Directory and File Service for All: ClearOS & SME

In a previous post I discussed Zentyal and FreeIPA as two options for FOSS ID management. Those servers provided directory service via LDAP and security services via Kerberos. In the case of Zentyal it provided a useful sub-set of Active Directory services that could (in some cases) replace a Windows small business server. The two servers under discussion today are a bit different, but supply some of the same features.

Both SME Server and ClearOS provide central ID management and CIFS file service, but without Kerberos or Active Directory compatibility. Both provide and easy to use web-based management interface, no need for Windows tools for managing your server.

SME Server

The Koozali SME (Small and Medium Enterprise) Server provides an easily set-up all-purpose network service appliance for small networks. It is based on CentOS (currently v6.6). In addition to ID management and CIFS file service, SME also provides many other services, whether you want them or not. At installation there are 3 options for the role that SME may play:

1. Server and gateway
2. Private server and gateway
3. Server only

I chose the "Server only" option, since I already had DNS, DHCP and routing implemented on other net components. Beyond the directory service (via OpenLDAP) and CIFS file service (via Samba v3.6.x) that I wanted, I also had an email server (SMTP/IMAP/POP) that I did not want. The trade off here is that SME is very easy to set up, but it is not very modular nor very flexible. Further, Samba does not use LDAP for it's credential store. By default, the server does not use LDAP for it's own authentication, although that can be changed by running a script apparently. Password synchronization between LDAP and Samba happens externally. So this means that there are 3 separate credential stores on SME: /etc/passwd,shadow, LDAP and Samba.

For my purposes I wanted a central directory service for authentication and a CIFS for personal and shared directories for 3 platforms: Linux, MacOS, and Windows. SME implements a Windows NT4-style domain through Samba version 3.6.x and provides the directory service via OpenLDAP version 2.4.x over SSL. SME gave me what I needed, but I was rather disappointed that it included email services that I did not need or ask for. I did not try out the gateway services: Firewall, DNS, DHCP and web content filtering.

Pros

• Provides LDAP over SSL for authentication and general directory service
• Provides Windows NT4-style domain for CIFS file service
• All services are open source and free of charge
• Easy to set up and manage

Cons

• No IPv6 support
• Provides Email whether you need/want it or not
• Divides authentication into 3 separate realms

ClearOS

ClearOS has some similarities with SME Server. Both are based on CentOS (currently v6.6). Both use OpenLDAP and Samba v3.6.x for directory and CIFS file services respectively. Both can provide gateway services as well as email services in addition to the directory and file services. Both implement Windows NT4-style domains for CIFS file service. There are some significant differences as well.

ClearOS is much more modular than SME, you add only the services that you need. Authentication is centralized in LDAP for all services. ClearOS can provide commercial services and subscriptions to extend it's capabilities.

My requirements were the same as those for SME server: Directory and file services for Linux, MacOS and Windows. In addition I did try some of the gateway services with ClearOS, but they won't be discussed here.

The various services come in packages that you can add individually. Once added, I could not find a means to "un-add" them through the management interface. Once the package is installed, you are stuck with them, so choose carefully. Here is a screen-shot of the modules I installed (including the gateway services):

I tested the "Community" edition of ClearOS. Some of the available packages are only available in the commercial or "Professional" edition. All of the modules I tried out were free of charge. One of the commercial (not free) additions available in the ClearOS "Marketplace" that I am interested in is the "Google Apps Synchronization" service. At present I don't have a Google Apps domain, but even if I did it would require the "Professional" version of ClearOS. The prices for the commercial services and subscriptions are generally rather reasonably priced. The "Community" vs. "Professional" dichotomy is no different than many "freemium" offers for software on the net. I would have preferred a straight commercial support option rather than splitting the server into two distributions. The Community edition is quite adequate for many purposes. There were 79 free Marketplace applications available for the Community edition.

