Just saw your video and it is AWESOME. I've been looking for a way to implement AD without all the hassle of Microsoft and their licensing schemes for servers. As an IT Consultant I cater mostly to Small to Medium sized business and honestly the cost of licensing alone can be the biggest deterrent. I made the decision to look into and implement Opensource and its changed my business for the better believe me. So far, I have not been disappointed and neither are my clients so thank you for these great videos and the time you have taken to do the research so that you can share this information with us all. I look forward to more episodes of "Building a Business on Open Source". Let's keep building the dream we dream.
I'm so glad you are getting something out of the series. I believe, that the more we all use open source, and eventually contribute back to it, then the more it can become the norm.
Great video! Zentyal is super easy to setup, I've been using it for awhile. I didn't see you include it but it also works with MacOS just in case anyone has that question.
This is great. I'd go for community version regardless if i run business or not then i'd use zentyal's source code and develop something independent on top of that. Their current prices for comercial product are way to high because they play dirty when you look at plans. I know they need funding to keep working on project but their pricing well... keeps users away.
So, I didn't get into all of the nitty gritty yet, but you can actually setup one of your Windows machines to set and dispense group policies, and more.
I manually setup a Samba active directory server to act as a centralized authentication server for my Linux and Windows VMs. I chose this approach because Windows can authenticate against it right out of the box, and Linux can authenticate against it by simply installing the appropriate PAM module. While setting it up by hand was educational, it was relatively tedious. Plus theres no pretty web UI to admin things. I think I will switch to Zentyal.
I'd be interested in a follow-up video going over the Mail, FTP, and Jabber. Edit: Will this work also for users offsite, like the same company but in different locations? Also, how about nginx to get to the dashboard instead of an IP so an admin can access it from anywhere?
man, so much stuff in this channel, I hope I can watch and absorb it all ahahhaha (strugglin to finish my home server but a lot to do in my irl career etc damn) thanks a lot
Totally understand my friend. I have a full time job, plus I do some IT work for a few clients on the side, make these videos, and have a family I love to spend time with. Life is a giant, delicious sandwich, so take one bite at a time.
@@AwesomeOpenSource yep, sometimes I get overwhelmed, but I just need to breath a little I got super curious about your physical hardware, maybe that would be a cool video : your home's infrastructure :D (I've saw some videos about Pis, yet curious to see if you have some xeon etc there ahaha)
if not mentioned below, this domain join for windows PCs only works on pro versions of MS Windows, any windows home edition cannot join a domain. having said that, this is a good video, keen to try it in my Linux environment
Nice to see the new improved installation. Installed a few more than 10 years ago, it wasn’t this easy, definitely not. Our bulk was MS and a few ClerOS that I really liked and then some odd Zentyal now and then. Z was a good set and it seems to have matured exceptionally well. Setting upp MS Office with centralized resources was easier on Zentyal and Clear. 10-15 years ago having data on a server was more secure than on PC’s in many ways.
This was a great video. I'm Microsoft trained and certified in Active Directory but have been on the lookout for open-source alternatives for my small to midsize clients. Finally, there is a proper, polished solution that doesn't require a PhD in Linux-ology to implement. I only wish it had an equivalent to Domain Local groups. Being able to separate user groups (Payroll-Mgr) and resource-access groups (Payroll-Records-Modify) is a godsend when auditing time rolls around (nesting, FTW).
There is also UCS Univention Corp Services. I'm working on a video on it as well, and it offers similar functionality. You may want to look into it as well.
Can you incorporate something like MDT for easier OS installs and autopilot for auto enrolment of devices with this? It would be interesting to see how to achieve something like this with open source.
MDT Shouldn't be a problem. You don't actually have to install MDT on a server. You can just install it (and the required ADK) on a Windows client PC to do all your work and configuration and still keep the DeploymentShare on the server for clients being built to access it.
So, freeipa is great for LDAP, RBAC, HBAC, and Linux controls. If you need to mix in users from freeipa into a Windows domain, you need to use AD trust. Don't know if this can be used for that, but it's an option. Also, there is Nethserver and UCS. UCS is HEAVY, but has neat things in it.
@@AwesomeOpenSource I'm actually thinking about demoing Nethserver 8 since the older version is based off of CentOS 8, and it feels a bit long in the tooth.
The Platform is very great and cheap setup for Domain Controller & Active Directory. The only lacking with this one is the Group Policy Object. I think that's the beauty of Windows Server vs. Zentyal.
Zentyal is still on the domain and forest level of 2008 R2(Equivalent of Windows 2012 R2, since 2016 to 2022 are all on 2016 domain and forest levels). I love the idea of the software, but you are very limited on what you can do with it. Also, I would never put this in a client's infrastructure. If they can't afford actual Windows Licensing, I'm not going to piece meal them. AAD Connect does not work with Zentyal, and it's literally a must if you are a 365 shop. l love the concept of "I want to use all open source software", but everything is literally revolving around cyber insurance requirements and security frameworks, so it's literally a pipe dream for most people in IT.
