LDAP Series Part V - Getting a Grip on Directory Service Modeling
November 29th, 2006 by Tom Adelstein
I have an observation I'd like to disclose about the Open Source community: We tend to leap into all kinds of things before we have all the facts and/or information necessary to make intelligent decisions. We criticize other communities, laugh at things like directory services from the two major NOS players, talk about all our great applications, etc. We hang on to old notions about what makes Linux tick. Sorry, but that model ESR defined doesn't fit any more. The community natter appears to come mostly from people who lack deep technical skills and knowledge of enterprises.
While Linux has garnered a major part of the UNIX market, it has not made much progress in the enterprise management field. Without directory services to create a serious model of an enterprise, Linux will continue to remain a great application server. Under Novell, Linux will become a nice kernel for the Netware proprietary stack.
I'm also concerned about the technology leader, Red Hat. Their inability to utilize the assets purchased from AOL demonstrates a lack of vision. With Directory and Certificate servers, Red Hat has the ability to provide Identify Management, user management and a more secure network environment. It needs to move quickly because its competitor, Novell, has Open Enterprise Server and that puppy provides outstanding enterprise tools.
Where to Start
An LDAP directory service provides the framework for enterprise management. Open Source LDAP servers need numerous features to compete and evolve into an identity management system. Running OpenLDAP or Fedora Directory Server from the command line may work for some but without a visual model and the ability to replicate across an enterprise transparently OSS LDAP stagnates. Also, the lack of a visual tool keeps OSS advocates from learning how to use OpenLDAP as an enterprise directory. FDS has a visual interface that's outdated and doesn't provide features useful across the enterprise.
Learning OpenLDAP and/or FDS starts with what seems like unnecessary root level orientation. The model focuses on setting up the top of the tree. That may appear like a place to start if you’re a complete geek who loves to fool around the hacking hardware code. It doesn't do much for an administrator.
Admins need the ability to focus on Organization Units (the ou) and model their organizations in the directory sever. We need to manage departments, people and resources across an enterprise. I want to see a set of organizational units under the auspices of a root server and I want to manage my mail, dns, dhcp, web services, shares, users and security. But unless you have lots o' bucks for Novell, the typical admin cannot do that.
An emerging OSS Organizational Model?
Unfortunately and maybe fortunately, Novell needs a low cost competitor. I suspect that such a development group will emerge as a startup. I'd like to see such an effort come from the Debian community. It's even OK with me if the Ubuntu team puts it together. I believe the effort will require a large team of dedicated developers who can finish a project.
I don't expect Red Hat to do this. Red Hat is already stretched thin meeting its low cost business model. Additionally, for perhaps the first time, Red Hat may have problems competing with Novell. As a side note, I can see the latter going after the best people at Red Hat as long as Novell does a Chris Stone with their monkey managers. I wouldn't work for either of those chimps.
Also expect Redmond's Open Source Software Lab to work with Novell to allow it into the forest. Redmond lacks some serious management tools. For example, have you ever attempted to run any command to see who is logged on to a server in a MS enterprise? Run any command you wish and you won't see what we can do with a simple command like “who
__________________________
Special Magazine Offer -- 2 Free Trial Issues!
Receive 2 free trial issues of Linux Journal as well as instant online access to current and past issues. There's NO RISK and NO OBLIGATION to buy. CLICK HERE for offer
Linux Journal: delivering readers the advice and inspiration they need to get the most out of their Linux systems since 1994.
Sorry, offer available in the US only. International orders, click here.
Subscribe now!
Recently Popular
| Linux HOWTO: Video Editing Magic with ffmpeg | Jul-23-08 |
| Man vs. Myth: Greg Kroah-Hartman and the Kernel Driver Project | Jul-21-08 |
| Building a Call Center with LTSP and Soft Phones | Aug-25-05 |
| Google Gadgets for Linux | Jul-21-08 |
| Review: HP 2133 Mini-Note | Jul-16-08 |
| Boot with GRUB | May-01-01 |
Featured Videos
Non-linear video editing tools are great, but they're not always the best tool for the job. This is where a powerful tool like ffmpeg becomes useful. This tutorial by Elliot Isaacson covers the basics of transcoding video, as well as more advanced tricks like creating animations, screen captures, and slow motion effects.
Shawn Powers reviews the HP Mini-Note portable computer.
Thanks to our sponsor: Silicon Mechanics
Silicon Mechanics is a leading manufacturer of rackmount servers, storage, and high performance computing hardware. The best warranty offerings available are backed by experts dedicated to customer satisfaction.
