Can FreeNAS Core replace Windows Server 2012 for AD (or LDAP) ..?

[TrumanHW]

After recovering a failed HP RAID-5 (hw controller P410i, total PITA) of a ProLiant DL380 G7:
(which had an Offset, a startup delay, was Right Sync (if I recall). Truly brutal without access to the SAS SA)
(I've never been to their office nor seen their server running | what it does)

Invariably, before starting, we define what constitutes "success" -- which includes corrupt data, which has a flowchart of scenarios, one of which being that his RAID vs RAIDz will have accumulated corrupt data over the 12 years of his usage. (If you want more on this LMK but I'm skipping to my questions):
This disclaimer & explanation of course peaked his interest in TrueNAS / ZFS, & thus, mine:


His office runs off a DL380 G7 (X5680, X5685, etc) supporting up to ECC-1333MHz with "RAID-5" for "fault tolerance" on the main storage pool–which it then shares to workstations clients via AD (possibly LDAP; I've never been to their office). The DL380 may host a Hyper-V (which TrueNAS Core also does?). And if they have any, they have few. I also think TN off-site backup mgmt (incremental & differential, etc) backups & ransomware protection may just be more familiar to me...but I think it's easier.

[If] TrueNAS Core CANNOT perform ALL services mentioned, without Win Server?
LMK the feature––as it may make all else moot.


I've setup ≥5 TN machines, (but never in a Pro Server Env & NEVER AD: on TN or Win)

In short, I'm not a SysAdmin, but, the person who'll be setting this up is, and is well acclimated with setting up LDAP & AD in Windows Server 20xx. (I'm uncertain which version he's on; if he's already EOL / not getting updates or not, as I believe he also had ransomware about 3 weeks ago). Anyway, the SysAdmin is adept in AD, but lacks experience with TrueNAS / FreeNAS ... but it's gotten easier (better GUI, less bugs) and he already understands networking and AD.

Now, I've never setup an AD or LDAP, but I can do everything else.
As the SysAdmin hadn't even heard of FreeNAS nor TrueNAS Server before I mentioned it about 2 weeks ago, and has never used it, I'm hoping someone here who's setup both can LMK if the comfort to configure one predicts comfort in the other OS. I read the AD | LDAP instructions for TN, and neither [looked] intimidating, but the process can always be deceivingly difficult once started.

Does Server 20xx AD fluency suggest TN will be easy? as he already gets the concepts?
And, by not using Win Server nor the CALS, all associated costs are eliminated ?


Any of these assumptions false or unreliable..?

1. Setting up AD on TN won't be challenging for a SysAdmin proficient with Win Server AD?
2. TN performs ALL Tasks mentioned & is likely to do so w equal-better performance?

Reiteration / consolidation of all server tasks uses below :

• AD (Active Directory) or LDAP
• Limited (if any) Hyper-V usage.
• Hosting Files & Folders (like a NAS)
• Flexible VM support (hardware limited).

TrueNAS Core does all above tasks & performs equal-or-better on (old) hardware.

MISC NOTES:
• In ~3y when his Win Server 2012 expires it'll be addressed as an emergency / surprise.
• Their Server suffered a RansomWare attack ~3 weeks prior to the RAID-5's 2nd HD failing.
• 600GB 10k IBM SAS HDs have 42k hours on them (why they're failing one after another)
• My sugg.: Replace 600GB 10k SAS with 2TB Evo 870 SATA SSD + IT mode SAS adapter.
• TrueNAS avoid the EOL (updates) in 3y for Win Server + CAL costs (for ≤ 8 users).

Any SysAdmin willing to grade service-performance of TN v Server is greatly appreciated

Simple: TrueNAS with existing AD taken over by the TN server.
Cheap: Replace the POS RAID card with a SAS cont. in IT mode
Cheap: Replace 600GB 10k SAS (pos) with 2TB Evo 870 for $155ea

improved reliability:
- RAIDz2 (Double Parity)
- Self-Healing FS
- SSD create less heat than 10k RPM SAS
- SAS controller (eliminates snowflake of RAID config)
- 2 more HD slots freed up if TN performs all tasks: special vDevs? Spare?
...maybe a pair of Mirrored large drives to do incremental differential backups...

(obviously TN has superior RAIDz & built-in backups unless he gets ZFS on Windows Running ?)

