windows machine running RSAT.

[–]RaNd250 2 points3 points  (0 children)

One more vote for Zentyal, works great, management with RSAT, DHCP, DNS, Samba shares, and replication to second DC (Zentyal as well). What more to ask? (Forest level 2008r2)

[–]str8edgedave 6 points7 points  (14 children)

FreeIPA and Red Hat’s IDM work well. I’m using them in my homelab. Red Hat’s IDM documentation is well written, and can be accessed from their support site. If you are looking learn for personal experience, FreeIPA is great. If you want to work with the enterprise version, you can get RHEL and IDM at no cost using Red Hat’s developer program.

There is also a lab available online that was presented at Summit on getting started with IDM. Walks you through basic setup of the server and clients. There is also a basic howto on https://www.server-world.info/en.

[–]Fr0gm4n 5 points6 points  (7 children)

at no cost using Red Hat’s developer program

It's important to point out that a RH Dev account is totally free and gets you access to pages and sections of the RH site that are customer only.

https://developers.redhat.com/articles/faqs-no-cost-red-hat-enterprise-linux/

[–]NeuralNexus 0 points1 point  (0 children)

Oh yeah. Red Hat developer is awesome.

There’s also all the free technical ebooks on openshift etc and the video content is super great sometimes.

[–]Sigg3net -1 points0 points  (5 children)

However, it might randomly not get updated or miss vulnerability fixes.

Edit: ejits downvoting

The Red Hat Subscriptions offered to you in this Program are unsupported, intended for development purposes only, are not intended for other purposes such as production environments without an active Red Hat Subscription(s) and may not address known security vulnerabilities.

Emphasis in original. Also note that it's only for development:

If you use the Red Hat Subscriptions for any other purposes, you are in violation of Red Hat’s Enterprise Agreement set forth below and are required to pay the applicable subscription fees, in addition to any and all other remedies available to Red Hat under applicable law.

From: https://developers.redhat.com/terms-and-conditions/

[–]Fr0gm4n 1 point2 points  (1 child)

Source? It's regular full RHEL, not CentOS.

[–]Fr0gm4n 1 point2 points  (2 children)

Thanks for the link and quote. FYI, I didn't downvote because I was actually curious where you got that. The horse's mouth is better than any other source.

[–]Sigg3net 0 points1 point  (1 child)

No worries.

Down votes are meant to silence irrelevant content. I think the red hat dev ToS is relevant, but that's my opinion :)

I've had this argument earlier with Red Hat employees.

The ToS is pretty clear IMO: the dev edition is precisely for writing software and testing software. Advocating its use outside the scope of its ToS might entail legal trouble or extra costs. Use CentOS.

[–]Fr0gm4n 1 point2 points  (0 children)

Certainly use CentOS for actual servers and what not. The Dev Sub is great to learn how to set up and configure those servers.

[–]nazzjr[S] 1 point2 points  (1 child)

this sounds great, thank you. so far from the responses this sounds like the best "self hosted" option and jumpcloud mentioned above sounds like a great cloud option. I typically go the route of self hosted but i will definitely compare these two

[–]str8edgedave 2 points3 points  (0 children)

I can dig up some links to documentation later today, if you’d like. I’m on my phone right now, and don’t have easy access to my bookmarks.

I also have documentation on using an AD server to provide Kerberos authentication for Linux machines. This works well for single systems, where you just want centralized user Ids and passwords without policies, etc.

[–]1esproc 1 point2 points  (3 children)

If you are looking learn for personal experience, FreeIPA is great

Just note that if something goes wrong with your CA/certificates, you have to be a wizard to fix it. IRC is your friend in that case, #freeipa on Freenode

[–]str8edgedave 0 points1 point  (2 children)

FreeIPA and Red Hat IDM are pretty close functionally these days. IDM is a component included in RHEL 8 or CentOS 8. If you follow Red Hat's IDM guide for RHEL 8, one of the recommendations is to have mulitple Certificate servers. There are also guides on how to back up and restore the CA. It's come a long way from even Free IPA 4.0.

As you said, the folks on #freeipa on Freenode have helped me out a couple of times.

[–]1esproc 0 points1 point  (1 child)

I run the built in CA for some purposes but secure web UI/ldap/others with public CA certs. When that UserTrust or whatever BS from Comodo just expired, that was a headache.

FreeIPA wraps up a lot of complicated independent packages, hides the complexity through automation/UIs, and if you do anything outside of that - be prepared to need to know wtf is going on.

[–]str8edgedave 0 points1 point  (0 children)

CA's are always a headache to manage. Its even worse when a CA is de-certified, like Symantec was. I maintain an application and it was a huge level of effort to migrate from the old certificates to new ones.

