Systems Integration

Making Many Protocols and Networks

Interoperate

           Nick Urbanik <nicku(at)nicku.org>
Copyright Conditions: GNU FDL (see http://www.gnu.org/licenses/fdl.html  )

A computing department

The Problem

There are so many Operating Systems: Microsoft:

Windows 9x Windows ce Windows nt Windows 2000 Windows xp Windows 2003

Linux, from various vendors Unix

Sun Solaris

aix from ibm

hpux from Hewlett Packard Apple: os X, and the previous mac os Cisco: ios, various others (e.g., for Catalyst switches, pix firewall,…)

OSSI — Systems Integration — ver. 1.0 – p. 2/14

So Many Protocols

Standard Protocols:

tcp^{/}ip smtp http ftp ssh  ldap telnet dhcp dns ppp  xml snmp soap radius tls  ntp nntp pop3 imap Kerberos

Proprietary Protocols:

Netbios (Microsoft file sharing) Active Directory wins Novell Directory Services Database services from many providers Appletalk Novell ipx

OSSI — Systems Integration — ver. 1.0 – p. 3/14

Many Different Hardware Platforms

So many computing platforms:

ibm mainframes handheld devices raid systems Cluster systems pcs Notebooks

So many different communication media: cat5 network cabling Wireless lans Gigabit Ethernet Optic fibre

Monoclulture

Why not just buy from one supplier?

How to Make them Work Together?

Free Software works hard to include as many protocols, file systems, vendor products, hardware platforms as possible

Solutions are cross-platform Java, Perl, Python, C, C^{++} Linux (runs on tiny handhelds to huge mainframes, almost everything between) Samba for integration with Windows Networks Netatalk for integration with Appletalk (for older Macintosh oss) Apache Web server runs on almost any platform Openldap for directory services

Prefer Open Protocols

Use open and standard protocols as much as possible Avoid “locking in” to proprietary solutions where a good open solution exists

Samba

Implements Microsoft’s smb protocol

smb = Symmetric Message Block, gave project its name

achieved through reverse engineering Microsoft’s proprietary protocols (no help from ms, but hindrance)

good reputation for stability and performance outperforming ms servers in both respects

Current production version supports use as a Wondows nt compatible server (file sharing, printing, support for network browsing)

Runs on many platforms, including very powerful Solaris machines

Most powerful windows servers run Solaris, not Microsoft software!

Samba 2.2.x

The release provided with current Linux systems Works as an nt 4 compatible pdc Winbind (part of samba) allows Linux and Unix machines to join a Windows Domain

Limitations of Samba 2.2.x

Does not support Active Directory in the way that a Windows 2000 server does

Samba 2.2 can neither be a Backup Domain Controller (bdc) nor use one

User information stored on a Samba pdc is not as complete as that stored on a Windows pdc

Samba obeys Linux group file access permissions on the pdc, but it does not tell the client machine about it properly. Group file permissions are hard to set from a client.

Full support for acls (access control lists) depends on applying a patch to the Linux kernel and recompiling the kernel, or waiting till the Linux 2.6.x kernel is released

Samba Version 3 (alpha release)

Currently used in some commercial systems, but documentation not complete

See

http://us1.samba.org/samba/ftp/alpha/WHATSNEW.txt

Supports Active Directory: a Samba 3 server can join an ads realm as a member server and authenticate users using ldap/kerberos

Supports migrating from a Windows nt 4 domain

Supports trust relationships with Windows nt domain controllers

Using ldap to Authenticate

ldap = Lightwieght Directory Protocol A network directory Can be used to store user accounts, group information, and information about network devices Any application can be made to authenticate against ldap Samba can use ldap to authenticate against Can build an infrastructure that uses ldap to authenticate everything

A Case Study: ict

We use Openldap to hold all user accounts (thousands), both full-time, part-time and staff All Linux systems authenticate against this directory Maintained only by me as a (very!) part time activity I did the programming in my spare time All home directories are on the same server

Next Step

The next steps are:

Provide better hardware We have an Adaptec clustering system with a dedicated shared raid system

Will run Red Hat Advanced Server Provide home directories via nfs (as currently do) and via samba Provide support for old Macintosh clients via Netatalk Provide a single sign-on for all services for all students and staff

Time frame: by next academic year.