Upload
clyde-lloyd
View
216
Download
0
Tags:
Embed Size (px)
Citation preview
Server Setup and Configuration
Babu Ram Dawadi
1
Servers• Minimum Server Required for
Intranet/Internet Operation– DNS server– DHCP server– Proxy Server– Web Server – Authentication Server (RADIUS)– Database Server – Mail Server – More…..
2
DNS Server
• See the slides provided on Distributed System Classes– BIND/DJBDNS concepts and configuration– Requirement of DNS server based on network
size– Benefits and drawbacks
3
DHCP Server
• DHCP Operation Concepts and Configuration DOC
4
What is Squid Proxy Server?
• A caching proxy for– HTTP, HTTPS (tunnel only)– FTP– Gopher– WAIS (Wide area information server, requires
additional software)– WHOIS (Squid version 2 only)
• Supports transparent proxying
• Supports proxy hierarchies (ICP protocol)5
Other proxies
• Free-ware– Apache 1.2+ proxy support
• Commercial– Netscape Proxy
– Microsoft Proxy Server
– NetAppliance’s NetCache (shares some code history with Squid in the distant past)
– CacheFlow (http://www.cacheflow.com/)
– Cisco Cache Engine
6
What is a proxy?
• Firewall device; internal users communicate with the proxy, which in turn talks to the big bad Internet– Gate private address space (RFC 1918) into publicly
routable address space
• Allows one to implement policy– Restrict who can access the Internet
– Restrict what sites users can access
– Provides detailed logs of user activity
7
What is a caching proxy?
• Stores a local copy of objects fetched– Subsequent accesses by other users in the
organization are served from the local cache, rather than the origin server
– Reduces network bandwidth– Users experience faster web access
8
Benefits of Caching
9
Benefits: Eliminate the need (in many cases) to:•Send request to origin server (reducing delay, and link use)•Send full response from origin server (reducing link use)Consequences:•Reduced delay•Directly benefits end-user.•May benefit service providers (ISPs or web servers) by making their service more popular to end-users.•Reduced traffic•Reduces load on network links•Reduces load on server•Mask unavailability of origin server e.g. when working offline, or during faults
How proxies work (configuration)
• User configures web browser to use proxy instead of connecting directly to origin servers
– Manual configuration for older PC based browsers, and many UNIX browsers (e.g., Lynx)
– Proxy auto-configuration file for Netscape 2.x+ or Internet Explorer 4.x+
• Far more flexible caching policy
• Simplifies user configuration, help desk support, etc.
10
How proxies work (user request)
• User requests a page:
• Browser forwards request to proxy
• Proxy optionally verifies user’s identity and checks policy for right to access
• Assuming right is granted, fetches page and returns it to user
11
Proxy– The Forward Proxy
• Forward Proxy– Proxy the outgoing requests, for the reason of
• Bandwidth saving
• Performance
• Central control
– When objects requested are• In cache, return the cached objects
• Otherwise, proxy server requests object from origin server, then cache it and return to client Request
Reply
Request
Reply
(using cached result)
Request
Replyclient
client
ProxyServer
OriginalServer
12
Proxy– The Reverse Proxy
• Reverse Proxy– Proxy the incoming requests, for the reason of
• Reducing Server Load (by caching)
• Load Balance
• Fault Tolerant
– Reverse proxy acts as the original server, accept incoming requests, reply corresponding result. SEAMLESS for clients!
