PDA

View Full Version : First few days while starting up with VPS


Zaf
08-20-2005, 06:37 AM
The following is a step by step guide of the first few days:

1. Add two child name server records at domain registrar for the base (primary) domain pointing to the two ip addresses allotted by PVPS (assuming that you have Power1 account)

ns1.yourdomain.com pointing to primary ip
ns2.yourdomain.com pointing to secondary ip.

Also change the name servers addresses for your domain name to these new name server names just created as above.

These changes probably might take upto 48 hrs to propogate throughout the web. You can see them take effect almost instantaneously on your computer if you downloaded and installed Tree Walk DNS (http://ntcanuck.com/downloads.htm)

To confirm the above check the whois of yourdomain.com, ns1.yourdomain.com and ns2.yourdomain.com

2. Next thing is to log in to the WHM. I'll try to list the ones that usually need changes and will try to explain some of them as necessary.

Server Setup --> Edit Setup
a. Primary ip
b. Server Contact e-mail address
c. Server Contact pager address
d. Host name of the server: You'd probably have host.yourdomain.com as your server name. If you dont like the name 'host' for your server...It would be better and far more easier to open a support ticket and request a change rather than going through settings yourself. For instance, this change also requires modifying the httpd.conf (atleast in my case it was required).
e. primary name server
f. secondary name server
Other than these, you can fill in ur AIM and ICQ account details which are self explanatory.

Server Setup --> Tweak Settings
Most of the settings are self explanatory. Dont need to change much here unless you want things in a specific way. I chose to enable AWStats and disabled Analog stats, also disabled Neomail and Squirrelmail to save resources.

Server setup --> Tweak Security: Atleast Enable the SMTP Tweak if not enabled already.

3. Next thing I did was to change my DNS Zone Template files.

I changed the SOA record of the zone templates as follows:
@ IN SOA %nameserver%. %rpemail%. (
%serial% ; serial, todays date+todays
7200 ; refresh, seconds
2400 ; retry, seconds
2419200 ; expire, seconds
3600 ) ; minimum, secondsFurther, i changed the www, mail and ftp records as follows:
mail IN A %ip%
www IN A %ip%
ftp IN A %ip%
4. I also modified the dns config file pico /etc/named.conf from SSH as follows:
I added the following line in the options { } section just below the line //query source address * port 53;
version "Ver 0.0";I have also disabled recursion by adding the following lines in the same sectionallow-recursion {
127.0.0.1;
pri.ip.of.vps;
sec.ip.of.vps;
};5. For MySQL, PHP and other tweaks you would have to read some of the threads in the forum. I'm doing the same too and am still in the process of changing a lot of things in my VPS. I'm just one week old in the world of VPS.

Lastly, I'm thankful to elix, who helped me great bit and even logged into my VPS to make sure most of the things were set right.

Hope this post is helpful to ppl who have just joined in.


Shahzada

StingRay
08-20-2005, 01:31 PM
Actually what would be more helpful is explaining briefly why you choose to make the changes you did and the effect they have.

Currently your target audience seems to be those who know everything... and they properly wouldn't need this Info :)

Hvu
08-21-2005, 01:23 AM
Good idea on changing the zones times, I can identify a default cpanel server just by looking up the DNS TTL timings LOL. Also it makes them comply with RFC standards. Also might want to SPF records to your zone template files. Something easy like "v=spf1 ~all" would work fine. Changing the Version number / remove number is great too, since it makes it "harder" for kiddies to hack since bots usually just scans for version numbers then attack. recursion disable is good too as it removes unneccessary traffic if someone uses your dns server as their dns server.

SPF info: http://spf.pobox.com/

Zaf
08-21-2005, 05:47 AM
Yes I agree about the SPF record, and I have the SPF record in place too. But i guess, that came as a default so I did not mention in my post. Mine is "v=spf1 a mx ptr" (the default setting with cpanel).
I've been to that link before but this time I went ahead of that to read the faq too. Tell you what, it has only confused me a bit and now I really wonder what should SPF records for my domains be. Can you or someone here pls guide

ozgreg
08-21-2005, 06:11 AM
I finally got my SPF record to verify in the end this is what I had to do..

Use the SPF Wizard -> http://spf.pobox.com/wizard.html

Enter your domain (note: without the www) and click on begin.

a -> yes
mx -> yes
ptr -> no
a -> host.example.com*
mx: -> example.com*
ip4: -> 127.0.0.1#
include: -> blank
~all: -> yes

Click on explain.

In the White box titled example.com IN TXT
"v=spf1 a mx a:host.example.com mx:example.com ip4:127.0.0.1 ~all"

Copy that text to your DNS Zone for example.com replacing the existing cpanel default SPF text which is invalid.

Stop and restart BIND.

Notes:

*Change example.com to your domain name
#Change 127.0.0.1 to the ip address of your vps host

Best way I know to test this is send email to gmail account and if you do a show all on your mail headers you should see Received-SPF: pass

ozgreg
08-21-2005, 06:22 AM
Extra Note: Also make sure the ip address of your host has been correctly setup (rDNS) to your domain.

When you SSH into your account the title should show your domain not xxxxx.defenderhosting.com. If your title is incorrect please lodge a support ticket to asking to correct your rDNS

vps-vince
08-21-2005, 05:07 PM
Oh, so the default settings v=spf1 a mx ptr" that came with my VPS is wrong?

Seems OK when you lookup with dnsreport.com

Should we get the zone templates changed to the correct settings?

