6338371
story
Comments: 182 +- Technology: Windows Server Trusts Samba4 Active Directory on Saturday October 10, @01:42PM
Posted
by
timothy
on Saturday October 10, @01:42PM
from the honey-it's-not-that-you-don't-trust-me dept.
from the honey-it's-not-that-you-don't-trust-me dept.
background: url(//a.fsdn.com/sd/topics/topicnetworking.gif); width:71px; height:37px;
networking
background: url(//a.fsdn.com/sd/topics/topicwindows.gif); width:49px; height:65px;
windows
background: url(//a.fsdn.com/sd/topics/topicit.gif); width:75px; height:61px;
it
Darren Ginter writes "A group of Samba v4 developers recently spent a week in Redmond to work with Microsoft on Active Directory interoperability(?!). The result? Windows Server will now join, trust and replicate a Samba-based Active Directory using Microsoft-native protocols. Although Samba v4 is still in the alpha stages, this is a huge step for open source. Or it could be a trap."
Related Stories
Submission: Windows Server Trusts Samba4 Active Directory by Anonymous Coward
You never know what is enough until you know what is more than enough.
-- William Blake
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.
Of course it's a trap (Score:3, Insightful)
But the supreme court may void software patents, so it might not spring.
Re:Of course it's a trap (Score:4, Interesting)
And then - "Who do you trust and who do you serve?" [notnews.org].
Anyway - you can't be too sure about anything these days, but if Microsoft doesn't cooperate they will have an even lower respect from the open source community than they have today.
In the end Microsoft are probably needing this cooperation.
Parent
Re:Of course it's a trap (Score:5, Funny)
Anyway - you can't be too sure about anything these days, but if Microsoft doesn't cooperate they will have an even lower respect from the open source community than they have today.
Well, that explains the move to 64-bit. We were at risk of over-running the lower bound of the signed long integer that would have been required to express this new depth of loathing. Now, they're good until at least 2038. 8^)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
And the DOJ might enforce the antitrust ruling against MS... I am sorry but I think that there is little chance that SCOTUS will do that right thing here.
Re:Of course it's a trap (Score:4, Informative)
Parent
Oh, great (Score:5, Funny)
Windows Server will now join, trust and replicate a Samba-based Active Directory using Microsoft-native protocols.
Now I have to get ready for the 4 horsemen, rain of fire and the end of time.
Re:Oh, great (Score:4, Funny)
Parent
Re:Oh, great (Score:4, Funny)
In related news, this winter is set for record lows in Hell. Frost is being expected for the first time ever.
Parent
Re:Oh, great (Score:4, Insightful)
Parent
Re: (Score:3, Informative)
That was actually my first thought. The biggest reason I really don't think MS will submarine .Net/mono is because they haven't pushed back on Samba or WINE for this long. With this, I'm actually pretty comfortable with it.
It is probably a result of the interoperability push from the EU, especially considering the Samba guys were the ones that didn't capitulate to MS when the EU anti-trust trials were proceeding.
It's a nice story... (Score:5, Interesting)
Re:It's a nice story... (Score:5, Interesting)
I don't think it's an earth moving change in the relationship between MS and the free world, but it's better than a sharp stick in the eye.
I'll breathe easier if this doesn't result in legal trouble for Linux distributions and the *BSDs down the road. MS has a long, long way to go before I could ever trust them to do something with the open source community for any purpose other than to, eventually, obliterate it as a threat.
Publicly recanting the Halloween Documents, and particularly "embrace, extend, and extinguish" would be a start, if only a start.
OK, it's an MS-created protocol anyway, but I'm still very suspicious about MS management's ultimate motives in allowing this collaboration to take place.
Parent
Re:It's a nice story... (Score:5, Insightful)
I'm kind of surprised you don't get what's going on here. MS sees a way to make money from open source. I doubt they'll trumpet that from the rooftops, but I think it's exactly what's happening lately. This will be a selling point for Server 2008 and another reason for MS customers to upgrade from Sever 2003 to 2008. So this potentially has the ability to increase upgrade sales to existing customers and provide possible sales to new multi-platform customers.
