9

I currently run a Windows server with Active Directory. But since we're no longer using Exchange 2007, it became a fancy file server with authentication.

I would like to move the AD to a Linux server. What would be the best way to do this? And which LDAP server should I use?

Update there won't be any Windows clients left. They'll be updated to Edubuntu.

Gert
  • 9,886
  • 3
  • 36
  • 37
  • Samba is trying to make there server be capable of being an AD server... I don't know the status of that project though... also OpenLDAP. – xenoterracide Aug 12 '10 at 09:15

2 Answers2

4

Samba v.3 is able to be a NT4 style domain controller. If you had a AD server running for Exchange, that is not good enough.

Samba v.4 will be able to be a Windows 2003 style domain controller, but is not done yet. Not by far.

Next question would be: do you have any Windows clients left? If so, you have a problem. Windows is not as pluggable as Linux. While it is possible to change a certain dll file (I forgot the name) to authenticate against a generic KDC, Windows was built to work with AD and with AD alone. Anything else requires altering Windows system dll's. That sucks.

If you do not have any Windows clients left, it becomes a lot easier. You can easily replace Windows AD with a combined Kerberos / LDAP solution. Kerberos kdc (Key Distribution Center) packages are in all distro's. LDAP servers are available in a lot of different forms. OpenLDAP server is in most distro's. A GUI based management tool for you LDAP directory is available from a lot of open source LDAP serers, like 389 and I think Apache DS too.

I mentioned the FreeIPA project in this context in another thread as an integrated solution, but it is only for Linux.

So, to make a long story short: do you have Windows clients on your network still?

Edit: Apparently not. So, build yourself a KDC, grab a copy of 389 DS and you're good to go. Then, you'll have to do some LDAP scripting to pull user information from the domain controller and insert it into your LDAP server. I don't think you can migrate the users' passwords though, you will probably have to reset those.

wzzrd
  • 3,690
  • 24
  • 19
0

Since you will migrate from a Windows based infrastructure to a Linux based one. I think that in addition to the setup of the new LDAP servers, you will need to migrate the user account information. If this is your case, maybe you could use the LDIFDE tool from the Windows AD Server to Export the required information. After that, you would import that information to the new Directory.