Implementing ifolder Server in the DMZ with ifolder Data inside the Firewall

Transcription

1 Implementing iflder Server in the DMZ with iflder Data inside the Firewall Nvell Cl Slutins AppNte JULY 2004 OBJECTIVES The bjectives f this dcumentatin are as fllws: T cnfigure iflder server in the DMZ with the iflder data physically stred n anther server inside the Firewall using tw NetWare 6.5 servers. T cluster iflder services via inexpensive iscsi technlgy using three NetWare 6.5 servers. Backgrund Mst custmers want t implement iflder but they are cnstrained by their cmpany's security plicy. Mst cmpanies have a security plicy that there is n access frm the Internet directly int the internal netwrk (if yu dn't have such a plicy, it is time t set up ne). This implies 2 things: Frm the Internet, users cannt directly access data in the internal netwrk, but can access applicatin servers in the DMZ T prtect data, data cannt be placed in the DMZ Mst cmpanies will d ne f the fllwing: Set up a VPN slutin. All access t applicatins frm the Internet must be via the VPN applicatin. Set up applicatin servers in the DMZ. All access t applicatins frm the Internet will hit the applicatin servers and the applicatin servers will then access the data via the firewall. The data is stred inside the firewall and the firewall is cnfigured t nly allw the applicatin servers t access the data. With this setup, the data is secured. Fr custmers with very tight security plicies, an even mre secure apprach can be implemented by cmbining the abve tw methds. Custmers may implement tw firewalls. The first firewall blcks all access frm the Internet int the Custmer's Netwrk except VPN traffic. All applicatin servers are stred in the DMZ. The 2 nd firewall blcks all traffic and allws nly access frm the applicatin servers. This means that users must use VPN, which gets past the 1 st firewall, t access the applicatins in the DMZ. Hwever, because f the 2 nd firewall, users cannt access their internal netwrk directly. The applicatin servers fetch the data frm the Internal netwrk and pass it back t users.

2 2 THE PROBLEM iflder stres its data n the server. This creates tw prblems: iflder cannt be placed in the DMZ because data wuld then be in the DMZ If iflder is the Internal netwrk, users cannt access iflder because f the firewall. Security plicy prevents users frm accessing applicatins directly in the Internal netwrk frm the Internet In the past, the nly way t get arund this prblem was t implement VPN. Hwever, fr custmers wh d nt have VPN, iflder cannt be implemented. Furthermre, VPN will wrk nly if custmers allw Internet users access directly int the internal netwrk. Fr custmers with extremely tight security plicies wh d nt allw VPN users t access directly int the internal netwrk, even VPN is nt a slutin. Because f all these restrictins, many custmers cannt implement iflder. THE SOLUTION NetWare 6.5 prvides the slutin. NetWare 6.5 allws the data t be stred remtely s that the iflder server can be placed n the DMZ but the data can be placed in the internal netwrk. This allws iflder t meet mst custmers' security requirements. The key t implementing this is thrugh iscsi. iscsi is a standard fr SCSI blck strage prtcls netwrked ver TCPIP netwrks. This means that iscsi allws a SAN t be built ver a LAN netwrk. In the past, a SAN was built using Fibre Cables, Fibre Cards, SAN switches and SAN strage; which was a very expensive slutin. NetWare iscsi lets yu use NetWare servers t create a shared strage and a NetWare cluster withut purchasing expensive SAN equipment. Fr mre n ISCSI, refer t iscsi Administratin Guide fr NetWare 6.5 Setup Overview In this dcumentatin, we are simulating the fllwing scenaris: 1. iflder server is setup in the DMZ and the iscsi strage server is setup inside the firewall. 2. iflder Server will be clustered and setup in the DMZ, and the iscsi strage server is setup inside the firewall. ISCSI IMPLEMENTATION 1. Setup tw NetWare 6.5 servers with iflder and iscsi services. One server is placed in the internal netwrk, and the ther is in the DMZ. The NetWare 6.5 server in the internal netwrk can jin the existing tree. The NetWare 6.5 server in the DMZ, hwever, shuld be a stand-alne server in its wn tree. In this example, the server in the DMZ shall have the fllwing cnfiguratin: Tree: IFOLDER-TREE ServerName: IFOLDERSERVER1 Server Cntext: O=NOVELL The IFOLDERSERVER1 will be cnfigured as the iscsi Initiatr The server in the internal netwrk will have the fllwing cnfiguratin:

