Baza znanja

AlmaLinux + cPanel VPS / Dedicated Server – Onboarding, Security & Responsibility Guide (v4)

This guide provides complete onboarding, deployment direction, security hardening, DNS setup, WHM configuration, Malaysian compliance requirements, and responsibility breakdown for all AlmaLinux + cPanel VPS and Dedicated Servers hosted with iCoreHosting.

Table of Contents

1. Service Direction & Deployment Planning
2. Server Overview & Initial Preparation
3. Login & Access Information
4. Network Configuration
5. Nameservers & DNS Setup
6. cPanel Account & WHM Basics
7. Security Baseline
8. Local Government Rules Reminder
9. Software & System Updates
10. Domain, DNS & Email Configuration
11. Web Server, PHP & Database (MySQL/MariaDB)
12. Backup Policy
13. Sub-Hosting / Reseller Responsibilities
14. Monitoring & Logs
15. Performance Optimization
16. Advanced Security & Hardening
17. Inodes & File Usage
18. Common Misconfigurations
19. Responsibility Breakdown
20. Support Information

1. Service Direction & Deployment Planning

Before configuring your server, it is important to determine the correct hosting direction. This ensures system stability, security, performance, and compliance with legal requirements. Proper planning also avoids future migration issues, resource overload, or service interruptions.

1.1 Common Deployment Use Cases

• Multiple website hosting / shared hosting environment
• Corporate website hosting
• eCommerce platforms (WooCommerce, Magento, Opencart)
• Web applications (Laravel, Node.js reverse proxy, SaaS)
• Email hosting for companies
• Development or staging environments
• Reseller or sub-hosting services

1.2 Planning Considerations

• Expected traffic and resource consumption
• Number of cPanel accounts required
• Security level required for customer data
• Backup strategy (local + off-site)
• Email deliverability requirements (SPF, DKIM, DMARC, PTR)
• Compliance with PDPA 2010, CMA 1998, and Malaysian regulations

1.3 When to Use cPanel

• You need a stable, proven hosting control panel
• You manage multiple customer accounts
• You host WordPress, corporate, or business websites
• You require professional email hosting
• You provide sub-hosting or reseller services

If you are unsure about which configuration suits your deployment, consult iCoreHosting support for architecture guidance.

2. Server Overview & Initial Preparation

Your server is running AlmaLinux with cPanel/WHM. This setup is optimized for stability and long-term performance. Before any configuration, verify these items from your welcome email:

• Server IP address(es)
• Root SSH login credentials
• WHM login URL
• Hostname assigned to your server
• Nameserver details or custom NS plan

Initial Recommended Tasks

• Log in to WHM immediately to check update status
• Change root password
• Update to latest kernel
• Verify network settings
• Set correct timezone (Asia/Kuala_Lumpur)

3. Login & Access Information

WHM Login (Admin Panel)

https://YOUR-SERVER-IP:2087

SSH Login

ssh root@YOUR-SERVER-IP

Recommended Access Security

• Enable SSH key-based login
• Disable SSH password login after setup
• Change SSH port for additional security
• Allow only admin IPs to access WHM if possible
• Enable 2FA for WHM & cPanel users

4. Network Configuration

Your server includes static IPv4 (and optional IPv6) addresses. Network configurations on AlmaLinux are found in:

/etc/sysconfig/network-scripts/

Useful Network Commands

ip addr
ip route
ping
mtr
dig
nslookup
ss -tulpn

Ensure outbound port 53 DNS, ports 80/443, and SMTP ports are functioning properly.

5. Nameservers & DNS Setup

Recommended – iCoreHosting Nameservers

nscp1.icorehosting.com
nscp2.icorehosting.com

Using iCoreHosting’s nameservers ensures best compatibility, fastest updates, and fewer DNS-related issues.

Custom Nameservers (ns1.yourdomain.com)

• Register Glue Records at domain registrar
• Set NS in WHM → Basic WebHost Manager Setup
• Assign IPs for ns1 and ns2

Required DNS Records

• A Records for website hosting
• MX, SPF, DKIM, DMARC for email
• PTR (Reverse DNS) request from support

6. cPanel Account & WHM Basics

WHM manages the server. cPanel manages individual domains. After installation, configure:

• Basic WebHost Manager Setup
• Tweak Settings
• EasyApache 4 for PHP & Apache
• Service Manager
• Backup Configuration
• Exim Mail Server Manager

Recommended Hostname Format

server1.yourdomain.com

Segmentation Advice

• Each website → separate cPanel account
• Each customer → separate cPanel account
• Never mix multiple client sites into one account

7. Security Baseline

Security is mandatory. The following steps must be completed immediately after server deployment.

