Linux

Ask something
Discussion Locked

Security/Gateway Linux recommendations?

0 helpful
24 replies

by jamesweaving

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,

I have recently discovered the site and found the amount of information here incredible, so I thought I'd ask a question of my own that I've been thinking over. I only have limited experience with Linux, a definite newbie but I will learn everything I need as I go along from various resources so not overly bothered about ease of installation and use.

I am looking at setting up a personal linux based gateway server for my home network (not a corporate/business site) and was looking for recommendations.

What I basically want is:
Firewall
IDS/IDP
Antispam & Antivirus
Webserver/FTP Server (possibly for websites and webmail access)
VPN Server (again only possibly required)

I have been looking at prebuilt distros such as Smoothwall and IPCop (with addons) that may fit my requirements, or perhaps building my own based on a linux or debian based os with relevant packages, such as Snort for IDS and Apache for web.

Can anyone give me any recommendations, looking to keep this secure and minimal as possible, hardware will be releatively new (P4/AMD Athlon XP x86 based). I am looking to connect into a mailserver on another machine so will not host on this gateway but would like spam & virus filtering prior to it reaching the mail server, also if there is something I can install to hold mail incase the mail server is down then recommendations there also.

Hope this is enough info for you to work from.

All help is greatly appreciated.

Thanks
James

24 replies

by hal 9000

And regardless of what Distro you finally decide to install you'll need to install the Samba Package as well so that any Windows computers connected to the network are visible and can use the gateway.

Snap Linux makes an excellent Firewall called Predator but it is more for the corporate side of things. There are a lot of available packages and depending on which Distro you chose to go with there are different installable packages which come with each Distro.

Debian "My Favorite" is a rock solid platform to work with but not all that user friendly for a first time user so I really would suggest something easier to work with initially at least.

Knoppix would be more than enough for your needs and it installs easily and will setup a network without any effort on your part. Apache is a great e-mail package but again its main purpose is for the corporate side of things and unless you are managing multiple e-mail accounts it would be a bit of over kill for a home network, it is generally used to collect e-mail and then distribute it to the recipients and is used in large corporations and ISP's.

But you can have a look at some of the Linux Distro's from Mandrake, SUSE or any of the others which have a whole array of packages available.

Mandrake also has the option of joining their users club for about $5.00 US per month and that gives you access to everything that they have stored on their program base which is very extensive so you could download and try different things before finally finding your preferred setup.

The rest should come with whatever Distro you chose to install and should be relatively easy to work with as well as easy to configure.

Col

by jamesweaving

Col,

Thanks for the advice, I realise the hardware is a little over the top but it isn't set in stone and I thought it would avoid the 'depends on your hardware' response. I also can't guarantee that I won't expand the use of the box so the hardware will cover that without further upgrades.

I'm not particularly bothered about ease, this is more of a project for me and so I will spend time learning and configuring before using so I'd prefer stability and security over ease.

I realise that some of my choices may seem odd, Apache is a very powerful package and may be used by large corporations but I'd like the experience with it, I work in I.T. (mainly MS Windows based) so the stuff I learn with my project will also carry over to my job.

To help clear things up for other posters as well I have a couple of domain domains that I want to host email for so that is the main reason behind my requirements for anti spam, av, apache etc.

If people can recommend specific packages that will do what I want for their choice of linux, debian etc that will really help, eg if someone has a preferred Antivirus solution that supports mail or a preferred VPN solution then I would appreciate the info.

Thanks
James

by hal 9000

Knoppix if only to cut your teeth on Linux so to speak. You can install Apache and everything else that you when into that Distro while still being fairly "user friendly." It is a very stable platform to play on and can do just about everything that things like Debian can but only easier as it can use the RPM's unlike Debian.

Coming from a Windows only environment it is easier and not as much of a "Culture Shock" as things like Debian are. Believe me with even Apache you will be embarking on a very steep learning curve so you do not want to have to do it all from scratch as it will just overwhelm you totally. I know the feeling as I went through something similar when I started working on PC's and left the "Real Computers" that I was used to. I found DOS and then things like Basic a profound learning experience particuarly coming from a Unix background I thought I had walked back a couple of hundred years to a different point in time where everything was back the front.