Request
Replyclient
client
ReverseProxyServer
Server1RequestReply
Server1
InternetInternet
13
Squid’s page fetch algorithm• Check cache for existing copy of object (lookup
based on MD5 hash of URL)
• If it exists in cache– Check object’s expire time; if expired, fall back to origin
server
– Check object’s refresh rule; if expired, perform an If-Modified-Since against origin server
– If object still considered fresh, return cached object to requester
14
Lifecycle of an object
15
Last-modified: When the object was last modifiedat the origin server.•< Date of client’s copy => OK to use copy•Date – Last-modified suggests frequency of changeDate: When the object was sent by the origin server=>•last time known to be fresh.•+ Age = Reference for checking for expiryExpires: Server’s prediction of when copies shouldbe replaced.Age: How long the object has spent in caches
Squid’s page fetch algorithm
• If object is not in cache, expired, or otherwise invalidated– Fetch object from origin server– If 500 error from origin server, and expired
object available, returns expired object– Test object for cacheability; if cacheable, store
local copy
16
Installing Squid (overview)
• Get distribution from http://squid.nlanr.net/• Run configure script with desired compile-time
options• Run make; make install• Edit squid.conf file• Run Squid -z to initialize cache directory structure• Start Squid daemon• Test• Migrate users over to proxy
17
squid.conf runtime settings
• Default squid.conf file is heavily commented! Read it!
• Must set– cache_dir (one per disk)– cache_peer (one per peer) if participating in a
hierarchy– cache_mem (8-16M preferred, even for large
caches)– acl rules (default rules mostly work, but must
reflect your address space) 18
squid.conf runtime settings
• Recommendations– ipcache_size, fqdncache_size to 4096
– log_fqdn off (use Apache’s logresolve offline)
– Increase dns_children, redirect_children, authenticate_children based on usage statistics (see cachemgr.cgi front-end)
19
squid.conf ACL example
• acl manager proto cache_object
• acl localhost src 127.0.0.1/32
• acl managerhost src 204.248.51.34/32
• acl managerhost src 204.248.51.39/32
• acl managerhost src 204.248.51.40/32
• acl cawtech src 204.248.51.0/24
• acl cawtech-internal src 172.16.0.0/16
• acl all src 0.0.0.0/0.0.0.0
20
squid.conf ACL example
• acl SSL_ports port 443 563
• acl gopher_ports port 70
• acl wais_ports port 210
• acl whois_ports port 43
• acl www_ports port 80 81
• acl ftp_ports port 21
• acl Safe_ports port 1025-65535
• acl CONNECT method CONNECT
• acl FTP proto FTP
• acl HTTP proto HTTP
• acl WAIS proto WAIS
• acl GOPHER proto GOPHER
• acl WHOIS proto WHOIS
21
squid.conf ACL example
• http_access deny manager !localhost !managerhost
• http_access deny CONNECT !SSL_ports
• http_access deny HTTP !www_ports !Safe_ports
• http_access deny FTP !ftp_ports !Safe_ports
• http_access deny GOPHER !gopher_ports !Safe_ports
• http_access deny WAIS !wais_ports !Safe_ports
• http_access deny WHOIS !whois_ports !Safe_ports
• http_access allow localhost
• http_access allow cawtech
• http_access allow cawtech-internal
• http_access deny all
22
Managing Squid
• the Calamaris.pl logfile analysis script, available at http://calamaris.cord.de/
• Use modified MRTG with Squid’s SNMP support
• SQUID-GRPAH
23
Content Distribution Networks (CDN)
Business Model: A content provider such as www.cnn.com or Yahoo pays a CDN company (such as Akamai) to get its content to the requesting users with short delays.
A CDN provides a mechanism for Replicating content on multiple servers in the
InternetProviding clients with a means to determine the
servers that can deliver the content fastest.
Terminology• Content: Any publicly accessible combination of text,
images, applets, frames, MP3, video, flash, virtual reality objects, etc.
• Content Provider: Any individual, organization, or company that has content that it wishes to make available to users.
• Origin Server: Content provider’s server , where the content is first uploaded.
• Surrogate Server (sometimes called edge server): Content distributor’s server, where the replicated content is kept.
