Server box specs

garylm wrote:Perhaps we can cook up a solution here for an inexpensive home server, with a recommended hardware list, Kickstart installer, and how-to guide.

Some smarty-pants will read this and tell us not to waste our time, that his company will be coming out with a "Mormon ITX" box this fall.

We're comming out with the Mormon ITX so don't bother... :p Just kidding actually how do we want the server to act? As a router, firewall and filter? That would most likely be the easiest if you are going to create a dedicated box, and for those that don't you just make your "server" a proxy server which must be on for anyone to access the internet. Though you can have problems with security since it just takes a small change in the internet settings to stop using the proxy.

This posting in another thread got me started (and rmrichesjr seems to have a handle on the concept as well):

cdjensen wrote:I have used many different 'solutions' in an attempt to filter internet for my home. By far the most effective is what I now use:

Built from an old machine, make sure it has two network cards, and a working hard drive, cd-rom, and video (very basic video card)-

1. install SME Server linux os - this will boot from the cd and configure your system as it is installed. One network card will be for incoming access (i.e. from your cable modem/dsl modem/whatever), the other 'serves' the connection to your home after filtering.
2. install Dansguardian, squid internet access monitor, and sarg reporting package
3. use a router/switch to connect from your SME machine's 'out' network card with enough ports for your computers (or a wireless router)
4. create accounts on the SME server for all your home users.

The results of the above configuration provide-

• login requirement for all internet access
• restriction of access as per your Dansguardian/Squid configuration (can even be by 'group'... some with very strict restrictions, others not)
• logging of ALL access BY USER
• administration of all of this or more

I set these up for others as well, but I have been impressed enough with it's effectiveness (compared to client software) that I thought I would mention it for those who would be knowledgeable enough/bold enough to try to set one up themselves. An old machine, a couple network cards, several hours of configuration and you have a home network filtering solution.

Craig Jensen

Not being a Linux expert, it's the "several hours of configuration" part that kills it for me.

I guess there are enough hardware differences between "old machines" that coming up with a common configuration "how-to" would be impractical. However, if we could settle upon a cheap, readily-available, stable hardware platform, we could at least cook up the how-to, and perhaps go beyond that to a plug-n-play install package.

I've been thinking one of those mini ITX boards would be a good starting point for a hardware platform. They've got nano and pico ITX boards if you want to get fancy, but I'm thinking that cheap is the way to go. That way, when a fellow ward member asks about blocking out the world, I can tell him how he can do it for $400 or less, or I can offer to do it for him at cost.

In the meantime I'll try to come up to speed on Linux, so that I know what you guys are talking about.

Does anybody have experience with the Via Epia EK 8000EG mini-ITX board?

It's got dual LAN, and it's fan-less, meaning you can hide it and forget about it.

Will it be available long enough in its current configuration? Are stable Linux drivers readily available?

Price:
~$200

Specifications:
800MHz Fanless Luke Corefusion integrated CPU and Chipset package;
Supports up to 1GB on 184-pin DDR 400 DIMM socket;

6 channel audio;

Integrated Unichrome Pro graphics with MPEG-2 decoder acceleration and 70 pin LVDS/TTL/DVI connector (requires add-on card).

Rear Panel Connectors:

PS2 Mouse & Keyboard;

Serial; Parallel, VGA;

4x USB 2.0;

2x 10/100 LAN;

3x 3.5mm Audio (Line-out, Line-in and Mic-in, can be configured as 5.1 outputs).



Board connectors:

2x IDE 66/100/133;

2x SATA with RAID 0/1;

20 pin ATX power;

1x DDR 400 DIMM socket;

4x additional USB 2.0 connectors on two 9 pin headers;

KBMS;

SIR fast infrared;

COM2;

LVDS/DVI/TTL (requires add-on card);

SMBus;

3x additional COM connectors on 3x 9 pin headers;

F_AUDIO; F_PANEL; 1x PCI slot.

... just arrived from the thread about recommended filters...