Everyone is so worried about the MS of 10 years ago that I think they're missing the dynamic now. Free and/or Open Source software and platforms aren't going away. If you can't make your competition leave then you might as well capitalize on them and make money. MS has far more to gain from interoperability with Linux, BSD, and other open source platforms than they do from not working together (it's just taking a long time for the boardroom to move it in that direction). FOSS on the other hand has far less to gain, in my opinion, by working together and everything to gain by not making things work together since the main business model of FOSS is support service oriented.
I think what we're seeing with this and their VM offering is to make themselves a viable player with Linux in the server arena.
Parent
Re: (Score:3, Insightful)
I'm kind of surprised you don't get what's going on here. MS sees a way to make money from open source.
Get back to me in five years, and we'll see how this plays out. I'd love to see MS back away from its old policies, but they actually need to do it before I'll give them credit for it.
Re:It's a nice story... (Score:5, Insightful)
I think the point here is that Microsoft's behavior is being driven by the market. The market is clearly saying that they like a lot of the FOSS solutions. If Microsoft tries to pretend like these solutions does not exist, then they will allow a software ecosystem to develop in which they have no influence. A dominant player simply cannot allow that to happen.
In the case of FOSS, there is no way to bankrupt or buyout the competition. They still try to compete with marketing FUD, but it is obvious that that is only good for trying to slow the growth of FOSS.
This isn't about Microsoft turning over a new leaf. The real story is that market acceptance of FOSS solutions has grown to the point where none of the major players (including Microsoft) can afford to ignore it. For someone like me who has used Linux seriously for 15 years, seeing this kind of growth and acceptance is amazing. Linux used to be ignored, but now it is respected.
Parent
Re:It's a nice story... (Score:5, Insightful)
In the case of FOSS, there is no way to bankrupt or buyout the competition. They still try to compete with marketing FUD, but it is obvious that that is only good for trying to slow the growth of FOSS.
That leaves the legal route, and that's what I'm worried may be employed here down the road. I hope the Samba developers obtained a rock-solid agreement allowing them to use the results of the collaboration in the Samba project, now and in the future. I'm concerned that the company may attempt, without the knowledge of the MS developers who probably had a blast doing this, to argue that anything in Samba4 written after this project having to do with AD interoperability is covered by patents relating to AD, or that it descends from MS intellectual property accessed while they were at Redmond, etc. IIRC, one of the Linux NTFS coders had to refrain from working on the functionality for some time after working at Microsoft due to contract stipulations, slowing the development of stable write capability (this was years ago, so I could be way off here).
I can see how this is a possible sign of a culture change at Microsoft (and for that company's sake, I hope the EEE culture is withering away), but I can also see a few ways this could go horribly wrong based on the company's past behaviour. Their future behaviour will determine whether this was a good idea, and that's why I remain skeptical.
Parent
Re:It's a nice story... Institute a 7 YEAR CLOCK (Score:3, Interesting)
Publicly recanting the Halloween Documents, and particularly "embrace, extend, and extinguish" would be a start, if only a start.
Institute a 7 year clock.
Watch Microsoft actions over a seven year period, only start purchasing their products again if their actions over the last seven years show that they have honestly changed.
Anytime they spread FUD or Embrace or Extend or Extinguish or do anything, any action, to harm open source, FOSS and/or Linux RESTART THE CLOCK!
Your base your purchase decision based on their business decisions and actions, period. Let me say that again, based on ACTIONS, not WORDS or marketing FUD. Thei
It's a trap! (Score:4, Funny)
I look forward... (Score:3, Interesting)
Re: (Score:2)
Re:I look forward... (Score:5, Informative)
to being able to implement this at home and at work to word towards replacing Windows Server 2003.
For home or small office use, this [snia.org] might be an interesting read. It's the slideshow from Kai Blin's Samba ARMed and Ready: Running an Active Directory DC on 2 Watts talk on an embedded Samba4 DC.
