Network services
Once upon a time it was all NetWare. Nowadays, which OS is best for network services such as directory, DNS, proxy, firewall, and remote access?
Geoff Halprin: One of the most critical network services is DNS. Unfortunately, Microsoft tends to extend Internet standards, and this leads to incompatibilities with non-Windows platforms. I believe--but I may be wrong--that the Microsoft DNS server does this.
The GUI to the Windows DNS server helps eliminate errors, but I have seen equivalently simple GUIs for BIND and DJBDNS, which are two Unix implementations of DNS.
Unix has a distinct advantage in the area of general network services.
It is built on a "building block" philosophy. This means that there is a rich environment for tailoring and automating business processes around provisioning of network elements, and this leads to reduced errors and increased serviceability of network services. With NT, each such change must be made by hand into a GUI.
This is error prone and time consuming. The results of a bad DNS change can be catastrophic, with a Web site being off the air, or mail being rejected because there is nowhere to deliver it.
It is a similar story in the Web caching space. The Open Source Squid proves to be the only significant player. Much work has been done to optimise Squid, and it is the only product used in serious environments such as ISPs.
Dean Thompson: Windows NT 4.0 made inroads into NetWare installations by providing both file and print sharing services, a server to store data upon and protecting all of the data with a username and password, in some cases more cheaply than NetWare.
Consequently, Novell re-invented NetWare to support Network Directory Information Services (NDIS), allowing network administrators to develop a tree-like hierarchy resembling the organisation's structure.
Until the release of Windows 2000 and its Active Directory, Novell had this approach to itself, which led it to slowly regain market share. However, NetWare can be viewed as an add-on rather than a standalone product, it doesn't seem to offer much that isn't provided by Active Directory in Windows 2000.
Most organisations have deployed Windows 98 or later on the desktop, and these operating systems capable of connecting to a Windows 2000 Active Directory server. I don't see the need to increase the complexity of the network by adding NetWare. Even in the Unix community we see products such as Samba that allow Unix machines to share files with Windows systems.
Peter Menadue: Microsoft's ability to bundle Active Directory as a component of Windows will ensure its wide scale adoption in the future, even if it's part of a broader directory fabric.
Most organisations that have deployed Novell NetWare also have Windows servers to support applications. Novell has some great directory-based technology, but are clearly being pressured by organisations that are rationalising the number of operating systems that they use.
Dean Thompson: Once again, reliability is critical. I would recommend running services such as DNS, Web proxy and a RADIUS database on a Unix system. All of these services are available in source code under Unix and allow the organisation to manipulate these programs.
On many occasions I have had to modify the operation of a proxy server or a RADIUS service to fit into the needs of the organisation.
Using these programs on a Windows platform would normally lock you into using the program the way it is rather than being able to tailor the program to the needs of the organisation.
The applications should help the organisation fulfil its job, not dictate the way the business is run.
In corporate settings, I recommend hardware firewalls rather than constructing one on top of a Unix system. Apart from the way they are optimised to protect networks, they may be built with redundancies allowing them to continue operating in the event of subsystem failure. Normal PC hardware does not allow for this.
Good firewall appliances are normally expensive, so if you were on a tight budget I would usually recommend implementing a firewall under Linux or FreeBSD, which can be secured to make it difficult for the firewall to be compromised.
Geoff Halprin: The success of a firewall running on a standard operating system such as Windows NT or Unix is only as good as the ability to control the services provided by the underlying platform, and shutdown all non-essential services.
The nature of Unix makes this an achievable and painless--though not trivial--task, and many people have reduced this process to checklists. It is far harder to disable all non-essential services on a closed platform like Windows.
In fact, with each new version of Windows, new services are automatically enabled. Windows XP ships with an insecure IIS server enabled by default.
There is already one severe problem scouring the net at present, and Microsoft made available on its Web site a free fix for both home and professional editions of Windows XP and forcefully urged consumers to install it immediately.
It is possible to secure a Windows server, but this is far more difficult, and there is little help from standard sources on how to do this. The rules change significantly with each release, nullifying any previous work done to reduce this to a checklist.
For small Windows shops, the pragmatic solution is a hardware firewall with a Web or Windows management interface.
Dean Thompson: The network service more suited to Windows rather than Unix is a Remote Access Server (RAS). In most cases, Windows clients are trying to form the remote link and so it makes more sense to integrate the RAS into the existing authentication mechanisms. RAS is often integrated into the server that is performing authentication.
If connections are to be made via the Internet rather than dial-up modems, I would position the VPN service on Unix as there are a number of programs which can be used to ensure the security of the VPN link between the remote user and the corporate network.
I find the comments about Unix versions other than Solaris becoming considered "legacy" systems rather funny. I believe it was Solaris that recently announced they would no longer be developing a version for Intel...
Furthermore; the only reason there is an "OS War" is because Microsoft is more interested in making money and increasing their market share than meeting the needs of their customers. Linux is not the one with the "secret" protocols and undocumented "standards."