Help me with setting up my first server

Question

I recently decided to buy a Mac Mini server for my small business (4 users including myself) to run mail, file sharing, calander and addressbook services.
Since I'm also looking at this as a personal project, I don't want to hire a server administrator to do it for me. I have a limited knowledge about server administration, so please bear with me!
So I got the mac mini server, an static IP from my ISP (business internet), a registered domain(example.ca) and a cheap SSL certificate. A website is already up on the example.ca domain (hosted by my domain and host provider) and I don't plan to mess with that.
Using my domain provider's CP, I set the default [email protected] as a catch-all email. I then plan to use a POP email fetcher on the server to get all emails sent to my domain from the webmaster account and distribute them among users. The reason for this setup is that I suspect having instability problems for a while and I don't emails sent to my employees to get rejected because my server might be down. then I set up my network like this :
Modem >>>
unmanaged switch >>>
1. 1st IP(dynamic) :an spare wireless router for my private home network >>> home clients
2. 2nd IP(static) : an 8 port business router for my office network with DHCP enabled >>> mac mini server and 4 other clients
I didn't use mac mini server as a gateway because I didn't want to deal with the complicated mesurements securing the exposed server from public internet.
If I made any mistakes so far, please correct me.
Now I want to start setting up snow leopard server, and I have some questions:
1.What DNS configuration do you think I should use? Considering the mail setup I want to use, and the fact that I don't want to mess with the website seperately hosted website(example.ca), Should I go with a split-brain DNS, use a subdomain, or get another registered domain (like example.me) for internal purposes?
Also,How should I configure the MX records?
(please answer in detail because I'm a real noob when it comes to DNS)
2.Do I need to ask my ISP to correct reverse DNS records for my static IP address? Is that at all needed for running a mail server?
3.What is the current status regarding SLS support for Windows 7 users? I saw a number of topics filled with people complaining that windows 7 users are unable to easily login to SLS. Is that problem still unresolved?
4. At what stage during setup do I need to add the SSL certificate? How do I get the mail server to use the certificate for encrypting connection to outside users?
5. Aside from VPN, what options do I have to provide access to the mail server for outside users? What ports do I need to open on my router's firewall(25,...?)
6.What is the current status of Mozzila thunderbird + Lightening plugin on windows? Is it stable and compatible enough with mail, ical and addressbook servers? Are there any other hassle-free options availabe
7.Do I need to leave NAT enabled on my router?
8.Should I turn off the SLS's built-in firewall to avoid having to open ports on two firewalls(h/w and s/w)?
Sorry if it's a lot to read!
Thanks,

Answer 1

Camelot wrote:
Lots of issues here, I'll try to cover then.
Let's start with:
1. 1st IP(dynamic) :an spare wireless router for my private home network >>> home clients
2. 2nd IP(static) : an 8 port business router for my office network with DHCP enabled >>> mac mini server and 4 other clients
That's fine, conceptually - giving you two LANs, one for home and one for work. However, I'm unsure of the 'dynamic' nature of the home IP address. I'm not aware of any ISP that would give both static and dynamic addresses over the same link. It could happen, but I think it more likely that the ISP gave you a small block of IP addresses (e.g. 4 or 8 addresses) one of which you'll use for your office and the other from home.
That doesn't really make a lot of difference, other than the fact the home network's public IP is likely to be static, not dynamic.
1.What DNS configuration do you think I should use? Considering the mail setup I want to use, and the fact that I don't want to mess with the website seperately hosted website(example.ca), Should I go with a split-brain DNS, use a subdomain, or get another registered domain (like example.me) for internal purposes?
You can't configure split DNS with Server Admin, so if that's what you want you'll have to get under the hood.
However, given the small number of clients involved I'd just go with private, internal DNS for your network clients. That doesn't preclude using an external web host.
Also,How should I configure the MX records?
That's a little trickier since you want mail to go upstream (to your host) and then suck it back down to your server. The real question is whether you want that to happen for internal clients, too - if Joe on your network is sending a message to Bob, does that message need to go through your web host or not?
If not then setup the mail server to be authoritative for your domain and point your internal DNS's MX record to your server.
Leave the MX record in your public DNS pointing to your web host - that way mail from external users will go to your web host (at least for now), but mail sent internally will go direct to the user.
In other words, for now, don't change anything on your public DNS. Just setup your own private DNS server that's only used by your internal hosts. That way you don't impact your public traffic while you're tuning this.
2.Do I need to ask my ISP to correct reverse DNS records for my static IP address? Is that at all needed for running a mail server?
Is that all you need? No. LOL
But it is an important requirement.
3.What is the current status regarding SLS support for Windows 7 users? I saw a number of topics filled with people complaining that windows 7 users are unable to easily login to SLS. Is that problem still unresolved?
I have no idea. I don't have any Windows clients on my network.
4. At what stage during setup do I need to add the SSL certificate? How do I get the mail server to use the certificate for encrypting connection to outside users?
OK, this one worries me a little since you say you have already the SSL certificate. How did you do that?
To obtain a SSL certificate you need to generate a CSR - Certificate Signing Request - from your server that you send to a Certificate Authority. This CSR contains details about your domain/hostname and is verified by the certificate authority - a critical element in the chain of trust.
If you don't yet have your server setup, you can't generate the CSR, so you can't obtain a certificate.
So what did you do?
Normally the process is to use Server Admin to generate a CSR for your server once it's up and running. You then send the CSR to the CA who return a SSL certificate. You install that cert via Server Admin, and all the services (such as mail and web) offer that cert as an option for encryption.
5. Aside from VPN, what options do I have to provide access to the mail server for outside users? What ports do I need to open on my router's firewall(25,...?)
If all your mail clients are internal, that's all you need (to allow incoming mail). All LAN clients talk to the server directly and don't go through your firewall.
6.What is the current status of Mozzila thunderbird + Lightening plugin on windows? Is it stable and compatible enough with mail, ical and addressbook servers? Are there any other hassle-free options availabe
See #3 above
7.Do I need to leave NAT enabled on my router?
Unless you have enough static IP addresses for every machine in your network, yes. Even if you do have enough, I'd usually recommend using it anyway.
8.Should I turn off the SLS's built-in firewall to avoid having to open ports on two firewalls(h/w and s/w)?
Personal choice, but I do.
1. The ISP actually offers only 5 dynamic IPs on my service. However, it gives the option of buying a static IP seperately. and that's what I did.
2. Can you go into a little more detail about the internal DNS configuratio? This is the part I really have problems with.
3. it's really not that important to me that the emails users send internally stay within the network or travel back and forth to the host server. We don't really have that much internal communications. What I really don't understand is how i am going to send emails (from a local email account) to the outside, while there is no reference to my host's mail server in my configuration.
4. I kinda jumped ahead a little bit when I was talking about the SSL certificate. I was actually in the process of buying it without knowing that I need to setup my server first.
5. Actually , I REALLY need the ability to access my mail outside my LAN (I travel a lot), and I prefer to avoid VPN because connecting to VPN that often is a inconvinient.
6.Do you also recommend putting the mac mini behind a router, or prefer the simplicity using it as a gateway brings?
Thanks a lot for the thoughtful answer.