Parent
A question of trust (Score:2, Insightful)
"Microsoft Windows" and "trust", do those two even go together?
Re:A question of trust (Score:5, Funny)
"Microsoft Windows" and "trust", do those two even go together?
only when joined together with the word 'anti'.
Parent
Re: (Score:2)
Re: (Score:2)
Popularity != trustworthiness, particularly regarding a company with a long, well-documented history of anticompetitive practices and protocol-busting behaviour.
I'm amazed so many people are willing to trust MS management's motives so easily. Maybe after they've gone a few years working with outside, even open-source developers, without pulling any technological or legal stunts to later eliminate those projects, will I be prepared to look kindly upon any effort involving MS.
Perhaps I'm just paranoid, or ma
Re: (Score:3, Insightful)
I have to disagree with your statement about popularity. If the majority of people didn't trust MS they wouldn't keep deploying it. That means that MS hasn't violated the trust of the majority and quite frankly, no one can please everyone.
While I agree that Microsoft shouldn't be trusted I understand that the majority of businesses out there do trust MS and only use basic functionality which in the Windows world simply works. Those of us that try to do unique things run into problems so we like flexible so
people think "PC == Windows" (Score:3, Insightful)
"Choice" is anathema to Microsoft. Gates, Ballmer, Mundie, et alia want Windows on every PC in the world, and they are willing to use every means, legal or otherwise, to convince people (especially clueless executives) tha
Re: (Score:3, Insightful)
"Choice" is anathema to Microsoft.
Steve Jobs to the rescue! You can get your Macbook Pro in any color, as long as it's silver.
EC mandate? (Score:2)
When I saw this article, my first thought was this was something Microsoft was doing just to show the EU that they would work on outside "vendors" to get them to work with their protocols.
Vendors is in quotes, as an open source project team really isn't a vendor.
Re:EC mandate? (Score:4, Insightful)
Vendors is in quotes, as an open source project team really isn't a vendor.
True, but it also gives Microsoft the most bang for their buck, since by working with Samba developers, the information gets out there for everyone to see. If I'm not mistaken, Microsoft requires you to pay for their documentation. Samba's interoperability is documentation in a real sense (and source code is almost always better documentation than something that a technical writer came up with), and this lowers the barrier to getting that information. I think that the EU will view this favorably, which is probably why Microsoft is doing this.
As a side note-- my gut feeling is that nowadays, Microsoft's closed-off protocols are a hindrance to them. At this point in the game, the lock-in is well-known and I think that works against Microsoft with many sysadmins planning new deployments. If, on the other hand, there is a large and open software ecosystem, sysadmins will look on Microsoft products more favorably. E.g., Exchange is quite full-featured as a groupware platform, relatively scalable, and fairly easy to use, but lock-in, cost, and infrastructure requirements are problems. But if someone can set up a Samba4 AD and run Exchange on top of it-- or even better, the other way around-- now we're talking. Microsoft's attitude up to this point, though, has made many people (me included) simply work to ditch the existing Microsoft software we use.
Parent
To all the doubters (Score:4, Insightful)
Microsoft have been working with the Samba folks for some time [zdnet.com]. I suspect this is more to shut the EU up than because they really want to, but if that's their purpose then starting to enforce patents against the Samba team would almost certainly be a most efficient foot-shooting exercise.
If I am being perfectly honest, the only frustration (and I'm sure it's got more to do with a lack of resources than a lack of talent - Samba probably needs about four times as many developers who know the protocol backwards and inside out, problem is most of them probably work for Microsoft) is the glacial speed this is all moving at. AD was introduced with Windows 2000, the Samba team have been working on getting Samba 4 out for years and it's still only alpha code. Frankly, only being able to provide something equivalent to an NT4 domain looked quaint four years ago. Today it's downright embarrassing for anyone claiming that F/OSS is functionally equivalent to Active Directory.