Players
Content Provider
H/W and S/W Vendor
Content Distributor
Hosting Provider
Yahoo, MSNBC, CNNCBC
Cisco, Oracle-Sun
Akamai,
Bell
Sells se
rvers
Send content
Install
servers
CDN Distribution
• Content providers are CDN customers
Content replication• CDN company installs thousands
of servers throughout Internet
– In large datacenters
– Or, close to users
• CDN replicates customers’ content
• When provider updates content, CDN updates servers
origin server
in North America
CDN distribution node
CDN server
in S. America CDN server
in Europe
CDN server
in Asia
27
CDN: Functional Components
Distribution Service Redirection Service
Accounting and Billing system
CDN:Distribution Service
The content provider determines which of its objects it wants the CDN to distribute.
The content provider tags and then pushes this content to a CDN node, which in turn replicates and pushes the content to all its CDN servers.
CDN: Redirection• When a browser in a user’s host is
instructed to retrieve a specific object (specified using a URL), how does the browser determine whether it should retrieve the object from the origin server or from one of the CDN servers?
• an example, suppose the hostname of the content provider is www.cnn.com
How Akamai Works
End-user
cnn.com (content provider) DNS root server
1 2
Nearby Akamai
cluster
GET index.html
31
http://a.73.g.akamai.net/7/23/cnn.com/af/cnn.com/foo.jpg
HTTP
Akamai
clusterAkamai global
DNS server
Akamai regional
DNS server
CDN: Redirection• Users get an html document from
www.cnn.com; this could be index.html
• The file index.html uses a modified URL for content that has been replicated.
• Example: If the jpeg files are what has been replicated then <img src=“http://cnn.com/af/foo.jpg>
may be modified as follows:
<img src=http://a73.g.akamai.net/7/23/cnn.com/af/foo.jpg>
• The browser needs to resolve a73.g.akamai.net hostname for replicated content.
Caching and Content Distribution(CDN)
33
CDN
34
CDN
35
CDN
36
CDN: RedirectionWhat does this mean?
<img src=http://a73.g.akamai.net/7/23/cnn.com/af/foo.jpg>
host part: a73.g.akamai.netAkamai control part: /7/23Content URL: /af/foo.jpg
CDN: Redirection
DNS is configured so that all queries about g.akamai.net that arrive at a DNS server are sent to an authoritative DNS server for g.akamai.net.
This is referred to as a Akamai DNS server (authoritative DNS server)
How Akamai Works
End-user
cnn.com (content provider) DNS root server
1 2
Nearby Akamai
cluster
DNS lookup
cache.cnn.comAkamai
cluster3
4 ALIAS:
g.akamai.net
Akamai global
DNS server
Akamai regional
DNS server
CDN: Redirection
When the Akamai DNS server receives the query, it extracts the IP address of the requesting browser.
.
PP
How Akamai Works
End-user
cnn.com (content provider) DNS root server
1 2
Akamai global
DNS server
Akamai regional
DNS server
Nearby Akamai
cluster
Akamai
cluster3
4 6
5
ALIAS
a73.g.akamai.net
DNS lookup
g.akamai.net
CDN: Redirection
Based on the IP address and information that it has about the Internet (called a map), the IP address of an Akamai regional server is returned to the requesting browser based on policy
e.g., select the server that is the fewest hops away.
The regional server may choose a surrogate server for content retrieval
HTTPHTTP
How Akamai Works
End-user
cnn.com (content provider) DNS root server
1 2
Akamai global
DNS server
Akamai regional
DNS server
Nearby Akamai
cluster
Akamai
cluster3
4 6
5
8
7
DNS a73.g.akamai.net
Address
1.2.3.4
HTTPHTTP
How Akamai Works
End-user
cnn.com (content provider) DNS root server
1 2
Akamai global
DNS server
Akamai regional
DNS server
Nearby Akamai
cluster
Akamai
cluster3
4 6
5
8
7
9
GET /foo.jpgHost: cache.cnn.com
HTTPHTTP
How Akamai Works
End-user
cnn.com (content provider) DNS root server
1 2
Akamai global
DNS server
Akamai regional
DNS server
Nearby Akamai
cluster
Akamai
cluster3
4 6
5
8
7
9
GET /foo.jpgHost: cache.cnn.com
1211
GET foo.jpg
CDN RedirectionThe Akamai DNS server IP address is now
in the cache of the local DNS server.
