Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I currently have five PCs at home, three running WinXP and two running Ubuntu. They are set up like this:

    ISP ----- Modem ---- Switch ---- Ubuntu1 -- B&W Printer
                           |      |--WinXP1
                           |      |--WinXP2
                        Wireless  |--Colour Printer
                           |
                           |---------Ubuntu2
                           |---------WinXP3 (laptop)

The Ubuntu1 machine is set up as a PDC using Samba and runs fetchmail, procmail, dovecot to get my e-mail and allow me to access the e-mail via imap so I can read the e-mail on any PC. I'd like to set up the network like this:

    ISP ----- Modem ---- Ubuntu1 ---- Switch ------WinXP1
                            |            |      |--WinXP2
                        B&W Printer   Wireless  |--Colour Printer
                                         |
                                         |---------Ubuntu2
                                         |---------WinXP3 (laptop)

My questions are:

  1. How to configure Ubuntu1 to act as a firewall.
  2. How to configure Ubuntu1 to provide a consistant user authentication across the network, at the moment Samba provides roaming profiles for the XP machines but the Ubuntu2 machine has it's own user lists. I'd like to have a single authentication for both XP machines and linux machines so that users added to the server list will propagate to all PCs (i.e. new users can log on using any PC without modifying any of the client PCs).
  3. How to configure a linux client (Ubuntu2 above) to access files on the server (Ubuntu1), some of which are in user specific folders, effectively sharing /home/{user} per user (read and write access) and stuff like /home/media/photos with read access for everyone and limited write access.
  4. How to configure the XP machines (if it is different from a the Samba method).
  5. How to set up e-mail filtering. I'd like to have a whitelist/blacklist system for incoming e-mails for some of the e-mail accounts (mainly, my kids' accounts) with filtered e-mails being put into quaranteen until a sysadmin either adds the sender to a blacklist or whitelist.

OK, that's a lot of stuff. For now, I don't want config files*, rather, what services / applications to use and how they interact. For example, LDAP could be used for authentication but what else would be useful to make the administration of the LDAP easier. Once I have a general idea for the overall configuration, I can ask other questions about the specifics.

Skizz

  • I have looked around for information, but most answers are usually in the form of abstract config files and lists of packages to install.
share|improve this question

5 Answers 5

  • How to configure Ubuntu1 to act as a firewall.

You want IPTables. I use shorewall to make it much easier.

  • How to configure Ubuntu1 to provide a consistant user authentication across the network, at the moment Samba provides roaming profiles for the XP machines but the Ubuntu2 machine has it's own user lists. I'd like to have a single authentication for both XP machines and linux machines so that users added to the server list will propagate to all PCs (i.e. new users can log on using any PC without modifying any of the client PCs).

You want to have linux control windows logins? I think the only way that can work is with some LDAP propogating to a directory server.... but I'm not positive. Not sure here.

  • How to configure a linux client (Ubuntu2 above) to access files on the server (Ubuntu1), some of which are in user specific folders, effectively sharing /home/{user} per user (read and write access) and stuff like /home/media/photos with read access for everyone and limited write access.

Samba. This shares home directories:

[homes]
comment = Your Home Directory
browseable = no
valid users = %S
writable = yes

And you can set up .bashrc to auto-mount a homedirectory upon login. There might be a better way but this gets you halfway there.

  • How to configure the XP machines (if it is different from a the Samba method).

Configure them to do what?

  • How to set up e-mail filtering. I'd like to have a whitelist/blacklist system for incoming e-mails for some of the e-mail accounts (mainly, my kids' accounts) with filtered e-mails being put into quaranteen until a sysadmin either adds the sender to a blacklist or whitelist.

I have no idea on this one.

share|improve this answer

Unless you want to be able to access parts of your network from the outside world, I'd change things slightly (and even then). I presume that you are using Ubuntu1 as a workstation, and not just a print server. Doubling up the roles of a computer (especially on something that is supposed to be secure like a firewall) is contrary to the norm, and opens you up for more problems and attack points.

