Thread

1. sneak · 1790334193 · focus · HN ↗

   I’m really curious to see what the answer for MDM and Group Policy is on Linux. The SSO part is mostly figured out, but the reason places use Windows is often manageability.

   Is there anyone doing MDM or policy enforcement on Linux other than Google Workspace + chromebooks?

   1. ndriscoll · 1790338500 · focus · HN ↗

      It's Nix so you just push the new generation to the device. It's probably the easiest possible way to do device management. It's also generally like two lines of extra config to wrap a block into a container if you want to hide some of the underlying OS tools completely, which I've never tried with a full desktop environment but I'd assume should basically just work if you pass a couple things like GPU?

      1. sneak · 1790428507 · focus · HN ↗

         I’m not talking about software install/updates, that is easy and straightforward on every major enterprise distro. I’m talking about Group Policy specifically, that is, the ability to enforce many settings across the whole OS/DE.

         Minimum password lengths, maximum screen saver delay, screen saver password requirement, disk crypto enforcement, a million other little things. All of them can be done by customizing linux sure but organizations won’t want to maintain a separate distro for each business unit that needs different policies.

         1. ndriscoll · 1790446601 · focus · HN ↗

            Nix does more than software install/updates. It also manages system wide config (e.g. files in /etc, systemd units, timers/cron jobs, firewall, etc.) or even user preferences with home-manager. You can also organize your config into modules to have e.g. a base for everyone + special settings for different BUs that need it. And it does all this declaratively with the ability to rollback to previous working config if needed since it can handle multiple versions of packages all being present until you choose to garbage collect old generations of the system config (which you can also set to automate, of course).

            It's basically what people think they want from Docker but don't actually get from Docker.

Unofficial Hacker News client; not affiliated with Y Combinator.