Plesk install and security audit

laughingbuddha · Thu Dec 18, 2008 6:35 pm

Your doing a great job. I'm just trying to get my head around it all, and plan for future server role outs. I don't want to have to back track and change stuff I messed up when doing this first server.

Ok this entry s1.mycompany.net. A xx.xx.xx.226 I put in because I thought you had to in order to resolve the server name for logins, SSL cert and such, is that right?

My idea is simply to name all future servers in order, so s1,s2,s3....and so on.

I put s2.mycompany.net. A xx.xx.xx.181 and the corrisponding ns3 and ns4 entries in so I can still access the US VPS, even though I'm dropping it right after I've moved the domains. It's very slow to access.

I'll set the rdns to s1.mycompany.net as that's the name of the server. Seems to me to make sense, unless scotts about to jump in???

No...ok fare enough.

So if I'm setting the rdns to that, would I then have to add s1.mycompany.net with a PTR as a domain by itself, or can I still use mycompany.net entry with its PTR as I have done so far?

Matt

faris · Unread post by **faris** » Thu Dec 18, 2008 7:09 pm

laughingbuddha wrote: Ok this entry s1.mycompany.net. A xx.xx.xx.226 I put in because I thought you had to in order to resolve the server name for logins, SSL cert and such, is that right?

Umm.....not really. You could just as easily use mydomain.net or even the IP address for logins. If you want an ssl cert for Plesk then it can be on any domain at all. Even one on a shared IP as long as it is the default domain.

I suspect I may not have understood what you want to do with it though, so don't mind me

Faris.

laughingbuddha · Thu Dec 18, 2008 7:24 pm

Ok, this is where I go off the rails.

Now, say instead of using www.mycompany.net as the main domain (the one I put the 2 A records in to resolve the first 2 nameservers, and the PTR record), I instead use s1.mycompany.net and do the A records for ns1 and ns2 (which are on that server), and the PTR record, in the dns for that domain/subdomain. Would that work ok?

Things I'm trying to get my head around are these.

1. When you type the servers address in, so in our example s1.mycompany.net it brings up a default plesk page. But if I instead made it the primary domain s1.mycompany.net could have a mini site of sorts,ftp space and so on.

Also

2. In future roll outs, if I used the standard www.mycompany.net as the primary domain and edit its DNS entries to create the A records for the nameservers and PTR, wouldn't I have to put it on all the other servers to in order for the IPs and nameservers to resolve?

If that sounds confusing, in short, how do you do it for long term role out?

I've just paid to ASL and once this done I'm going to install asl.

Thanks again,

Matt

Kalimari · Unread post by **Kalimari** » Thu Dec 18, 2008 7:51 pm

You're on the right track Matt, if you intend to eventually roll out multiple servers you will be best off using:

s1.mycompany.net
s2.mycompany.net
s3.etc

Each configured as the primary domain/IP on own server, with nameservers:

nsa.s1.mycompany.net
nsb.s1.mycompany.net

Personally, I use third party DNS entirely, but if using Plesk DNS the principal is the same, requests for domains on other (independent) nameservers go externally so no need to replicate.

laughingbuddha · Thu Dec 18, 2008 8:06 pm

Cool, so with that in mind the dns record for the primary domain on the first server would look like:

xx.xx.xx.226 / 24 PTR s1.mycompany.net.
ftp.s1.mycompany.net. CNAME s1.mycompany.net.
mail.s1.mycompany.net. A xx.xx.xx.226
ns1.mycompany.net. A xx.xx.xx.226
ns2.mycompany.net. A xx.xx.xx.227
s1.mycompany.net. NS ns1.mycompany.net.
s1.mycompany.net. NS ns2.mycompany.net.
s1.mycompany.net. A xx.xx.xx.226
s1.mycompany.net. MX (10) mail.s1.mycompany.net.
webmail.s1.mycompany.net. A xx.xx.xx.226

And on any future servers the record would be the same, apart from the IPs (of course) the server name (next one is s2) and the nameservers which would be ns3 and ns4.

Is that right?

Matt

laughingbuddha · Thu Dec 18, 2008 8:28 pm

Ah, I've spotted a problem with my thinking (one of many at this time of night), I can't create an entry for ns1.mycompany.net in s1.mycompany.net. So if I wanted the namerserver to be ns1.mycompany.net I'll have to create a domain for mycompany.net add the A record for the nameservers (ns1 and ns2) in its dns record, and then I can have the ns1 and ns2.

Ok, then in future if put online another server, say s2.mycompany.net which would use ns3 and ns4 I would then add the A records for that in the domain www.mycompany.net on the server s1.mycompany.net.

Ok I think my head hurts now. Bed.

Matt

Kalimari · Unread post by **Kalimari** » Thu Dec 18, 2008 8:55 pm

This might be why external DNS is your friend...

In Plesk have you tried to create a new domain name as s1.mycompany.net (uncheck the WWW entry), select the primary/shared IP and proceed through hosting set-up... Under Server->IP Addresses, click the right most link (to number of assigned sites to IP) and ensure s1.mycompany.net is Set As Default...

Everything else (NS etc) should be set-up as you outlined before.

I'm flying blind so maybe entirely wrong...

laughingbuddha · Thu Dec 18, 2008 9:10 pm

Aren't we all

I know I am!

Right so my s1.mycompany.net is setup, but I've not put any A records in there for the NS1 or NS2 (because I cann't as I want them like ns1.mycompany.net and not like ns1.s1.mycompany.net).

I've done what you sugested, cool. I had forgot about that

And now I've created an entry for www.mycompany.net. Now this is an entry with no hosting, instead I've told it to redirect the web requests to www.mycompany.co.uk (the formal site for my company). But in the DNS records for mycompany.net I've added the NS1 and NS2 A records.