I hadn't actually been thinking about a separate hardware box. I had just been encouraging people to install a browser and/or OS that is less vulnerable to the threats those pieces of software can deal with. A separate server box does sound like an interesting idea, though.

thedqs wrote:We're comming out with the Mormon ITX so don't bother... :p Just kidding actually how do we want the server to act? As a router, firewall and filter? That would most likely be the easiest if you are going to create a dedicated box, and for those that don't you just make your "server" a proxy server which must be on for anyone to access the internet. Though you can have problems with security since it just takes a small change in the internet settings to stop using the proxy.

The earlier quoted posting from cdjensen has one very good solution to the possibility of a user changing internet settings to bypass the proxy: put the proxy machine between the home LAN and the external WAN so it can't be bypassed. The proxy machine then can become a firewall among possibly other things. However, if the users are adept at unplugging and replugging RJ45 connectors, it might be necessary to build some physical security (doors, padlocks, etc.) around the proxy box.

There are other possible functions to put on the proxy machine, though security folks will tell you to keep the proxy/firewall box separate from other functions. Those other functions could include print serving, storage for family history data and photos.

rmrichesjr wrote:There are other possible functions to put on the proxy machine, though security folks will tell you to keep the proxy/firewall box separate from other functions. Those other functions could include print serving, storage for family history data and photos.

Exactly but since we are trying to keep it simple I think just having the basic OS, firewall and proxy would be alright.
Example of complex server (meaning my own):
Windows Server 2003
Active Directory Server (Real nice for keeping everyone's profiles in sync and managing permissions in a central local)
Web Server
File Server
Print Server
Terminal Services Server
Network Monitor
Certificate Authority Root
Subversion server
And some other things I might be forgetting.

The proxy and firewall are missing because I use DLink's firewall for the WAN to home connection.

Getting the Active Directory to work was the hardest part really and for a normal user that would be out of their league. (If anyone wants a step by step tutorial send me a PM)

Also as for my Server it is a simple 800 MHz machine with 384 MB SD Ram. So you don't need much.

garylm wrote:Does anybody have experience with the Via Epia EK 8000EG mini-ITX board?

It's got dual LAN, and it's fan-less, meaning you can hide it and forget about it.

Will it be available long enough in its current configuration? Are stable Linux drivers readily available?

Price:
~$200

Specifications:
800MHz Fanless Luke Corefusion integrated CPU and Chipset package;
Supports up to 1GB on 184-pin DDR 400 DIMM socket;

6 channel audio;

Integrated Unichrome Pro graphics with MPEG-2 decoder acceleration and 70 pin LVDS/TTL/DVI connector (requires add-on card).

Rear Panel Connectors:

PS2 Mouse & Keyboard;

Serial; Parallel, VGA;

4x USB 2.0;

2x 10/100 LAN;

3x 3.5mm Audio (Line-out, Line-in and Mic-in, can be configured as 5.1 outputs).



Board connectors:

2x IDE 66/100/133;

2x SATA with RAID 0/1;

20 pin ATX power;

1x DDR 400 DIMM socket;

4x additional USB 2.0 connectors on two 9 pin headers;

KBMS;

SIR fast infrared;

COM2;

LVDS/DVI/TTL (requires add-on card);

SMBus;

3x additional COM connectors on 3x 9 pin headers;

F_AUDIO; F_PANEL; 1x PCI slot.

If you notice my previous post you can get quite a server out of those specs that you have listed. Though if you are going to use it as an Active Directory or a File Server make sure you get a lot of hard drive space.

garylm wrote:Does anybody have experience with the Via Epia EK 8000EG mini-ITX board?

While I was at Linspire, we did a lot of work with Via. They seemed to have a great success rate with Linspire/Linux. I am not familiar with the model you are talking about, however. Their processors are lightweight which is why they can get away from having a fan. They aren't the fastest on the market but are inexpensive.

Tom

My biggest problem w/ the ITX boards is the on-board audio and snazzy video. My firewall runs headless, and I cant see a need for speakers in my basement closet, so I generally use stripped down machines.