3 3 Tree: NW65SERVER_TREE ServerName: NW65SERVER Server Cntext:.SERVER1.NOVELL The NW65SERVER will be cnfigured as the iscsi Target 2. On the 'NW65SERVER' server, d the fllwing: LOAD NSSMU > Partitins Press 'Insert' t create a new partitin Select the Free Disk space and press 'Enter' Select iscsi Define the partitin size (which will be the size f yur iflder data stre) and create 3. On the NW65SERVER server, type TON.NCF In the installatin, TON.NCF is already laded by default in the AUTOEXEC.NCF. In this case, yu can type TOFF.NCF and then TON.NCF t relad the iscsi target NLMs. (If yu have nt realized it by nw, TON stands fr Target ON and TOFF stands fr Target OFF.) 4. Open up CnsleOne, brwse t the lcatin f the NW65SERVER and yu will see an iscsi Target bject that has been created. This bject is autmatically created when a iscsi partitin is created n a server and the 'TON.NCF' is laded n that server. The bject will lk smething like this: 5. Create an iscsi Initiatr Object in the same cntext as the NW65SERVER bject. Yu will get the fllwing prmpt, but click OK and key in the bject name. Fr this example, the iscsi Initiatr Object is iflderserver1 6. Right Click n the iscsi Target bject created in Step 4 and chse 'Trustees f this bject'. Select ifldserver1 Initiatr Object as a Trustee and click OK t select the default Trustee rights.

4 4 7. On the IFOLDERSERVER1, type 'ION.NCF" (Yu may have rightly guessed that ION stands fr Initiatr ON) 8. On the IFOLDERSERVER1, type 'ISCSI LIST' Yu will see the fllwing screen 9. Yu need t change the initiatr server's IQN t crrespnd t the Initiatr Object that yu have created in the NW65SERVER-TREE. T d this, n the IFOLDERSERVER1, type the fllwing: iscsi set InitiatrName=iqn cm.nvell:.iflderserver1.nvell.nw65server-tree. NOTE: ADD a Trailing '.' at the end f the ".iflderserver1.nvell.nw65server-tree." cmmand, r yu will nt be able t cnnect.

5 5 10. On the cnsle screen, type => iscsinit Cnnect [IP Address f NETWARE 6.5SERVER] This cmmand will enable the iscsi Initiatr t cnnect t the iscsi Target 11. Open up a brwser and brwse t Remte Manager n IFOLDERSERVER1 server ( address f IFOLDERSERVER1]:8009) 12. Under the MANAGE SERVER sectin, chse PARTITION DISK, and yu will see the fllwing screen. Click 'Initialize Partitin Table' 13. Once that is dne, the disk is initialized and ready t be used. 14. On the IFOLDERSERVER1, d the fllwing: LOAD NSSMU > POOLS Press 'Insert' t create a new pl. Enter Pl name (e.g. IFOLDER_POOL) Chse the Free Disk space which has been created n the iscsi Target Cnfirm the Partitin Size