From the Magazine
August 2008, #172
There's nuttin like a Cool Project to give you some relief from the summer heat, so get out your parka cuz we got a bunch of em. First up is the BUG, not a bug, The BUG. It's got a GPS, camera and more, in a hand-sized package that's user programmable. The BUG does everything. It's both a floor wax and a dessert topping. Get one now. Need a software version of a Swiss Army knife? Take a look at Billix, and don't leave home without it. Then, chew on this one, an X server on a Gumstix device driving an E-Ink display. Need more storage? How about 16 Terabytes? Can do.
And, of course, we have the usual cast of characters: Marcel, Reuven, Dave, Kyle, Doc, plus the new kid on the block Shawn Powers. But it doesn't stop there: build a MythTV box on a budget, build your own GIS system, set up the tools to monitor your enterprise and more. Finally, remember The War of the Worlds? Now you can play too.
Delicious
Digg
Reddit
Newsvine
Technorati







LDAP Series Part V - Getting a Grip on Directory Service Modelin
On April 17th, 2008 concon says:
Thanks for the suggestion…
__________________________muhabbet | Yonja | Netlog
gpinventory
On November 30th, 2006 Alan (not verified) says:
The application to see whos logged on to a machine(s) is called gpinventory. also does alot of other useful functions
Any decent sys admin would know about this tool if they did there homework. yes, it would of been better if this was bundled by default, but it's only a download away and can be run from and xp machine.
I do think there is a need for a competing directory services that is free and global for linux and windows, but isn't that a very similar function samba 4 will bring, and ldap backend that is supported?
It will be interesting what policy funtions it will bring, as the nt4 policy editor and registry editing is not an ideal way of doing things, as the funtions AD has where polices can be removed is pretty useful. unfortunatly, samba4 is a wait and see aplication, so only time will tell with the true functionality it will bring.
might be worth request group policy functionality to the samba team.
Fooled again
On November 30th, 2006 Tom Adelstein says:
From MS Download center:
Group Policy Inventory (GPInventory.exe) allows administrators to collect Group Policy and other information from any number of computers in their network.
alan wrote:
Any decent sys admin ...
ok big guy,
We're still attempting to find a MS command equivalent to "who"
who [options] [file] who am i
Show who is logged into the system. With no options, list the names of users currently logged in, their terminal, the time they have been logged in, and the name of the host from which they have logged in. An optional system file (default is /etc/utmp) can be supplied to give additional information.
We need to belittle people all the time
On November 30th, 2006 Tom Adelstein says:
Alan writes:
Any decent sys admin would know about this tool if they did there homework.
actually, one of the best admins I know gave me this bit of information - a gold partner. So, I should tell him he didn't do his home work. Should I call him a jerk? Maybe, just maybe, he should stop teaching and throw away all his certifications.
Merry Christmas
the joy of writing
On December 1st, 2006 Alan (not verified) says:
sorry, i didn't mean for it to come across that way... thats one of the most unfortunate things about non-verbal communication...it can get interprated in so many ways. i wasn't meaning this in a negative way and i did take the way you said it as "command" not "command line", to me command is anything run in the run box. again im sorry.
With xp and a 2000 AD infratructure.. MS were never really geared for the command line. more tools appeared for 2003, but there still not great at it.
the powershell, the new scripting thing from MS can do similar functionality with "Get-WmiObject -Class Win32_ComputerSystem -Property UserName -ComputerName COMPUTER"
but thats nothing near as nice as a single command, unless you encase it in a batch file of .vbs script. and this may not look at terminal client sessions.
MS current OS's as a whole are really just geared for GUI operation, so in a sense it is a semi futile quest to find such an utility. bit pants in comparison to *nix, but isn't that why more and more are adopting open source?
asked samba
On November 30th, 2006 Alan (not verified) says:
I asked tridge in #samba-technical about group policy functionality and he said he is looking to implement it although its not been a priority.
He also said he is working on a "when it's ready" POV for samba4, so if anyone wants to speed things up, they can always get involved with samba development.
From this, it feels like this will meet the requirements of your article, might be worth interviwing the samba team on this.
LDAP
On December 1st, 2006 Trent Murray (not verified) says:
I am constantly disappointed at the quality of comments made by some of our readers.
It would be nice to see discussion without a condescending comment or chest beating.
I hope that future readers who choose to comment to Linux Journal article s also take the time to choose their words a bit more selectively so that readers can benefit from the information shared without having to wade through paragraphs of flaming and unnecessary chest beating.
Engaging in squabbling in a public forums make linux professions look like amateurs and in my opinion only serve to undermined the spirit of the information shared.
LDAP
On December 1st, 2006 Anonymous (not verified) says:
Well articulated. My sentiments exactly.
-Tom