(note to F/OSS advocacy trolls: I am well aware that AD is little more than LDAP/Kerberos under the hood. When you compose your flames, perhaps you would be so good as to explain exactly how one can manage a network full of Windows workstations with the level of control AD policies offer using nothing but F/OSS software which has reached a reasonable level of stability. NT4 policies are a pretty lousy substitute.)
Re: (Score:3, Insightful)
>I suspect this is more to shut the EU up than because they really want to
Considering pretty much all IT shops are mixed shops, Im sure every MS rep gets an earful about how about a company with a few linux-based NASs or servers dont integrate with AD. MS is now in the position where it needs to embrace a lot of OSS or their customers will revolt. I suspect the MS of the 90s is behind us. The market is just too diversified and competitive now. Fixing SAMBA is something that should have been done years a
Re: (Score:3, Insightful)
As others have mentioned elsewhere in this thread, you don't have to. With a proper trust relationship now possible, you can actually use the same MS AD management tools yo
Smack!!!! (Score:2)
A trap? MS spent a week of developer time in cooperation with a Linux team for the express purpose of allowing interoperability. This is a level of cooperation that has previously been unheard of in the Linux community, with well publicized lawsuits filed in an attempt to get a hint of cooperation. Microsoft working with the Linux community at this level has previously only been dreamed of.
All this and some idiot has the audacity to think it might be a trap? For goodness sake, be grateful that it was possib
Really? (Score:3, Interesting)
A whole week? Here'a a nice memory jogger [theregister.co.uk] for you:
Only summer comes, and the code isn't ready. It isn't ready in the autumn, either, and this starts to play hell with Sendo's budgets. December rolls round, and according to Sendo, bugfixes that carriers have requested are being refused by Microsoft. Sendo is in a cash crisis, and a call to VCs is spurned. So Sendo asks Microsoft for a further cash injection, which is declined:
"Microsoft refused with the full knowledge that this refusal would push Sendo to insolvency", claims Sendo in the filing.
How did it know? Well, meet Marc Brown, who was by now acting in his capacity as a Sendo board member while continuing his day job as the director of Microsoft's corporate development and strategy group.
In the end Microsoft winds up with all of Sendo's cellular phone intellectual property as the company is liquidated:
"They were not entitled to such information under the terms of the SDMA" - the precursor to the February 2001 agreement that the two inked in the fall of 2000.
In fact, this SDMA turns out to have been Sendo's death warrant. As the company explains:
"Under the SDMA, in the event of a Sendo bankruptcy, Microsoft would obtain an irrevocable, royalty free license to use Sendo's Z100 intellectual property, including rights to make, use, or copy the Sendo Smartphone to create other to create other Smartphones and to, most importantly for Microsoft, sublicense those rights to third parties."
So... two years, 12 million dollars and a board member, and it does appear that it was a trap the whole time. To anybody who remembers IBM's partnership with Microsoft on OS/2 this tale will sound familiar. If you dance with the devil, you will pay his fee.
Re: (Score:3, Insightful)
So a company received money from MS after negotiating and signing an agreement and it's MS's fault that they are going under because they refuse to give them more money.
As far as IBM and MS are concerned, it was always an uncomfortable alliance and it wasn't as if the larger IBM wasn't used to playing hardball in the big leagues.
Besides, it was clear that IBM didn't didn't consider OS/2 to be a priority because they were very quiet in their promotion of it. There had more ads for the PC jr (with its chickle
Re: (Score:3, Informative)
Sendo did take them to court. The suit was settled in 2004 for money and Microsoft giving up their ownership stake. In 2005 Sendo finally went under and what's left was bought by Motorola [wikipedia.org].
This is in no way related to Microsoft's outright buyout of SideKick and Danger, which at last report was a square deal for cash and going swimmingly except for the minor data loss issue, the defections and the total absence of morale since the Pink Slips incident.
So apparently this whole SideKick/Danger thing had gott
This is good news (Score:5, Interesting)
back in 1995 I ran a small business that did Linux installs for companies to replace Windows NT Server systems with Linux plus Samba. We used Slackware Linux and then later Red Hat, but it did Windows file and printer sharing for Windows clients and saved those businesses thousands in Windows Server licenses.