​

TrueNAS Core​	Graded Categories(5 = Best)​	Windows-S 2012​
Score: 5​	RAID Reliability​	Score: 2​
Score: 1 - 5​	RAID Performance (speed) using AD​	Score: 1 - 5​
Score: 1 - 5​	Network Setup​	Score: 1 - 5​
Score: 1 - 5​	LDAP / AD General Performance​	Score: 1 - 5​
Score: 1 - 5​	LDAP / AD General Reliability​	Score: 1 - 5​
Score: 1 - 5​	Hyper-V usage​	Score: 1 - 5​
Score: 1 - 5​	Hosting Files / Folders (NAS)​	Score: 1 - 5​
Score: 1 - 5​	AD Performance (speed) per equal specs​	Score: 1 - 5​
Hours:​	Avg. Maintenance per Month​	Hours:​
Score: 1 - 5​	Vulnerability to Virus​	Score: 1 - 5​
Score: 1 - 5​	Vulnerability to Malware​	Score: 1 - 5​
Score: 1 - 5​	Vulnerability to RansomWare​	Score: 1 - 5​
Score: 1 - 5​	Ease of Keeping Backed up​	Score: 1 - 5​
Score: 1 - 5​	Setup difficulty of [ AD | LDAP ]​	Score: 1 - 5​
Score: 1 - 5​	Does Experience setting up AD on Win Server make set up AD on TrueNAS relatively easy?​	Score: 1 - 5​

 

[danb35]

Are you considering running TrueNAS as an AD/LDAP server? Because I don't believe it supports that at all. You could, of course, install Windows Server (or Univention Corporate Server, or Nethserver, or Zentyal, or probably other software) in a VM and use that for AD. Or you could install OpenLDAP (or whatever other provider you wanted) in a jail in CORE. Or you use the TrueCharts app for OpenLDAP in SCALE.

As to some of your other points: Obvously TrueNAS (CORE or SCALE) can handle acting as a NAS--that's kind of what it was built to do. But nether Linux nor FreeBSD run Hyper-V, so that would be out. I have no idea what you mean by "RAID Performance (speed) using AD", as those sound like two completely unrelated things. Linux and FreeBSD are far less vulnerable to viruses and malware than Windows, both because there's less interest in writing malware for them, and because their respective permission systems limit the impact of any such software. A sensible snapshot schedule (and backups, naturally) should greatly reduce your exposure here.

 

[TrumanHW]

Shit. Looking at your info here, I HAVE to assume you know what you're talking about ... but they say how to set up AD ... but I know so little about AD that maybe I'm confusing workstation with server..?

Setting Up Active Directory

Provides information on how to configure Active Directory (AD) on your TrueNAS.

www.truenas.com

 

[TrumanHW]

Okay, I'm starting to get why I'm dumb: Joining an AD is nothing like being a Domain Controller.
(Obviously no protocol is gonna sync to an existing Windows DC's AD (eg., LDAP) & customers can't tell you what they use to tell you what they don't need.)

This is something ESXi might solve:
- ESXi VM of Windows Server
- TrueNAS VM to create the zPool

- or -

Install Windows Server on a Mirrored Pair
- Then back it up to the ZFS Pool so it's easy to get, the drives won't know...
- Make a Hyper-V of TrueNAS on a pair of THUMB drives, create the zPools...
- Obviously, the TrueNAS Thumb Drives should boot as a Hyper-V or standalone image to restore Windows.

The trick will be how getting the ZFS drives shared back to Windows Server without going through the network.

 

[anodos]

In very broad terms, TrueNAS is a NAS appliance. It provides network storage (either file-based, or block). AD / LDAP comes into the picture in terms of basically single-sign-on ability for file-based storage.

When we join AD for instance, AD users and groups can be used to authenticate to SMB shares (or NFS), and the users and groups are also visible in the permissions editors.

Being an actual domain controller or LDAP server is a different sort of role. TrueNAS doesn't do this. Although some users decide to host their DCs as VMs on TrueNAS and then join the TrueNAS server to the VMs that are running on it, this sort of configuration is not supported due to the logical / configuration loop involved.

 

[danb35]

but they say how to set up AD ... but I know so little about AD that maybe I'm confusing workstation with server..?

That section of the docs is about joining TrueNAS to an existing AD domain, not about TrueNAS acting as a Domain Controller--as you've since found. Earlier versions of FreeNAS--through around 11.2--could act as a Domain Controller, but that feature has since been removed. Since I never used that service, I didn't pay much attention to the reasons; maybe @anodos or someone else can fill in on that.

But as I said, there are at least three other pieces of software than can act as a Domain Controller, other than Windows Server. Any of them (or Windows Server) could run as a VM, either under TrueNAS (SCALE would be better than CORE for this) or some other hypervisor, and then TrueNAS could connect to that system.

The trick will be how getting the ZFS drives shared back to Windows Server without going through the network.

Why would this be important?