Re: NoCat hardware requirements

On Fri, Oct 21, 2005 at 09:56:02AM +0200, Fabio Casadei wrote:
> Hi,
> i’m trying some hardware to line out NoCatAuth (gateway and authserv on
> the same machine, Fedora Core 3) hardware minimum requirements.
> Any suggestions (possibly supported with production machines examples
> and number of users served)?

I can't quote any figures because we haven't been that far as rolling
NoCat out in production mode, but the major bottleneck appeared to be
the Perl processes created at client login time. It's kind of easy to
bring a machine on its knees would anything go wrong (http scans
by worms etc.). However even the highest-end machine will be vulnerable to
this. So you may need to take extra steps like custom iptables rules
with rate limits.

>  
> Has anybody installed NoCat on the same machine where a proxy-based web
> contents filtering system resides?

Yes I have. Squid + SquidGuard. But only for a testbed.

> Any suggestion about the content filtering system to choose (i’m looking
> for an open-source one)?

SquidGuard is simple (simplistic?), works fine but isn't fancy.
Many free online blacklists exists that you can feed it with.
DansGuardian is more advanced, but newer and somewhat more complex
IMO. AFAIK not many free blacklists available if any.

> How such a system will increase minimum hw requirements?

In my experience SquidGuard doesn't generate as much overhead as could
be feared if properly configured and used only for filtering domains
and URLs using the table approach (not the regexp).
I can't talk about DansGuardian. I've really only played with it.

Squid by itself requires fast CPUs and more importantly a lot of RAM
and fast disks if you let it have a big cache.  On the other hand if
you're only interested in content filtering, you can trim down the
caching part a lot.

Greets,
_Alain_