My current firewall is a Pentium Classic 200, with 32Mb. I have been debating getting a 4Gb CF card and replacing the HDD with it, as I am more prone to HDD failure than anything else. I have a file server, so I could just net-boot the thing, but I haven't been that motivated yet.

My box is not running Squid, nor any type of IDS, as it is behind the modem/router firewall. My Linksys box does logging and access control, so if I want to do that, I might see what the router has to offer.

I guess that would kind of fit in the more advanced category....

A few things about LInux and hardware:
Most OLDER hardware is well supported. Exceptions tend to be things very dependant on software drivers and rare stuff.

Linux auto-detect works better (IMO) than MS auto-detect. Also, most linux installs come with all the drivers you will ever need. If you doubt this, try a liveCD of Ubuntu or a similar distro. It will find your sound, video, CD, USB, etc. You might have to dig a bit to connect your old-school parallel printer.
When my old laptop died, I removed the HDD, put it in a new laptop w/ a different MANUFACTURER, and my linux system booted fine without problems. Windows couldnt even find the bootstrap.

My suggestion:
There is a free VMWare VM image of a proxy / firewall system available from the VMWare site. It has Squid, and all of the reporting / gui config / whatnot software installed. I think that would make a good reference, and a place where people could try out a Linux solution without getting mired in the detail.

I prefer physical separation between my networks, so I don't like the idea of a VM firewall, but I am trying to think of a way that it could work. With a VM image, you could run the firewall on an existing system and on the OS of your choice without trying to work through an install and config.

Wouldn't you know it, I can't remember which one I used....

The first few on this page look good, but I cant find mention of the GUI config stuff.

http://search.vmware.com/search?q=squid ... _appliance

The VMWare Virtual Applicance home page. You may find other images there.

http://www.vmware.com/vmtn/appliances/

VMWare is not affiliated with the Church of Jesus Christ. The Church does not endorse VMWare, or its products.

The Earl wrote:My current firewall is a Pentium Classic 200, with 32Mb. I have been debating getting a 4Gb CF card and replacing the HDD with it, as I am more prone to HDD failure than anything else. I have a file server, so I could just net-boot the thing, but I haven't been that motivated yet.

Just remember that you cannot rewrite to CF as much as you can with HDD so as long as the temp files are stored on a RAM drive and the CF is basically read only then you'd be fine. If you write temp files to the CF often then HDD would be better.

The Earl wrote: A few things about LInux and hardware:
Most OLDER hardware is well supported. Exceptions tend to be things very dependant on software drivers and rare stuff.

I wonder if they have something for my 8086 box and the custom hardware it runs off.

The Earl wrote: If you doubt this, try a liveCD of Ubuntu or a similar distro. It will find your sound, video, CD, USB, etc. You might have to dig a bit to connect your old-school parallel printer.

Though on one box the Ubuntu LiveCD just mangles the graphics but DSL (Linux Distro) worked farily well.

The Earl wrote: I prefer physical separation between my networks, so I don't like the idea of a VM firewall, but I am trying to think of a way that it could work. With a VM image, you could run the firewall on an existing system and on the OS of your choice without trying to work through an install and config.

It works (at least with Virtual PC, haven't tried the VMWare) to have an intermediate server IF you have 3 ethernet connections on the machine. 2 would be dedicated to the virtual server (WAN to LAN) and then the other is a dedicated to the host machine. Most computers come with 2 network jacks on the motherboard and so you'd just need to get a card.

http://lwn.net/2002/0404/a/elks.php3


No, i understand it would work w/ a machine with 3 cards in it, I was more wondering if VLAN or virtual interfaces would make it possible and secure for a single or dual nic MB.

In my experience, multi-home Windows boxes do not route well at all, but that may be more indicative of my windows networking skills than anything else.

It might by editing the internet settings to use the virtual server as the proxy but the problem would be using the out connection to the router's wan port and have the same be on the lan side. Of course if you have a network hub then you could do it with two. Have the internet connect go into one port and the connection to the hub goes into the router. Your virtual server becomes the firewall and DHCP server (or DNS if everything is static IP) and all the information has to go through the virtual server. Though I don't know if you can disable the connection in the Host machine but still use it in Virtual machine.

