From Interlock Rochester Wiki

(Difference between revisions)

Latest revision as of 15:55, 15 March 2012

Interlock Rochester Infrastructure

Sub-group	Lead	Members
Power	JustBill
Environment	JustBill
Security	Mark Manning
Inter-hackerspace Communication	Mark Manning
Network	Team Effort	Carl, JustBill, Mark Manning
Virtualization	JustBill	Carl

Power

Overhead cord reels are a solution, but they must not remain plugged in at their source when not in use in order to comply with fire code. Cable trays are not a good solution for power. (They are a pain in the ass.)

Environmental

We have a central room that is supplied with heat and direct access to A/C controlled environment. To keep air flow active a standard box fan will be installed in the drop ceiling as air flow is the biggest issue in our server room.

Recycling

We don't want to horde a bunch of stuff that will never get used, but things that are likely to get recycled (especially scraps of raw materials) we should hold on to. This not only potentially benefits the environment, it's in our best interest from a costs perspective as well.

Network

See networking wish list

The network infrastructure group will create and maintain the network acceptable use policy. The policy will be approved by the board of directors and then signed by every member who wants access to any of the following networks. The mentality is to use the keep it simple methodology since all work is done by volunteers. As we do not have staff, we can not always know who may manage our environment next.

The network is broken down into 3 smaller networks:

Production
Development
Warzone

Subnets

if	VLAN	Network/Mask	Name	Description
OPT100	100	172.16.100.0/24	Production	Core Equipment management (routers, switches, etc)
OPT200	200	172.16.200.0/24	Development	This is where all other traffic lands
OPT1000	1000	192.168.1.0/24	Warzone	*A place where invasive network attacks will* occur. May also have VPN links to other hackerspaces (both in the US and abroad).** Currently routed through it's own router, which is the 192.168.1.x network. Physical isolation will be maintained.

See Network Switch Configuration for more details. Project, and Warzone may have undocumented subnets / VLANs beneath them.

Last updated: -- JustBill 13:10, 15 March 2012 (EST)

Internet

We use NYSYS for our internet connection. The contract has been signed and services are in place.

Production

The production network will be the main segment and will provide network access to Interlock's members. This network will be subdivided into 5 separate subnets, to help manage IP growth, and secure vital systems. The production network will not be used to perform penetration testing or other white hat hacking (port scans, IP sweeps, DoS, etc). The production network must have reliable uptime, as that other members will be dependent on it.

Change Control

The infrastructure group will need to determine a method to log changes to the network. A consensus must be reached within the group before any change can be done on the production network. Change management will loosely follow ITIL Recommendations. The current methodology is use the netadmin email to log all changes.

Crappy Viso

Soon to come

Planning

(not necessarily implemented)

Access

Access to core network equipment and topology will be restricted to those in the infrastructure group.

Services

RADIUS/LDAP Server
- Central Authentication repository
- Should be linked with Google Apps

Web Server
- Host the wiki, website, etc

CoLo Boxes
- Not intended to host production/high bandwidth websites
- Used for offsite backup

DHCP Server
- IP addresses will only be given out to know and trusted network adapters.
- A device registration system, like RIT's start.rit.edu, would be useful

DNS Server

File Server
- Access via SFTP, SMB, or WebDAV possibly

VPN Server
- Provide VPN access to the network. This needs to be decided as to whether this will be implemented, and the scope of the build.

Streaming Music Server
- Use a AirPort Extreme AP to play music via AirTunes

Image Server
- RIS or Ghost

Development

No expectation of reliability
Open access to equipment / no change management
No probing / pen testing (unless you have permission)
Can be used to setup non-critical projects that do not require the stability of the production network
Dynamic
If you need a private network below for your testing you can supply your own firewall and create your own network.
If you need remote access to your above network, send an email to netadmin@interlockroc.org and your request will be handled as soon as possible by a team member.