Pros

• Provides LDAP over SSL for authentication and general directory service
• Provides Windows NT4-style domain for CIFS file service
• Easy to set up and manage
• Flexible modular architecture
• Extensible via add-on "Marketplace" applications

Cons

• "Professional" version needed in some use cases
• Marketplace applications can be added but not removed
• Limited IPv6 support (optional and set up manually; not all services supported)

Conclusions

The use of Windows NT4-style domain may seem a step backward from Active Directory or even FreeIPA, but it has it's uses. The Samba implementation of NT4-style domains does not require changes to existing DNS domains (as both AD and FreeIPA do), since they use a separate naming service (WINS). This means they can be more easily integrated into existing networks without the need to create sub-domains (as I have done in the past). The CIFS distributed file system may not be the best available, but it is the most widely supported and the NT4 domain makes such file systems easier to share in a diverse network supporting all three major platforms (Linux, MacOS and Windows).

Of the two systems discussed here, I prefer ClearOS to SME. Both are usable and useful, but the modularity and extensibility of ClearOS, along with the unified LDAP authentication tip the balance for me. The commercial nature of ClearOS will dissuade many users. The model I have in mind when evaluating these systems is a small K-12 school. Schools have needs that many small businesses and home networks do not have. The use of Chromebooks in schools is widespread and on the rise, so integration of the campus network with a Google Apps domain that can be used to manage Chromebooks would be a plus; the availability of a packaged GADS application that would allow managing accounts and passwords in one place is a real win for ClearOS, even if it costs $125/year through their "Marketplace".

Links

SME Server: http://wiki.contribs.org/Main_Page

ClearOS: http://www.clearfoundation.com/Software/overview.html

Notes on LDAP client authentication:
https://drive.google.com/open?id=0B6yzbC9y4l-CMkVtejRKaUEzX0k

Zentyal and FreeIPA: FOSS ID Management Options

In the past I have used OpenLDAP combined with Samba3 on CentOS 5.x for cross-platform, centralized authentication services (https://sites.google.com/site/fossvi/centos-5.x-smbldap-fix). Unfortunately that setup has become obsolete, so I have been searching for a more modern system to replace it. The most important criteria for such a system are:

• - Freely available without licensing hassles
• - Run on Linux servers
• - Support Linux, Mac and Windows clients
• - Use encrypted transport for credentials
• - Easily deployed and maintained

I have so far come up with two likely candidates: Zentyal and FreeIPA. The purpose of this posting is to highlight some of the features of these systems and to discuss their pros and cons.

Zentyal 

Zentyal is based on Ubuntu Server LTS (currently 14.04), BIND9 and Samba4. It is intended to be a drop-in substitute for a Microsoft Windows Small Business Server. It's modular design allows it to fill any of several roles. For my purposes I used it as an Active Directory primary domain controller and CIFS file server. While it is a useful sub-set of an Active Directory server, it does not offer all the features that the Microsoft original does. On the other hand, the open source community edition is the right price (free), and there are no CALs to buy.

My testing of Zentyal was conducted on a virtual network built with Virtualbox on a Linux Mint 17 host. The clients were Mint and Debian Linux workstations  using the closed-source Centrify Express client software for joining the hosts to the AD domain. The "Express" Centrify clients provide only basic AD functionality, but again the price was right (free). Centrify Express can be used freely on up to 400 clients for educational institutions (200 for government and commercial institutions). Beyond that scale, or if you need fuller functionality, the full Centrify suite would be required (not free). Centrify offers their software suites (both Express and full) for Mac and Windows too. The full Centrify suite provides full AD functionality and more.

Zentyal clients are authenticated via Kerberos, with group membership and authorization information etc. stored in LDAP, just like Microsoft. LDAP and CIFS are provided by Samba4. A Zentyal server can participate as a primary or additional AD domain controller. Server administration is handled via a web interface running on the server, so you don't need a Windows workstation to manage the server.

