Linux In The Enterprise - Turning Point

[zeland]

We have plans to convert our whole organization into using Linux on our desktops by the end of the year. All our file, web, ftp, mail, domain, DNS/DHCP/WINS servers etc have already been converted over to Linux for a good year or so without much hassle. We have started a pilot project with one of the departments (about 8 PC's) to be the first batch of guinea pigs. We're trying with an assortment of 2xFC5, 2xUbuntu, 2xXubuntu & 2xFreespire.

The guinea pigs are happy with their transition over to Linux and were browsing the net, doing their e-mail almost instantly. The FC5 users were overall the happiest. The ability to quickly add fonts and play all sorts of multimedia files were quickly addressed with a little scripting and installing mplayer + essential codecs from the freshrpms repository. Ubuntu/Xubuntu was a bit more difficult. Freespire was out as we were required to subscribe for thier CNR thing before we could download additional software and patches. I later replaced the Freespire machines with another 1xFC5 and 1xUbuntu.

The meat of the problem now is to have the ability to logon to any Linux PC without needing to create a local user account and get network file sharing going as easy as Windows. I've tried going the samba + winbind way for the user logon problem but can't seem to get it working. The system just tells me incorrect username or password. For file sharing, all 3 FC5 machines were the easiest to connect to by playing around with the GUI authentication configuration tool and swat. Everybody can connect to them and access their files. I however can't seem to be able to get people to access the Ubuntu/Xubuntu machines. Another thing about file sharing is the ability to mount a share folder to a mount point. Currently, when you cannoect to a network share, gnome just creates a shortcut to the location using smb:// notation. Some software cannot access files that way and those that can, cannot save back to it.

I talked with some people and was advised to skip samba+winbind and just use plain NIS. From time to time, we'll also have consultans comming that are still using Windows so I guess still need to have samba around.

I would love to hear from anyone who has done an enterprise wide implementation of Linux on what Linux clients you use and what type of authentication backend (samba, winbind, ldap, NIS etc) you are currently implementing and deployment quirks.


--== Anything can go wrong. It's just a matter of how far wrong it will go till people think its right. ==--

 

[thedaver]

Wow, zeland. I don't have the advise you need, but I am very interested in your outcomes.

Have you considered chronicling your efforts on a blog/site? Setting, configs, topology, services, user-facing tricks-and-traps?

I think your effort, knowing your previous competencies!, would be a highly valuable road map to helping others follow along.

Please consider it, let us know if you do!
Dave.

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[lgarner]

You do need to mount the shares to get fairly seemless access. NFS might be much easier, but make sure that you use NIS or LDAP or some other central authentication mechanism, and definitely make sure that no one can modify the config files on the workstations.

Perhaps check out something like cfengine to manage your workstation configs, especially if you have many of them.

 

[zeland]

Over the weekend, I was trying to convert samba's backend from smbpasswd to LDAP. LDAP is somewhat of a new front for me. The perl scripts that are part of smbldap-tools (used to add/remove users, groups and machines) seem to be having some issues with missing files and unknown functions and I know nuts about perl. Will try doing this again on a fresh install to see if my perl is hosed.

As for mounting shares, we don't have the ability to point at any arbitrary share on the network and say 'map network drive' like in Windows. This at least doesn't seem to be possible on Gnome or maybe because we are not using LDAP as out backend. Our users liked Gnome as it looked 'clean & simplistic' as opposed to KDE. This seemed to greatly reduce the resistance to change. Freespire (KDE) however was able to mount shares into a common 'Network' folder. Will try to get a copy of Kubuntu to try this out.


--== Anything can go wrong. It's just a matter of how far wrong it will go till people think its right. ==--

 

[LawnBoy]

There's a very good perl forum here at Tek-Tips.

Good luck, I'm sure there are lots of people who'd like to see you pull this off.

 

[Trevoke]

My god, yes, please, BLOG IT!

"That time in Seattle... was a nightmare. I came out of it dead broke, without a house, without anything except a girlfriend and a knowledge of UNIX."
"Well, that's something," Avi says. "Normally those two are mutually exclusive."
-- Neal Stephenson, "Cryptonomicon"

 

[BobMCT]

zeland;

You might also want to consider installing WEBMIN on your systems that you wish to configure. It is a browser based configuration/admin tool that does configure samba server and shares very well. Also soes lots of other things for you.

http://www.webmin.com

Good luck. And PLEASE post/blog your experiences and results?

 

[LawnBoy]

Zeland,

Give us an update! Are things progressing smoothly?

 

[thedaver]

PLEASE!

D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[zeland]

Ah yes, an update on the project that failed politically. The implementation was somewhat difficult, especially on the integration of SAMBA and LDAP. At the time of my endeavor, I believe SAMBA version 3.0.21a was just released. All my machines were installed then updated with all the latests packages. Somehow or another, authentication wouldn't work and drive mapping was semi screwed. A Windows client could map a Linux share and Read/Write files and folders. A Linux client could map a Linux client's share but could only change folders, list file in folders and create new files. We couldn't create folder nor read files. Linux to Windows worked only if I went through nautilus using smb://[computer_name]. It was almost a 3 week affair with SAMBA and LDAP not working. It was really baffling. I encountered the same problem when I updated SAMBA on my Linux machines at home. A little bit of research soon revealed that 3.0.21a was buggy and building 3.0.21b from source was another project on its own. As a stopgap solution to the LDAP authentication problem, I used rsync to push /etc/passwd, /etc/group and /etc/shadow to all the clients every 15 minutes. Just dumb luck I would say.

To be honest, the whole Linux migration push of servers and desktops was always one man show. The other techs would deem themselves too busy or Linux to be insignificant to be bothered. The support and enthusiasm for Linux was never really there. At a time when business was slow, management “bared” with me on the idea of moving the servers off to Linux as they were trying to save a few bucks on legalization of software use. I use the word “bared” because there was objection to the use of Linux, but because Linux just worked while Windows had problems keeping its head above water, everyone stayed quite.

It later boiled down to a power struggle between people who knew Linux (Me) and people who didn't (The Rest). The Rest who resisted the Linux change thought that this was all a dubious plot for me to hold the company by it's balls. The fact that I had indicated my intentions of leaving to startup my own business in the near future might have further instigated the situation. I had since left the company.

--== Anything can go wrong. It's just a matter of how far wrong it will go till people think its right. ==--

 

[LawnBoy]

Too bad. I was really hoping you had overcome the inertia that keeps windows in the driver's seat.

I frequently face FUD when discussing linux with my cohorts. They're concerned that they don't know anything about linux. My response lately has been to ask what they know about Vista. I mean, if you're going to learn a new OS anyway, linux makes so much more sense...

 

[lgarner]

This doesn't sound political to me, just that it was a difficult migration due to elements that didn't work properly.

Not that the technical obstacles couldn't be overcome, but there does need to be a significant perceived value at the end of the project to justify its cost.

Incidentally, I have the standard Samba release on my platform running (3.0.10) and authenticating against AD (though not pulling users; the need Linux file sharing is extremely limited here and I use /etc/passwd). It works fine. So I do know that it's technically possible, but may require more effort for a large rollout than it's worth.