SSH Hardening

• Enable SSH key login
• Disable password access
• Change SSH port
• Enable cPHulk or Fail2Ban

cPanel Security Features

• Enable 2FA for WHM & cPanel
• Enable ModSecurity (OWASP rules)
• Install CSF Firewall
• Enable Brute Force Protection

Malware Protection Options

• ClamAV Scanner
• ImunifyAV / Imunify360 (recommended)

8. Local Government Rules Reminder

All servers must comply with Malaysian laws. The customer is fully responsible for all content and activity.

Applicable Acts

• Communications and Multimedia Act 1998 (CMA)
• Computer Crimes Act 1997
• Personal Data Protection Act (PDPA) 2010
• Copyright Act Malaysia

Prohibited Uses

• VPN/Proxy/Tunneling without written approval
• Phishing, malware, scanning, botnets
• Spam or bulk unsolicited email
• Illegal streaming or copyrighted downloads
• Fraud, gambling, or abusive activities

9. Software & System Updates

AlmaLinux uses the DNF package manager. Your server must stay updated to ensure security, stability, and compatibility with cPanel. The operating system, kernel, and cPanel itself should be updated regularly.

9.1 Update Operating System

dnf update -y

9.2 Updating cPanel

WHM → Upgrade to Latest Version

• cPanel updates automatically by default
• Security patches are applied automatically
• KernelCare (optional) provides rebootless kernel patching

9.3 Update PHP, Apache, and PHP Extensions

WHM → EasyApache 4

• Install new PHP versions
• Enable required PHP extensions
• Compile Apache and related modules
• Ensure deprecated extensions are removed

10. Domain, DNS & Email Configuration

Correct DNS and email configuration is essential for website and email stability. The following items must be configured for each domain.

10.1 DNS Records Required

• A Records: Domain & WWW → Server IP
• MX Record: Points to your mail server
• SPF: Authorizes sending servers
• DKIM: Enables cryptographic signing
• DMARC: Protects domain reputation
• PTR: Server reverse DNS request via support

10.2 Email Ports

• IMAP SSL – 993
• POP3 SSL – 995
• SMTP SSL – 465
• SMTP TLS – 587

10.3 Improving Email Deliverability

• Enable DKIM & SPF in cPanel
• Enable DMARC enforcement
• Match hostname with PTR record
• Use reputable SMTP relay when needed

Recommended SMTP Providers: Amazon SES, Mailjet, SendGrid, Mailgun

11. Web Server, PHP & Database

11.1 Web Server

• Apache (default)
• NGINX Reverse Proxy (optional)
• LiteSpeed Enterprise (optional license)

11.2 PHP Configuration

WHM → MultiPHP Manager

• Assign PHP version per domain
• Use MultiPHP INI Editor to adjust limits
• Recommended minimum:
  • memory_limit: 512M
  • max_execution_time: 300
  • upload_max_filesize: 256M

11.3 Database (MySQL/MariaDB)

• Upgrade versions using WHM
• Manage databases via phpMyAdmin
• Enable slow query logs for optimization
• Use InnoDB for better performance

12. Backup Policy

Backups are critical for server recovery. cPanel provides a built-in backup system, but backups are NOT included unless you have purchased a backup add-on plan.

12.1 iCoreHosting Backup Scope

• Backups only included if ordered separately
• Retention depends on purchased plan
• Automatic cPanel backups must be configured manually
• Restoration requests require a support ticket

12.2 Customer Responsibilities

• You must maintain off-site backups
• You must verify backup integrity regularly
• Avoid storing backup archives on the same server
• Schedule backups to external storage (S3, FTP, Google Drive)

12.3 Recommended Backup Methods

• WHM → Backup Configuration
• Incremental or Compressed backups
• Remote backup destinations:
  • Amazon S3
  • Wasabi
  • Backblaze B2
  • SFTP storage
  • Google Drive

13. Sub-Hosting / Reseller Responsibilities

If you use your server to host clients (sub-accounts), you are fully responsible for all downstream activity. Misuse by sub-clients is treated as misuse by the server owner.

13.1 Compliance Responsibility

• You must ensure all sub-clients follow Malaysian laws
• You must enforce iCoreHosting AUP
• All illegal content or activity from sub-clients is your responsibility

13.2 Resource Abuse

• Overselling CPU, RAM, or IO may trigger suspension
• High inode usage affects entire server performance
• Monitor account quotas and usage spikes

13.3 Security Enforcement

• Enforce strong passwords
• Ensure sub-client websites are updated
• Outdated plugins/themes can compromise the entire server

13.4 Email Sending Responsibility

• Spam from sub-clients affects your IP reputation
• Repeated spam can permanently blacklist your server
• You must configure outbound limits
• You must monitor mail queue for abuse

13.5 Abuse Action Policies

• iCoreHosting may suspend the offending sub-account
• For repeated abuse, full server suspension is possible
• You must cooperate immediately with abuse investigations

14. Monitoring & Logs

Monitoring ensures stability and helps detect problems early.

