sideh

That's a very old guide from 2005. I wrote one recently for Ubuntu 10.04: Run Level 3 » Blog Archive » Ubuntu 10.04 Active Directory Authentication Anything obvious in the log file?

+1 on Nagios. I would also take a look at nagvis. (NagVis | NagVis.org) With nagvis you can display specific service or host groups with custom background images. Very cool stuff. I just used apt to install nagios. Slightly older version but much less hassle. Also, Nagios Exchange has a tonne of plugins for everything imaginable although It's fairly trivial to write your own. One thing I will say is that Nagios is a huge pain in the arse to setup, but once it's up and running its easy to manage.

If you'd done the ccna you'd know how to route two different networks. With regards to certs, most are useless. I did the comptia a+ and don't bother putting it on my cv. The ccna on the other hand was much much harder, and the ccnp even more so. The great thing about the Cisco stuff is that it teaches a lot of general networking concepts and not just Cisco specific stuff. Some of the terminology is slightly different but that's about it. The exams are very hard. For example, they give you a network simulator and will ask you to find x amount of faults without any clues. It could be an interface with a broadcast address set or a mismatched duplex/speed setting etc. They will also disable certain commands to make it harder. If I had to back to the beginning of my career I would start with the CCNA and then possibly the CCNP. This will help get your foot in the door. For everything else I just read the docs/buy a book or do a short training course.

Let me know if you have any difficulties with that notrainers guide and I'll update it accordingly.

Exactly what dhicks said. The syntax for rid mapping is: idmap uid = 70000-1000000 idmap gid = 70000-1000000 idmap backend = rid:”EXAMPLE=70000-1000000″ Where EXAMPLE is the short domain name. It will then use 70000 + the last four digits of the user's SID. This is how I did it: Ubuntu 10.04 Active Directory Authentication | Run Level 3 A few other things I tweaked were the following settings: winbind cache time = 60 <- default is 300, so if you add an AD user, it won't show up for 5 mins on the linux server. see smb.conf

After creating the two vlans you need to set the switch ports you want on those vlans to untagged (1 vlan per port). This makes it the default vlan for that port. The PVID for the ports should change. Making it tagged means the switch expects the frames to already be tagged which won't be the case unless it's an uplink/dot1q port or the frames are set to tagged from whatever network device is attached.

Yeah, if they're both joined via likewise-open you should be ok. I know winbind uses the last 4 digits of the user's sid in AD so likewise probably does the same, meaning that uids and gids they'll be the same from all machines.

I've written up the winbind stuff here: Ubuntu 10.04 Active Directory Authentication | Run Level 3 Hope it helps. As for mounting home folders why not use nfs? You can export them from an ubuntu server as long as its also joined to the domain so that users ids match.

I didn't use samba at all on clients. Just winbind, which uses stuff from /etc/samba/smb.conf. Then added winbind stuff to /etc/nsswitch.conf. There's a bit more to it but I'll get my notes tomorrow and write something up.

I've just finished implementing this at work. 1 Domain Controller with windows and linux (ubuntu 10.04) clients. With the ubuntu clients, authentication was done against AD like a normal login through gdm. They could change their AD password with the passwd command and a bunch of other stuff. When you say normal login, I take it you mean a login through gdm as you would do with a local account? I did try likewise-open initially but it was awfull. I managed to get it working and after a reboot it broke again. Winbind is farly easy to setup and it's perfectly possible to write a script to join a machine to a domain, something I'm planning on doing as it's all manual at the moment. I used the ubuntu wiki, there's some AD stuff on there. I still have my notes from my install which I can write up if you like.

I didn't do it with koha but with glpi and one thing that drove me nuts was the fact that AD doesn't allow anonymous binds for authentication, so you need to specify a search user. The error message I was getting wasn't indicative of this, it just said invalid login. Might be related to your issue.

Cheers for the info. I'll have a look at Auto-it. I've already partially done 1. I'm using wpkg to get newly imaged machines up and running. I use nlite to get xp installed then wpkg installs office 2003/pdfcreator/firefox/flash and a bunch of other stuff. Even some settings. However, I'm not even supposed to be using this hence I can't keep machines updated. I have to remove the wpkg client before I give someone a machine. I was told to use ghost console instead... Thanks for all your input btw.

Yeah, although it wasn't much help. Now it's being taken up by someone more senior than me who can hopefully resolve this. And if it doesn't get resolved soon I'll have to start looking for another job. And I totaly agree. Every OS has it's problems. I use the best tool for the job. If I need a simple file server, linux+samba. If I need to manage 150 staff machines, win+AD domain. If I need a webserver, bsd+apache. etc etc

I just wanted to get some opinions from people on this. I work at a branch office of a medium-sized business where we have about 150 odd desktops. All winxp pro. The IT manager has banned the use of windows servers entirely due to "security concerns". So here I am having to manage 150 odd machines without being able to push out applications (manual installs for everything), no group policies at all, no WSUS for updates, nothing like epolicy orchestrator etc etc etc. Has anyone ever come across an IT department like this? It's really starting to do my head in.

Imaging makes sense and it doesn't take much time. I can just schedule a few tasks through ghost console and all student machines are re-imaged overnight. As this is done overnight I don't need to wait for the summer. What I don't understand is all the server rebuilding going on. For example, our fileservers were setup in 2004 and they're still going strong. I have absolutely no reason to rebuild them. Our webserver was setup in 2005 and again I've never had a need to rebuild it. Eventually they will need replacing, but not yet.