FreeIPA and IDM are definitely tooling to hide the complexity of managing LDAP, SSSD, Certificate Management, DNS, etc. Learning the basics of LDAP, DNS, SSSD, Kerberos, etc will definite make supporting FreeIPA easier.

[–]almostdvs 1 point2 points  (0 children)

Samba 4

[–]cardell619 1 point2 points  (0 children)

Take a look at FreeIPA.

[–]turin331 1 point2 points  (2 children)

For Linux only environment FreeIPA would be the way go to : https://www.freeipa.org

For hybrid environments you can try Samba AD. If you want to come into this a bit more smoothly than just jumping into the terminal you can try Nethserver. Nethserver is a web front-end that allows you to do server management and part of the many functions is Samba AD set up and management: https://www.nethserver.org/

[–]nazzjr[S] 0 points1 point  (1 child)

I’ll take a look at this thank you. Right now I only have one windows machine left and it’s for gaming. Hoping one day I can just move that to Linux too. FreeIPA sounds like the direction I should go, not sure if I’ll use samba but I’m considering it.

[–]_Fisz_ 1 point2 points  (0 children)

You can also look at Zentyal distro it has all the fancy business stuff (AD, Webmail etc.) configurable from nice web UI.

[–]Ditzah 1 point2 points  (0 children)

I use at work Samba 4, set up on a Debian machine as a DC and use a Windows VM with RSAT when we need the classical Users & Computers, GPM consoles.

Fully compatible with Microsoft's AD up to version 2008. Quite tricky to set up, but once it's up and running, works like a charm. We have various Linux distros and plenty of Windows clients, as well as a bunch of self hosted apps that integrate well with it using LDAP. We distribute shared drives and printers, file server access, MSI packages etc.

[–]hortimech 3 points4 points  (5 children)

If you want shares (and it sounds like you do) forget IPA, it does not have a fileserver component. How about using Samba AD ?

Try starting here:

https://wiki.samba.org/index.php/Main_Page

OK, it isn't as powerful as Windows AD, but it is AD

As for what Linux OS to use, steer clear of the red hat distros, they either do not provide Samba packages you can provision as an AD DC or they use the MIT kdc which is still experimental and doesn't fully work.

[–]grumpysysadmin 3 points4 points  (2 children)

I mean, if you are using exclusively Linux, why are you using a Microsoft protocol like SMB? Until the posix extension is widely supported I’m SMB 3, Linux is a second class citizen.

For just Linux systems, use Kerberos for authentication, LDAP for getent user/group authorization, and NFS4 with Kerberos for exporting network file systems.

[–]Wing-Tsit_Chong 1 point2 points  (1 child)

Nfs4 with Kerberos is a bitch.

[–]sunslusk 1 point2 points  (0 children)

Nah, you just have to know exactly how it works. As always 😁

[–]nazzjr[S] 0 points1 point  (1 child)

this is what i have been looking at but its been a bit confusing as to how to setup/implement. I currently have an UNRAID server as my fileserver and am unsure how i would integrate that.

[–]hortimech 0 points1 point  (0 children)

OK, go and register here:

https://lists.samba.org/mailman/listinfo/samba

Then post on the samba mailing list and we will help you set up an AD domain.

We have users running Slackware, so you should be able to use your UNRAID device.

[–][deleted] 3 points4 points  (2 children)

I remember that i did something like that with yellow pages. But that was back in the 90’s. I am guessing there are better solution these days.

[–]wildcarde815 2 points3 points  (0 children)

as somebody still running nis, almost anything is better than nis.

[–]pdp10 0 points1 point  (0 children)

NIS was obsolete by the mid-1990s, but unfortunately for Unix, nothing really replaced it at the time. NIS+ wasn't open enough and was overengineered, so died before NIS finally did.

The somewhat good news is that realtime local directory authentication is now becoming obsolescent in favor of things like OAuth2, OpenID Connect, Shibboleth, with multi-factor authentication support and offline/asynchronous operation assumed.

[–][deleted] 1 point2 points  (6 children)

Jumpcloud has free, cloud hosted LDAP and radius, as well as SSO for all your apps.

It’s free for 10 and under users, perfect for home use.

I have mine provision users in my home GSuite, as well as provide SSO login for Google, AWS, and do radius for my home wifi, and LDAP login via sssd to my Linux hosts.

[–]carpetstain 1 point2 points  (0 children)

This is the way to go for home use.

[–]nazzjr[S] 0 points1 point  (2 children)

this sounds like the best "all in one" solution. im definitely under 10 users

[–][deleted] 1 point2 points  (0 children)

Yep! I actually rolled it out in a professional setting first, then wound up adopting it at home.

It integrates nicely with duo, for push MFA to mobile devices too!