You should also try to find a Linux User Group in your area as they will be of assistance as you learn and most are more than willing to help you out at a moments notice.

However if you are a real masochistic you can try Debian but stick to the Woody version as, as yet the Sarge version is still in development and has a few problems that are in the process of being ironed out. You can subscribe to the Debian User Group at http://www.debian.org/

Knoppix has a user forum at http://www.knoppix.net/forum/
which may be of some help as well and I'm not advocating using the Knoppix Live version but installing it so you get the full experience of Linux.

Ubuntu also has a forum group at http://www.ubuntulinux.org/community

so have a look at these and ask there I'm sure that you'll get quick answers back by devoted Linux users although they may be a bit one sided depending on which site you participate in as they are all devoted to their own individual products.

I hope that is of some assistance.

Col

by jamesweaving

Col,

Thanks again for the info I rally do appreciate the info.

I am not entirely new to linux, I have installed and played with some of the more commercial kitchen sink style packages such as Suse and Redhat although admittedly not played much with them. I also have some unix experience as we have previously run core business apps on a SCO Unix server at work although these have since moved to MS based servers and SQL.

I did stumble across a linux distro called RedWall that seems to do most of what I want or need so I may play with that but I will definitely play around with some of the easier stuff to gain experience, I will check out Knoppix and a couple of others and get used to them before taking the plunge to harder systems like debian. I also take note of the Woody version as I am far from ready to start with versions that are still developing.

Thanks for all your help
James

by bluecollargeek

James,

Your later responses indicate you have some *nix experience.

For the features you desire, you may want to look at http://knoppix-std.org/ - their distro Knoppix STD is NOT the standard Knoppix - and offers much more in the IDS area. I keep their livecd in my tool kit at all times. Be careful in their forums though, noobs can be flamed into oblivion for asking "novice" questions - use Knoppix forums for basic questions and the Knoppix STD forums for distro specific questions.

Also Sentinix was a great distro for IDS related tasks as well as AV and Anti-spam. http://www.sentinix.org but development seems to have slowed. I have used Sentinix and out of the box, it is a great IDS/IDP system and mail filter.

Otherwise, I am a debian fan - and you can build anything with Debian. Just figure out what applications you want on your system and start building.

Have fun and learn much - *nix is addicting

by jamesweaving

Hi,

Thanks for your comments and suggestions I will check these out, I have seen bits of Knoppix previously but not the STD version. From the quick look at the Sentinix site, this looks good, seems to have most of what I wanted.

I think I will play with a couple of these first then move on to building my own on a debian platform once I have picked up more knowledge on these systems and have more pratical experience.

Thank again
James

by desmack

Hi James,

If you are new, and want the most hardware compatibility, online available support then go with Mandrake. They seem to have the hardware drivers support in there distro faster than any other distro I have seen. SATA for example?

Anyway, I would defiantly not run a web server on the edge of your network. If the box is a gateway box then make it just that. A gateway.

For fire walling, IPtables is fine. Heaps of support, heaps of features. Put Webmin on the box, for web configuration, "mailx" for application mail monitors, sendmail for admin email, but lock down sendmail for use only by the server itself for admin purposes. For receiving your company email from the net and forwarding to your mail server use qmail. Its a pain but 100% secure.

Squid proxy is great to speed things up for web traffic. Real easy to make this transparent using IPtables.

For IDS, unless your have significant hard drive space and are extremely paranoid use Snort for IDS. If not then I suggest PSAD for your IDS. Great stuff and will capture about 70% of the attacks snort would.

If you want all of this to be redundant, make two of these boxes, and implement Keepalive. This app implements the VRRP protocol, and creates Linux virtual servers. (Note this is advanced stuff.)

For Antivirus, I am not sure, I usually place this on the real mail server
. usually an app designed to plug directly into the mail app that the client is using. I find then you don?t have to manage two sets of user names, etc. or cross domains, platform issues.

