The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
2answers
111 views

Should i put all my servers into my domain?

I am setting up a lab/mock-up network and i'm wondering if is considered bad practice to add all my servers to my Windows Domain. Of course the DC must be part of the domain, and any server that users ...
0
votes
2answers
53 views

where to put core services in two-node cluster

I'm currently configuring two-node HA cluster based on CentOS with DRBD. Most services are packed in virtual machines with migration available. I have not made decision where to put some core ...
1
vote
2answers
73 views

RAIDs with a lot of spindles - how to safely put to use the “wasted” space

I have a fairly large number of RAID arrays (server controllers as well as midrange SAN storage) that all suffer from the same problem: barely enough spindles to keep the peak I/O performance, and ...
16
votes
8answers
1k views

Best practices for backup checking?

It is a common situation, when administrator makes system for automatic backuping and forgets it. Only after a system fails administrator notices, that backup system has broken before or backups are ...
-1
votes
1answer
71 views

Best practice for setting up a small fileserver for my group? [closed]

My R&D group are setting up our network and development environment. We have a dedicated 'kitchen sink' server machine, running Using Kubuntu 12.04 LTS as the distribution. which is going to run ...
0
votes
1answer
358 views

AWS Elastic IP vs. VPC Usage Recommendations: Suggestions?

I'm working on creating a suite of self-training exercises and guides (perhaps eventually a collection of videos or Slideshare presentations) covering a range of systems administration and "ops" ...
2
votes
2answers
131 views

Can a Windows Server CA separate code-signing keys from keys for other purposes?

I am a software developer. My team encrypts the sensitive sections of our ASP.NET web.config files. aspnet_regiis.exe is used to manage the local key store, encrypt and decrypt. I want to build a ...
0
votes
1answer
75 views

Consequences of exposing VM storage on same subnet as VM's and hypervisor

I recently purchased a RAID array to store my VM's and segregate the storage from the host machine. Since my needs are pretty simple I've configured the VM's to bridge with the host network (I think ...
-3
votes
2answers
189 views

RAID 10, 3 drives or 2 drives?

Drives are very cheap these days. Would it be worth it to increase the group size from 2 to 3. I found 1TB drives for $60. I feel as if the array is very vulnerable to failure in a 2 group setup ...
7
votes
2answers
2k views

Best strategy to keep chef cookbooks versions under control

I'm looking for ideas about chef cookbooks versions management. I know that you pin specific versions in the environment, but I'm not sure how to go about it. We use librarian-chef which installs 3rd ...
0
votes
2answers
436 views

Network design vm virtualization in small office [closed]

I just recently bought a 16gb ram, Intel i7 quad core Mac mini to be used as the central point of entry to my network and am looking for advice on how to design a network suitable for a small office. ...
1
vote
2answers
58 views

Should I change root password

I manage about 50 servers mostly by remote access using ssh on a custom port (root login disabled and users need a public/private key to log in, password login are disabled). each servers have a ...
10
votes
3answers
554 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
1
vote
1answer
443 views

Minimum level of access required for service account to run a scheduled task on server?

We have 2 domain administrator accounts in Active Directory: "Administrator" and "Robocopy". Robocopy is a service account associated with a scheduled task which executes a batch file- which runs ...
3
votes
1answer
312 views

Current Best Practice for using AD to auth Linux (2013)

As far as I'm aware, there are 3 (common) ways to use Active Directory as the Authentication and Authorization for Linux hosts: LDAP Kerberos Samba/Winbind Is there a (current) consensus on which ...
1
vote
3answers
60 views

Using drivers not supplied by server motherboard manufacturer

Is it considered bad practice/risky to use drivers for servers not provided by the motherboard manufacturer? My on board NIC drivers supplied by the manufacturer of my motherboard were released in ...
3
votes
2answers
210 views

What are best practices for creating a system account? (*NIX)

I've manually installed a service called Gate One into /opt. I want to harden its security, so I thought I'd create a system account for it to use, because of least necessary privileges, and all that. ...
2
votes
1answer
435 views

Default NTFS permissions for shared folders

I'm looking for best practices around share files and there NTFS permissions. I'm upgrading servers from SBS 2003 to Server 2012 Standard and thought this would be a good opportunity to do our ...
1
vote
0answers
156 views

Enable shadow copy where VHD files are stored?