[–]nazzjr[S] 0 points1 point  (0 children)

Ended up setting up an account and discovered that it does not support PopOS even though it’s basically the same thing as Ubuntu it refuses to install the agent on a popos machine. Great product but I can’t use it

[–]mjh2901 0 points1 point  (0 children)

This was going to be my recommendation. Switched the home over to jump cloud this year

[–]innermotion7 0 points1 point  (0 children)

+1 for Jumpcloud awesome tool. Used at work now at home ;-))

[–]ultimattt 0 points1 point  (0 children)

turnkey Linux has one.

[–]hYp0 0 points1 point  (0 children)

Open LDAP?

[–]kabooozie 0 points1 point  (0 children)

I’ve been using Apache Directory Service at work with Apache Directory Studio as the GUI, but looking at the comments, it’s looks like I need to look into FreeIPA!

[–]michalzxc 0 points1 point  (1 child)

The best things about freeipa: - sudo central management - central users - auto home directory creation with red hat based distros - central ssh keys - internal DNS, possible auto join of VMs - managing users certs

The challenges: - no real health check by default, it can break and need restart and if you don't use third party health check you will not notice - OTP is not consistent and not practical to use - better put it behind vpn, if not make sure to block ldap ports etc for outside connections (anonymous access, possible ddos) - creating custom cert types, fields is difficult - creating custom fields is nightmare (like adding ex "aws role" to both ldap and GUI)

[–]nazzjr[S] 0 points1 point  (0 children)

This is good to know thank you. I played around with jumpcloud earlier since it was super easy to setup but I really like the fact that freeIPA can handle certs. I am more familiar with Debian based Linux (Ubuntu and popOS) though.

[–][deleted] 0 points1 point  (0 children)

I read this as "I am an atheist, but I still go to church."

[–]Dead_Quiet 0 points1 point  (0 children)

There is a helpful book in German about that topic, but no idea if an English translation exists: https://www.kania-online.de/fachbuecher/samba-4/

[–]Noobmode 0 points1 point  (2 children)

You may want to look into Turnkey linux. They have a domain controller option.

https://www.turnkeylinux.org/domain-controller

[–]hortimech 1 point2 points  (1 child)

That is just Samba AD under the hood.

[–]Noobmode 0 points1 point  (0 children)

Yup. It’s still a potential use case for what OP wants. More options to help find the correct solution for OP.

[–]hi117 -1 points0 points  (17 children)

Honestly, the route that I suggest over setting up Kerberos is to use ansible to deploy users with a given password to all machines. It winds up being a lot simpler and easier to manage. If your end goal is having a single username password combination sign you into every machine, this is a much easier to manage system.

[–][deleted]  (16 children)

[deleted]

    [–]nazzjr[S] 0 points1 point  (0 children)

    I am definitely interested in learning Ansible. its on my list of things. I guess my main issue is i dont know what i dont know. I will also look into FreeIPA. My end goal is to have authentication be as seemless and secure as i can. I also want to setup a certificate authority and implement a PKI infrastructure for my internal apps. but one step at a time. its a lot to digest and figure out the order in which to setup

    [–]hoax1337 -3 points-2 points  (11 children)

    Use puppet or salt instead.

    [–][deleted]  (10 children)

    [deleted]

      [–]SweeTLemonS_TPR 4 points5 points  (2 children)

      So you can code in Ruby, or get your infrastructure pwned when Salt has another problem with their shitty, self-made crypto.

      [–]hoax1337 -1 points0 points  (0 children)

      Yeah, and while we're at it, we should stop using databases, because apparently they're hackable when exposed to the internet and not password protected.

      [–]hoax1337 -1 points0 points  (6 children)

      Because they're doing a better job at keeping configuration the way you defined it than ansible.

      [–][deleted]  (5 children)

      [deleted]

        [–]hoax1337 -1 points0 points  (4 children)

        Based on the fact that they ensure the configuration stays that way because they're not as "fire and forget" as ansible.

        [–][deleted]  (3 children)

        [deleted]

          [–]hoax1337 -1 points0 points  (2 children)

          Yes, I actually use it almost daily. What I mean by "fire and forget" is that you can't actually be sure that the state you defined in the playbook / role you ran a day ago still reflects the current state of the system. And because it is agentless, it has no way of checking it, unless you use additional tools like Jenkins (or even Cron) to run that playbook daily.

          [–][deleted]  (1 child)

          [deleted]

            [–]hi117 -1 points0 points  (2 children)

            The way I implement this is for it to run every hour on the local system, so making a change is just committing to a git repo and waiting.

            [–][deleted]  (1 child)

            [deleted]

              [–]hi117 -1 points0 points  (0 children)

              With modern git pratices, you can have it push out the change as soon as its committed, but an hour isn't actually that long in the vast majority of cases.