For VPN's. FreeSwan is supposed to be the chosen option. (I Haven?t tried it myself.) The newer group ware apps (SLOX, Exchange 2003) tend to have secure WEBDav access which in my opinion is much easier to implement, and more importantly use by users. I.e. no software, access codes, they just use the domain credentials, to access the intranets from the web.

To top it all off I usually implement some packet shaping based on the famous advanced Linux networking http://lartc.org/howto/ since this is a gateway server first and foremost.

Cheers,

Lindsay Rex
IT Consultant.
RexTek ltd.

by jamesweaving

Hi Lindsay,

Firstly, thank you for all the information you provided its great to know of people's experiences.

Secondly, I see your point about putting a web server on the perimeter network, I may not implement this anyway but a lot of the pre-built type gateways all have Apache built into them for some reason?
For antivirus this was meant to be an early protection not complete protection, I have been looking at MailScanner with something like BitDefender antivirus added on to filter virus infected email, I will never the less have AV on the mail server itself as well.

I don't think I'll have the need for redundancy but the info is useful to have anyway.

I also hadn't thought of packet shaping either but may look at implementing something, I'll have to read through your link first though. As you say this is a gateway so my main priorities are security (Firewall, IDS etc) then, mail routing. I will worry about the rest afterwards.

Thanks for your input
James

by jaqui

is more than a web server, it is also a strong intranet server.
you can use apache as a file server for your network.
you can use a running instance of apache to block several ports on a machine.
( bind to the ports with apache virtual hosts, deny indexes and have no files in the virtual host documentroot. then stop apache from giving any info other than refused message. )
you have then used apache as a firewall. ( not a recommended usage, but a possible one.)

by apotheon

As Jaqui points out, Apache can be used as a security tool, but I strongly recommend against it. It is likely to create more security issues than it solves, if used in this manner.

The real reason Apache is included on so many gateways and/or firewalls is likely for web administration purposes. You can use a browser to configure most firewalls and gateways, and in order for that to be possible some kind of web server must be running on that system. Apache has become "the standard" for that.

by rshannon

Consider Astaro's execllent integrated FW/Gateway solution. They offer a very inexpensive license for home users (up to 3 NIC's) and equally inexpensive automatic update service. In addition to anti-virus & VPN, it includes Squid web cache.

If you're determined to have all the features you've described, including your own email server, I suggest you get the KRUDServer distro from http://tummy.com, and implement Shorewall (http://shorewall.net) for the firewall piece. In any build-it-yourself configuration, you'll certainly want to have Webmin (http://www.webmin.com) for complete web-based administration capability.

by jamesweaving

Hi,

I had seen Astaro's solution whilst researching this but hadn't realised that they did a home licensing solution, I'll have to have another look at that.

I'm not guaranteed to need or even implement all the features I mentioned, they were purely an initial thought list to get feedback on. I definitely want a mailserver but this will be a seperate box, I only need the gateway to receive the mail and pass it on, not store in user mailboxes.

I will check out Webmin, I have seen a little of this before and it will definitely solve my problem of administration.

Thanks for your comments.
James

by jaqui

linux from scratch.

http://linuxfromscratch.org

this is actually the absolute best way to have a server with only the required software on it.

sine you have to have a linux running ( live cd works ) to install it. you literally compile everything manually to fit your needs.

hours of work, but can be worth it to keep system overhead down.
bare bones webserver, ftp server, mail server, firewall can be about 100 megs of disk space.
with small ram footprint also.

is keeping it minimal for system performance important? then this may be the way to go.
( enterprise networks it definately is )

to add more funtionality to lfs system you actually need to also get blfs ( beyond linux from scratch ).
this is also a great way to really learn the os, it's configuration, requirements and gotyas.

by apotheon

"this is actually the absolute best way to have a server with only the required software on it."

Not from my point of view. I definitely prefer Debian over LFS, if only because Debian allows me to manage software quickly and easily using apt with the official Debian apt repositories. While lfs has its place (trying to fit Linux into a very, very limited system, for instance), it's generally unnecessary.

