Linux Domain Controller
-
That's where a VPN like Pertino is handy.
-
Did I miss the part where you tried to actually join the SAMBA server to the domain to make it a DC?
As Scott mentioned you'll want to do this over a VPN like Pertino, you definitely don't want to open ports 135, etc to the world on both sides (at C@C and at home) to make this work, which you'd be required to do if you don't use VPN.
-
Haha its funny I actually came on here to say "At what point am I prompted to join this to the domain" seemed like all I was doing was making a file share so far.
So to use Pertino for example I would need the VPN on every machine I assume?
I guess my initial plan here is mail server (or SMTP relay even) in the cloud, backup DC (this) in the cloud, dc at home then all my computers and servers, so I would need everything that I want to have access to the cloud DC to have the VPN correct?
Anyone know of any free options for 10-15 computers? (even under 10)
Thanks
-
@Sparkum said:
So to use Pertino for example I would need the VPN on every machine I assume?
Pertino is a full matrix VPN. So every machine that needs to talk to any other machine needs to be on it. This is a limitation, to be sure, compared to site to site VPNs, but it is also its power. It's also known as "software defined networking" and it turns your machines hosted here and there, your independent cloud nodes, your laptops, your desktops, no matter where they are into a single LAN that can all see each other, all the time.
NTG uses Pertino to turn our people around the world and our datacenters all over the world (US, Netherlands and Canada) into a single network. It's like we are all sitting in the same room, even when we are traveling.
-
@Sparkum said:
Anyone know of any free options for 10-15 computers? (even under 10)
You'd have to build your own using a tool like OpenVPN. We've done that before. Can work well but gets cumbersome.
-
For sure I see the benefit don't get me wrong but I'm trying to cut fees with this not add them (again just a simple homelab wanting to expand knowledge and reach)
And I was thinking OpenVPN last night so I'll keep looking down that route.
Thanks.I'll try to get the VPN going this weekend and then hopefully start tackling the DC again Monday/Tuesday.
-
OpenVPN has more overhead, It's great for Roadwarior but I've never used it for site-site connections.
-
@thecreativeone91 said:
OpenVPN has more overhead, It's great for Roadwarior but I've never used it for site-site connections.
Same here. We used it for hub and spoke designs which are typically better for AD situations. He's looking at cloud servers which are not sites, but end points. So OpenVPN works really well.
IPSec is definitely lower overhead when available.
-
Tinc is a pretty neat mesh VPN which has less overhead.
You really want all static IPs for it though. -
@thecreativeone91 said:
Tinc is a pretty neat mesh VPN which has less overhead.
You really want all static IPs for it though.You always need that somewhere. Pertino handles it by actually being an elaborate, hosted hub and spoke system that mimics a full mesh. You can do the same thing with OpenVPN or even IPSec, just takes a lot of work.
-
@scottalanmiller said:
IPSec is definitely lower overhead when available.
IPSEC is lower overhead because it is has been offloaded in most cases.
If you are not offloading the encryption in a router, the overhead between the two is not all that different.
I use OpenVPN as the site-to-site method to connect the ERL at most clients. IPSEC always seems to have issues. For most SMB this is good enough as they will never saturate the OpenVPN link.
-
Yes, IPSec is such a pain to deal with. We used to have a huge site to site mesh using Netgear VPN hardware. That was well over a decade ago, though.
Now I feel old.
-
For the record, an Ubiquiti EdgeMax Lite will cap out an OpenVPN connection at about 10-14mbps because it will take up all the processor.
So unless you are going to push more than that, there is just no reason to worry about it.
-
Not talking much traffic at all.
Honestly might not even put all devices on it.
Going to still run local DC, so I'm thinking maybe three cloudatcost, my main desktop, and local DC all on VPN
So maybe 5, might push it to one or two more computers but nothing really intensive.
Would/Should I be able to host my dc on CentOS7 as well as OpenVPN? Or would that require two? (Dev1)
Thanks
-
Yes, you can put OpenVPN aggregator on the same VM as your DC, that's no problem.
-
This is more so what I meant.
Not typically in the 80's but it's usually floating around the 60's
(Just did a restart so I'm assuming thats why its spiking)
Edit: However; its definately not dropping from 87% now
-
Just doing a quick google search found this how to
I assume for the most part this should be fine minus not using google'd DNS records
-
@Sparkum said:
This is more so what I meant.
Not typically in the 80's but it's usually floating around the 60's
(Just did a restart so I'm assuming thats why its spiking)
Edit: However; its definately not dropping from 87% now
There is another thread on this. That is a completely worthless graph and should be removed from their site. It was created by someone who didn't know Linux and it uses the most common newbie Linux admin mistake that there is - reading the output of the "free" command incorrectly. Your system is not using 87%, likely more like 20-30%.
Show the completely output of **free -m"" and we will show you how to read the real memory utilization numbers.
-
@Sparkum said:
Just doing a quick google search found this how to
I assume for the most part this should be fine minus not using google'd DNS records
I would expect that to be fine. I run an ELK stack on Digital Ocean and our FreeBSD lab system.
-
Haha thanks thats alot better and brings me confidence in my box back.
Especially after everyone said a Samba server was one of the lowest resource wise.
