<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
<channel><generator>iloblog 1.0</generator><title>Phil setting up an SBS Feed</title><link>http://sbsblog.philippmuenzel.de/</link><description>&lt;br/&gt;</description><item><title>Day Four: The Virtual Host</title><link>http://iloapp.philippmuenzel.de/blog/sbsblog?Home&amp;post=4</link><description><![CDATA[ Today we'll look into the configuration of the host system.  As the virtual host I will use a Debian 5.0 Lenny with a specially patched Kernel 2.6.26 and Xen 3.4.  There exists an extensively documented and well pre-configured distro with an easy installation and various helpful tools maintained by the German computer magazine c't - the "c't Debian Server". It comes as a rather naked system that serves purely as a virtual host and thus has only very few services installed, which is good because we do not want to expose the host system too much.  In the Xen-jargon, the machines are called "domains". The host is called the "Dom0" and the guests are "DomU"s, unprivileged domains. Within the Dom0 you can setup "bridges", these serve exactly as an ethernet switch would do, and connect the virtual NICs of the DomUs with each other and with the physical NICs. This hard to explain in words, better look at the diagram of my setup:  You see the three "bridges" I set up in the Dom0. The external bridge (red) conncects the bad internet to the eth1 of the firewall machine. Purely virtual is the DMZ (yellow), which connects the DMZ port of the firewall with the servers that run inside the webserver machine. They are accessible from the internet.  Finally, the internal bridge (green) connects the file server and the "filtered" port of the firewall with our home network.   I will spend the next days now on exploring various distros that should run in the DomUs.  For the firewall, it will be Endian or IPFire, and for the servers I will take a look at Clarkconnect, centOS and clearOS.  
 ]]></description><pubDate>Fri, 12 Feb 2010 13:51:27 +0100</pubDate><category>Main</category></item><item><title>Day Three: The Hardware</title><link>http://iloapp.philippmuenzel.de/blog/sbsblog?Home&amp;post=3</link><description><![CDATA[ Today it's time to think about the hardware that should run our virtual servers. With the decisions from yesterday we know that we need a board with two NICs and a processor that supports virtualization. Yes, I know you don't need Intel-VT to run Linux inside Xen. But paravirtualisation is lame and doesn't work in case you want to go for Solaris instead (or windows ).  So what's left: 2Gigs of RAM is what I consider reasonable for the needs of two or three virtual machines. I've seen people running their home servers on less RAM than their hard drive had cache... Not what I want. Then of course we need a nice case and a really efficient 80+ power supply. And a harddisk. One harddisk, don't you want RAID, you ask?  I don't want RAID because RAID doesn't protect my data. It's as simple as that. RAID is good when you are going for high availability applications and 99,99% uptime. But RAID is not a substitute for backups. I've met people running a RAID 1 and saying "I never do backups, because my data is mirrored anyway." This is dangerous! Mirroring data within the same computer doesn't protect against fire, water, ESD, voltage surges or theft. If you have a fire in your office and your RAID1-server is toasted with both harddrives inside, where are your backups? RAID 5 is even worse. If your RAID controller fails after two years of use, all your data is probably lost, even if the disks are in perfect condition. Why? Because you need an exact replacement for your controller that uses exactly the same data distribution for the hard disks. But with the "innovation cycles" of our industry, it's unlikely to get an identical (and that means, also with identical firmware!) controller after a few years, even more if you used a cheap on-board RAID. Without this, data recovery from RAID 5 is immensely complicated and costs several thousands of €uro. And RAID is dangerous because people get lazy: "Oh, the hard disk failed. Well, the two others are doing well, I'll buy a new one when I have time..." Chances are, that when you are running a RAID of hard disks from the same manufacturer you bought at the same time, they are going to fail at about the same time. And if two disks of your RAID 5 fail, say farewell to your data.  Okay, enough of the RAID-rant. I rather spend the money saved on a second internal hard disk on an external hard disk for backups.  With all the above in mind a started browsing the sites of Dell, HP, and various small server manufacturers, like Thomas Krenn, who had some very interesting offerings. But I found that every time I started configuring one of the 300€uro offerings so that it would suit my needs, I always ended up in the 500-800€uro range.  A good friend told me of the super-duper-mega "Apple home server" which is nothing else than a Mac mini with two hard disks and a special edition of the proprietary Snow Leopard at 999 €uro. No, thanks.  I decided to revert from blog-writing to screw-driving and see what I can do myself.  Here's what I came up with: -A Supermicro SOHO 5035L-IB Barebone It comes with a 300W 80+ active PFC power supply, an Intel 945GC chipset, dual Realtek Gigabit Ethernet, a rotatable hard drive cage and is reasonably silent with 25dB. That barebone would cost 270 €uro. I added  -an Intel Celeron E3300 2x2.5Ghz CPU with virtualization extension for 40€uro  -2Gigs of RAM for another 30 €uro -a 500 Gigabyte WD Caviar for again 40€uro ====== I'm at 380 €uro now.  I think 380 for a home server with a dual core, VT and 2 Gigabytes of RAM is not too bad.  I'll invest another 190€uro in a NFS-capable NAS for the backups, which I will place two floors and 10 meters distant to the server, and I'm done. The Iomega Storcenter ix2-200 seems to fit this.  Okay, tomorrow I will talk about the setup of the virtual host and have a look at the distros for the guest systems.  
