Dentrasi's questions

I've been asked to setup access control/filtering on a network that has it's own address block (a /24). This is for students who will be connecting to the wireless network. Requirements are as follows.

• Website/category filtering (stop people going on dodgy stuff)
• Outbound port blocking
• Transparent (no need to change router/subnets/etc)
• Captive portal (ideally hooked into AD)
• Logging (at least 1 month).
• Traffic shaping (not essential, but nice)

The client the system to be set up so that if they recieve a complaint that someone has been accessing illegal materiel from the network, they can take an IP address and a date (for at least a month ago) and work out who it was. If this can be done from a nice web interface, even better.

We've looked at Untangle, which seemed to be the best bet, but after talking to their support, seemed to be lacking. It would be good if the system rememebered MAC addresses that people logged in from, so they wouldn't have to keep logging in, but Untangle doesn't seem to support this. They also said that the Captive Portal logs weren't kept very long (couldn't be exact), and that they would be lost when restarting the device. The suggested solution was to copy them off with SSH, and read the logs by hand. Not ideal.

Does anyone know a solution. Untangle sounds like it would be very hard to actually track down someone who was doing stuff on it more than a few days ago - which isn't really acceptable. Surely someone else has done something like this?

I've currently got 3 ESXi servers (free version), using direct attached storage. I want to move to shared storage, because direct storage is very limiting. There are about a dozen VMs, most are fairly low requirements (Exchange is the only one with much IO).

Unfortunately, budget constraints mean I can't get a proper SAN. Can't even get something reasonable off ebay.

Basically, I have two choices. One is a Netgear ReadyNAS 3200. I'm kind of against this, because it's only got 2 gigabit ports, and if you're using one of them for management, that leaves 1 port for all our VMs. Not good.

The other is to pick up a Dell server (such a a T410), fairly low spec, and then to get a quad port gigabit card, and put openfiler on this. For the same kind of price, I can get a dual core xeon, 4GB of RAM, and 6TB of storage (which is enough) on a RAID card, with dual PSUs.

Has anyone done something like this before? Can anyone comment on the performance I might get for this kind of setup?

And yes, I know you should have a proper (new) SAN, dedicated network, replication, etc, but that simply isn't an option. Thoughts?

I've to an EMC AX150 SAN, with two FC controllers in it. And no existing FC infrastructure. Since the controller cards seem to be modular (you can get 1 or 2 of them), is it possible to obtain iSCSI cards and replace the FC ones in that SAN to make it usable with iSCSI?

If not, can you get a switch that can connect to the SAN via FC, and then have client servers (ESXi 4.1) connecting with ethernet? Can I use something like FCoE?

I wasn't involved in the purchase of this SAN (it's also missing the UPS, which means it needs bodging to get write caching enabled), I'm just trying to see if we can use it at all. FC cards aren't cheap (most of the 2G ones I've seen are PCI-X, which our servers don't have, and the PCI-E ones seem to be £600+.

Thanks,

~Dentrasi

On Windows Sharepoint 3, users who have Collaboration permissions on a site can edit the shared view, so they can change how the site looks for others, adding and removing parts of it. Looking online, the only "fix" I've seen for this is using CSS to hide the Site Settings menu, which isn't really a solution. Can anyone give any pointers? The only permission level below the one they have is read only, which is useless for this site.

The permissions are on the top level of the site, and are being inherited down.

Thanks,

~Dentrasi

Currently, we have a test TS machine at work, which has a dual core Pentium 4 3GHz CPU, and 1.5GB of RAM, running 32bit server2003 (I didn't built it, not my choices). My boss wants to get this using Terminal Services, for about 50 light users (browsing the web, word, nothing to heavy). Considering this gives each user 30MB of RAM (assuming none for the OS), this clearly isn't going to work. What sort of spec would you recommend for a machine like this? What's a reasonable amount of RAM per user? Is CPU going to be a bottleneck?

My client's setup is as follows.

Two Dell Poweredge servers, running ESXi, with 3 virtual machine spread across them. Each has about 2TB of space in SAS disk, which host the virtual machines. These are connected to a NAS via gigabit ethernet, and run nightly backups of the VMs, using ghettoVCB. In the event of one Dell server failing, the VMs will be booted onto the other one from the backups on the NAS, losing at most 20 hours of data.

The NAS I have is a Thecus N5500, with 4 1TB disks in RAID5. It can be configured either to use iSCSI, or NFS, with a filesystem of XFS, ZFS or Ext3.

Looking online, I've seen some bad reviews for iSCSI on ESXi, some people have complained of terrible performance, and as one of the VMs is a Terminal Services server, it needs to be fairly fast. Is iSCSI/vmfs better than NFS, and which filesystem would you use as a backend for it? Does anyone have experience with this NAS and any performance issues with any configuration on it?

Thanks,

~Dentrasi

Edit: ESXi is running from a USB stick on an internal port on the MB.

I'm trying to set up an NFS share on a server 2008 machine, that can be accessed from and ESXi server. However, when asked to provide a list of groups/accounts, the only two options I am given are AD Intergration, and a Username Mapping Server, neither of which I have.

A guide I was looking at used the /etc/passwd and /etc/group files, with Windows Services for Unix 3.5, but this isn't compatible with Windows Server 2008 64bit. Is it possible to do this Windows Server 2008, using just the two files, or will I have to use a third party NFS server?