6 6 G t the Main Menu > VOLUMES Press 'Insert' t create a new vlume. Enter vlume name (e.g. IFOLDER) Select the pl (e.g. IFOLDER_POOL) and press 'Enter' Select yur Vlume prperties and press 'Create' 15. On IFOLDERSERVER1, type 'Edit AUTOEXEC.NCF' and add the fllwing lines: in.ncf iscsinit cnnect [IP address f NW65SERVER] Delay 5 munt iflder IFOLDER IMPLEMENTATION As with any default installatin f ifolder, the default lcatin f ServerRt and UserRt is in SYS:\iFOLDER and the LDAP server cnfiguratin is usually pinting t itself (using DNS r IP address). The purpse f this sectin is t cnfigure ifolder t: Use the LDAP server in the internal netwrk t authenticate users Change the ServerRt and UserRt t be placed n the iscsi vlume created n the iscsi Target lcated in the internal netwrk In this example, bth the LDAP server and the iscsi Target server in the internal netwrk is NW65SERVER ( ) 1. On the ifolderserver1 server, edit the SYS:\APACHE2\IFOLDER\SERVER\ HTTPD_IFOLDER_NW.CONF file Mdify the fllwing parameters: iflderserverrt: Change t IFOLDER:\iFlder iflderuserrt: Change t IFOLDER:\iFlder 2. Frm yur brwser, pen up the iflder management URL (i.e address f IFOLDERSERVER1]/iFlderServer/Admin 3. Click 'Glbal Settings'. Type in the admin name and passwrd f IFOLDERSERVER1 4. On the left clumn, chse 'USER LDAPs' and delete all existing User LDAP server 5. On the left clumn, chse 'USER LDAPs' and add User LDAP server. Under the Hst DNS r IP, key in the DNS r IP f yur internal edirectry LDAP server. In this example, NW65SERVER is the internal user LDAP server. Key in the admin name and passwrd f NW65SERVER

7 7 6. The User LDAP cnfiguratin will pp up. Check the 'Search Subcntexts' ptin. 7. Restart yur apache web services by typing the fllwing cmmands n IFOLDERSERVER1: ap2webdn ap2webup 8. Map a drive t IFOLDER vlume n IFOLDERSERVER1. Yu will see that IFOLDER directry has been created n the vlume. After yu have cmpleted the abve cnfiguratin, the fllwing will have been accmplished: The iflder Server in the DMZ is purely an applicatin server that des nt have user infrmatin r user data User infrmatin will be accessed frm LDAP servers inside the firewall iflder user data is physically stred n an iscsi strage inside the firewall INSTALLING CLUSTERING SERVICES OVER ISCSI Sme custmers may cnsider iflder services imprtant enugh that it warrants clustering f the iflder services. In the past, this wuld be an cstly endeavur because it requires expensive Fibre Cables, Fibre Cards, SAN switches and SAN strage. Nw all yu need is anther NetWare 6.5 server. 1. Setup a NetWare 6.5 server with iflder and iscsi services. This NetWare 6.5 server will jin the IFOLDER_TREE. In this example, the NetWare 6.5 server in the DMZ shall have the fllwing cnfiguratin: Tree: IFOLDER-TREE ServerName: IFOLDERSERVER2 Server Cntext:.SERVER2.NOVELL 2. On the NW65SERVER_TREE, create an iscsi Initiatr Object in the same cntext as the NW65SERVER bject. Yu will get the fllwing prmpt, but click OK and key in the bject name. Fr this example, the iscsi Initiatr Object is iflderserver2