 ]]></description><pubDate>Thu, 11 Feb 2010 14:07:51 +0100</pubDate><category>Main</category></item><item><title>Day Two: Network Topology Considerations</title><link>http://iloapp.philippmuenzel.de/blog/sbsblog?Home&amp;post=2</link><description><![CDATA[ Okay, now we know what the server will be needed for, it is time to think about where to deploy the server.  Here's what we have so far: Three windows clients in the office, two windows clients in the appartment, and my two Linux clients. Every client is hooked to the GBit switch, and we connect to the internet via a DSL-Router with NAT and firewall. This router is one of the average "home" routers you get from your Telco. I'm terribly unsatisfied with their firmware (you need Internet Explorer to update the firmware! Not kidding!), so I was planning to replace this with decent D-Link or Netgear stuff soon.  My original plan was to let the server only be a simple file server, and hook it to the existing network just as it was another client. That would look like this:  Then I re-thought my plan because of my need for a remotely accessible svn-repository on the server. It's rather complicated to setup static routes in the home-router. But my plan was to run a VPN server and SVN repository on the new server and that should be accessible from the "outside". Moreover, how much better would be a "real" server for a firewall! So I switched my plans to throw out the Router/NAT and instead go for a server mainboard with two physical NICs. That would look like this:  I then remembered a wise quote from one of the last CCC speeches: "Firewalls are just computers, they have lots of internet and behind them it's often untidy"*. So how could I possibly plan to have our important data and our backups on the same machine that is for filtering all the "bad" traffic?? Not a good idea. The defensive system should not be identical to the system to be defended!  So the next idea was to use a dedicated server for a firewall, a dedicated machine for everything that should be accessible from the outside which would be in the DMZ for the firewall, and a third machine with the files not accessible from the outside:  Hmm. We're up to three servers now. What was again our budget? Not good.  Then I began thinking of how safe it would be to use virtual machines for all this. That sounded like a good idea: Have one physical server with two physical NICs. Install three virtual servers on it and connect one to the "outer" NIC and install a decent firewall distribution on it. The others would connect to the "inner" NIC, with one of them in the DMZ of the firewall. Like this:  Hey, this would also allow me to throw away that stupid, unconfigurable home router. So this is the solution I'm going for now.   Tomorrow, we will look into hardware that suits our needs and our budget.   * Sorry, I cannot translate this any better. The original quote by Frank Rieger: "Firewalls sind auch nur Computer und sie haben viel Internet. Und dahinter ist es meistens unaufgeräumt".  
 ]]></description><pubDate>Wed, 10 Feb 2010 13:06:35 +0100</pubDate><category>Main</category></item><item><title>Day one: Gathering information on the users&#039; needs</title><link>http://iloapp.philippmuenzel.de/blog/sbsblog?Home&amp;post=1</link><description><![CDATA[ So why would one possibly need a small business server?  In my case, a lot of reasons where pulling my leg until I finally decided "We need a server, right now!"  First of all, we recently moved to a new house where there's Gigabit Ethernet in every room. Yep, every single room has 2 RJ-45 outlets hooked to a gigabit switch in the basement. I was involved in planning this house, in case someone wonders.  In the basement of this house is my mother's business. They have three windows computers there and they want to share data between them.  Problems arise because access management with shared folders on windows sucks. My mom wanted several files to be accessible by a certain client only, and some files to be write-able by one user only, whilst ... You get the picture.  Next there is a software they deploy that has mediocre to non-existent networking capabilities. To overcome this, I had to set up a network drive on one PC linked to a share on another PC. A day later they asked me why the "harddrive" was not accessible if the other PC was turned off.  So the lack of manageable storage really turns down their productivity.   Then there is my dad. He has a good digital camera and likes taking photos. And now he is running out of space on his 80gig drive. So he went to a supermarket and bought a "network direct attached storage" of 500 Gigabytes. But this thing uses some nasty proprietary protocol with driver-support not existent for anything else than Windows XP.  And, in case someone wonders, it has exactly zero means of user-management or access control.  So here's what happens: My dad takes pictures that my mother needs for her business and puts them on the NDAS. Of course they are to be shared with the employees, but not our holiday pictures on this drive. We ended up copying tons of folders from the NDAS to a PC...   So, in summary, these are the needs that i determined: -A network storage device where you can 
configure who can access what -storage for daily backing
 up the data from the three employee PCs. Please, don't ask me how they do this now... 
-network storage for my dads pictures, again with folders where you can configure who can access what.  And finally there's me. I think you guessed it, I need a server for playing with things. -I want to setup a svn repository for my various coding projects. I'm not satisfied with the various free svn-hosters on the net and I need version control for a few hundred megabytes of resources and code. -I need an apache-webserver to play with -I want VPN to access machines at home from remote -I want SSH to run some jobs at home (compiling large stuff) from remote -and its cool to have your own server.  I think you got the idea why we desperately need this piece of hardware now!  
 ]]></description><pubDate>Tue, 09 Feb 2010 12:54:43 +0100</pubDate><category>Main</category></item><item><title>About this blog</title><link>http://iloapp.philippmuenzel.de/blog/sbsblog?Home&amp;post=0</link><description><![CDATA[ Hi folks,  over the next few weeks I will let you participate in the process of planning, configuring and deploying a small business server in a 
network with a handful of clients.  My goal is to share my experiences with you, and get you interested in setting up your own private server. Also, I'm eager to read comments from you. I'm sure many of you out there have more experience with Linux than I have and certainly many people know more about network security than I do.  So please feel free to add your recommendations and tips, it's good for your "told you so"-Karma!  Another reason why I decided to put on this blog is that I was looking for good info on small Linux servers, but only found very outdated resources, and nothing that handles the topic in-depth with respect to state-of-the-art Linux distributions.  So this is my try to put fresh info "into the internets".  Let the party begin!  
 ]]></description><pubDate>Sat, 06 Feb 2010 17:36:22 +0100</pubDate><category>Main</category></item></channel>
</rss>