This implies that it is not always necessary to go to the root DNS server.
The TTL associated with the IP address of an Akamai server(surrogate) is relatively small.This is done for performance reasons.
Akamai content distribution servers are caches
CDN RedirectionWhat if content is not there?
If the request content is not found then the surrogate will ask other surrogates within a specified region for information.
If requested information is still not found
or is stale, then a request is made to the original web site.
CDN SelectionThe tricky issue is selecting which local content
server to use for a particular requestWant to spread load evenlyWant minimal impact if server is added or removed.
In Akamai, each surrogate server sends measurement results to the Network Operations Communications Center (NOCC).Measurement results include number of active TCP
connections, HTTP request arrival rate, bandwidth availability, etc
This information is used by the Akamai DNS server.
Accounting MechanismAccounting mechanisms collect and track
information related to request routing, distribution and delivery.
Information is gathered in real time and put into log files for each CDN component.
This gets sent to the Network Operations
Communications Center (NOCC).
Full Site Delivery vs. Partial Site Delivery
Full Site Delivery : All the contents are delivered by the CDN (including HTML, images, and other objects).
Partial Site delivery: Only images, streaming media and other bandwidth intensive objects delivered by the CDN.
Current Akamai Customers
52
Web Server: Click Here
53
RADIUS
54
RADIUS Overview• RADIUS: remote authentication dial-in user
service
• Designed to centralize the authentication process for large distributed networks
• Originally intended for dial-up networks
• Can be used for VPN servers, switches, and wireless access points
• Two mandatory server roles:– RADIUS client– RADIUS server
55
56
RADIUS Overview (continued)
• The RADIUS client accepts authentication information from users or devices and forwards the information to a RADIUS server
• The RADIUS server accepts authentication information from a RADIUS client
57
Radius Overview (continued)
58
Radius Overview (continued)
59
Outsourcing Dial-up Requirements
• A user dials into ISP, ISP forwards request to RADIUS proxy, RADIUS proxy forwards request to RADIUS server, RADIUS server passes information to domain controller for authentication
60
Outsourcing Dial-up Requirements (continued)
61
What is AAA ?
• Authentication
• Authorization
• Accounting
62
Authentication
• Verify a person’s or machine’s declared identity.
• Mechanisms: passwords, Public Key Infrastructure (PKI).
• Key aspect is Trust relationships between servers.
63
Authorization
• Rules or templates on what a authenticated user can do on a system.
• Dial up user requests can be one link or multiple.
64
Accounting
• Measures and tracks resources a user accesses.
• Include time, amount of data, session statistics, resource utilization etc.
• Logs sent and analyzed for billing, security servers.
65
Properties
• Client/server model
• UDP based
• Hop by hop security
• Stateless
• Uses MD5 for password hiding.
• PAP/CHAP via PPP
66
Authentication methods
• PAP: Password Authentication Protocol (MD5/XOR).
• CHAP: Challenge Handshake Authentication protocol
• PAP is preferred sometimes in cases where authorization must travel outside the realm of control
67
68
The CHAP 3-way handshake
69
Using RADIUS and CHAP
70
71
Ports
• Authentication: udp/1812
• Accounting: udp/1813
72
Implementations
• Livingston
• GNU
• FreeRADIUS
• Cistron
• Radiator
• Alepo
• Juniper: Steel Belt.
73
Databases
• Oracle • Informix • Sybase • mSQL • MySQL • Microsoft SQL including versions 6.5, 7 and 2000 • ODBC • Interbase • SAP • PostgreSQL • SQLite