My employer is currently considering some new options for our internal data-center based items. My hope is that I can get a few comments or suggestions on a few of the areas we are looking at.

We've been using Smoothwall 2.0 (GPL) as our firewall for a while now, and it has met our needs to date. We'll probably move to Smoothwall Corporate and add SmoothTunnel for the client-platform agnostic VPN capabilities, as we want remote users to be able to access the corporate network easily from remote Windows and Linux machines.

Inside, we will have primarily Windows desktop machines (XP or W2K), with a few linux flavors, an OS X laptop, and some Solaris workstations. That being said, we can not alienate any one community - especially Windows, as that is what management uses on their machines. The user community is approximately 15 people, but we would like to be able to support double that without significant changes to the infrastructure. We're trying to plan and architect now to support expected growth in the 3-24 month future.

IT services which we will provide to the user community (and the other IT resources) include naming (DNS), authentication (ie Single Sign On, perhaps LDAP), DHCP, source control (SourceSafe and CVS), a health monitor (example, Nagios), groupware (mail, calendars, contacts...), VPN... Hoping to handle this with a minimal set of machines, but looking for a bit of feedback.

Currently considering...

* Naming (DNS), DHCP, and Single Sign On Authentication to be handled by a pair of boxes. We've got some older Netra T1s which will work for this, assuming we can host our authentication on a Solaris (8 9 or 10) box and have Windows, linux, etc, all talk to it. Already hosting Naming there, just want to add Authentication and DHCP responsibilities.

* Visual SourceSafe and ArcServe to be handled by a single Windows server, probably running SBS 2003. We are already able to do this, in fact we will make its job easier if we can remove the authentication requirements from it.

* CVS and health monitor on a single Linux box. Health monitor and linux distribution still TBD.

* Groupware (email, contacts, calendars, shared documents) selection is TBD. One of the primary requirements is that "technically unsavvy" windows users be able to use the groupware - this means something like an Outlook plugin is a must. We are currently considering Exchange, OpenExchange, egroupware... That all of our workstations be able to communicate with the groupware package is also important. Also, we'll need a way to access the group ware from remote, i.e. from a web portal residing on a host in the DMZ.

* We are considering a NAS appliance for various network shared directories, including *NIX and Windows home directories. This device will need to authenticate users with the selected Single Sign On mechanism. I have not yet started looking at NAS vendors. I would not be surprised to learn that a SAMBA server better suits our needs, but the NAS appliance may be more in line with the KISS direction I would like to follow.


Areas of concern...
1) Single Sign On. Which route better addresses the various operating environments, having Windows AD controlling things, or LDAP on a *NIX host letting Windows talk to that? Something else entirely?...

2) Groupware. Any recommendations on a mature package to support our variety of client desktops?

3) NAS recommendation? Most of my storage experience is in the SAN arena, but we are not putting HBAs in each host, rather we want to centralize storage and use the IP network to transfer data. Tie-in to the authentication mechanism is important.

Nice open topic as we continue the holiday lull.

Thanks for any feedback you can provide!

Sounds similar to my network and my questions

Groupware...While I haven't installed it yet, but I am looking at a product from icewarp.com. We have been using the email server softweare for 4 years along with spamassasssin. The email server works quite well. If you want to read about any bugs first, there is a US company supporting the product.

http://www.merakmailserver.com/
http://forum.altair7.org/bb2/index.php

There is also a project based on openoffice

http://groupware.openoffice.org/

Good luck

Don

It is my intent to set up a couple of the different groupware systems next month, once the company returns from holiday, and learn what I can about real-world accessibility from different client platforms. I will take a look at the groupware.openoffice option more extensively at that time.

Right now, our email is good ol' sendmail, with spamassassin and clamav tied in with procmail so we do spam and virus checking for all inbound email. We may keep these functions on a mail relay host in the DMZ if we come up with a worthwhile package to host the email on the inside.

In order to focus on something, and actually be able to step through and finish things in a reasonable manner, we're going with two items up front:

platform and location agnostic VPN

Email access from anywhere, most likely via a web client access to the current mailhost.

These will make the traveling employee's lives much easier. From personal experience, I know that an unhappy traveling employee is not a good thing.

Next, to pursue those two items.