8 8 3. Right Click n the iscsi Target bject created and chse 'Trustees f this bject'. Select ifldserver2 Initiatr Object as a Trustee and click OK t select the default Trustee rights. 4. On the IFOLDERSERVER2, type 'ION.NCF' 5. On the IFOLDERSERVER2, type 'ISCSI LIST' Yu need t change the initiatr server's IQN t crrespnd t the Initiatr Object that yu have created in the NW65SERVER-TREE. T d this, n the IFOLDERSERVER2, type the fllwing: iscsi set InitiatrName=iqn cm.nvell:.iflderserver2.nvell.nw65server-tree. NOTE: ADD a Trailing '.' at the end f the ".iflderserver2.nvell.nw65server-tree." cmmand, r yu will nt be able t cnnect. 6. On the IFOLDERSERVER2 cnsle screen, type => iscsi Cnnect [IP Address f NETWARE 6.5SERVER] 7. On IFOLDERSERVER2, type 'Edit AUTOEXEC.NCF' and add the fllwing lines: in.ncf iscsinit cnnect [IP address f NW65SERVER] On IFOLDERSERVER2, type the abve 2 lines n the server cnsle screen. If yu have been fllwing the exercise thrugh, n IFOLDERSERVER1, use NSSMU t remve the IFOLDER vlume and IFOLDER_POOL pl. Remve the fllwing lines frm AUTOEXEC.NCF file. Remember, we want t cluster the IFOLDER Vlume and we dn't want t munt the vlume in the AUTOEXEC.NCF file. delay 5 munt iflder 8. On bth IFOLDERSERVER1 & IFOLDERSERVER2, d the fllwing: NSSMU > Devices Chse the iscsi device (the name cntains 'NOVELL' in it) Press 'F6' t share the device The device cnfiguratin becmes 'Sharable fr Clustering' 9. Install Nvell Cluster Services 1.7 n bth IFOLDERSERVER1 & IFOLDERSERVER2 using Deplyment Manager. The details t install Nvell Cluster Services can be fund in NetWare Nvell Cluster Services 1.7 Administratin Guide 10. After installatin, type LDNCS.NCF n bth server cnsles, and bth servers shuld jin the Cluster. Yu shuld see bth servers having Cluster Membership Mnitr with the status 'UP'. NOTE: Nw yu can prvide better reliability by creating an iscsi device fr the SBD partitin and anther iscsi device fr ifolder partitin. If yu have fllwed thrugh the exercise, the SBD partitin wuld have been created in the iscsi device that was created in the previus exercise. It is then a simple matter f repeating the steps and then creating a larger iscsi device fr ifolder. Of curse, yu can extend this idea by creating anther iscsi device fr SBD mirrring, but these are beynd the scpe f this AppNte.

9 9 S fr this exercise, if the SBD partitin is created n the same device as the IFOLDER partitin, it is fine. But yu prbably wn't want t d this in a prductin envirnment. On IFOLDERSERVER1 server, type the fllwing: NSSMU > POOLS Press 'Insert'. Type in Pl Name (e.g. IFOLDER_POOL) Chse the crrect device and select partitin size The Cluster Pl Cnfiguratin Screen will appear. Type in the IFOLDER Virtual IP address 11. On IFOLDERSERVER1 server, type the fllwing: NSSMU > VOLUMES Press 'Insert'. Type in Vlume Name (e.g. IFOLDER) Select the pl that yu created in step 11 (e.g. IFOLDER_POOL) Chse the Vlume prperties > Create That's it. Yu have just clustered the IFOLDER vlume. Yu can use Remte Manger r CnsleOne t migrate the IFOLDER vlume between IFOLDERSERVER1 and IFOLDERSERVER2 t test whether r nt it is wrking. CLUSTERING IFOLDER SERVICES 1. Lading iflder in prtected memry iflder des nt by default lad its wn instance f apache in prtected memry n NetWare. It will instead create an include statement n the default apache cnfiguratin file (SYS:\APACHE2\CONF\HTTPD.CONF) and lad in the kernel address space. The prblem with this is that when yu are nt lading iflder, yu are unable t use all the NetWare 6.5 services that lad n tp f apache. T slve this prblem, iflder can be laded in its wn address space s that the apache services are nt affected by iflder. iflder will be cnfigured t be laded up by cluster services nly. Belw are the steps t lad ifolder int its wn memry space. These steps have t be dne n all cluster ndes. a. The fllwing changes were made t SYS:\APACHE2\IFOLDER\SERVER\HTTPD.CONF file Change frm Listen 80 t Listen [ifolder Virtual IP address]:80 (e.g. Listen :80) Change frm SecureListen 443 "SSL CertificateDNS" t SecureListen [ifolder Virtual IP address]:443 "SSL CertificateDNS" (e.g. Listen :443 "SSL CertificateDNS") Change frm DcumentRt "sys:/apache2/htdcs" t DcumentRt "sys:/apache2/iflder/dcumentrt"