- Vince

Zaf
08-21-2005, 06:16 PM
Well, I think gmail passed the default SPF record too.

"v=spf1 a mx ptr"

Shahzada

ozgreg
08-21-2005, 06:31 PM
Upto my (documented) changes gmail would reject my SPF *shrugs*

canuck
08-21-2005, 07:42 PM
Does everybody else have this tweak enabled ?

"SMTP TweakThis SMTP tweak will prevent users from bypassing the mail server to send mail (This is a common practice used by spammers). It will only allow the MTA (mail transport agent), mailman, and root to connect to remote SMTP servers. "

Shouldn't this have beed done in th einitial setup ? Any consequences enabling it ?

Thanks

Fred
08-21-2005, 08:33 PM
For the spf stuff... I heard ( so my post couldn't be 100% trusted ) that even if it's enabled in our dns zone... it doesn't mean it will be used... We will have to enable it in exim to make it work...

elix
08-21-2005, 08:41 PM
Does everybody else have this tweak enabled ?

"SMTP TweakThis SMTP tweak will prevent users from bypassing the mail server to send mail (This is a common practice used by spammers). It will only allow the MTA (mail transport agent), mailman, and root to connect to remote SMTP servers. "

Shouldn't this have beed done in th einitial setup ? Any consequences enabling it ?

Thanks
iirc that screws everything up on a VPS environment =(

ozgreg
08-22-2005, 12:24 AM
I saw this post in WHT I believe...

Please do not enable "SMTP Tweak" in the "Tweak Security" section of your WebHostManager. This feature is incompatible with your VPS and will cause mail deliveries to fail. Also, please do not enable "Shell Fork Bomb Protection" as it is also incompatible."

Zaf
08-22-2005, 02:24 AM
I saw this post in WHT I believe...

Please do not enable "SMTP Tweak" in the "Tweak Security" section of your WebHostManager. This feature is incompatible with your VPS and will cause mail deliveries to fail. Also, please do not enable "Shell Fork Bomb Protection" as it is also incompatible."I have "SMTP Tweak" enabled and also have "Shell Fork Bomb Protection" enabled, NO PROBLEMS yet. If it is going to cause intermittent failure of mail deliveries, I'd like to check about it further. Can you please give me the thread link or a link to find more info on that?

Btw, the default SPF of cpanel is getting a PASS status on gmail. Here is the gmail line:Received-SPF: pass (gmail.com: domain of mail@domain.on.vps.with.spf designates
my.pri.ip.address as permitted sender)Interestingly, Gmail even gave passed status to another domain which does not have a SPF record and is DNS managed outside and here is the gmail line:Received-SPF: pass (gmail.com: best guess record for domain of
mail@domain.on.vps.without.spf designates my.pri.ip.address as permitted sender)Just before posting this, I checked some more headers in the gmail account and found a different SPF status on gmail. Here it goes:Received-SPF: neutral (gmail.com: 217.160.242.235 is neither permitted nor denied by best
guess record for domain of download@yessoftware.com)

ozgreg
08-22-2005, 06:34 AM
It is an old thread -> http://www.webhostingtalk.com/archive/thread/406977-1.html but I seen this been posted a few times in other VPS forums. Cpanel might have fixed this issue by now but I stayed away from it..

As for SPF after making those settings I no longer have failures, but if the default works for you that is great..

elix
08-22-2005, 07:55 AM
Perhaps Virtuozzo had fixed this issue in later versions?

charles
08-23-2005, 04:06 PM
For the spf stuff... I heard ( so my post couldn't be 100% trusted ) that even if it's enabled in our dns zone... it doesn't mean it will be used... We will have to enable it in exim to make it work...

The SPF DNS record is for other MAIL servers to use (if they wish). You need the SPF records to get others to accept your mail.

Your mail server needs to be configured to use SPF (if you wish). It's just like an RBL in that there is nothing forcing you to use it, but it's generally a good idea.

charles

Fred
08-23-2005, 07:05 PM
Charles, so it's not enabled for spf if we are using the default exim config right ?

Zaf
08-23-2005, 07:47 PM
Adding an SPF record in your domain's DNS records is one thing, and implementing a check (in your mail server) for SPF records of domains sending mails to your mail server is another.

DNSreport.com gives the following brief description about SPF records.
Your domain does not have an SPF record. This means that spammers
can easily send out E-mail that looks like it came from your domain,
which can make your domain look bad (if the recipient thinks you
really sent it), and can cost you money (when people complain to you,
rather than the spammer). You may want to add an SPF (http://spf.pobox.com) record ASAP,
as 01 Oct 2004 was the target date for domains to have SPF records
in place (Hotmail, for example, started checking SPF records on 01 Oct 2004).By having an SPF record in your domain, you are only complying with certain standards/recommendation.

Whereas, when you configure your mail server to check for SPF records of the domains sending mails to your server, you are enforcing the standard/recommendation.

While it would be a positive step if you add an appropriate SPF record in your DNS records, you should think twice (IMHO) before you implement this check in your mail server, as you might end up rejecting mails coming from ill-managed domains (and surely they are toooo many even today)

I'm still not tooo sure of the most appropriate SPF records for my domains, but I'm keeping the Cpanel defaults for now as they give me "PASS" status at gmail.



Shahzada

MarkB
09-04-2005, 05:12 PM
All domains on the same IP (shared IP) as your mailserver IP will pass the SPF check.

For domains with dedicated IP you should add your host as permitted sender.

Some hotmail servers are already bouncing mail with neutral SPF check.