Update (22Aug2015):

If you wish to join a recent release Ubuntu client to Zentyal (or any Active Directory Server) then there is a working alternative to Centrify. The "realmd" package is a front-end to sssd (or winbind, reputedly) that can be used to join Ubuntu to an AD domain. There is a good "howto" by Myles Gray on his blog entitled: "Utilising Kerberos/AD auth in Ubuntu 14.04 with realmd". For Linux Mint (v17.2 Mate), I had to tweak a few things to get it working, you can see my notes here.

Pros

• - Easy set-up and management
• - Provides standard AD protocols (krb5, LDAP, AD schema, DNS SRV RRs etc.)
• - With Centrify, easy client enrollment for Linux, Mac & Windows
•  - The "realmd" package makes joining a Zentyal/AD domain easy for Ubuntu & Fedora 

Cons

• - Rigid organization structure
• - Limited DNS functionality
• - Can't be easily used as generic LDAP server
• - Doesn't support IPv6
• - Almost requires 3rd party SW for some Linux & Mac clients

FreeIPA 

FreeIPA is an open source system for ID managment developed by Red Hat. It combines the "389 Directory Server" (LDAP), with MIT Kerberos 5, BIND 9 and Certmonger/Dogtag (certificate managment). While FreeIPA is intended to provide secure ID managment for Unix-like systems, it is capable of providing one-way Kerberos trust relationships with Active Directory domains(AD to FreeIPA). FreeIPA is included in the core repositories (both client and server packages) of the common RedHat Linux derivatives (RHEL, CentOS, Fedora). The FreeIPA client packages are also found in repositories that serve Mint. For a "Howto" on enrolling Linux Mint clients you can go here.

Unlike Zentyal, FreeIPA does not "look like" Active Directory. It does however utilize the same basic approach, using LDAP storage and Kerberos authentication. Unlike Zentyal (and AD) FreeIPA can be easily used as a generic LDAP server. This ability allows authentication by many services that may be difficult to integrate with AD or Kerberos. For Ubuntu, Mint and Debian clients, I can use bare-LDAP authentication. In the past I have used bare-LDAP to authenticate Mac OS X clients (Tiger and Leopard). By using LDAP over SSL (LDAPS), I can have secure centralized authentication without resorting to 3rd party software. I lose the single-sign-on (SSO) capability that Kerberos enables, but  otherwise this is quite adequate in many situations. Beyond bare-LDAP, I was able to enroll Mint and Fedora clients in a FreeIPA/Kerberos domain. When enrolled within such a domain, client IP addresses are recorded along with SSH public host keys and host certificates (provided by certmonger/dogtag). There are no pre-built FreeIPA client package for Mac or Windows hosts. While there is documentation on how to go about manually configuring Windows and Mac hosts to enroll in FreeIPA, I consider those instructions to be too intricate and error-prone to be used by any but expert admins; Macs should readily be able to use bare-LDAP however.

Enrolling Mint clients only succeeded by *not* using sssd (the default setup used by freeipa-client) but utilizing nss-ldapd and pam-krb5 instead, plus manually adding one line to the pam session configuration file (to automatically create home directories). Once these steps were taken, everything went well and worked as expected.

I ran into a "hiccup" when attempting to enroll Fedora v21 (newly released while I was testing) with my CentOS v7 FreeIPA server. The FreeIPA version on CentOS 7 was v3.3.3, while the FreeIPA client version supplied with Fedora v21 was the newer v4.1.2. Enrollment completed, but several key pieces of information did not end up recorded on the server: DNS info, SSH host public keys, and host certificates. Authentication and authorization worked fine. This result combined with a reading of the FreeIPA FAQ leads me to believe that currently, FreeIPA client and servers should be in the same major release version (v3 or v4 but not mixed) for full functionality. I was able to enroll Fedora v20 in FreeIPA without any suprises (used the v3.3.5 client), and even upgrade it to Fedora v21 (via FedUp) without incident. So only the enrollment process seems to be affected by these differing software versions.

The CentOS/FreeIPA server that I used does not provide an integrated CIFS file service. Adding the schema and functions to integrate Samba4 are beyond my brief. File service options would be limited to SSH and NFS (the latter can be Kerberized NFS4). This is unfortunate, because neither of these protocols can be used (for mounted file systems) by newer Macs without 3rd party add-ons.

