Re: [Nufw-users] nufw in production environments

[Vincent Deffontaines]

Matthew Branton said:
>
> On Apr 27, 2005, at 4:00 PM, Vincent Deffontaines wrote:
>
>> Matthew Branton said:
>>> hi everyone,
>>>
>>> I am interested in know if anyone has had any success deploying nufw
>>> in
>>> 100-500 user environments.  Specifically whether or not the clients
>>> work well in a windows terminal services / ltsp environment.  Any
>>> insight would be appreciated. :)
>>
>>
>> Ok, here we go now.
>> We have finished an installation on a 250 users network last week.
>> It runs like a charm.
>> Clients are 99% windows 2K/XP, which are running a service for
>> authentication. The service grabs the login and password directly from
>> the
>> user starting their session, so this behaviour is 100% transparent to
>> the
>> user.
>>
>> Also, the login/password is integrated to the Windows NT domain.
>>
>> The performances of the engine are, as we thought, very fine. Nuauth
>> runs
>> with quite little ressources, and there is no perception from users
>> about
>> the extra filtering tasks.
>>
>> As a résumé, very positive experience.
>>
>> Feel free to ask for more specific details if needed.
>>
>> Vincent
>>
>
>       This is very interesting, what about in terminal services
> environments? When you say you integrated with an nt4 style domain, are
> you talking about a samba3/tng controller, or the real deal? How was
> the integration performed?  SInce this is the only reference I have
> ever seen to a large scale integration just any kind of details on the
> specifics of clients and topology would be great.
>
> Matt
>


I don't know yet about terminal environment. We have another (smaller)
deployment soon on a Citrix environment, so I will be able to provide
feedback at that time.
However, we see no problem at all about it, so there should be no big
deal. The main concern was about the load on the authentication server, so
this point is definetely clear.

When mentionning a nt domain, I am talking about a MS NT4 PDC, not a samba
server, so this is probably  what you call the "real" deal ;)
The intergration is performed via PAM/winbind, and is quite straightforward.

There is nothing really special on the client side, apart from the
software we installed. It integrates to the login procedure and grabs the
login/password of the user transparently.


Vincent