To each their own, though.

by stevebuck

First off, let me say I am not anti-Linux, I'm just pro BSD. I am using FreeBSD 4.10 on an old K6-300 box with two NICs between my ADSL modem and internal network to do firewall, apache web, PHP, MySQL, sendmail, DNS, OpenSSH, OpenVPN, and DHCP for my home network that has a fixed PC and several notebook computers using wireless. I know the BSDs scare most Linux advocates, but if you know your Linux history, you know that Linus Torvalds wrote the clone Unix after AT&T bought the rights to Unix from the University of California and trademarked UNIX. The BSDs had to rewrite code that infringed on AT&T's then proprietary UNIX. I guess I still favor the BSDs, particularly FreeBSD, because they work and are configured more like the commercial Unices; SCO, SUN OS, Unixware, that I had previous experience with. If this is really just your gateway, then I see no reason to overkill with your hardware or to install any kind of X window or GUI. If you are not trying to emulate an NT fileserver, there is no need to install Samba. Internet access for your home network is via TCP/IP and has absolutely nothing to do with Samba. You can find a great deal of help on www.Onlamp.com for whatever open source path you decide to take and whatever firewall you're going to use, ipfw or iptables. This isn't play and play, but there is a great feeling of accomplishment when it's finally all setup and working. Then, just make sure you have a UPS on your AC power, sit back and let it go 24/7 (In my case also gather dust because I never even touch it).

by jaqui

depending on usage of the system, I would use it.
if it wasn't a workstation where the full multimedia toys were also wanted or needed on a brand spanking new ( under 1 year old ) system. the lack of drivers for the bsd kernel with newer hardware is an issue.
linux gets device drivers faster than bsd does.

I currently do not have a single station that bsd could drive my nic. so bsd is useless for my network. ( even my server has unsupported nic in it... unsupported by bsd )

by apotheon

I haven't seen a single reason in all of that to choose a BSD over a Linux firewall, unless you just prefer the configuration style of FreeBSD.

There are possible reasons to choose a BSD over a Linux. I just don't think you actually brought any up other than "It's a personal preference of mine." Unfortunately, I think the OP was asking for technical reasons, not just personal preferences.

I've heard it said that OpenBSD is the most secure x86 OS out-of-box. Considering the security available with a simple install of (for instance) Debian, I have a tough time imagining what could be so different, security-wise, but for now I'm still willing to concede that point. That's only true, however, of OpenBSD. I rather suspect that FreeBSD isn't any more secure than something like Slackware or Debian.

A firewall-specific distribution of Linux greatly increases default security, and adds incredible ease of configuration for iptables firewall rules, among other things. I don't know of any comparable BSD firewall-specific distributions, though I'm sure one or two exist.

So: Your point that in addition to Linux one might want to consider a BSD is made. I hope you weren't trying to convince anyone that FreeBSD is better for this task, though, because you didn't really make a case for it.

by jamesweaving

Ok, firstly I'd like to thank everyone for their input lately, I have now been overwhelmed with the information, advice and support given.

Now, can you help me decide the way forward from all the advice?

Firstly, please forget about experience or knowledge, I plan to learn everything I can before starting this and have some previous knowledge to start with so I don't necessarily want the easiest route.

Secondly, assume hardware is P3 Procesor, 256Mb Ram, 40Gb hard disk. (Please advise if any of this needs improving)

Which is the better (ie most secure and appropriate) solution.

1 - Use one of the many 'pre-built' Linux firewall distros (possibly adding on packages for other required features)

2 - Build my own from scratch (and securing myself).

If option 2 is the best way forward, which OS/version do you recommend?
Linux(flavour - RedHat/Slackware etc)
Debian
*BSD?

Thanks again for your advice.
James

by apotheon

If you want the maximum learning curve, go with Linux From Scratch. If you want the reputed most secure OS, go with OpenBSD. If you want something that is likely just about as secure as OpenBSD (you'll likely never notice the difference), and want it to be as easy as possible to maintain once you have it set up (ease of maintenance is a major issue for servers, in my honest opinion), go with Debian. If you want a corporate-backed OS with a logo on it, go with SuSE or RedHat. If you want something easy to set up with all the security bells and whistles already designed into it, go with a pre-designed firewall distribution of Linux.

