How to set up remote login and DNS resolution in a small business environment having centralized server

Question

Dear fellow Administrators,

I have a very burning issue I am still hunting an answer for. We had a maintenance involving the IT infrastructure (new computers, cabling, etc.), but we have found that software-side improvements are needed too.

I have a small, central server, which is a very bull computer, two big (1 TB) hard drives with motherboard-driven RAID1, two NICs and all, having Ubuntu Server 12.04 x64 installed. This server is planned to be used as the central server, managing the name resolution, the IP leasing, proxy, remote profiles, local and remote website, FTP and e-mails. All in all, basically everything will be put on this machine.

The small services were not a problem for me to set up, but I am deadlocked with the DNS and remote profile part. This computer runs a Linux-based server, but our workstations (we have roughly 30 of them) are using Windows 7, so we need SMB\CIFS too.

I have found a way to configure the DHCP server (preconfigured address for the dekstop workstations, and (with the throttle ACL in Squid) slower subnets for occasional notebooks), using Shorewall for firewalling. eth0 connects to the local network, while eth1 is the connector to the rest of the Internet. It is done this way because the integrated card is faster, and we only have a very slow connection to the world. Clients need to use the proxy server (it's configured on the workstation) to access the internet. Apart from DNS and remote profiles, everything is working.

We have approx. 90 users who will need to be registered and need access to log in, they are groupped into 5 groups, if this information could matter anywhere. I have found that LDAP would be a neat and handy thing to have, but I can't find a good documentation how to configure it. The funny thing is that I found a step-by-step guide (with a big sum of explanation at each step) but unfortunately it involved using a certain premade Python script to set something up which ultimately failed at the 38th step out of the 40 steps... and using my small knowledge to Python I was unable to resolve the issue. This guide was somewhere on UbuntuForums but unfortunately I have lost the bookmark.

I have read other questions (on this site and elsewhere) and... let's see if there is anything more I can provide in terms of information.

1. We have an outside-registered domain name we allocated using a qualified Registrar, but our internal network would have some other domains we need to resolve locally. (For example: our outside-avaialable domain is something.org but we should have a hosts entry to management.in)
2. The internet comes in from the provider and enters the server on the eth0 card. The server's networking is set to automatically fetch the IP from the DHCP server of the provider. The eth1 card (which I will need to set an IP for) then connects the server to a local switch, and after that switch, using some more switches, the workstations are connected. We also have two wireless access points plugged into that whole branch. These switches are passive switches, they don't have an administrative website. The access points only wirelessly distribute the local internet, the connected notebooks are (or will be) set to lease IP from the central server in question.
3. On the serverside, we are bound to open-source solutions. We are a non-profiting organization, and, due to budget issues, licensing a Windows server is out of the questions. The workstations have legally licensed Windows 7 Ultimate or Enterprise on them (it varies), and they are mostly 64-bit.
4. Our internal network is planned to be in the same subnet, with 192.168.1.0 being the IP of the server (the outside IP address is likely to change semi-anually, roughly in every fourth month). Our workstations are named WK01 and then incrementally, with IP addresses starting from .1.1 and then incrementally too. Our clients are grouped into 5 groups (conventionally having group names GROUP_A, GROUP_B and so on, and so forth), with an extra group called ADMINISTRATION.

The following services are already installed, and mostly configured on the server:

• dhcp3-server
• Apache Web server (with MySQL for database hosting and php5 interpreter)
• Postfix for e-mail sending and receiving
• squid is our proxy server
• Webmin (for browser-based administration, however I prefer the command-line)
• OpenSSH for remote terminal, of course.

I would be grateful if I could use bind9 as the DNS server, and most likely Samba for the remote sharing and some sort of ldap for centralized login database. The workstations will need to have some remote folders mounted as a network drive (e.g.: H:\) from the server. I will need to set per-user quotas on this mount, which I am again unsure how.

To reiterate, the questions are:

• How would I start to set up DNS resolution for domains, preferably using bind9. It would be great if I could also set that if a client tries to access the system using the domain available on the outside, it should resolve locally (and on the LAN IP) too, to prevent useless data traffic?
• How could I reasonably manage the local workstations and the user database of it, preferably using an LDAP service?
• Is there any way to set up remote profiles, so if client John Smith logs in from WK02 (let's say this is the name of the workstation), his profile is loaded from the server. He then modified something, logs out, and if he logs in from WK04 (another workstation), he will retain his modifications because the profile is saved remotely?

I have, basically, set up the environment we need using Windows Server 2008 RC2, but, due to budget (and that unfortunate thing backed up with some fortunate curiousity), I would like to transfer our wishes to a Linux-based server.

Thank you for your time and your replies.

Answer 1

Install the samba-doc package. It includes the Samba3-By Example document which covers most of what you want to do. For now you may want to use Samba3, but Samba4 is developing rapidly and should be able to provide AD (Active Directory) services. I found the shell version of ldapscripts easier to work with than the smbldap-tools scripts.

bind9 will provide your DNS requirements. Out of the box it provides recursive lookups. You will need to configure a zone file for your internal zone. It will be simpler to use your domain registrar to maintain your external DNS. If your domain is example.com, it is possible to have domain like lan.example.com defined in your local bind.

If you do move your external domain into your local bind, setup a split zone configuration and prevent access to cache and recursion for external users. This will prevent your server from being used in amplification attacks.

I have used a variety of LDAP adminstration tools. If I remember right, I found gosa to provide reasonably simple web-based interface for managing LDAP users and Samba machines.

Answer 2

Simple answers:

1. Install bind9, set it up as either a recursive (independent) or forwarding (relies on Google/ISP/whatever) resolver. I believe tha bind9 comes out of the box with recursion enabled, but the manual is easy enough to read for configuration changes.
2. Buy a Windows Server license. Run it in a VM if you have to.
3. See 2.

I know you don't want to go Windows. If that's the case, then you're going to be best skipping the Windows features.