Yes looking at this I could have used an outside dns provider to managed the domain mycompany.net dns, but this works for now until I change it to a more reliable dns provider as you mentioned.

Thanks for your help, I think this madness has finaly come to an end. Now I can migrate a domain.....at last.

Thanks again Faris and Kalimari, I owe you two a drink.

Matt

laughingbuddha · Fri Dec 19, 2008 8:01 am

Ok, its been running over night ok. And last night I mirgrated a domain over from the US vps.

Problem I'm experincing this morning is that the ftp works ok, the mail is work (from what the client told me) but I can't access this website through the browser. All I get is the "You see this page because there is no Web site at this address."

Is there something I've done wrong in my dns, or is it becaue the dns changes I've made haven't taken effect.

He changed his namerserver settings for the domain a 4pm yesterday (UK) and it's now 12 midday (UK). According the to whois look up I did on his domain the ns entries are correct.

Help

Matt

Kalimari · Unread post by **Kalimari** » Fri Dec 19, 2008 8:06 am

Sounds as if the DNS changes are resolving to your new box, do you have identical default pages on both sites? Best way to know for sure, alter the default page on new server...

faris · Unread post by **faris** » Fri Dec 19, 2008 4:00 pm

Don't change anything based on what I'm about to say, OK?
It all looks fine and that domain will probably burst into life very shortly.

I'd fogotten about something. The hostname.

This is just a basic summary:

IF your hostname, aka servername if you like, is s1.yourcompany.net

THEN

hostname should be same as rnds for "primary" IP, i.e. both should be s1.yourcompany.net

Ideally, the domain with the PTR for the primary IP should also be the same as the above (i.e. same as rdns and same as hostname), since the PTR record is providing rdns for local lookups on the primary IP. There is no harm in having the PTR on yourcompany.com or yourcompany.net, however, instead of s1.(whatever). Not really anyway.

For nameservers, I'd say that using ns1.yourcompany.net/ns2.yourcompany.net is less of a mouthfull than ns1.s1.yourcompany.net (etc).

As Kalimari suggests, off-server DNS makes a lot of sense and is extremely useful (ideally as long as it is automated and doesn't force you to manually add records each time you add a domain).

faris · Unread post by **faris** » Fri Dec 19, 2008 4:03 pm

p.s. even Windows has a hosts file (somewhere in /system/win32 or something like that)

If you put ...

migrated-domain.com IP-of-your-new-server

...in that file, it will force Windows to act as though the dns change had already happened, with no "propagation" delay.

You can also use nslookup at the Windows command line, as follows...

nslookup domain nameserver-to-use-for-lookup

...for testing.

Faris.

laughingbuddha · Fri Dec 19, 2008 6:38 pm

Thanks Faris.

Kalimari mentioned a possible problem in a PM to me.

Basicly my ns1.mycompany.net uses the same ip as s1.mycompany.net, and both ns1 and ns2 are on the same machine (using differnt ips).

Is that a problem?

Kalimari did mention that they should use seperate ips to the s1.mycompany.net. and ns1 and ns2 should be on seperate machines, but at the moment I don't have the funds to run a second server just as a backup to the first, nor any idea of how to run replication on an automatic level.

Currently I've got s1.mycompany.net on ip 80.xx.xx.226 and a rdns entry for that plus its the default domain for IP 80.xx.xx.226 in Plesk (under IP addresses management) and has a PTR record. I've had the ns1.mycompany.net and ns2.mycompany.net rdns entries removed as I thought that might cause an issue.

ns1.mycompany.net is on ip 80.xx.xx.226 and ns2.mycompany.net is on ip 80.xx.xx.227.

A domain entry for www.mycompany.net is also present on ip 80.xx.xx.226 but is only used for the A records for the nameservers (ns1 + ns2 and the ns3 + ns4 which are in the US) and an A record for s2.mycompany.net which is in the US.

Do you think it would be better to move the www.mycompany.net and it's dns as I mentioned above, off to a seperate dns management system, if so can you recommend one and how to do this?

I have some images of my dns layout in Plesk if this helps, which I can forward on PM.

Thanks again for your support, both of you.

Matt

faris · Unread post by **faris** » Sat Dec 20, 2008 7:05 pm

I'm afraid I'm horribly confused, but no, there's no problem with s1 and ns1 having the same IP, not with ns2 being on the same machine but on a different IP.

Having secondary DNS (ns2) on a different machine would be better, and having ns1 and ns2 on two different deparate machines is best of all.

But consider this: If you have only one machine, and it goes down, it does not matter that you still have two nameservers up - nobody is going to be able to get to your machine for web or email etc anyway.

Someone once mentioned that the above may be true, but that some smtp servers will treat a DNS failure differently to a no connection failure. Thus you might get emails bounceing to their senders instantly if your DNS servers have failed (e.g. they are on the same machine as Plesk, and that machine is down), but this might not happen if your Plesk machine is down and DNS is on a separate machine or machines and is still answering.

Faris.

biggles · Unread post by **biggles** » Sun Dec 21, 2008 3:14 am

faris wrote:Someone once mentioned that the above may be true, but that some smtp servers will treat a DNS failure differently to a no connection failure. Thus you might get emails bounceing to their senders instantly if your DNS servers have failed (e.g. they are on the same machine as Plesk, and that machine is down), but this might not happen if your Plesk machine is down and DNS is on a separate machine or machines and is still answering.

Faris.

I've had a similar experience. If you have a respnding DNS most mail servers will think your mail server is just being overloaded/missing/restarting if it's down and will retry later. But if the DNS isn't availible, the mail will almost always bounce immidiatly.