OK, let me ask another question, O my mailing list friends:
What do you do for a living?
Specifically, I'm looking for people who make a living serving schools. What are the biggest pains in your collective asses?
--g
I consult for some schools and I work for a school district.
I hesitated to write this as a reply to the other question, but now you've asked the question to which I REALLY have an answer.
And the answer is... single sign on and MS Active Directory.
We want to be able to join a Linux box (K12LTSP server, usually) to an AD network and have home directories automagically mounted correctly (pam_mount needs to be enhanced to query the AD server, etc.), and we want to be able to configure Samba/LDAP easily for non-AD environments.
Our desired state of affairs is one username/password/homedir per person. If there's an AD server in place, we should be able to add the K12LTSP server to the AD domain and use the Windows home directories. If it's a new network, we should be able to create a new Samba/LDAP domain (answering a bare minimum of questions, with some "advanced" configuration options available) and be able to join Windows workstations to it with no hassles.
--matt
Greg Dekoenigsberg wrote: [Mon Apr 23 2007, 11:52:37AM EDT]
OK, let me ask another question, O my mailing list friends:
What do you do for a living?
Specifically, I'm looking for people who make a living serving schools. What are the biggest pains in your collective asses?
--g
-- Greg DeKoenigsberg Community Development Manager Red Hat, Inc. :: 1-919-754-4255 "To whomsoever much hath been given... ...from him much shall be asked"
Fedora-education-list mailing list Fedora-education-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-education-list
-- Open Source Software Engineering Consultant http://majen.net/
On Mon, 23 Apr 2007, Matt Oquist wrote:
I consult for some schools and I work for a school district.
I hesitated to write this as a reply to the other question, but now you've asked the question to which I REALLY have an answer.
And the answer is... single sign on and MS Active Directory.
We want to be able to join a Linux box (K12LTSP server, usually) to an AD network and have home directories automagically mounted correctly (pam_mount needs to be enhanced to query the AD server, etc.), and we want to be able to configure Samba/LDAP easily for non-AD environments.
Our desired state of affairs is one username/password/homedir per person. If there's an AD server in place, we should be able to add the K12LTSP server to the AD domain and use the Windows home directories. If it's a new network, we should be able to create a new Samba/LDAP domain (answering a bare minimum of questions, with some "advanced" configuration options available) and be able to join Windows workstations to it with no hassles.
Is any work going on here that you know of?
--g
winbind authentication is available through the Samba project, and with a some config-monkeying you can use that to join an AD domain. But to my knowledge there is no good way to mount Winders(TM) home folders at login, unless all of your home folders have the same path except for the username. It's been a couple of years, but IIRC pam_mount lets you specify a home folder path where the username is replaced with the name of the current user, but that's not sufficient for many schools' needs. Many districts have year-of-graduation in home folder paths. For example:
\PDC\homes\YOG07\asenior \PDC\homes\YOG08\ajunior \PDC\homes\YOG09\asophomore \PDC\homes\YOG10\afreshman
As I recall the situation, pam_mount doesn't have any capability of querying the AD server to directly fetch the appropriate home folder path for the current user, and that's something it should really be able to do.
WRT a Linux-centric auth/files network, Samba4 is attempting to provide AD-like services for Linux servers. I haven't been following the developers' discussions or anything, but from what I hear we have no real ETA on Samba4, so I'm not making any plans around it now.
In the meantime the Samba team has improved LDAP support in Samba3 (yay!), so that use of the smbldap-tools project is no longer necessary. This is a step forward, but based on what I read about it (I haven't tried it yet) it's still far too difficult/confusing for non-programmer/non-UNIX types to configure; I'm not at all comfortable telling most folks who are comfortable with an AD server to switch to Samba/LDAP on a Linux box.
In the meaner meantime, I've got a config-file-munging set of Perl scripts that get Samba/LDAP running on a server. It asks the right questions and puts the right stuff in config files. It's definitely not a polished solution and I've been waiting for years now for it to become obsolete. Nevertheless, quite a few people have found it useful. It lives at http://majen.net/smbldap
--matt
Greg Dekoenigsberg wrote: [Mon Apr 23 2007, 04:12:14PM EDT]
On Mon, 23 Apr 2007, Matt Oquist wrote:
I consult for some schools and I work for a school district.
I hesitated to write this as a reply to the other question, but now you've asked the question to which I REALLY have an answer.
And the answer is... single sign on and MS Active Directory.
