Network Design

Network Design

The network will be a combined Linux, FreeBSD and Windows network. Routers, firewalls firewalls and servers will use Linux or FreeBSD while workstations and laptops will use both Linux and some version of Windows.

Table of Contents

• Network Topology
  • Logical
  • Physical
  • IP Addressing and Naming Conventions
• User Account Policies
  • Account names
  • Password policies
  • Network vs Local accounts
  • admin accounts
• Remote access
  • ssh port forwarding
  • remote admin logins
• Network Services
  • Internal services
  • External services

Network Topology

Logical Topology

Figure 1 shows the logical topology of the network.

                                 To Internet
                                      .
                                     /_\ 
                                      |
                                 +----+-----+
                                 |          |
                                 | Firewall |
                                 |          |
                                 +----+-----+
                                      |
                       +------------------------------+
                       |                              |
                  +----+-----+                     #######
                  |          |                     # DMZ #
                  | Wireless |                     #######
                  |  Router  |                        |
                  |          |                    +---+----+
                  +----+-----+                    |        | 
                       |                          | Switch |
            +----------+----------+               |        |
            |          |          |               +---+----+
        +---+----+     |    +-----+------+            |
        |        |     |    |            |           _|_
        | Media  |     |    | NAS Server |           \|/
        | Center |     |    |            |            ' 
        |        |     |    +------------+         External
        +--------+     |                           Servers 
                       |
                +------+------+ 
                |             |
           +----+----+        |
           |         |       _|_
           | Display |       \|/
           | Laptop  |        ' 
           |         |     Laptops /
           +----+----+    Workstations

Figure 1. Logical Network Topology

Physical Topology

IP Addressing and Naming Conventions

The network will use 192.168.8.0/24 as the network address. Table 1 shows the IP address blocks that will be used for each type of system. Adddresses will be assigned consecutively from each block with no gaps.

Table 1. IP Address Blocks

Table 2 shows the initial hostnames and IP adddresses that will be used by each system adddress.

huor | | | idril | | | luthien | | | mandos | | | nienor | | | rose | | | samwise | | | thorin | | | ulmo | | | voronwe | | | wulf | | | yavanna | | | zimrahin | | |

Radius server Web server Ansible server Gopher/Gemini server Mail server Crossfire

Table 2. Initial Hostname Set

Network Access

Account Names

Password Policies

Network vs. Local Accounts

Admin Accounts

Logon and Privileges

All logons will be authenticated through the network logon server (dior) using LDAP. Users may log onto systems using either character mode or graphical (assuming X is installed on the system).

SSH access will provided for all systems in the network. Root logons are only permitted in single user mode. The firewall (beren) will provide port forwarding so that each system in the network has its own address for SSH. Ports are assigned by adding 50000 to the final octet of the system’s IP address. This system is summarized in Table 4.

Table 4.

Account Privileges

In general, all users will have access to all workstations and laptops, unless there is a specific need to limit access to certain systems. However, access to routers, firewalls and servers will be strictly limited. Access is broken down into four groups: root, system, service-name and users.

EXPLANATION HERE

Keep the root account local but put all other accounts in LDAP.

Use sudo to allow service-based and system-based access.

The users group includes all network users. These accounts have normal access only to workstations and laptops.

NOTE: Use LDAP to authenticate users using the following /etc/nsswitch.conf: passwd: files ldap group: files ldap shadow: files ldap

Account Naming and Password Conventions

Account names will be eight characters in length and will be made of the user’s first initial and the first seven letters of the last name. If the user’s last name is less than seven letters then the account name will be less than eight letters. As an example, a user named Jeremy Brubaker would have a user name jbrubake.

In the case of duplicate names sequential numbers will be added to all names after the first. For example, given three users whose account names would be jscott, the first user would have an account name of jscott, the second would be jscott1 and the third would be jscott2. These numbers may not cause the account name to exceed eight characters in length. As an example

Passwords will be eight to ten characters and must contain at least one of the following: capital letter, number or symbol. A new user’s password will be randomly generated. Passwords can be changed at any time, but do not expire.

Software

The following lists detail what software packages will be installed on each system.

Base System Packages Router/Firewall Packages Web/Email/DNS Server Packages Network Services Packages Workstation/Laptop Packages

Installation Instructions

Configuring the Systems

Ideas

• Implement TCP troubleshooting protocols (chargen, qotd, etc.)