Server and network setup for a small private school

Question

I help a local private school with a lot of their tech needs. So far, it's been on the order of repairing/installing office computers and helping manage the office network.

But now the administrator is looking forward and wants to get the staff and students modernized and online. He has asked me if I would be interested in setting up a server and maintaining it (possibly for a little remuneration).

But now I'm in a quandary - I'd love to help, but I have little experience with servers. I have the time to dedicate to learning and maintaining, but this will be a new venture for both the school and I.

The school would need user logins for approx. 50 staff and faculty, and around 200 students. These would all need strongly filtered internet access, data storage, security, printer access, backups, and I'm sure they'd eventually want VPN's. They'd like school email accounts for all students and staff, shared calendars, etc.

My original plan was to use Google Apps (they already have a Google Apps for Education account) combined with OpenDNS filtering. But now I understand that it would be pretty simple for a knowledgeable student to bypass that.

Also, the school currently uses an old 24-port switch, a hodge-podge of wireless routers as AP's (it's a long 2-story solid brick building complete with fallout shelter), and "standard" DSL (bandwidth unknown). Only the office computers are wired. Almost all the teachers access the network wirelessly. To keep the students from learning the password and gaining access, the school uses MAC filtering to prevent unauthorized access. Obviously if they are going to allow student access, this system will also need to be rethought.

So given all these requirements, I'd like to ask these questions:

1. Besides filtering, what other benefits can the school receive from their own server as opposed to only using Google Apps?
2. Does a Virtual Private Server solve these issues any cheaper than having their own server? Would it introduce other problems?
3. Without looking for a specific hardware recommendation, what kind of server would we need? Basic, mid-level, etc.? What features should I be careful to invest in?
4. I know Windows OS fairly well, and have dabbled in Ubuntu. Given my relative inexperience and the above needs, does any server software stand out as far more applicable to the school's (and my) needs?
5. Given the possible user numbers, mix of user systems (Macs, PC's, phones, etc.), and other things I'm sure that I can't foresee, what changes should we consider for the network?
6. Is there another possible solution to this project that I should look into?
7. Any glaring holes you see that we've missed?

Right now, the school doesn't utilize the network for much more than print sharing. So it won't take much to make improvements. However, we'd like to also future-proof as much as is reasonable. The school is on a tight budget (who isn't?), but some of these things could be a great help.

Answer 1

I work for a school of similar size. My recommendation:

Focus on the network infrastructure as the first priority. Get beyond consumer level switches and internet access by implementing say, a Cisco ASA 5505 firewall combined with a Squid web proxy to do edge and http filtering and VPN connectivity.

An ASA 5505 is probably less than 500$ with a support contract, and Squid is open source, you have to build it on a decent machine but you can use it with Cisco's wccp protocol, which redirects http requests to the proxy for approval, but if the proxy machine dies, the system "fails open", meaning access is still allowed. )

Connect that to a main backbone switch. I recommend say a Cisco 2960 48 port switch. Get any other random switches and the wireless ap's plugged back into it. This type of managed switch will prevent switching loops and gives extensive monitoring capabilities if there are problem, as well as providing security mechanisms.

Yes Cisco gear is expensive and can be intimidating to set up when you are new to it, but it is solid, feature rich, and conforms to every network protocol out there. It can be the foundation of resilient networking.

I'm guessing the wireless network is shabby and performance sucks. Run around with netstumbler and see what is interfering and how the wireless range is. Be sure to configure the radios to use non overlapping frequency of channels 1, 6, or 11.

Server? A modest Dell or HP rack server for $4K or $5K with Windows 2008 R2 will work fine. You can use it for user and group management, group policies, print serving, file serving. Get as much RAM and the fastest hard drives you can afford. Sure *nix based systems will work too. Supporting it in the future if you aren't around might be trickier than finding a MS admin.

I'd virtualize that server on a VMWare ESXi install, and size the physical server so I can add another guest machine.

Don't forget to plan for power supply, UPS, and heat mitigation in equipment areas. Enterprise grade gear gets hot fast and uses plenty of power.

No reason to not use both local file storage, and Google Docs, if they want. Let the users needs drive their particular situation.

Antivirus? Probably something that's managed in the cloud, or not managed at all, like MSE? Maintaining a Symantec or Sophos enterprise install is a pain in the ass and licensing is hugely expensive. Give them MSE, take away admin priviliges from their user accounts on their local pc, and call it mitigated. Without admin rights they'll have to try a lot harder to get infected.

Trick here is budget I'm sure. Convincing management that IT is important infrastructure that will break fast and catastrophically if not done correctly is key.

Answer 2

Network backbone is going to make or break this, lay ethernet to all rooms, the wifi will be a mess and basically unusable with a lot of traffic on it.

These would all need strongly filtered internet access,

Some firewalls come with content filtering, but that costs $$$, haven't had much experience outside of that but is typically your best bet (especially for a school). This is probably the last thing I'd cut considering a school can get into big trouble involving kids and access to the net (plus you don't want kids killing the DSL line).

data storage,

Any computer with shared storage will do, maybe even a NAS for cheap, Linux based boxes can get you far.

security,

AD is pretty much required for this, again, $$$. I've heard of people getting by with OpenLDAP, but good luck implementing the security you need (GPOs) to keep kids from breaking everything.

printer access,

Print server with CUPS is cheap and awesome.

backups,

Removeable hard drive is your budget option, buy a few, rotate them offsite.

and I'm sure they'd eventually want VPN's.

If you have an AD server that's easy, any firewall that filters content should have VPN support too.

Biggest things you're looking for is: Network infrastructure, Active Directory, and content filtering firewall I would say. We use a Cisco firewall (ASAs), they're nice but kind of pricey, maybe someone can recommend something cheaper.

I'd say:

1. Start with infrastructure, ethernet backbone, get the classrooms wired (get bulk cable from Geeks.com or something).
2. Get a content filtering firewall.
3. Kids can use computers at this point, but lock them down with local policies and keep ghost handy, you'll have to reimage a lot.
4. Active Directory as soon as you have the budget.

Some ideas to get the ball rolling, a lot of this has to do with how much you have for a budget, we kind of need numbers to get into software and hardware to purchase.