14.1 System Monitoring Tools

• top / htop — CPU & RAM usage
• vmstat — memory performance
• iostat — disk performance
• nload / iftop — network monitoring

14.2 Important Log Locations

• /usr/local/cpanel/logs/
• /var/log/messages
• /var/log/secure
• /var/log/exim_mainlog
• /var/log/httpd/

15. Performance Optimization

15.1 PHP & Web Server Optimization

• Enable OPcache
• Use PHP-FPM for high traffic sites
• Limit worker processes to prevent overload

15.2 Caching

• Enable Redis for dynamic websites
• Use LiteSpeed (optional) for faster TTFB
• Use Cloudflare CDN

15.3 Database Optimization

• Enable slow query logs
• Optimize InnoDB settings
• Remove unused indexes

16. Advanced Security & Hardening

Beyond the basic security foundations, advanced hardening is strongly recommended for production and client-hosting environments. Proper security configurations prevent hacking, malware infections, brute-force attacks, data breaches, and service disruptions.

16.1 Advanced WHM Security Tools

• ModSecurity (WAF): Enable OWASP or Comodo rulesets
• cPHulk: Protects WHM/cPanel/SSH from brute-force attacks
• Two-Factor Authentication (2FA): Mandatory for admins
• CageFS (CloudLinux): Contains each user inside a secure filesystem
• PHP-FPM Isolation: Separate pools for each domain

16.2 OS-Level Hardening

• Disable password SSH login
• Allow only specific admin IP addresses
• Install CSF Firewall and restrict inbound ports
• Disable unused services and ports
• Move SSH port to a non-standard port

16.3 Malware & Threat Protection

• ImunifyAV — malware scanner included
• Imunify360 — premium, best for resellers and shared hosting
• Email attachment scanning
• Automated quarantine functions

16.4 Web Application Security

• Enforce HTTPS via AutoSSL
• Enable HSTS (HTTP Strict Transport Security)
• Disable old TLS versions (TLS 1.0, 1.1)
• Monitor for suspicious PHP files (webshells)
• Disable dangerous PHP functions when possible

17. Inodes & File Usage

Each file on Linux consumes one inode. Even if disk space is available, inode exhaustion can break email, prevent file uploads, stop website operations, and cause backup failures.

17.1 Check Current Inode Usage

df -i

17.2 Common Causes of Inode Explosion

• Large email inboxes with thousands of old messages
• WordPress or Magento cache directories
• Session files in /tmp
• Excessive log files
• Backup archives stored inside user accounts

17.3 How to Reduce Inode Usage

• Enable auto-delete for email trash & spam folders
• Use caching plugins that auto-clear aged cache
• Clear logs under /home/USERNAME/logs/
• Store backups externally (not on the server)
• Regularly clean /tmp and session folders

18. Common Misconfigurations

Many server problems originate from simple configuration errors. Reviewing the list below can prevent most outages, performance issues, or email failures.

18.1 DNS Errors

• A record pointing to wrong IP
• MX record misconfigured
• Missing SPF, DKIM, or DMARC
• PTR mismatch with hostname

18.2 Email Issues

• Spam from sub-accounts damaging IP reputation
• SMTP ports blocked by firewall
• Mail queue full due to compromised accounts

18.3 PHP & Web Server Problems

• Mismatched PHP versions
• Insufficient memory_limit or max_execution_time
• PHP-FPM pools overloaded

18.4 Backup Failures

• Backups stored on the same server
• No remote backup configured
• Backup retention misconfigured
• Insufficient disk space

18.5 Security Misconfiguration

• SSH password login enabled
• Firewall not configured correctly
• ModSecurity disabled
• Unpatched CMS or plugins

19. Responsibility Breakdown

19.1 iCoreHosting Responsibilities

• Datacenter infrastructure — power, cooling, physical security
• Network connectivity and upstream routing
• Hardware replacement for dedicated servers
• Hypervisor uptime for VPS infrastructure
• IP allocation and network-level DDoS protection

19.2 Customer Responsibilities

• Server OS and cPanel updates
• Firewall, SSH security, and intrusion prevention
• Website and CMS updates (WordPress, Magento, Laravel)
• Email deliverability and spam control
• Backup retention and off-site backup management
• DNS record management
• Compliance with all Malaysian laws (CMA, PDPA, etc.)
• Sub-client activities and abuse control

19.3 Not Included by Default

• Website coding or debugging
• CMS or plugin troubleshooting
• Email marketing, newsletter, or bulk mail solutions
• Manual restoration of customer-deleted data
• Security cleanup for hacked websites (optional service)

20. Support Information

For assistance, billing inquiries, or server-related help, please contact:

• Support Portal: https://www.icore.com.my/support
• Billing Portal: https://billing.icore.com.my

Information Required in Support Tickets

• Server hostname or IP
• Domain name involved
• Accurate description of the issue
• Error message or screenshot
• Time the issue occurred
• Steps already taken to troubleshoot

iCoreHosting – AlmaLinux + cPanel VPS / Dedicated Server Onboarding Guide v4 (Final)