Preparing Servers for H-Sphere Installation

The purpose of this document is to provide comprehensive information on how to prepare Linux and Unix servers for the installation of H-Sphere components by the Positive Software team or by customers themselves. It covers the following topics:

• Supported Operating Systems
• Hardware Requirements
• Single-Server and Multi-Server Installation
  
  • General Considerations
  • Sample 1/2/3-Server Configurations
  • HDD Partitioning
• Requirements
  
  • OpenSSH
  • Kernel
  • Disk Quota
  • Ports (Firewall Configuration)
  • DNS Server
  • Perl
  • Make
  • Command-Line URL Download Utility (wget or fetch)
  • compat3x (FreeBSD only)
  • SELinux Must Be Off (RedHat Enterprise Linux 4, CentOS 4 and up, and White Box Enterprise Linux 4 only)
• Updating Linux (separate document)

Please also read the following:

• Winbox Pre-installation Guide
• H-Sphere Requirements (Overview)

Note: We don't install H-Sphere on live servers and we don't take responsibility if your functional services go down during the H-Sphere installation.

Supported Operating Systems

Before requesting H-Sphere installation, make sure to install one of the following operating systems:

For supported Windows Server versions, refer to the Winbox Pre-installation guide.

You may also want to read a related discussion in our forum.

Hardware Requirements

If you are going to install H-Sphere to only one computer, make sure it is at least Pentium III, 500MHz CPU and 512MB RAM. This will allow to host only a small number of customers. Adding SiteStudio will require at least 1000MHz CPU and 1GB RAM.

Single-Server and Multi-Server Installation

General Considerations

H-Sphere can be installed on one or more servers. The required number of servers and their hardware configuration will largely depend on the number of accounts you are planning to host, Web and mail quotas, traffic load and other related factors.

Here are some general considerations common to H-Sphere server environment:

1. We recommend installing Control Panel (CP) to a separate server. It is also acceptable to install one DNS server to the CP server box, for example, if you are planning 2-server installation.
2. You must not install PostgreSQL hosting service on the same box with Control Panel, as the latter requires a separate PostgreSQL server for its system database.
3. You can have several DNS servers on one box. However, for multiserver H-Sphere installation, you should install each DNS server on a separate box. The best solution is to have two DNS servers on separate boxes. More on DNS servers
4. We advise installing mail server on the same box with MySQL server, as mail server requires its own MySQL database.
5. It is reasonable to allocate separate physical servers for the most resource-consuming services. Usually, these are Web and mail servers, but sometimes it may be MySQL and PostgreSQL.

According to these recommendations, the following 4-server installation may be an optimal solution:

• Server 1: Control Panel (with the system PostgreSQL database);
• Server 2: Web1 + DNS1;
• Server 3: Mail + MySQL1 (user DB) + DNS2;
• Server 4: PostgreSQL (user DB) + MySQL2 (user DB).

Later on, you may add more boxes to your system, as your needs grow:

• Server 5: Web2;
• Server 6: Mail2 (with its own MySQL DB);
  
  ...
  

See the illustration chart of multi-server installation.

Sample 1/2/3-Server Configurations

Below are sample 1/2/3-server H-Sphere installations with preferable partitioning schemes outlined.

HDD Partitioning

H-Sphere is installed to the /hsphere directory.

We recommend dedicating a separate partition for the H-Sphere installation directory and mount it as /hsphere.

H-Sphere directory can be located on any other partition as well. However, we do not recommend installing H-Sphere to the root / partition. Having H-Sphere on the root partition may cause certain problems. For instance, if disk quota gets damaged, you cannot repair it without server reboot and fsck check in the single user mode.

If your H-Sphere installation directory is to be located on another partition, for example, /usr/hsphere on the /usr partition, the /hsphere symlink to this directory must be anyway created:

Important: Do not create /hsphere as a symlink to another partition on servers with FreeBSD 5.3 and up! Allocate the separate /hsphere partition instead! If this is impossible, use nullfs partitioning for this purpose.

There are no more requirements to partitioning the servers, just make sure there is enough disk space to store user and other H-Sphere data.

Required Components and Configuration

Prior to the installation, make sure your server has the following:

OpenSSH

1. Install OpenSSH package on each H-Sphere box. You can use standard RPMs under Linux or packages under FreeBSD. Usually, the standard Linux and FreeBSD installations contain the OpenSSH package, you can use it without any restrictions. However, we recommend to update the package to the last version. SSH keys need to be configured under the cpanel user.
2. To enable Permit Root Login, open file /etc/ssh/sshd_config and uncomment the line:
   
   PermitRootLogin yes
   Make sure PermitRootLogin is set to yes. Then restart SSH:
   
   • for Linux:
     /etc/init.d/sshd restart
   • for FreeBSD 4.x:
     kill -HUP `ps ax | grep sshd | grep -v grep | grep -v tty | awk '{print $1}'`
   • for FreeBSD 5.x:
     /etc/rc.d/sshd restart
3. Enable the OpenSSH daemon start at server startup.
4. Start the OpenSSH daemon.