We want to be able to join a Linux box (K12LTSP server, usually) to an AD network and have home directories automagically mounted correctly (pam_mount needs to be enhanced to query the AD server, etc.), and we want to be able to configure Samba/LDAP easily for non-AD environments.
Our desired state of affairs is one username/password/homedir per person. If there's an AD server in place, we should be able to add the K12LTSP server to the AD domain and use the Windows home directories. If it's a new network, we should be able to create a new Samba/LDAP domain (answering a bare minimum of questions, with some "advanced" configuration options available) and be able to join Windows workstations to it with no hassles.
Is any work going on here that you know of?
--g
-- Greg DeKoenigsberg Community Development Manager Red Hat, Inc. :: 1-919-754-4255 "To whomsoever much hath been given... ...from him much shall be asked"
Fedora-education-list mailing list Fedora-education-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-education-list
-- Open Source Software Engineering Consultant http://majen.net/
In the meaner meantime, I've got a config-file-munging set of Perl scripts that get Samba/LDAP running on a server. It asks the right questions and puts the right stuff in config files. It's definitely not a polished solution and I've been waiting for years now for it to become obsolete. Nevertheless, quite a few people have found it useful. It lives at http://majen.net/smbldap
--matt
I'll just quick make the claim that Matt's work on the Samba/LDAP installer is awesome. Many users from the k12ltsp@redhat.com mailing list and I am sure others all over have used this and find it awesome...and most importantly simple. The only thing missing here is a standard and easy to configure/use GUI LDAP/SAMBA management tool. I know there darn near hundreds of tools out there, but most are missing something. Matt has included excellent tools for the command line to bulk-import users and such. But an admin should not have to use a mixture of gui apps and command line to accomplish something. Not that it doesn't work, but it isn't as easy or consistent. I have tried at least a dozen different tools to admin Samba/LDAP still can't find an all in one solution. I'll just quick list what such a tool should be able to do:
Bulk import Users (all imports should be able to be from a text file and have the ability to import all applicable fields or just a single field and populate all others with custom defaults when left null) -Bulk import Groups -Bulk remove Users -Bulk remove Groups -Export current user and group base for move to a new system or to re-import after a server rebuild -Set custom defaults per user/group (ie: home folder location, privileges, default shell, etc) -Be able to show a tree view of users/groups -Allow selection of single or multiple users and groups and allow drag and drop to new location (ie move users from group to group) not very important to me but I have talked to many users who would like this feature. -And a huge option for larger districts would be to allow management of custom menus by group (for larger installs where an LTSP cluster might server grades k-12 and staff, an admin would want to offer a different application set to grades k-3 than for 4-7 and maybe 8-12 and also offer a different set to staff and teachers.
Thanks again Matt for all your work with Samba/LDAP.
On Mon, 23 Apr 2007 11:52:37 -0400 (EDT), Greg Dekoenigsberg wrote
OK, let me ask another question, O my mailing list friends:
What do you do for a living?
Specifically, I'm looking for people who make a living serving schools. What are the biggest pains in your collective asses?
See my first post to your first question. I won't put everyone through reading all that crap again :-)
Quick summary: Easy Management/Configuration of Server Services for both Master and Slave servers. Easy configuration of clients OS to use such server services. Something that doesn't require a second lifetime of Googling and forum posts and is standard enough that one doesn't have to weigh 1000 options (unless of course they want to deviate from the norm and do so). Windows may be a hunk of swiss cheese as far as security and as stable as me on stilts, but at least there are nice GUI tools and there is a "standard" method of implementing such services. Linux needs those, at this point most admins still choose the unstable cheese just because it is easier, foolish, but easier.
Greg Dekoenigsberg wrote:
What do you do for a living?
Sysadmin for K-12 schools.
What are the biggest pains in your collective asses?
General desktop bloat, Firefox and OpenOffice in particular, especially as applied to multi-user environments.
The short window of support for individual Fedora releases. I understand why that is the case, but it's still a pain point. The emergence of EPEL may reduce this somewhat, providing a wider breadth of free software that is easily installable and supported on RHEL and "other distros".
Directory services for mere mortals, as already mentioned by Matt Oquist. Honestly, outside of trivial installations, who gets by with /etc/passwd? Mad props to the Fedora DS guys for getting the core into Extras. What about the console? Are we waiting on compatibility w/ GNU Classpath, the free JDK, either?
education@lists.fedoraproject.org
-
Dan Young -
Greg DeKoenigsberg -
Jim Kronebusch -
Matt Oquist