System overview

LAN: 192.2.0.0/24 Gateway: 192.2.0.254 Server: 192.2.0.1

• Old laptop
• Pentium i5 520M 2.4GHz
• 4GB DDR3 SO-DIMM (8GB upgrade ordered)
• Storage (ZFS)
  1. zroot: 120GB SSD Transcend JetDrive 420 (internal 2.5“ SATA slot)
  2. zbay: 1TB HGST Travelstar 7K1000 2.5” HDD (Drivebay caddy)
  3. zesata: 500GB Seagate Momentus 5400.6 2.5“ HDD (not yet, eSATA-p external)

Links will go to more detailed wiki articles

1. DHCP/DNS server
2. File-server
3. Backup target for Desktop and laptops
4. Cloud storage server
5. Web-server
   • Personal website
   • Family website
   • Freelance website
6. Mail-server (AKA OpenSMTPd) (incl spam classification and virus scanning)

1. dnsmasq for DHCP and dynamic DNS
2. Unbound as validating, caching and recursive DNS resolver
3. OpenLDAP as user and authentication backend
4. Samba 4.2 as file-server and for backup-target
5. rsync for backups
6. OpenVPN for secure internet access for my mobile devices
7. Apache 2.4 as web-server
   1. ownCloud as cloud storage/calendar/contacts server
   2. PHP 5.6, etc. as required
   3. MariaDB for apps requiring database backend
8. OpenSMTPd as mail server
   1. Dovecot as LDA and IMAP server
   2. AMaVisD as networked scanner daemon
   3. ClamAV as virus scanner
   4. SpamAssassin as rule-based spam classifier
   5. dspam as Bayesian spam classifier
9. System management
   • Poudriere for keeping ports up-to-date
   • ezjail to manage the jails
   • smartmontools to monitor disks

Anything that can be connected from the internet is jailed. Mail scanner was separated provide additional isolation.

• db: Home of MariaDB server
• http: Home of Apache and the web applications and content
• mail: Home of MTA and IMAP-server
• scan: Home of Amavisd, clamav, spamassassin, dspam
• tor: Home of my TOR router

Every jail is firewalled using ipfw.

1. tor gets access to the internet only (not LAN) and is denied anything else
2. Allow all jails to access DNS
3. jails get specific access, anything else is denied