On Thursday 16 February 2006 02:05 pm, Steven Williamson wrote: > Does anybody mange a windows network from linux specifically gentoo? > What software do you use to achive this. Im mostly interessted in achiveing > single sign on with LDAP > and controlling access to samba servers. But im also looking for > possibilites regarding managing software deployment. > I have had a brief look at unattended (on sourceforge) anyone any experince > with this? or similar set-ups?
I have a system setup using OpenLDAP combined with Cyrus-SASL and Heimdal kerberos. I have tied samba into it, and will eventually setup samba-tng as an authentication head for samba. With samba, I may use NTLM authentication to include more options for SSO. The way my setup works is samba has access to use LDAP for accounting and simple binds (over SSL/TLS). Unfortunately, samba doesn't support kerberos based authentication "(yet)". In this setup, the users sign on to their desktop, and the same login is used to access network shares without prompt for another password (this happens by default on most windows desktops) using NTLM. Various applications using SPEGNO/GSSAPI can provide autologin functionality using this same login if we chose to implement something to that effect, but that depends entirely on the applications we might use. For example, IE and Firefox support SPEGNO/GSSAPI, so enabled web applications may use this to authenticate the client without additional credentials. Another example may be squid, as it provides NTLM authentication mechanisms. Even if kerberos or NTLM authentication isn't possible I can still integrate other services such as pam, Jabber, samba, AND Outlook addressbook into LDAP using SSL/TLS and simple binds. This makes my setup more of a flexible centralized authentication system, than simply an SSO server. In the end, it all comes down to what auth mechanisms the apps you're using support in your ability to perform SSO. I have referenced a lot of these links for my setup. With them, there should be enough information to create a setup truly exact to your needs: Centralized authentication howtos: http://www.openinput.com/auth-howto/ http://www.bayour.com/LDAPv3-HOWTO.html Samba (TNG) and authentication: http://www.mami.net/univr/tng-ldap/howto/ http://www.deschner.de/gd/dual_samba.html http://www.mami.net/univr/tng-ldap/howto/sambausermapping.html http://www.samba-tng.org/docs/tng-arch/tng-arch.html Other misc resources: http://acctsync.sourceforge.net/ http://www.cmf.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html "Making the big boys play nice..." (one of my favorites) http://pgina.xpasystems.com/?page_id=3 In a sense, I have been trying to work toward SSO for a while. There are still many things that require a password on our network though. By centralizing authentication, I feel that I am one step closer. Anyway, I hope this helps. Regards, Robert Larson -- [email protected] mailing list