Warzone

No expectation of reliability
Relatively open access to equipment / no change management
No expectation of structure, very dynamic depending on project use etc, may use different IP address schemes
Expect to have equipment probed / pen tested
ChaosVPN endpoint/node (link to other hackerspaces)
"Rogue" access points allowed (maybe include DHCP message that states you'd better be sure you want to connect to this network - want to be friendly with our neighbors)

Audio-Visual System

Audio

Public Address system array across the ceiling
Two speakers rigged to the top corners of the room
Surround sound rigged to the top of the room (low priority)
Inputs to an audio mixer/home receiver
Sources: Microphone, CD/DVD, computers

Video

Ceiling mounted projection
Screen
Sources: DVD, computers

@@ Line 5: / Line 5: @@
 ! Sub-group !! Lead !! Members
 |-
-| Power   ||
+| Power   || [[User:JustBill|JustBill]]
 |-
-| Environment ||
+| Environment || [[User:JustBill|JustBill]]
 |-
 | [[Hackerspace_Security_System|Security]] || [[User:Antitree|Mark Manning]]
 |-
-| Inter-hackerspace Communication          || [[User:Antitree|Mark Manning]] || [[User:Ben Woodruff|Ben Woodruff]]
+| Inter-hackerspace Communication          || [[User:Antitree|Mark Manning]]
 |-
-| [[Network Infrastructure Group|Network]] || [[User:Ben Woodruff|Ben Woodruff]] || [[User:fvox13|Steve Smith]], [[User:IGadget|Rowan Hawkins]]
+| [[Network Infrastructure Group|Network]] || [[Team Effort]] || [[User:Carl |Carl]], [[User:JustBill|JustBill]], [[User:Antitree|Mark Manning]]
 |-
+| Virtualization   || [[User:JustBill|JustBill]] || [[User:Carl |Carl]]
 |}
-Please feel free to claim ownership of any empty spots above, or add yourself to the members list.
-We need a decision on power needs sooner rather than later.
-''' NOTE''': This page contains information with regard to network/server setup for the final space, not the temporary one. For the temp space, power distribution can be done with extension cords, while network access will be ad-hoc in nature.
 =Power=
@@ Line 26: / Line 22: @@
 =Environmental=
-The space will need to have environmental controls in the event that servers will be kept in location. The general operating temperature of servers and network equipment should be around 75F. In order to ensure this, the purchase of an AC system may be necessary depending on what projects we approve.
+We have a central room that is supplied with heat and direct access to A/C controlled environment.  To keep air flow active a standard box fan will be installed in the drop ceiling as air flow is the biggest issue in our server room.
-'''Things we may need to acquire:'''
-*<s>Heater</s> <-- Heat is included
-*Air Conditioner
-*Dehumidifier
-*<s>Thermostat/Thermometer</s> <-- Usually bundled with AC
 ==Recycling==
@@ Line 39: / Line 30: @@
 =Network=
-See [[Phase 0 Networking]]
-[[image:Interlock_logical.jpg|thumb|See [[file:interlock_logical.vsd]]]]
+See [[networking wish list]]
+The network infrastructure group will create and maintain the [[network acceptable use policy]]. The policy will be approved by the board of directors and then signed by every member who wants access to any of the following networks.  The mentality is to use the keep it simple methodology since all work is done by volunteers.  As we do not have staff, we can not always know who may manage our environment next.
-UPDATES:
+The network is broken down into 3 smaller networks:
-* 1/27/10: Despite some difficulties with Frontier that will have to be worked out, the internet and phone lines were installed today. The router is ready to be dropped into place, as soon as we move the rack in. We did get the rack, and it is being stored for us until we are able to move it into #42.
+* <span style="color: green">Production</span>
+* <span style="color: brown">Development</span>
+* <span style="color: red"> Warzone</span>
-The network infrastructure group will create and maintain the [[network acceptable use policy]]. The policy will be approved by the board of directors and then signed by every member who wants access to any of the following networks.
-In order to meet the demands of the group over time, the network will be segregated into 3 main segments:
-(in order of priority for setup)
-* <span style="color: green">Production [http://www.interlockroc.org/wiki/index.php?title=Infrastructure#Production >]</span>
-* <span style="color: gold">Project [http://www.interlockroc.org/wiki/index.php?title=Infrastructure#Project_.2F_Project >]</span>
-* <span style="color: red"> Warzone [http://www.interlockroc.org/wiki/index.php?title=Infrastructure#Warzone >]</span>
-Each main segment will have an associated color code for its jacks (as is seen above), both on the walls, as well as near the network equipment. Category 6 cabling would be preferred for the environment. Each wall plate should be 6 feet apart, and should contain at least 1 of each colored jacks. Every jack should had 2 drops associated with it.