FreeIPA is managed via a web interface. This management interface is more full-featured than that of Zentyal. The BIND 9 server is more flexibly managed; I believe it could be used as a primary DNS server for small to medium enterprises, though I used it only within a sub-domain for testing.

Pros

• - Easy set-up and management
• - Can be used as generic LDAP server
• - Easy enrollment for Ubuntu/Mint and RedHat/Fedora derivatives
•   - Supports both IPv4 and IPv6
• - Flexible DNS functionality

Cons

• - No integrated CIFS file service
• - No pre-built Windows or Mac clients
• - Enrollment of Ubuntu/Mint client requires minor tweaking
• - Client - Server enrollment is version sensitive

Conclusions 

Both FreeIPA and Zentyal are usable and useful. If you are dealing with mostly Linux clients I would use FreeIPA, with Kerberos (full enrollment) or without (as a bare-LDAP server). If you have some Macs, you could still use FreeIPA as a generic LDAP server, but the lack of CIFS file service will be limiting. If you have primarily Windows and/or Macs, then probably Zentyal along with Centrify client software would be the better choice.

FreeIPA's better performance as a generic LDAP server may make it easier to integrate with GADS (Google Apps Directory Service), although with passwords stored in Kerberos it means that while the accounts can be synced, passwords would have to be managed externally (true for AD and Zentyal as well).

Personally I like the "feel" of FreeIPA better than Zentyal. FreeIPA feels less restricted than Zentyal. The simplicity of the Zentyal management interface comes with the cost of less flexibility.

These two solutions have different target use cases: FreeIPA could manage a fleet of Linux virtual machines in the cloud, while Zentyal is a drop-in for a small business (or school) with Windows workstations. Both solutions are under active development and are bound to become better with time.

While both FreeIPA and Zentyal are useful solutions for central ID management, neither of them quite replaces the basic functionality of my old CentOS-5/OpenLDAP/Samba3 system, which provided authentication and CIFS file service for Linux, Mac and Windows clients (via Samba NT-style domain configuration), but also could be used as a generic LDAP server for use with Squid proxies, web and RADIUS servers etc. While the old system didn't provide Kerberos, and the single-sign-on it provides, it was still quite useful, reasonably secure  and didn't require a third-party client on any of the three platforms.

Update (15 June 2016)

I have received some tips that will allow Mint users to install FreeIPA just like Ubuntu and utilize sssd rather than rely only on LDAP. This information came from Brendon Bonner:

"Reading https://sites.google.com/site/easylinuxtipsproject/mint-cinnamon-first

1.2.1. Mint deviates from the Ubuntu way, where the so-called "recommended" packages are concerned. When you install software yourself, Ubuntu installs the recommended packages by default, but Mint does not.

This has two important disadvantages: in Mint, the features of the applications that you install yourself, can be needlessly crippled. And some how-to's for Ubuntu, don't work in Mint. All this for the sake of saving some disk space...

You can make things right like this:

Menu button - Administration - Synaptic Package Manager

Settings - Preferences - tab General
Section Marking Changes: tick: Consider recommended packages as dependencies

Click Apply

Click OK.

Furthermore, you need to change the setting "false" into "true", in the settings file /etc/apt/apt.conf.d/00recommends. That's easiest to do in the following way:

Menu - Accessories - Terminal

Copy/paste the following command line into the terminal, for example by a right-click with your mouse (this is one line!):

sudo sed -i 's/false/true/g' /etc/apt/apt.conf.d/00recommends

Press Enter. When prompted, type your password. Your password will remain entirely invisible, not even dots will show, this is normal.
Press Enter again."



Links

• - FreeIPA http://www.freeipa.org/ 
• - Zentyal  http://www.zentyal.org/server/
• - Centrify Express http://www.centrify.com/express/centrify-express-overview.asp 
•  - Realmd http://www.freedesktop.org/software/realmd/