network design questions

multipass · n00b Joined: 09 Apr 2008 Posts: 11

hello, im currently building a network for me and some of my friends using some gentoo boxes, and i have several questions

basically i will be using it to host their websites n what not

now i have 2 really good servers and a really crappy one (the two good ones are dual core opteron 1u's) and the crappy one is a dual processor 800Mhz (x86)

one of the really good servers is already setup and running (i used a xen faq and was able to setup a mailserver, spam/virus check relay, secure-mail login (imap), database, DNS server i still have to setup, file (stores the virtual mail accounts), and webserver)

so far they are not yet secured (no firewall) and run bridged with a domU the server it self is now offically running out of memory and is maxed (i dont think i could possibly add anything more to it. and each xen only has 128mb max dedicated)

i have a dsl connection

what i was thinking of doing was running on the second really good opteron server a virtualized firewall either within vmware or inside of a domU as it has xen on it right now

now i still have to buy new network cards and cat 6 cables for everything (As the ones im using now are really old and pretty much broken)

but what should i consider ?

is it safe to use something like ldap or Nis for all the admin user accounts on the mail servers (i will only need admin really) and on the dom0 that is bridged to the server running all the xen boxes can i put in a proxy ? a packet sniffing firewall ? some type of scanner for virus or intrusion prevention (snort) etc etc.

the last x86 i will need for lan to use as a desktop computer its more the sufficient, and i have a switch also for lan computers (i have another laptop) i have never done this and dont know too much about lan/dmz type settings. what would be the best route to go about this for with low TCO but moderate security settings

thank you

gerdesj · Posted: Wed Apr 09, 2008 11:18 pm Post subject:

You have posted a bit of a nightmare set of questions. What would you like help with exactly ?

For example:

>>is it safe to use something like ldap or Nis for all the admin user accounts on the mail servers (i will only need admin really) and on the dom0 that is bridged to the server running all the xen boxes can i put in a proxy ? a packet sniffing firewall ? some type of scanner for virus or intrusion prevention (snort) etc etc.

LDAP and NIS are both fine for authentication. You can put a proxy wherever you like. You can wedge in scanners anywhere you like.

Please have another go at posting (I notice this is your first) but this time confine the query to specifics. That way we can help you.

I don't want to put you off asking for help in any way but your post was a bit of a disasterous start

Cheers
Jon

multipass · n00b Joined: 09 Apr 2008 Posts: 11

gerdesj · Posted: Thu Apr 10, 2008 9:06 am Post subject:

I would suggest that you run your "crappy" box as a router and firewall only, probably using the SELinux profile (see he standard Gentoo docs on this).

Give it three NICs (Interweb, DMZ, LAN) and use FWBuilder, Shorewall or something to configure it as such.

You create specific rules for specific access to things. Eg run Squid as a web proxy on a box in your DMZ and allow clients on the LAN to access that on port 3128 only. You then allow the Squid box to the internet for only the ports that it needs. On that box with Squid, you could also put bind, ntpd, a mailer daemon and other services again with specific rules for access. Also look into Snort and Base for NIDs.

Finally once you are up and running you allow access from the Interweb to your web sites.

The above is a lot of work and may be a bit excessive for your requirements. On the other hand its a damn good learning exercise and will keep you noodling for some time.

However you do it the golden rule of firewalls is a default deny rule at the end. Its all too easy to put in an accept to get it working with the intention to sort it out later.

Logwatch is what you need for log notifications - many bits of Gentoo are already geared up for it. I was rather pleasantly surprised when it got installed as a dependency for something and all of a sudden I got a daily email from one of my systems telling me what it found in its logs. The rest of them have it now.

On the accounts side, an LDAP system would be a good idea but you will still need a root account on each box.

I've got to leg it now but I'll post back on mail.

multipass · n00b Joined: 09 Apr 2008 Posts: 11

hello thanks for reply, im just wondering why would i run bind and squid on the same server ?

wouldnt it be much more secure to simply run those separate ?

and also i still have yet to figure out my self as what i should do with sending the mail from those servers. i found a good gentoo howto on setting up a mail relay, and im thinking about setting up an ldap server (scared because i never have before) and also using authentication to send mail from those into my mail server admin account

i cant seem to find any better of a way to do it then that.

Erulabs · n00b Joined: 08 Mar 2006 Posts: 48 Location: erulabs.com

If you're using stable packages (you should be), BIND and Squid are nearly bullet proof.

Also, if you're running one box as a DNS server and a mail server, why not just give all the other domains MX records for mail?

Maybe I'm missing something.
_________________
No more things should be presumed to exist than are absolutely necessary. Or really cool.

multipass · n00b Joined: 09 Apr 2008 Posts: 11