10 10 Change frm <Directry "sys:/apache2/htdcs"> t <Directry "sys:/apache2/iflder/dcumentrt"> Change frm JkWrkersFile "cnf/md_jk/wrkers.prperties" t JkWrkersFile "sys:/adminsrv/cnf/md_jk/wrkers.prperties" Change frm JkLgFile "/lgs/md_jk.lg" t JkLgFile "sys:/adminsrv/lgs/md_jk.lg" b. In the SYS:\APACHE\CONF\HTTPD.CONF file, remarked ff the include statement cntaining SYS:\Apache\iFlder\Server\httpd_iflder_nw.cnf. The fllwing changes were made as fllws: #include sys:\apache2\iflder\server\httpd_iflder_nw.cnf c. In the SYS:\APACHE\CONF\HTTPD_IFOLDER_NW.CONF file Change iflderserverdnsrip frm [server IP address] t [cluster virtual IP address] Change iflderuserserverdnsrip frm [server IP address] t [cluster virtual IP address] d. Cpy SYS:\PUBLIC\ROOTCERT.DER t SYS:\APACHE2\IFOLDER\SERVER\LDAP\_MASTER.DER e. Cut STARTIFOLDER.NCF AND STOPIFOLDER.NCF frm SYS:\SYSTEM and paste them t SYS:\APACHE\IFOLDER\SERVER. Make the fllwing changes t STARTIFOLDER.NCF LOAD ADDRESS SPACE = IFOLDER APACHE 2 -f SYS:\APACHE\IFOLDER\SERVER\HTTPD.CONF # LOAD APACHE2 -f SYS:APACHE2\CONF\HTTPD.CONF Remarked ff 'UNLOAD APACHE' frm STOPIFOLDER.NCF f. Edit AUTOEXEC.NCF file and add the fllwing line: SEARCH ADD SYS:\APACHE2\IFOLDER\SERVER Type the abve cmmand in the server cnsle as well 2. Mdify iflder Cnfiguratin Open up the iflder Management URL, under Glbal Settings > iflder Server, change the IP address t the Virtual Cluster IP address

11 11 3. Mdify Cluster Script Cnfiguratin Add startiflder in the Cluster Lad Script and stpiflder in the Cluster Unlad Script as shwn belw. In the Cluster Unlad Script, yu may like t add a delay fr iflder t cmpletely unlad befre prceeding with the rest f the script. Cluster Lad Script Cluster unlad Script 4. Restart yur Apache Web Services by typing the fllwing cmmands ap2webdn ap2webup Yu will ntice that iflder service has nt been laded. Lad the iflder service by lading the Cluster service. Prts t be pen in the Firewall Finally, t get all these t wrk, the administratr has t pen up the firewall. Belw are the lists f prts required t be pen at the firewall:

12 12 Surce IP Destinatin IP Destinatin Prt Descriptin IFOLDERSERVER1 IFOLDERSERVER2 NW65SERVER 3260 iscsi prt IFOLDERSERVER1 IFOLDERSERVER2 NW65SERVER 389 LDAP prt IFOLDERSERVER1 IFOLDERSERVER2 NW65SERVER 636 LDAP with SSL prt (if cnfigured) CONCLUSION With NetWare 6.5, yu are able t cnfigure a high availability iflder slutin that is bth secure and inexpensive. It is secure because yur data is prtected inside the firewall. It is inexpensive because yu nly need three NetWare 6.5 servers withut the cstly SAN equipment. The best thing abut NetWare 6.5 is that since licenses are based n per user, yu can install as many NetWare 6.5 servers as yu want. References iscsi Administratin Guide fr NetWare 6.5 NetWare Nvell Cluster Services 1.7 Administratin Guide Nvell iflder 2.1 Installatin and Administratin Guide TID : Hw t run iflder 2.1 in Prtected Memry TID Hw d I cnfigure iscsi when the iscsi Target and Initiatrs are in different edirectry Trees