I completely understand where you are coming from, and there may not be as many open source projects as we need. But, as I've always said, just because it's closed source doesn't make it better. A lot of compliance and standards are set by arbitrary boards that then charge incredible amounts fo money to get through the compliance or certification process. It's generally an issue of not being able to afford to go through the process for most projects more than it being the project wouldn't be able to pass, or at the very least fix any issue identified. Theere's this line in the movie "Willy Wonka and the Chocolate Factory" that has stuck with me since I was a kid... "We are teh music-makers, and we are the dreamers of the dreams." Unless we start dreaming the dream, we cannot build up what we dream of. I'm just trying to help people realize the dream, and we will build it as we can.
Please don't misunderstand. I love open source. I have a VCP-DCV and I'd rather run Proxmox or XCP-NG for my personal use any day of the week. But when you're dealing with insurance companies, HIPAA audits, FDIC audits, pretty much ANY audit, this will be flagged for a ton of issues. Not only that, but if you have a BAA with your clients, you're going to have a hard time even running this yourself for your own infra, because YOU have to also pass the audits. Having been through SOC2 compliance, FDIC audits for credit unions and banks, and dealing with many large healthcare orgs, I have a much more cynical view of open source in a real enterprise setting. Speaking of quotes, my step dad used to tell me the same thing every time I really "wanted" something and I couldn't get it "Son, wish in one hand and shit in the other. See which one gets filled the quickest".
Год назад
You're talking about the biggest companies as a client of yours, when this (Zentyal) and similar projects made for the smallest companies to spare the money they must spend on a single Windows Server licence they ever may need. Of course, anyone who would like to integrate thing with MS's own cloud or other systems, must purchase and run original MS software. And of course, who must certify on specific topics (which usually have a list of accepted solutions) also buy from the accepted solutions list to pass that certification. But everyone else can use open source software, and this "everyone else" is a very big set not a marginal one...
I 100% understand. Seriously. I work (in my day job) in software for public safety, which has all kinds of audits, and compliance requirements. I'm always looking for the Open Source that will make the grade, but in so many cases, you're right, the audits just don't allow for it. I appreciate you sharing what you know about the subject. I'm always the first to say that I in no way, shape, or form, know everything. I try to learn something new everyday, so seriously, thank you for sharing.
I just try with zentyal. I dunno why the username & pw is incorrect when joining the domain. I am pretty sure the pw is correct. And I go to github saw the same issue and still have some bugs with zentyal. hopefully, zentyal will fix that.
Question, in the bottom right corner of your taskbar you have a system monitor which is a little graph that's running across. I was wondering if you have the name of it because I can't seem to find one like that for KDE
@@AwesomeOpenSource It's free to use, and pay for support if needed. Yes, it's open source. I used it for LDAP, AD, and Kopano Mail Server. it's very user friendly.
Excellent Video! Can you pls also cover the process/steps for joining Ubuntu machine to zentyal DC through shell. Also see if you can demonstrate the Additional Domain Controller setup by spinning up second instance.
Great video, there is a bug in the webadmin. The only problem I have is trying to get the RSAT tool to work via windows 10, not sure if it because I am using a made up domain techie.local, I can join the domain but if I try to use RSAT it says the domain cannot be found, same setup using server 2022 no issues, not sure if you had similar issues?
I haven't tried it myself, as I don't use Windows generally, but was just passing along that the project says RSAT can be used, but if Server 2022 for Windows has the same issue, I'm guessing it's not a Zentyal issue alone.
I used the iso to create Vmware Workstation Machine -- but everything gets installed automatically and after it finishes I only get a shell window --- what am I missing here ?
I'm not sure. Shouldn't install everything by default. Did you miss a screen somehow? Maybe the wizard didn't run, so the services are all there technically, just not started?
@@AwesomeOpenSource I tried it twice. There are some installation screens shown but everything is installed automatically. At the end there is only a prompt.
@@AwesomeOpenSource Maybe someone else here will check it. Apart from that my conclusion from all the comments over here that this project is no longer very well maintained and the only reasonable option is to buy a windows server licence.
There are several tools for doing this. They are all available in OPNSense / pfSense firewalls, either built in, or as plug-in / add-ons. Suricata is one option for IPS/IDS. Takes time and tuning, but it's touted heavily by pros.
I have been using Zentyal for a while now and with a new build, I wanted to get Zentyal 8 up and running with 2 domain controllers. Has anyone had any luck with getting 2 domain controllers joined on the same domain? I've fought it about half a dozen different times and it keeps getting messed up around the Samba config. Overall, Zentyal has been very great in v6 which I've used for a while, but v8 seems to be needing some love around additional DCs
You can add the functions to any Windows 10 PC and then manage group policy from there. I believe they have instructions on how to do it on their site as well.