Good grief. Where do you guys find the time for all this stuff?

garylm wrote:This posting in another thread got me started (and rmrichesjr seems to have a handle on the concept as well):



Not being a Linux expert, it's the "several hours of configuration" part that kills it for me.

I guess there are enough hardware differences between "old machines" that coming up with a common configuration "how-to" would be impractical. However, if we could settle upon a cheap, readily-available, stable hardware platform, we could at least cook up the how-to, and perhaps go beyond that to a plug-n-play install package.

I've been thinking one of those mini ITX boards would be a good starting point for a hardware platform. They've got nano and pico ITX boards if you want to get fancy, but I'm thinking that cheap is the way to go. That way, when a fellow ward member asks about blocking out the world, I can tell him how he can do it for $400 or less, or I can offer to do it for him at cost.

In the meantime I'll try to come up to speed on Linux, so that I know what you guys are talking about.

Smoothwall express is a good cost free option too. It's basically a firewall operating system that you install on a box and place between your modem and your LAN. It's really easy to install, you access it via a web interface (so no need for a monitor/mouse/keyboard to be connected to this machine) once installed and dansgardian is a free addon that you can install via the web interface. I had it set up in my own home in literally minutes. Runs on old hardware very well (it was designed to), though again requires two network cards. We use the corporate version of smoothwall along with dansgardian at work, I am very impressed with it.

http://www.smoothwall.org/

EDIT: My apologies, I didn't see how old this thread was

For many people, they see these solutions as unattainable because the depth of the skill required to make some of these things work is too complex and difficult. I've read through the threads and many of the solutions presented were single point (individual computer), complex (install this, then this, then this, configure that), or costly.

There are open source projects out there, and most of them use the same tools (dansguardian, squid, et al). SME Server is a very good solution and one of the key maintainers lives in Utah, works for the state, and is a devout member of the church.

Another solution which has not been mentioned on this board is ClearOS. I work with the company and the open source foundation so yes, this is a blatant plug.

I use this solution to protect my whole home and to protect my children. Here is an intro video. It is very easy to setup and configure, has an active open source community, and has delegation of administrative privileges so you can set up multiple named administrators. Administration of the box is from a web interface which is very intuitive and super easy. It is available in 20 languages so it is ideal for many members worldwide. The content filtration controls can be configured to just log activity (the free agency with accountability paradigm) all the way to white list only control with designated access based on time of day and user (the protect my family at all costs paradigm). My brother-in-law, for instance, used this to prevent his daughter from getting up in the middle of the night and chat with friends.

In addition to being a great content filter it is also a firewall, anti-spam, anti-virus, file, print, and intrusion prevention server and much more. Many charter schools and private schools use it because it works, it is simple to configure, and it is :eekeek:.

The corporate entity behind it makes their money by selling business grade services to businesses. They also sell content filter updates for those that want that level of control but for my family, the pattern files included in the latest releases are sufficient.

Many of the people that work on the project are LDS, and their offices are in Orem. The vast majority of users that use it worldwide are homes and private individuals who just want a working server for their home. It is in the top 30 linux distributions and has been compared as the MS SBS replacement by Linux Magazine.

It will easily run on older x86 hardware or on the ITX boxes talked about on this forum. At home, I run it on a older fanless LEX Twister with 1Gig memory, 80 Gig hdd, 800 MHz processor.

I've been running Untangle for several years.

It's nothing that couldn't be done with a lot of Linux work, or Smoothwall, or such. But it's a pretty simple installation, and has a very slick GUI, so you don't need to be an expert at the low-level stuff. Mostly it just plain works.

It does require a dedicated box, and I'm using a mini-ITX homebrew system for space's sake. The basic free version is fully functional, but they'll be happy to sell you upgrades with more bells and whistles.

Combining Untangle with OpenDNS's filtering makes for a pretty solid filtering system.