Hi!
I would like to install a linux web/mail server.
I am currently running:
<Internet>
|
|
[ADSL router]
|
|
[Managed switch]
|
|
<internal network>

My questions is where to put it (the server)? I was thinking in a separate segment from the router. Is this a safe configuration? Would could it be improved?
I saw a great document that talked about several topologies and vulnerabilities, i think it mentioned IPCOP and SME Server, and the troubles of running all the services in one macchine. Got it from a link that, i think, was here in the foruns, but now i can't find it. If someone knows this document please post it here.

Any suggestions are welcome.
Thank you.

I have put my server behind the router, on the same network as the rest. This way, it is easy to access from the network. Also, you have the advantage of it being behind a firewall. The disadvantage is that, for each port you want to serve, you are going to have to set up port forwarding from the router to your server.

I find this works very well for me.

Rhys

Configure IPTables on your server and if the other systems are Windows, put a personal firewall on each one of them. I use ZoneAlarm Pro on my Windows machines. It does a nice job with a firewall, virus detection, pop-up blocker, etc.

Also, do some hardening. That is, remove all processes, applications, etc. on the server that you do not intend to use.

If you have only 6 or so systems, creating DMZs is not very practical, expecially if a DMZ port is not built into your router or firewall.

Finally, think twice about what sites you go to and what emails you open and respond to. Think three times about what mail attachments you open.

I was consedering adding an IPCOP firewall. Separate the to segments green and orange (DMZ), I just don't know if it would require significant changes in clients or existing infrastructure?
Because the www/mail server is priority then will be moving to some other services (NAS, LDAP; DHCP and probably a SIP Proxy) so i would like to get me a "smart" topology.
Plus i really want to get my hands on that document i talked about .