<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
Did I send this out already? This is the configuation at the church
that Rodney had worked on. <br>
<br>
-------- Original Message --------
<table cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr>
<th valign="baseline" align="right" nowrap="nowrap">Subject: </th>
<td>Fwd: St. Pete's</td>
</tr>
<tr>
<th valign="baseline" align="right" nowrap="nowrap">Date: </th>
<td>Fri, 14 Jul 2006 00:41:41 -0400</td>
</tr>
<tr>
<th valign="baseline" align="right" nowrap="nowrap">From: </th>
<td>Rodney Hampton <a class="moz-txt-link-rfc2396E" href="mailto:rodney.hampton@gmail.com"><rodney.hampton@gmail.com></a></td>
</tr>
<tr>
<th valign="baseline" align="right" nowrap="nowrap">To: </th>
<td>dean <a class="moz-txt-link-rfc2396E" href="mailto:mdlug@sbcglobal.net"><mdlug@sbcglobal.net></a></td>
</tr>
<tr>
<th valign="baseline" align="right" nowrap="nowrap">References: </th>
<td><a class="moz-txt-link-rfc2396E" href="mailto:b25eb7f50604170812i357076ddq6b500bfe0cea8140@mail.gmail.com"><b25eb7f50604170812i357076ddq6b500bfe0cea8140@mail.gmail.com></a></td>
</tr>
</tbody>
</table>
<br>
<div>Basically, there are two linux boxes. One is in their computer
lab (name is <a href="http://gateway.stpeterslutheranchurch.net"
title="http://gateway.stpeterslutheranchurch.net" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
gateway.stpeterslutheranchurch.net</a>)<br>
and the other is in the closet in Matt's classroom (name is <a
href="http://router.stpeterslutheranchurch.net"
title="http://router.stpeterslutheranchurch.net" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">router.stpeterslutheranchurch.net</a>)
I haven't looked in a while, I think they're RedHat 8.
<br>
<br>
On router, there are two NIC cards. So the cable modem goes in one
side, and the internal network goes in the other.
<br>
I set it up using the monmotha firewall ruleset, bastille linux, etc.
Look in root's pine mail for all the evil stuff getting logged.
/etc/hosts.deny is getting pretty long because I've got scripts that
add to it regularly.
<br>
They've got a SPRINT business account and a "pizza box" wireless
receiver on the roof. They have 5 static ips<br>
<a href="http://24.221.90.238" title="http://24.221.90.238"
target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">24.221.90.238</a>,239,240,241,242.
Costs them $150? a month but has screaming fast inbound and outbound.
<br>
<br>
On the router there is email, DNS, and apache. The box is severely
memory constrained and is on old hardware.<br>
It's running qmail, spamassassin, vmailmgr, procmail, qmail scan (perl
script replacing qmailqueue binary and the real binary is qmailqueue
original), clamav. It's a tempermental beast, but has served them well
enough. The router also runs bind where they host their own
authoritative DNS for <a href="http://stpeterslutheranchurch.net"
title="http://stpeterslutheranchurch.net" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">stpeterslutheranchurch.net</a>,
nslaa (their athletic league website), <a href="http://lfahall.com"
title="http://lfahall.com" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">lfahall.com</a>
(.net, .org .biz), and my own <a href="http://elect-rodney.com"
title="http://elect-rodney.com" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
elect-rodney.com</a> domain. If bind goes down (which it does from
time to time due to lack of memory on the box) then everything stops
working. Matt usually just reboots it. For apache, it's an ancient
version because stpetes uses front page extensions. Also proxy's
through ssh is locked down, will only allow certain users to have
access. There's an iptables rule that will allow direct access to the
computer in the lab, listens on a specific ip/port combo. Never seems
to get scanned on that port.
<br>
<br>
In the computer lab, the server runs samba as a PDC so all their
workstations can log in, they've got a 5CD rack that has some perms set
up in /etc/samba/smb.conf.<br>
The computer lab (gateway) also acts as a buffer between the church
network (
192.x.x.x and the school network 10.x.x.x.x) I think I put the teacher
computers in the 10.x.x.x network in one subnet and the student
computers in another subnet as well. Trying to add a bit of defense in
depth, but it added to the complexity of the setup. iptables here
rules all.
<br>
gateway also runs apache and mysql. The nslaa website actually runs
back here, as does my own <a href="http://www.elect-rodney.com"
title="http://www.elect-rodney.com" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
www.elect-rodney.com</a> and formerly <a
href="http://hamptonandassociates.net"
title="http://hamptonandassociates.net" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">hamptonandassociates.net
</a>. We used to host other real-estate sites as well for extra cash
for the church.<br>
gateway server also runs squid and <span id="st" name="st" class="st">dansguardian</span>.
Basically, <span id="st" name="st" class="st">
dansguardian</span> is the proxy that the school,church, and student
computers hit and it does filtering. Recently I upgraded it. Then <span
id="st" name="st" class="st">dansguardian</span> hands the outbound
stuff off to squid. I can't recall if this is because we wanted to tie
it into samba auth. Also have snort running, but ruleset is very old
and all it ever did was help us figure out where broadcast storms were
coming from when there were occasional network problems.
<br>
Occasionally you'll see errors from the CD rack that show up in pine
for root. Pay them no mind (hard to ignore these kernel messages but
you'll get used to it).<br>
<br>
In the church office there is an NT (yes NT) server box running
Shepard's Staff. That will be hard to upgrade and is crucial to their
church so I didn't touch it. Basically, I've only patched the NT box
and made sure they had some kind of backup tape scheme. Much room for
improvement here. There's a rats nest of cables behind the NT server
that predates me. The rat's nest was set up by a "consulting" company
who didn't leave the admin password but it was so easy I just guessed
it when they needed me to access the box.
<br>
<br>
Anyway, this gives you a 10,000 ft. overview. <br>
<br>
All the desktops are windows 98. Matt aborted an upgrade to 2000 long
ago when he saw the effort we'd need to go through. They're mostly
patched but I think they could be converted over to all linux someday.
The dos programs would probably all run under crossover office, wine,
or a dos emulator.
<br>
<br>
Thanks,<br>
</div>
<div><span class="sg"><br>
<br>
<br>
<br>
Rodney Hampton<br>
</span></div>
</body>
</html>