Weblog entry #9 for lykwydchykyn
See all weblog entries made by lykwydchykyn.
I mean, take for example the recent news about the french MP's migrating to Ubuntu. With 1100+ workstations, I want to know:
1. What sort of single-sign on or Identity management solution are they going to use?
2. What sort of software deployment system?
3. Are they going to have any sort of desktop policies being deployed?
It seems like a lot of things are "roll your own" nowadays, there isn't really an integrated solution a-la NDS or AD.
Can anyone point me to some relevant material on Linux infrastructures? Case studies, how-tos, etc? I mean, I can find "how to setup LDAP", but not really anything relevant on how to use it, if you know what I mean.
Comments on this Entry
A lot of different opinions 'out there' :-)
---
stoffell
[ Parent | Reply to this comment ]
[ Send Message | View dkg's Scratchpad | View Weblogs ]
There were hiccups along the way, of course, but the system seems to function pretty well. If i got to do it again right now, i'd try to use NFSv4 and ditch the IPSEC business. Host-to-host encryption never did sit right with me anyway, because the real encryption layers you want are user-to-service (and vice versa). But alas, NFSv4 was even more in its infancy at the start of that project. Things move fast these days.
[ Parent | Reply to this comment ]
Redhat do a directory service, which is not so different to a roll your own OpenLDAP and Kerberos in terms of software, but the value add is in pre-written policies, schemas, and documented deployment steps.
It is definitely the case that this is an area of weakness because there aren't many large GNU/Linux desktop deployments in the style of Microsoft ADS. Typically client policies are managed by software installation, and config file synchronization, which isn't so different from how large GNU/Linux server farms are deployed.
Everyone I've met who have done big deployments are almost to a man thin client fans. Unlike Microsoft Windows, that was never designed for thin client, X and Unix were both designed with this in mind, and unless you have keen processing, or multimedia requirements, this is almost certainly the best way to meet traditional business desktop computing requirements and can vastly reduce the scale and complexity of deployment. If you have say 1 desktop server to 60 users, suddenly how do I manage the systems for 120 users, becomes how do I manage 2 servers, and suddenly OpenLDAP begins to look like it might be overkill. It is perfectly reasonable to run desktop Office apps for 60 users simultaneously on a low end x86 server hardware these days, you have to stick a lot of memory in, but it works really well. Indeed if they are mostly non-power users you can probably get 120 users on a server costing only 50 USD per user. This is becoming more of an issue as people expect sophisticated multimedia apps as standard desktop stuff.
Similarly fully automated install is pretty straight forward on modern hardware, so they places that didn't go "thin client", went with identical client machines, which can be remotely reimaged when the standard image is updated. Reinstalling the OS for simple updates seems like overkill, but it does keep things simple, and if the OS is largely "thin" or "thinnish", it doesn't really take long or require a lot of bandwidth to reinstall a few hundred desktops.
[ Parent | Reply to this comment ]
I've deployed a small network using LTSP and PXE, which is really cool (You know those "Holy poop, linux is awesome!" moments? I had one the first time I played around with LTSP). Just seems a shame to waste all that computer power at the client, though I guess if you're setting up "from scratch" that's not a concern. Of course, the thin client vs. fat client argument has been done to death, but it's a shame we don't have a good libre option.
Anyone know if there's a place where one can read some case studies of big deployments?
[ Parent | Reply to this comment ]
And "big" server is good for fast deployment to ordinary users.
It is much better to install software automaticly than to have a "golden computer" to make images from and distribute. Images doesn't scale as good as automatic installation.
[ Parent | Reply to this comment ]
I want to see some case studies on the nuts and bolts of it.
[ Parent | Reply to this comment ]
[ Send Message | View dkg's Scratchpad | View Weblogs ]
And with NFS, you don't need to automount the user's home directory, you can just mount the entire /home (or whatever) in /etc/fstab and people will just use it.
Do try to use NFSv4, though (though i haven't tried it myself) as it has a real per-client authentication model and built-in encryption possibilities (NFSv3 servers implicitly trust that the client workstation isn't lying about the user's identity, which is a bad bad thing unless you really lock down the client workstation).
[ Parent | Reply to this comment ]