I have a Wildcard * A record for self-registration of subdomains by users on our web app. All works fine.
I now need to set up an alias for support.mydomain.com to point to mydomain.freshdesk.com. I created a CNAME record as per instructions however it appears my Wildcard A record is overriding the CNAME entry.
Any thoughts on how to resolve this? I need the wildcard so creating an A record for each user subdomain is not possible.
Thanks.
I was wondering... whats the best place to host DNS at? For quick propagation, security, and etc?
I always hosted DNS on my own server.... which gave me a lot of control.... but hosting DNS on the same box as http is never a good practice. What are the advantages of using the domain registrar's dns and simply poining the A record to your ip? What about those commerical DNS hosting companies, that charge ~$35/year for it. Are they worth it?
Answer
I can tell you reasons for and against, from my point of view.
First, I run my own servers. Why I do this is both for professional reasons (I write DNS software for a living) and historically geeky ones. I used to love running my own stuff, doing what I wanted with it, and spending hours a day tweaking this or coding up that.
The reasons you might want to run your own as well are many, and you touched upon a few big ones: If you run your own, you have full control, full knowledge that what you put in is what you get out, and no one to fight with on the phone when it breaks.
The reasons against it are: you are all on your own if it breaks, you have to deal with any upgrades of software needed, and you have to understand zone files and other bits.
Now, if you choose to have someone else host it, I would look into these things. Remember, this is somewhat geeky -- many won't care about some of these features, but I would.
I finally chose to run my own server, but have someone else actually serve my zones to the public. sns.isc.org pulls from my servers, so I maintain all the content, just don't have to worry about the big headaches.
This is the way how many of us do set a route on windows:
route add 10.10.0.0 mask 255.255.0.0 10.77.77.1 if 58 -p
In the command line 58 is the Interface Index (IF) and most of the time its value is constant for a specific network interface card. Therefore one can create a CMD batch file to automate deletion and re-setting of all the routes she/he need.
However, in my case I have a USB 3.0 to Dual Port Gigabit Ethernet Adapter NIC, and its IFs change every time when I connect to the USB port of my notebook. What I do, just open a cmd shell, get the current Interface IDs by giving route print, then open the CMD batch file with text editor and change all the old IF (ex: 58) values, save&close, and at last run the CMD batch file on the shell.
If there is a way to set a route only by knowing the MAC address, not depending of the IF - then the problem is solved :) The solution may be a simple one line CMD command (set route by MAC), or maybe first get the IF by MAC and set route by IF (set route by IF of the MAC).
Any help is highly appreciated!
Answer
Next code snippet shows how-to get the IF by MAC using FOR /F loop against result of WMIC (Windows Management Instrumentation Command):
@ECHO OFF
SETLOCAL EnableExtensions DisableDelayedExpansion
set "_maca=AA:AA:AA:AA:AA:AA" change to match your circumstances
set "_geta=InterfaceIndex^, MACAddress" to keep next lines in reasonable length
set "_ifin=" to ensure that `_ifin` variable is empty
for /F "tokens=1,*" %%G in ('
WMIC NIC where "MACAddress='%_maca%'" get %_geta% 2^>NUL ^| find ":"
') do set "_ifin=%%~G"
if defined _ifin (
rem route command block here:
route add 10.10.0.0 mask 255.255.0.0 10.77.77.1 if %_ifin% -p
) else (
echo %_maca%: No Instance^(s^) Available.
)
Resources (required reading):
I've heard often that it is better to su to root rather than log in directly as the root user (and of course people also say that it's even better to use sudo). I've never really understood why one is better than the other(s), insight?
Answer
The inference is to only su or sudo when required.
Most everyday tasks don't require a root shell. So it is good practice to use an unprivileged shell as your default behaviour and then only elevate to root when you need to perform special tasks.
By doing so you are reducing scope for dangerous mistakes (bad scripting, misplaced wildcards, etc) and vulnerabilities from any applications that you use. Especially those which connect to the Internet - see the old adage "Don't IRC as root".
sudo is often recommended because it allows you fine grain and audit the use of such privileges.
By observing these practices you are also in a position to disable remote root logins. This increases the bar of entry for any would-be attacker, as they would need to compromise both a regular user account that was a member of the "wheel" group and ideally only authorised by SSH public keys, then the root account itself.
It seems to me that data=journal prevents file system inconsistency in the case of power failure. Using it with a dedicated journal device mitigates the performance penalty of writing the data twice. A power outage would still lose the data that is currently being written to the journal, but the file system on disk would always be consistent.
If that amount of loss is acceptable, is a RAID controller with battery backed cache really worthwhile?
Answer
A battery backed cache does more than just keep your filesystem consistent in the event of a power-failure. The cache itself actually performs read caching, and to some extent write-caching (mostly just re-ordering the writes for better write performance). Having a cache on your RAID controller can be a significant speedup for performance. Having a persistent cache of some kind (be it battery-backed, or the newer flash-backed caches) just makes sure that uncommitted writes don't get lost when things go kablooie.
I have a dual boot Ubuntu 10.04 and Vista laptop.
My Ubuntu partions /dev/sda4 extended, which contains a /dev/sda5 ext4 and a /dev/sda6 ntfs partition.
Vista is on /dev/sda2 ntfs. I would like to wipe vista out, turn off dual boot (if possible) and use the space taken by vista to extend my /dev/sda6 ntfs partition in ubuntu.
What's the best way of doing this safely?
On centos 5.7 the default Apache / httpd install has a number of modules enabled by default. Should I disable all the modules and only enable the bare minimum of modules that we need.
Will that improve performance and security.
We are running this server as a production server serving a blog / forum / etc as virtual hosts.
Here is the list of modules enabled by default.
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule file_cache_module modules/mod_file_cache.so
LoadModule mem_cache_module modules/mod_mem_cache.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule version_module modules/mod_version.so
Answer
It is recommended to disable any service/module if you don't need it. This is a general rule.
This will save you some resources (even if it is minor) and will potentially improve your server security. This is because someone can exploit some vulnerability in any of them (if any). If that one is disable, it becomes impossible to exploit.