But when Active Directory came out, companies switched back to Windows Server, because Linux and Samba lacked that. Exchange can be done via OpenExchange and use MySQL or PostgreSQL instead of SQL Server.
Linux has to match Windows Server feature by feature in order to compete with it, and be used. Linux might never replace Windows on the desktop, but it can replace Windows on the server as Unix and Linux are designed as server operating systems.
Re:This is good news (Score:4, Insightful)
... but it can replace Windows on the server as Unix and Linux are designed as server operating systems.
Unix (and by extension Linux) makes for an excellent general purpose operating system. Just because it was developed before desktops and graphical user interfaces doesn't mean that it isn't fully capable for such use any more or less than Windows (which was morphed from DOS). Mac OS X is an example of a very capable desktop operating system built on Unix. A general purpose operating system like Linux is "designed for" whatever people have built on top of it, and desktops running on top of *nix and X11 are not recent occurrences. Nowadays, X11-based desktops are extremely capable, and the development gap between Windows and such desktops has essentially been closed in the minds of many users.
So, let's drop the meme that Linux is designed for servers (thereby implying that it isn't designed for desktops or something). Instead, let's acknowledge that it is a good general purpose operating system which scales well from small devices to servers to desktops, and anything in-between. It just doesn't make sense to continue saying Linux was "designed as a server operating system" when it has really been designed for much more than that.
Parent
Re:This is good news (Score:5, Informative)
Windows (in the modern sense) has nothing at all to do with DOS aside from including a 16-bit virtualization layer (in the 32-bit versions) and R/W support for its filesystem (not that you'll see many FAT16 volumes these days).
Windows, or more correctly NT, was designed from the ground up to be 32-bit, multi-user, preemptive multitasking, support multiple APIs and/or ABIs (DOS, Win16, Win32, OS/2, and POSIX), be portable (the DOS-based Windows versions used assembly heavily, which made them fast and lightweight, but prone to bugs and impossible to port; NT is almost entirely C and has been ported to several completely different architectures), and be suitable for servers and workstations (not, initially, home computers). The lead designer of NT (and author of much of its kernel), Dave Cutler, used to be one of the leaders on VAX/VMS and other projects by DEC. http://en.wikipedia.org/wiki/Dave_Cutler [wikipedia.org]
Claiming that Windows was "morphed from DOS" indicates either a stunning lack of knowledge about the modern software world (the last Windows version in any way based on DOS was ME, which was quickly replaced with the NT-based 2000 and XP), or that you are simply a troll.
Parent
Re: (Score:2, Funny)
Are you saying the Samba folks are trying to EEE Windows server?
Re: (Score:2)
I trully hope not. I'm counting on this to workout.
Re:Just Don't See How This Could Be A 'Trap' (Score:5, Interesting)
Folks interested in saving a buck will start using Samba servers to either completely host or participate in Active Directory domains. The trap or catch will come further down the road when Microsoft patches something that breaks the functionality, at which point Microsoft will simply state that if you wanted something reliable you should have used genuine Windows servers. Don't believe me? The samba project is already rife with examples of this. Didn't we see Samba choke when enterprises tightening up security disabled ntlmv1?
I seriously doubt Samba-based AD servers will be fully functional anyway, just like Samba emulating an NT4 domain was just barely functional. Microsoft helped them figure out how to use the native Microsoft protocols to replicate the AD database instead of having to rely on the semi-functional openldap hack they had been using (actually be be more accurate, MS confirmed and correct their reverse engineering of the protocols).
Being able to replicating the AD database/ldap and form working trusts does not make Samba a good substitute for AD. It simply gives it an ability to co-exist with a real AD infrastructure. GPOs and most of the other desirable features of Active Directory are not implemented in Samba. Big businesses will still use MS boxes to ensure all the features work and its stable, since the cost of the software is not the driving factor.
