HPD West Precinct TAP Lab Network
Jerritt Collord Kirby Urner
The Hillsboro (Oregon, USA) Police Department hosts a Linux-based computer lab at their West Precinct facility. This is part of an outreach program which establishes Technology Access Points locally and makes available the resources for partner communitybased groups. Thusfar the lab has been congured for easy network management, but much is left to be done towards user management/authentication with storage quotas, etc.

Table of Contents

Network Layout....3 TODO....5 Suggested Upgrades....5

Network Layout

Cable Modem
Dont know much about it. It appears to be a Netgear. Either Comcast has the connection on private IP space or this is actually a NATing router.
Gateway/Firewall/Server (mainman)
Manufacturer: HP Model: a610e Operating Sytem: Red Hat Linux 9.0 IP: eth0: 10.1.10.74 (dhcp) IP: eth1: 192.168.0.10 (static)

Services/Functionalities

DHCP: Static host entries are contained in /etc/dhcpd.conf for each of the workstation computers. The correlation is such that the host "linux04" will receive the address 192.168.0.104. NTP: Upstream NTP signal is retrieved from HE.nets public NTP server and our service is available for any machine on the lab network; the DHCP responses contain a reference to mainman as an NTP server and currently all the workstations are congured to use it. DNS: Forward and reverse DNS for the workstation network (192.168.0.x) is provided (TODO: need to make generic entries for the non-lab computers). BIND is congured as a caching nameserver with the ISPs nameservers as upstream query points. DHCP responses contain a reference to mainman as DNS server and currently all workstations are congured to use it.
Firewall/Routing: NAT is provided between the private lab network and the upstream Internet. (TODO: block known-bad ports e.g. gnutella, or establish a whitelist.) HTTP Proxy: A SquidGuard conguration from the K12LTSP project is installed that transparently diverts all HTTP requests that come to the gateway into the SquidGuard system. (TODO: make the blacklist databases automatically update in cron.)

Main Switch

Manufacturer: D-Link Model: DI-604 Residential Gateway IP: 192.168.0.1
This is used only as a 4-port Ethernet switch. The WAN port is unused, and the DHCP server is disabled.

Wireless Access Point

Manufacturer: Linksys Model: WRT54G IP: 192.168.0.5 wireless: 802.11b/g with 64-bit WEP
Again, the WAN port is unused. The device simply bridges Ethernet between wireless and its wired LAN ports. The two workstations on the East table are plugged into its LAN ports as well.

Feeder Switches

Manufacturer: D-Link Model: DSS-8+
These are 8-port unmanaged Ethernet switches, one each on the middle of the North and South sides of the classrooms. Each feeds 6 workstations.

Workstations (14)

Manufacturer: Compaq Model: ? Operating System: Red Hat Linux 9.0 IP: 192.168.0.101-114

HPD West Precinct TAP Lab Network Lab seats are PIII-based Compaq workstations with built-in ethernet. All authentication is local at the moment; the machines are congured to boot into a graphical (gnome) session for a non-privileged "user1" user.

Network Conguration

It would be nice to have a non-NAT, publically-accessible IP address from Comcast, or if in fact there is a routing cable device, to replace it or recongure it. This would be the best way to do remote administration, etc. Failing this, a reverse SSH tunnel can be established from mainman to a point on the public Internet with a watchdog in cron to re-establish should the connection break.
Server/Gateway Conguration
See TODO notes in Network Layout section. Authentication as below will require NFS and LDAP services running on mainman.

Workstation Conguration

Authentication Source
User authentication via LDAP (pam_ldap) with home directories NFS-mounted from server.

Software Updates

Congure all with apt-rpm or yum or up2date or equivalent. Local repository if possible.

Suggested Upgrades

Ethernet Speed
A gigabit Ethernet backbone would provide a large speed boost in this lab conguration. This would be facilitated by replacement of the DI-604 by a small 5-port gigabit switch e.g. D-Link DGS1005D (list: $129), replacement of the DSS-8+ with equivalents with gigabit uplink e.g. D-Link DES-1009G (list: $149 each), and a new gigabit card for mainman e.g. D-Link DGE-530T (syskonnect chipset, list: $30)