I'd put in a separate linux box (probably low end is sufficient, because it doesn't have much to do) to act as a the firewall - running something like IPCop.

ISP ----- Modem ---- IPCop ---- Switch ---- Ubuntu1 -- B&W Printer
                                   |      |--WinXP1
                                   |      |--WinXP2
                                Wireless  |--Colour Printer
                                   |
                                   |---------Ubuntu2
                                   |---------WinXP3 (laptop)
share|improve this answer
    
The Ubuntu1 PC is more a server than a workstation. It currently is the PDC (Samba) and grabs e-mails from my ISP and provides them to clients (Thunderbird) running on the other PCs via imap protocol. I'll look into IPCop. –  Skizz Jul 15 '09 at 12:42

I'm just going to answer points 2 and 3, as I don't have anything useful to say on the other points.

  1. How to configure Ubuntu1 to provide a consistant user authentication across the network, at the moment Samba provides roaming profiles for the XP machines but the Ubuntu2 machine has it's own user lists. I'd like to have a single authentication for both XP machines and linux machines so that users added to the server list will propagate to all PCs (i.e. new users can log on using any PC without modifying any of the client PCs).

I have no experience with this, but PAM is very flexible and can be used to authenticate the users on your linux machines to all kinds of systems. So, you could for example use LDAP to store your user accounts in on Ubuntu1, and have the pam setup on Ubuntu2 connect to that LDAP to authenticate users.

  1. How to configure a linux client (Ubuntu2 above) to access files on the server (Ubuntu1), some of which are in user specific folders, effectively sharing /home/{user} per user (read and write access) and stuff like /home/media/photos with read access for everyone and limited write access.

If you make sure the user ids on both machines match (for example by using the single sign-on using LDAP), then the easiers is to use NFS. After installing the nfs packages (don't forget the "portmap" package), enter "man exports" at a linux prompt to get started.

share|improve this answer
    
Yes, I thought LDAP would come into it. That alone is complex enough for several questions. –  Skizz Jul 16 '09 at 16:36

I would use pfSense as my router/firewall. I would also connect the wireless stuff through a separate network adapter, so that you can have more control over the network.

                .---------------------.  .---------------.
                |       pfSense       |  |    Switch     |
                |---------------------|  |---------------|  .-------------.
    .-------.   | .------.  .-----.   |  | Ubuntu Server--->| B&W Printer |
    | Modem |<----| Wan  |  | Lan |----->| WinXP-1       |  '-------------'
    '-------'   | '------'  '-----'   |  | WinXP-2       |
        |       |                     |  | Color Printer |
        v       | .------------.      |  '---------------'
     .-----.    | | Opt1       |      |
     | ISP |    | | (Wireless) |      |  .------------------.
     '-----'    | '------------'      |  |    Wirelessly    |
                '--------|------------'  |    connected     |
                         |               |    Computers     |
                         '-------------->|------------------|
                                         | Ubuntu-2         |
                                         | WinXP-3 (laptop) |
                                         '------------------'

This way you can easily control which computers can connect to the wireless Network, without having to worry as much about the wired connection. pfSense has an excellent, easy to use, web-based interface, just look at the screen shots.

(I made the diagram with Asciio)

share|improve this answer
    
Are you suggesting that the pfSense is running on its own PC? In which case, I do have a very old P200 (with MMX!) that I could use (assuming it still works). Unfortunately, though, the wireless node is also a four port switch. –  Skizz Jul 16 '09 at 16:35
    
Also, Asciio looks cool. Will check that out. –  Skizz Jul 16 '09 at 16:38
    
It was just a thought. This is largely how I plan to set up my own network. –  Brad Gilbert Jul 16 '09 at 16:53
    
+1 for pfSense. It really is a great (free) firewall/router with so many options. –  osij2is Aug 14 '09 at 15:18
up vote 0 down vote accepted

After musch hunting for and trying out ideas, I eventually found a simple little utility that allowed me to configure the network the way I wanted - dnsmasq. Also, it was really easy to set up as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.