Parent
Re:Just Don't See How This Could Be A 'Trap' (Score:5, Informative)
"Yes, Samba4 can emulate an AD server, if you don't mind having to maintain two sets of user and group accounts. Samba4 still requires either usermapping, or managing the linux users and groups separately. "
Wrong! It's certainly possible to use trivial mapping for Unix and Windows groups and accounts. It was possible to do this since the early days of Samba.
Samba4 even supports the full mapping of Windows ACLs which was the main missing feature in Samba3.
"It simply lacks the nice seamless integration of AD, and does not fully implement GPOs inheritances, etc."
Again, wrong. You can actually use Microsoft's tools to manage GPOs in Samba4.
"If you read the article, you'd see they barely got it to the point where a Win2008 server would talk to it enough to join the domain (not just replicate the LDAP database). That's a far cry full full interoperability."
Wrong. Win2008 server not just joined the Samba4 domain as a member. It has established a _trust_ _relationship_ with it. So members of Win2008 domain could now access resources in Samba4 domain with correct cross-authentication. And this is not a small task.
Samba4 is about >this close to the full AD replacement.
The main missing feature is printing, there's no support for it in Samba4. This task is being tackled in the 'Frankie' project which tries to use parts of Samba3 for printing.
Parent
Re:How many years has Samba4 been in development n (Score:4, Interesting)
I think you mean "this is a sterling example of how poorly documented and understood, even within Microsoft, Windows behavior is".
Microsoft had to dig into Windows kernel source to figure out why Windows didn't like what Samba was doing. How the hell was the Samba team supposed to figure it out from specs?
This is why the OOXML spec is six and a half thousand pages long and even then parts of it still read, simply, "do what Excel does here".
Parent
Re: (Score:3, Interesting)
So what you're basically saying here, is that Microsoft is not purposefully evil, but rather incompetent (like many shops) at documenting their source code and software behavior ?
What I'm saying is that this is not evidence of *Samba* being incompetent.
However.
You can't rule out both.
I have in the past said that I wouldn't mind Microsoft being the "Evil Empire" if only they were a *competent* Evil Empire.
Re: (Score:2)
And how will they sell licenses to people who download free software anonymously?
Re:Why can't Microsoft be a business too? (Score:5, Informative)
WTF? How can you possibly justify your position?
Lets just a quick "Lets get the facts straight campaign":
A 2003 license is $429.99 US ex tax (Euro pricing, I am sure that the US is cheaper) and that includes 5 CALs. Datacentre runs well and truly above your $3,000 figure, try doubling it if you want Hyper-V.
A 2008 CAL is about $30, but it's not just that you are probably going to want, it's sharepoint and everything else. So really, you just haven't done any research.
Lets run with your understanding about using Linux to connect to Windows, it's wrong.
If you aren't using their software, why would you have to pay for a Client Access License? I am sure you could make a donation to the Samba Foundation, and I am sure that they would appreciate it. Aside from that though, why would the protocols need a license? They have publicly posted the protocols, they got forced to by the EU as part of their anti-trust investigation. This was part of their settlement. They have also posted the protocols for Exchange and a number of other protocols; they had to.
Really, this is the whole point of Jeremy Allison going tot he EU hearings and testifying and everything else, to MAKE Microsoft go through the interoperate with everyone else. Take a look here: http://www.samba.org/samba/PFIF/PFIF_history.html [samba.org]
Disclaimer: I am not an apologist, I am a Linux advocate but I still use a lot of MS products in my day to day business
Parent
Re: (Score:3, Interesting)
The trap wouldn't necessarily be Microsoft claiming patent infringement but offering the technology with a license that's incompatible with the GPLv3's patent requirements. Since the GPLv3 and Samba going to the GPLv3 license, it would basically cause Samba 4 to discard all works done under the GPLv3 license and basically cripple Samba to pre-GPLv3 conditions with a lot of work to redo a lot of functionality and improvements.
I warned of this possibility way back when the GPLv3 was a heated debate and again