Kernel

We strongly recommend using typical Linux/FreeBSD kernel (i.e., coming with official OS distributives or updates). In particular, in case of FreeBSD we instist on GENERIC kernel with basic configuration. We do not guarantee correct H-Sphere work on a server with customized kernel! Please carefully test H-Sphere functionality on such a server before it becomes a production server!

Disk Quota

Enable the disk quota feature on each H-Sphere Web server. There is no need to enable it on other servers.

To enable disk quota:

1. Log in as root.
2. Insert the usrquota directive (userquota for FreeBSD) into the /etc/fstab file for the corresponding partition.
   On Linux, it must look similar to this:
   
   LABEL=/hsphere   /hsphere   ext2   defaults,usrquota   1 1
   On FreeBSD, it must look similar to this:
   
   LABEL=/hsphere   /hsphere ufs rw,userquota 2 2
3. Execute the following commands:
   quotaoff /partition_with_userquota_enabled
   mount -o remount /partition_with_userquota_enabled (Linux only, skip this line with FreeBSD)
   rm -rf /partition_with_userquota_enabled/aquota.user /partition_with_userquota_enabled/quota.user
   quotacheck -mufv /partition_with_userquota_enabled(Linux)
   quotacheck -guv /partition_with_userquota_enabled(FreeBSD)
   quotaon /partition_with_userquota_enabled
   
   [-] If quotacheck returns the error: quotacheck: Cannot get quotafile name for /dev/xxx

   Do the following:
   1) # touch /partition_with_userquota_enabled/aquota.user
   2) # quotacheck -m /partition_with_userquota_enabled
   and ignore the message:
   "quotacheck: WARNING - Quotafile /partition_with_userquota_enabled/aquota.user was probably truncated. Can't save quota settings..."
   3) quotaon /partition_with_userquota_enabled
4. FreeBSD Web server installations: Enable disk quota in the kernel configuration. Also, in /etc/default/rc.conf set:
   
   enable_quotas="YES"

Root Partitions: we don't recommend enabling the disk quota feature on root partitions. Use other partitions for this! Therefore, we advise not to place H-Sphere files on the root partition.

Quotacheck: quota versions can have some differences on different OSs. You may need to execute the quotacheck command with some additional parameters. Please read the command manual before performing this action.

Ports (Firewall Configuration)

In your firewall settings, open the following ports in both directions and specify the connection type - tcp or udp or both.
We need that firewall be configured by our customers.

*For those requesting PSoft support, make sure your firewall settings allow SSH connection to PSoft IPs.

**For highest security, open:
  - udp permanently;
  - tcp worldwide during H-Sphere installation and post-installation tests;
  - tcp between H-Sphere DNS servers permanently.

***Open these ports only if you want to use Mail SSL.

Note: In the above table, all ports should be opened for external connections unless specified otherwise (for example, "tcp between H-Sphere servers").

DNS Server Notes:

1. Port 953 (rndc) should be open for localhost only if your DNS server is using BIND 9.x.

2. If your DNS server is using BIND 8.x, it can be upgraded to run with H-Sphere, but old domains would still have to be managed by hand. Please agree your DNS server upgrade with our installation team.
* As of now we don't provide support for Reverse DNS configuration.

Perl

H-Sphere installation script is written in Perl, therefore Perl is required on each box. To check if Perl is installed, run:

perl -V

Caution: Do not update or change any configuration to your system Perl, as it will most likely damage your H-Sphere installation.

See the list of supported Perl versions per OS.

Make

Make sure the make utility is installed on every box. To check if make is installed, run:

make -v

Command-Line URL Download Utility (wget or fetch)

H-Sphere installation script requires the command-line URL download utility, wget for Linux, fetch for FreeBSD.

compat3x package

On FreeBSD 4.X servers, make sure to have the compat3x package installed for compatibility with 3.x. To diagnose if your compat3x is missing, run:

/stand/sysinstall

and then go to Configure -> Distributions

SELinux Must Be Off

Before H-Sphere installation, make sure SELinux is off on your Linux servers.

To check SELinux status, run:

selinuxenabled && echo $?

If as a result of this command you receive 0, SELinux is enabled. No result means that SELinux is off.

To disable SELinux, set the following option in /etc/selinux/config:

SELINUX=disabled

This will turn off SELinux after reboot. To disable SELinux immediately, type:

setenforce 0

Now that you have prepared the servers, you can proceed to H-Sphere installation or request installation by Psoft.