 == Subnets ==
@@ Line 62: / Line 46: @@
 ! if !! VLAN !! Network/Mask   !! Name            !! Description
 |-
-|  || 10 || '''10.10.0.0/22'''  || '''Production'''      || '''Supernet slice for all production networks'''
 |-
-| OPT100 || 100 || 10.10.0.0/24 || Core            || Core Equipment (routers, switches, etc)
+| OPT100 || 100 || 172.16.100.0/24 || Production            || Core Equipment management (routers, [[Network Switch Configuration|switches]], etc)
 |-
-| OPT101 || 101 || 10.10.1.0/24 || Servers         || Servers (LDAP, DHCP, DNS, etc - assuming not provided by router)
+| OPT200 || 200 || '''172.16.200.0/24'''  || '''Development'''      || '''This is where all other traffic lands'''
 |-
-| OPT102 ||  102 || 10.10.2.0/25 || Wired Hosts     || Shared workstations
-|-
-| OPT103 || 103 || 10.10.3.0/24 || Wireless Hosts  || Registered Member laptops
 |-
-| OPT104 || 104 || 10.10.4.0/24 || Wireless Guests || Event Participants, Class registrants, etc - May be partitioned into a separate network, see below
+| OPT1000 || 1000 || '''192.168.1.0/24'''  || '''Warzone'''         || '''A place where invasive network attacks ''will'' occur. May also have VPN links to other hackerspaces (both in the US and abroad).''' Currently routed through it's own router, which is the 192.168.1.x network. Physical isolation will be maintained.
-|-
-| OpenVPN || 105 || 10.10.5.0/24 || Production VPN clients || Network administration (core network)
-|-
-| LAN || 200 || '''10.200.0.0/16'''  || '''Project'''      || '''Network specific for individual projects. Should be sliced further to /24 and /26 networks as needed'''
-|-
-| LAN || 1000 || '''192.168.1.0/24'''  || '''Warzone'''         || '''A place where invasive network attacks ''will'' occur. May also have VPN links to other hackerspaces (both in the US and abroad). Currently routed through it's own router, which is the 192.168.1.x network. If we eventually run through the pfSense box the IP scheme will be in the 10.100.42.x range'''
 |}
+See [[Network Switch Configuration]] for more details. Project, and Warzone may have undocumented subnets / VLANs beneath them.
+Last updated: --[[User:JustBill | JustBill]] 13:10, 15 March 2012 (EST)
 == Internet ==
-We have decided on Frontier Business DSL for our internet connection. The contract has been signed.
+We use NYSYS for our internet connection. The contract has been signed and services are in place.
 ==<span style="color: green">Production</span>==
@@ Line 89: / Line 67: @@
 === Change Control ===
-The infrastructure group will need to determine a method to log changes to the network. A consensus must be reached within the group before any change can be done on the production network. Change management will ''loosely'' follow [http://en.wikipedia.org/wiki/Change_Management_%28ITSM%29 ITIL Recommendations].
+The infrastructure group will need to determine a method to log changes to the network. A consensus must be reached within the group before any change can be done on the production network. Change management will ''loosely'' follow [http://en.wikipedia.org/wiki/Change_Management_%28ITSM%29 ITIL Recommendations].  The current methodology is use the netadmin email to log all changes.
+=== Crappy Viso ===
+Soon to come
+== Planning ==
+(not necessarily implemented)
 === Access ===
@@ Line 124: / Line 109: @@
 ** RIS or Ghost
-==<span style="color: gold">Project</span>==
-* 172.25.x.y
+==<span style="color: brown">Development</span>==
-** Each project should claim an address space (ie 172.25.15.y) so we can tell what traffic is coming from which projects
+* No expectation of reliability
-* Temporary, dynamic, but more static and stable than the warzone
+* Open access to equipment / no change management
-* Change management much more loose than production network but there should be some expectation of reliability so please at least check with someone unless you're very sure of what you're doing
+* No probing / pen testing (unless you have permission)
-* Access to the internet
+* Can be used to setup non-critical projects that do not require the stability of the production network
-* Area to play with an test new technologies (for example, play with VOIP/SIP)
+* Dynamic
+* If you need a private network below for your testing you can supply your own firewall and create your own network.
+* If you need remote access to your above network, send an email to netadmin@interlockroc.org and your request will be handled as soon as possible by a team member.
 ==<span style="color: red">[[Warzone]]</span>==
-* 172.30.x.y
 * No expectation of reliability
 * Relatively open access to equipment / no change management
@@ Line 154: / Line 140: @@
 *Screen
 *Sources: DVD, computers
+[[category:cleanup]]

Infrastructure