Should I enable Shadow Copy on the volume that stores our Hyper-V VHDs? This same volume also has all our file shares, which is why I want to turn on shadow copy. If I do enable it, will it eat up ...
1
vote
2answers
4k views

Enabling Receive Side Scaling & IPsec Task Offload v2 on a Network Adapter

Running the Best Practice Analyzer on a Windows Server 2012 RTM (this virtual server runs on a hyper-v host), I receive two configuration warnings. Enable Receive Side Scaling (RSS) on a network ...
1
vote
1answer
56 views

Install Apache from Source or from Binary?

I work on a platform which serves several different projects. For the most part, all of the projects install their web server using Red Hat's RPM. We never created a policy for this which would ...
-2
votes
2answers
75 views

how to limit directory size without quota (vserver)? [closed]

Hope the question is not too general. As I have a vserver (Ubuntu 12.04) I cannot restrict the size of directories by using quotas. I wonder if there are other possibilities to achieve this. The only ...
1
vote
1answer
704 views

what would be a better practice instead of chmod g+r /etc/shadow so I can use Unix user/group database for Jenkins authentication?

I don't want to run Jenkins as root, nor giving public access (or even group access) to /etc/shadow seems to a good idea. as suggested by "Manage Jenkins" when selecting Linux user/group database: ...
-4
votes
3answers
72 views

How to debug and prevent flaky unreliable IT environment? [closed]

I am not an IT admin, I'm a software developer (microsoft stack) and I'm trying to understand what is wrong with the IT environment of one of our customers. We have deployed our client\server ...
1
vote
3answers
306 views

ESXi running 2 x Windows 2012 setup advice

After much deliberating and advice I'm intending to use an element of virtualisation for deploying some new servers. The original (physical) plan was one server running as domain controller, SQL ...
0
votes
1answer
261 views

Integrity checking vs. audit

In RHEL5 Security Guide using of AIDE for checking software integrity is recomended. And also built-in RPM integrity checking functionality. But frequent checking can be resource demanding and rare ...
8
votes
1answer
2k views

Server room wiring questions

I'm looking at rewiring our server room to be more presentable, organized, and easier to troubleshooting. Right now we currently have 4 HP racks (don't know the model right now). We do not have a ...
25
votes
10answers
1k views

Why shouldn't you let developers near root passwords? [duplicate]

I just came across Something is burning in the server room; how can I quickly identify what it is?. In the comments I found the following quote: you don't let a developer anywhere near your root ...
1
vote
1answer
234 views

When moving a server from behind a firewall into a DMZ, should you move a test server first? [closed]

We have to move a server from within the firewall to a DMZ (not a true DMZ, but a space that's between 2 firewalls. Is it typically a good idea, when moving a server in this fashion, to stand up ...
4
votes
4answers
7k views

How can I investigate sustained high CPU usage by Microsoft.Exchange.Rpc.ClientAccess.Service.exe?

One CAS server in our array has nearly 90% of its 4 CPUs used. The remaining CAS servers are at 30 percent. How should I investigate what is causing this increase? Below is a graph of: Six ...
2
votes
1answer
2k views

Active Directory Domain Controller in Multiple Sites - Server 2012

So I'm not used to setting up DCs in multiple subnets/locations, I was hoping to get some guidance. I'm just messing with virtual servers at the time being. DC1 = Apollo DC2 = Cronos Pre-AD Config ...
0
votes
2answers
588 views

remote access/vpn to windows server 2012 production server best practice

I' need to access my production environment from remote ,outside the lan for emergency. I don't want users are prompted for remote desktop credencials and try to guess username and password. So what ...
0
votes
1answer
159 views

Best Practices Analyzer for Microsoft Dynamics AX 2009

We recently uncovered a potential issue with our Dynamics AX setup whereby Receive Side Scaling (RSS) was not enabled on our AOS servers, which we believe is limiting their performance (currently ...
0
votes
1answer
254 views

Cisco ASA 8.4+ redirect multiple ports - best practice?

