Linux at Hawker College

Andrew Bartlett

Hawker College

Who am I

Hawker College

Student Network Administrator

Part Time (alongside uni)

Linux Servers

Network Services

Samba Team

Authentication

ANU

3rd year student

Corporate Network

Hawker is reasonably big:

800 users

170 computers

I treat it as a 'corporate network'

Avoid 'educational' software

Often too site-specific, or simply not maintained

Look for 'big end' solutions

It may be more effort to set-up, but it is worth the pain.

Minimal Client Disruption

First and Golden Rule at Hawker

Slow roll out of a new idea each year

Steps:

File-Server

Proxy Server

E-mail, shared folders

Authenticated Proxy

Single Sign on

Printing

Starting with Samba

Mission:

Provide secure file storage for students

Samba In a corner

Year 12 Project

Promises: 'Won't harm the network'

The 'student server project' was born

Taking over the proxy

Squid

Previously on a SCO box

DHCP

(automates network configuration)

Windows box hosting it died

DNS

Easy takeover

I soon ran 'basic network services'

File services and beyond

All students given accounts

Assignment submission

Shared folders

Website

E-mail

Single Sign on – the big leap

Finally have Single Sign On

No more 'duplicate logins'

One into NT (classroom, published)

Another into File server

First screen 'must change password'

Users easily prompted to change their password

Mandatory Profile

Internet Access

Outgoing

Authenticated

Quotas

Ad-zapped

Incoming

Access to files

Web-based

SSH

Public Website

Behind Single Sign On

LDAP

Integrating NTLMSSP into

Squid

Apache

pam_winbind

Apache

IMAP

SSH

VPN access

Patch to pppd and ntlm_auth

Printing

Software

CUPS, Samba

Hardware

HP JetDirect Network Printers

LTSP clients

Benefits

Accounted

Planned for this year

Automatic

Automatic Driver Download

Always prints to the 'local laser'

Current Status

6 Operational Servers

Every student has a login

They don't all use it

RedHat Linux 8.0, 7.3

Samba 3.0 (even when in alpha)

Well, I am on the Samba Team...

OpenLDAP

Stores as much information as possible

OpenSSH

CUPS

Looking Forward

Directory Integration

Push more software into LDAP backing

DHCP

Require an entry for every machine

NTLMSSP Integration

Gain transparent logins, where possible

VPN Integration

Secure access from our wireless network

Policies and Procedures

Password polices

Custom patch for 'cracklib' support

Random initial passwords

Expire in 2 weeks

Stuck to the back of ID cards

Lost passwords

New random password issued

Daily passwords

Password sent by e-mail

Used by students who need access 'now'

How we did it

Samba as a DC

Domain Controller

Backed onto LDAP

Squid/PAM use this

Samba 3.0 client compatibility

No 'hacks' for WinXP clients required

Samba as a File Server

File Server

Home drives

Ext3

RAID5

Samba print Server

Print Server with CUPS

Samba handles talking to windows

CUPS handles talking to the printers

Is there anything you can't do with Samba?

We also use samba for:

WINS Server

Network name resolution

Hooked into DNS

More reliable

Browsing

standard for a DC to perform

OpenLDAP

Enterprise backend

Don't believe the 'advocates' – it's a tool, not an enterprise solution

Achieves what we need:

Replication (BDC)

Extensible (stores quotas etc)

Distributed access

Linux clients a possibility

Printing

The bane of my existence

Mostly HP LaserJet printers

These work very well, and talk postscript

LocalLaser hack, based on %m macro in samba

Postscript Jobs from clients

Almost all the laser jobs require no processing

InkJet printers

Not designed for a network, unless you buy it inbuilt

High quality requires per-printer drivers

Custom Scripts

hcadduser

Simple prompting script, to add a new user

Maze import script

Brings in all the new students

Password change script

Prints a 'new password' form to screen

Uses Net::LDAP, and Crypt::SmbHash

I always manipulate LDAP directly

Adds custom Hawker entries

Such a quotas, grade, 'GAS group'

Maintaining Windows clients

WinNT, Win2k, WinXP clients

Until now, has not been my problem

Other staff have dealt with the clients

170 computers is too many...

Panics like 'MS blaster' could bite us

Looking into using 'unattended'

Automated windows installation

Still not as good as Linux tools

Internet Quotas

LDAP and MySQL

LDAP contains the 'real time' data

MySQL contains the paid-up quotas

Squid 'redirector' checks quotas

Redirects to a 'over quota' page

Caches values

Logfiles read and added up

These values put into LDAP

Lag

Between caches, and time to process, up to 30mins over quota

E-mail

Students and Staff have e-mail

Most stuff use their 'staff network' account however

Webmail setup

Uses Squirrelmail

Courier-IMAP

Stores e-mail in home directories, as a Maildir

Procmail / Sendmail

SpamAssassin

Not been very effective, needs update/training

Access from home

We push access via SFTP

OpenSSH server

ssh.com windows client

(educational licence)

WinSCP would work too

Also via a web page

Clunky, and I've often broken it often

I need to do work on this area

Pitfalls, Dangers

OpenLDAP

Powerful, but can be hard to debug

Firewalls

Our network design may be over-complex

Samba

Running pre-production code not for the faint of heart

'Its either up or its down'

Compared with the incumbent NT systems:

Linux either just works

or my mobile is ringing...

Questions?

No Slide Title

CIFS 2002 Conference

CIFS 2002 Conference

2002-11-27T21:47:47