Getting a web-server ready for production

[HodgeHi]

Hello all,

 

So i am readying a Mac OS X Server (10.5.6) ready to serve out our web-pages, VLE, Support desk and email. But first i have a few questions.

 

1. I have currently set up the sites so that the DBs are on a different server from the Web front-ends. So each website (Joomla, Moodle, Support desk) has to connect back to another machine. Is this a good idea. The two servers won't be in the same location.

 

2. If the first answer is yes it's a good idea, then is it a good idea to use non-standard port numbers? For example moving MySQL's port number from 3306 to something else. Moving IMAP port numbers to something else? and SMTP? Is it worth the extra hassle of configuring?

 

4.MySQL Permissions for DB access. When configuring Joomla, Moodle etc. You create a user to connect to the DB to. What permissions should this user be given? Do they need all of them or only a select few?

 

3. The final one (I think). I have numerous sites hosted on the one server and all of them use a log in facility. To protect the passwords i am using SSL. Now the problem is Apache complains about using SSL in conjunction with Virtual Hosts. This is something i need to research. But if this is the case how can i use more than one SSL site on one server?

 

Hope you can help. I think that's everything...for now

 

Thanks in advance.

[powdarrmonkey]

1. I have currently set up the sites so that the DBs are on a different server from the Web front-ends. So each website (Joomla, Moodle, Support desk) has to connect back to another machine. Is this a good idea. The two servers won't be in the same location.

 

If you're expecting to be very, very busy then yes, it is. But in a typical school I'd be surprised if you will notice any difference. It would make more sense if each front-end was on a different server as well, then you could take one down without killing other services.

 

2. If the first answer is yes it's a good idea, then is it a good idea to use non-standard port numbers? For example moving MySQL's port number from 3306 to something else. Moving IMAP port numbers to something else? and SMTP? Is it worth the extra hassle of configuring?

 

I doubt it. A well-configured firewall would be a better solution.

 

4.MySQL Permissions for DB access. When configuring Joomla, Moodle etc. You create a user to connect to the DB to. What permissions should this user be given? Do they need all of them or only a select few?

 

They won't need GRANT after initial installation except during upgrades.

 

 

3. The final one (I think). I have numerous sites hosted on the one server and all of them use a log in facility. To protect the passwords i am using SSL. Now the problem is Apache complains about using SSL in conjunction with Virtual Hosts. This is something i need to research. But if this is the case how can i use more than one SSL site on one server?

 

No, you can only have one SSL site per IP address (so lots of IPs, lots of sites).

[matt40k]

No, you can only have one SSL site per IP address (so lots of IPs, lots of sites).

 

Or have it all in subfolders.

[HodgeHi]

Or have it all in subfolders.

 

Do you mean inside each one? How would this work when upgrading sites such as Joomla, Moodle? Would it not make it harder to do these things?

 

So SSL requires individual IP addresses for each site. Would this then allow me to use as many self-signed certs without errors appearing in the logs? The sites still work but i am unsure as to what issues/vulnerabilities could arise from keeping it this way.

 

Thanks for the advice so far though guys. Most appreciated.

[matt40k]

You can have 1 SSL address like ssl.webserver.local then have subfolders so:

ssl.webserver.local/joomla

ssl.webserver.local/helpdesk

ssl.webserver.local/email

 

or you have have multiple SSL addresses like:

joomla.webserver.local

helpdesk.webserver.local

email.webserver.local

 

the second would require 3 (static) IPs

[SteveBentley]

4.MySQL Permissions for DB access. When configuring Joomla, Moodle etc. You create a user to connect to the DB to. What permissions should this user be given? Do they need all of them or only a select few?

 

It depends on how the package needs to interact with the database. The install guide will tell you how to do it, for example https://help.ubuntu.com/community/Joomla specifies

 

mysql> GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES ON joomla.* TO 'yourusername'@'localhost' IDENTIFIED BY 'yourpassword';

 

Some packages are more specific, such as PHPMyAdmin requires a user with very specific rights on the main mysql database, and has different rights on each table. Probably because it is the main mysql database and if you leave it too loose you could compromise the whole server.

[Jay]

Have you tried configuring different certificates for each location using in https.conf? (never tried it, but can't see why it wouldn't work.)

 

You could also use a wildcard certificate which would cover *.blah.com, makes things easier as well as cheaper assuming all your virtual hosts are of the format [host].blah.com.

[powdarrmonkey]

Have you tried configuring different certificates for each location using in https.conf? (never tried it, but can't see why it wouldn't work.)

 

No, you can't, because of a race condition negotiating the certificate to use for different hostnames. Recall that in HTTP/1.1 the hostname is presented to the browser *after* a secure connection has been negotiated, so the certificate is already chosen. If they don't match, the browser then whinges.

 

The only way to use differing certificates based on some condition is to have different IP addresses (since these are lower in the OSI stack than the application layer).

Edited March 26, 2009 by powdarrmonkey
speeling

[matt40k]

[host].blah.com.

 

God I wish I owned blah.com... such a cool domain.

Sorry I've wandering off topic...

[Jay]

Didn't know that, but it explains a restriction we have with a reverse proxy solution that servers multiple sites. I assumed the host address was presented to the server in the initial handshake. (lesson for today, never assume.)

 

Cheers,

Jay

[powdarrmonkey]

Didn't know that, but it explains a restriction we have with a reverse proxy solution that servers multiple sites. I assumed the host address was presented to the server in the initial handshake. (lesson for today, never assume.)

 

If that were the case, you could sniff some data from the packet, which defeats the point of SSL (ok, it's not usually the most sensitive part, but that depends how embarrassing a site you're looking at. Or dangerous: https://bombsrus.com/ for example.)

[powdarrmonkey]

I just thought, you could also use one IP address with virtual hosts on multiple ports and therefore multiple SSL sites.

[HodgeHi]

Sorry i haven't replied to any of these posts but i never got a mail saying there had been replies.

[HodgeHi]

It depends on how the package needs to interact with the database. The install guide will tell you how to do it, for example https://help.ubuntu.com/community/Joomla.

 

This was a very useful page. Thanks for this.