I was wondering whether anyone could advice on best practices as to the best way to redirect multiple ports for single host in the internal network. As I understand this you can only nat a single ...
0
votes
1answer
389 views

DNS Server 2008 R2 from 2003 - Stand Alone -

We have just implemented two new windows 2008 r2 stand alone servers running dns and they took the place of our old 2003 stand alone servers. Is there residual clean up that would need to be done on ...
10
votes
2answers
369 views

Outlook Email Abuse - Guide for email etiquette?

I've spent a lot of time performing mail migrations for companies that either had very little IT focus, or no fulltime staff to handle common issues. As a result, policies governing email use and ...
1
vote
1answer
63 views

best practice renaming ssh login server [closed]

quick question: let's say you have a ssh login computer called sshlogin.example.com. Now for some obscure reason, your company decided to rename that machine to ssh.example.com. What's the best ...
4
votes
3answers
119 views

What protocol should be followed if website is actively under attack?

When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there ...
1
vote
2answers
188 views

Is there a reason I shouldn't use iptables port forwarding?

I have a small application running on port 8888, and as a quick fix to remove the need to append the url with the port, I used the iptables program to forward all requests to port 80 to 8888. sudo ...
1
vote
5answers
513 views

Best Practices for Open Relay Email Server

I have a scenario where I need to setup postfix with no TLS, no SMTP authentication, and open relay allowing from only one remote IP address. Emails from this remote IP may have spoofed "from" address ...
0
votes
1answer
98 views

Is it a good practice use LDAP for auth in a public webapp beside the app DB?

Internet app needs to be really secure. So LDAP for auth got into the game. Instead doing the traditional db with users table, we want to authenticate agains a LDAP server. How good/bad you think it ...
0
votes
2answers
98 views

NginX installation-source best practice

I'd like to install NginX as a reverse proxy on CentOS. I know three different ways to install NginX: Compile itself Install over EPEL Install over official NginX package repository Which way ...
-1
votes
1answer
56 views

Disabling/hiding rather than deleting [closed]

From what I understand, it's generally best practice to design a system with user access to delete "records" to only hide/disable that record and not actually delete it. This typically ends up being ...
7
votes
2answers
1k views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
1
vote
1answer
91 views

Avoiding sudo to root with an alias, is it possible? [closed]

I've developed a bad habit of constantly sudoing to root. I was wondering if its possible to create an alias that prevents straight sudo but allows sudo -u. Or possibly echoes a warning when using ...
1
vote
1answer
113 views

Best practices for IPv4/IPv6 hosts in DNS zones?

I've got a VPS with IPv4 and IPv6 addresses, and I'd like to use them both for my website and other services I might use. I've added a "www" register both with "A" and "AAAA", and I've done the same ...
2
votes
1answer
441 views

Is there a good reason to change session.save_path?

On shared hosting, we had occasional problems when the server's /tmp directory was full. Our hosting company suggested we change the session save path to be unique for each site. ...
3
votes
2answers
119 views

One active directory server for one geographical site?

we have an 2008 R2 active directory server on our main site. Recently we opened a small secondary site. My question is pretty simple : our 2 sites are connected with a VPN, is it mandatory for us to ...
4
votes
1answer
273 views

Using Public IP addresses for Private Network

I have a network that uses the 192.192.192.x network address for their private network. It looks like publicly those are IP addresses that are assigned in Taiwan. I don't think they do too much ...
13
votes
4answers
4k views

In Puppet, how would I secure a password variable (in this case a MySQL password)?

I am using Puppet to provision MySQL with a parameterised class: class mysql::server( $password ) { package { 'mysql-server': ensure => installed } package { 'mysql': ensure => ...