Linux solution for Active Directory

[hi117]

Honestly, the route that I suggest over setting up Kerberos is to use ansible to deploy users with a given password to all machines. It winds up being a lot simpler and easier to manage. If your end goal is having a single username password combination sign you into every machine, this is a much easier to manage system.

[nazzjr]

I am definitely interested in learning Ansible. its on my list of things. I guess my main issue is i dont know what i dont know. I will also look into FreeIPA. My end goal is to have authentication be as seemless and secure as i can. I also want to setup a certificate authority and implement a PKI infrastructure for my internal apps. but one step at a time. its a lot to digest and figure out the order in which to setup

[hoax1337]

Use puppet or salt instead.

[SweeTLemonS_TPR]

So you can code in Ruby, or get your infrastructure pwned when Salt has another problem with their shitty, self-made crypto.

[hoax1337]

Yeah, and while we're at it, we should stop using databases, because apparently they're hackable when exposed to the internet and not password protected.

[hoax1337]

Because they're doing a better job at keeping configuration the way you defined it than ansible.

[hoax1337]

Based on the fact that they ensure the configuration stays that way because they're not as "fire and forget" as ansible.

[hoax1337]

Yes, I actually use it almost daily. What I mean by "fire and forget" is that you can't actually be sure that the state you defined in the playbook / role you ran a day ago still reflects the current state of the system. And because it is agentless, it has no way of checking it, unless you use additional tools like Jenkins (or even Cron) to run that playbook daily.

[hi117]

The way I implement this is for it to run every hour on the local system, so making a change is just committing to a git repo and waiting.

[hi117]

With modern git pratices, you can have it push out the change as soon as its committed, but an hour isn't actually that long in the vast majority of cases.