If you want to screw around with it for a couple of months to learn as much as possible and, at the end, wind up with an extremely effective firewall that is easy to maintain, I'd actually recommend the following:

Start with a firewall Linux distro, like IPCop (the most popular firewall distro). Learn how to set that up and run it, learn what tools are installed, and find out everything from it that you can about how a firewall is set up. When you're satisfied that you know what you're doing (taking notes, of course), set up a firewall again using another firewall distro. Do the same thing, learn how things are done differently with this one, then move on. You might even want to do the same thing a third time, with a third distro (depending on how much time you want to spend learning about it). Then, I'd recommend moving on to either OpenBSD or Debian GNU/Linux.

I'm personally not certain you'd get any additional value out of OpenBSD, really. There are those who swear by its security, though, and if you are swayed by such testimonials it's always an option. Debian strikes me as the best x86 server OS available, because of the software management system (called "apt", or "advanced package tool") and the incredibly complete official apt repositories maintained for Debian.

About the only reason to choose a different Linux distro for production servers, other than personal preferences, is corporate support. For that, Red Hat and SuSE are probably the way to go. That, of course, can cost quite a bit of money.

by hal 9000

If you really want to go it alone use Debian I'm hooked on it but in all fairness I did start in computers with Unix.

Most of the people I help to get started on Linux I start with something like Lycoris Desktop LX which is very Windows like and not such a massive step away from what they already know.

After they get comfortable with that I then switch them to Knoppix or something similar and let them play to their hearts content.

Then to something harder to setup and eventually to Debian that way they keep at it and do not throw up their hands in disgust and run away and hide hoping it will all go away. But I follow the KISS principal "Keep It Simple Stupid" and everyone who I've started off this way from a Windows only background is now using Linux and would never consider again using Windows.

I like the idea of crawling before trying to walk and then walking before attempting to run and so forth, but if you really want to jump in at the deep end Debian is the way to go as it is really the standard platform for most scientific and industrial uses {The High End anyway} and if you can grasp the way of this nix you can use anything.

I find it really simple to use but I will admit to being biased.

Col

by jamesweaving

Thanks Col and Apotheon for your advice.

I think I will play with the pre-built one's such as IPCop and redWall to start with, time isn't really a problem as this is a personal project I would prefer to spend the time learning and getting it right.

Then I will move on and build my own using Debian as you have both suggested, I'm not really one to follow hype and if I am unlikely to notice a difference between OpenBSD and Debian and with Debian being easier to manage that sounds like the best way to me. As this is a personal project, corporate support is not required so the expense of RedHat or Suse is not appropriate. I've also heard that Debian is probably the most stable as well whether it is true or not I don't know.

Thanks again for your advice
James

by hal 9000

Most of the big specialist places who used to use Unix are now using Debian to do the job so I think that speaks volumes for its stability.

If you need a hand drop me an e-mail through the Peer Listings I'm sure that Apotheon would welcome any correspondence as well.

Now exactly what is it that they say "You do not need to be mad to do this but it sure as Hell helps!"

Col :D

by apotheon

I don't mind lending help, if it's needed.

Debian is widely regarded as the most stable of the major Linux distributions. That's largely because of the extensive review process that every package goes through before being included in the official apt repositories, not only to test the stability of the package itself but to test its interaction with other packages as well. The amount of time and effort put into testing Debian packages really boggles the mind.

by thrash cardiom

I use IPCop on my home network. I have it setup with an internal network and a DMZ (which is a single computer). The DMZ acts as a mail forwarder to the internal network and as a webserver. Build yourself a similar setup and stick your anti-virus / anti-spam software on the DMZ. Setup squid as a reverse proxy to handle web requests and feed any webmail requests through to your internal network webmail server via pinhole.

This discussion is closed to new replies.