DC Demotion Question
-
@tiagom said in DC Demotion Question:
Good points.
In my environment I use AD for other services like VPN and version control and if AD goes down those services are also effected.
Its a give and take i guess. I could have the services independent of each other but then im stuck managing multiple accounts databases and that is messy at best.
That's a good point. We also authenticate the VPN against AD.
-
But ultimately, it definitely means taking a bit of a risk.
But as a SOHO/SMB, I think it's safe.
You probably are in the same boat as the only IT guy where you are.
-
@tiagom said in DC Demotion Question:
Original it was using sonicwalls built in user database, but it was messy. On hire and fires we need to go to multiple systems to enable/disable their access. Users would constantly forget their passwords as they had different account/passwords for each service.
That's why we use keys, no user interaction, very secure. And it only exposes AD after the connection is secure.
-
@BRRABill Yup same boat. Solo it guy.
-
@scottalanmiller I agree that is a superior but i would still have issues with the other services.
-
@tiagom said in DC Demotion Question:
@scottalanmiller I agree that is a superior but i would still have issues with the other services.
How crippling are those other services? Do they affect everyone, just a few people?
-
Varies on the service. But some of them can have engineers or our manufacturing floor at a stand still.
-
@tiagom said in DC Demotion Question:
Varies on the service. But some of them can have engineers or our manufacturing floor at a stand still.
Can't you replicate those services on other servers and leave AD singular?
-
Why isn't there an open source product that can replicate AD? That would solve all our problems!
-
The services authenticate against AD using LDAP.
-
@BRRABill said in DC Demotion Question:
Why isn't there an open source product that can replicate AD? That would solve all our problems!
There is. Samba4 functions as AD completely. LDAP will replicate it, like FreeIPA.
-
@tiagom said in DC Demotion Question:
The services authenticate against AD using LDAP.
So you have double dependencies, if either AD or LDAP fails everything goes down?
-
I happened to have spare licenses already in house, so it was the "simplest" solution.
-
It is single dependency as i understand it. If AD goes down i cant use a LDAP query again it.
-
@tiagom said in DC Demotion Question:
It is single dependency as i understand it. If AD goes down i cant use a LDAP query again it.
That's one dependency. But you depend on LDAP as well. What if LDAP goes down?
AD needs LDAP, LDAP needs AD. It's an "and" not an "or".
-
@scottalanmiller said in DC Demotion Question:
@BRRABill said in DC Demotion Question:
Why isn't there an open source product that can replicate AD? That would solve all our problems!
There is. Samba4 functions as AD completely. LDAP will replicate it, like FreeIPA.
Could one of those provide redundancy for AD in a 1 server scenario?
Save some licensing costs?
-
@scottalanmiller said in DC Demotion Question:
@tiagom said in DC Demotion Question:
It is single dependency as i understand it. If AD goes down i cant use a LDAP query again it.
That's one dependency. But you depend on LDAP as well. What if LDAP goes down?
AD needs LDAP, LDAP needs AD. It's an "and" not an "or".
Maybe im missing something but..
I have the service and AD(/DC). The service uses a ldap query's against AD.
If the service goes down well then we never get to authenticate. If AD goes down the service will still try to authenticate but fail.
-
@BRRABill said in DC Demotion Question:
@scottalanmiller said in DC Demotion Question:
@BRRABill said in DC Demotion Question:
Why isn't there an open source product that can replicate AD? That would solve all our problems!
There is. Samba4 functions as AD completely. LDAP will replicate it, like FreeIPA.
Could one of those provide redundancy for AD in a 1 server scenario?
Save some licensing costs?
Samba4 can, but doesn't do the LDAP portion that he needs.
-
@tiagom said in DC Demotion Question:
@scottalanmiller said in DC Demotion Question:
@tiagom said in DC Demotion Question:
It is single dependency as i understand it. If AD goes down i cant use a LDAP query again it.
That's one dependency. But you depend on LDAP as well. What if LDAP goes down?
AD needs LDAP, LDAP needs AD. It's an "and" not an "or".
Maybe im missing something but..
I have the service and AD(/DC). The service uses a ldap query's against AD.
If the service goes down well then we never get to authenticate. If AD goes down the service will still try to authenticate but fail.
Oh, you are hitting AD directly, not talking to an LDAP server? Commonly for non-AD enabled services people use federation for AD to sync to LDAP and then they hit LDAP directly. Like with FreeIPA.
-
@scottalanmiller There's the disconnect.
Yup hitting AD directly.
I see interesting, i haven't been in that scenario. Is that the only way to do it, or just the most common?