I just installed this in a VM last week to test it out. Was that windows home or pro in the setup? If it was home, were there additional installs required?
so far no luck installing the software properly. Upon install should I restart the server its either zentyal lost IP or lost internet connection. Unsure on what happen.
yes, did more testing and zentyal have problem. Upon setup and input the IP etc, it stuck just like in your youtube on webadmin. I can refresh as follow. Then basically now the proxmox VM have no access to internet. Updating is basically impossible. Unsure what is being changes, that disable the connection to outside world
@@AwesomeOpenSource could you tell us how you solve the problem.. Because it giving me a headache. Been trying to fixed without any right solutions. Furthermore it wont allow the domain admin to login from Windows 11 Pro. Keep saying wrong password
That's a huge question. It really depend on your needs. I have really fallen in love with BookStack. It has some incredible features, and really makes keeping a documentation site up and running pretty easy. I have an older video on it, but need to do an update. There are, however, some other great videos that go through the "superuser" type features of it.
You can using some tools that you would install into one of your windows clients. You'd login to it using the Domain Admin account, then install the Remote Server Admin Tools for Windows. From there, if your domain, and dc are setup properly, the tools will identify your server and any group policies you create will be applied on the server and to your other machines / users.
I don't have a Windows 11 machine to test, but someone else mentioned they didn't think it would be an issue...I don't think they tested it though...so just don't know.
@@AwesomeOpenSource I was able to connect a windows 11 VM last night, however it's one that I had previously made some settings changes to in order to try and connect it to a different AD. Will need to clean install the VM and try again to be sure. Microsoft offers a win11 ISO on their website as a free download. Win11 has made some significant changes to how it authenticates with ADCs.
Unfortunately you can't add existing windows pc's to the domain without giving them a whole new user/profile. I tried zentyal but it was pointless since I wasn't willing to re-do every pc on my network with a fresh install. Note; this is a windows domain problem, not a zentyal problem.
@@AwesomeOpenSource Yeah, active directory doesn't allow adding an existing local user. All new users have to be created in the domain. The only workaround, aside from reinstalling the windows client and starting from scratch, is to create a new user/profile in windows. Some people do this for work purposes (ie: second profile for logging into domain, first profile for home use), but otherwise the windows domain has to be built from day 1 from the controller outward. If that makes sense....
@@AwesomeOpenSource no, I meant if you use this as a domain controller, how do you manage the AD policies which must reside on a domain controller? This looks more like LDAP than Active Directory to me.
Zohrab, i have to disagree. 80% roughly of the entire world is on Linux, saying Linux isn't on a desktop, is like a meme. Almost anything you can imagine or use is running on Linux at some level. Microsoft runs on Linux.
Agree, when you consider servers, Linux runs the world and the interneet. But if you only look at desktop usage, people don't use Linux but about 2.2% overall. So I see the OP's point.
RU-vid deletes comments with links from anyone who isn't the video owner. Sorry, forgot about that. If you'll just give me the names of the software, I"m happy to do some digging.
@@AwesomeOpenSource Why compared to MS offerings? First full AD is invented by Novel, MS just stole it. And there are RFC' s alreayd in 1971 about AD And BTW why are there still so many bug's and erro's in a 40 year old operating system? Windows startend in 20-11-1985 so Ad was already invented by then. Should be free for everyone
Sorry to hear that... but I don't know if it's greed. Open Source projects are very hard to maintain. Most people work on a project as their side hobby...and if we want them to continue the project, build it up, make it better, then we want them to make it their full time job, and that costs money. I can see why it becomes a value add type system after a while, and that's why it's importatn for us to be advocates of open source, and pay for the software we love to use, adn donate where we can.
It's open source software. You can use a good portion of it at no cost, but keeping the software going depends on financial backing just like any project.
Just stand up a Windows domain controller. This thing is nothing but a pain in the butt. If you just want to play around, fine, but don't use it for anything that you need to work consistently.
Did you ever get around to making the video of how to modify an existing Ubuntu user account so that it will use the Active Directory Domain Controller rather than the local Linux PAM authentication?
I thought I added it to the end of this one. I know I did record it. Been so long, don't really recall. But, you need to set it up on install of Ubuntu if you want to use the GUI tools, otherwise there's a whole set of commands to get it setup. Not sure why it matters when you setup the account, but that's how it was when I originally did this video.
@@AwesomeOpenSource I think that towards the end of this video, you mentioned that you might make a separate video of how to modify an existing Ubuntu user account, so I am just following up on that remark.
Ok, I re-watched, and refreshed myself, and I did say that, but I did not ever follow up. I still notice that it's from the initial setup / install that it's right in the GUI. If you're adding a new user to the machine (in 23.10 at least), you can also choose Enterprise Login and add them to a domain that way. Here's a link on how to do it help.ubuntu.com/stable/ubuntu-help/user-add.html.en, but if it's an existing user, there are a lot of steps to follow to change how they login as far as I can tell.
@@AwesomeOpenSource "but if it's an existing user, there are a lot of steps to follow to change how they login as far as I can tell." Thank you. I was under the impression that you might have conducted the research already in regards to how to modify an existing user account to have it join an Active Directory domain. But based on your reply, it sounds like that my assumption may be incorrect. Thank you, for your help.
I don't know any that have Proxmox setup already if that's what you mean, but you should be able to install proxmox on a hosting provider's server....that said, might be overkill.
