Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.

learn more… | top users | synonyms

3
votes
2answers
229 views

Importance of ha.cf file in a heartbeat/pacemaker environment?

I'm having a few issues trying to understand ha.cf and how the cluster picks up on updates. For example, when creating a new cluster, I usually: Set some default options in ha.cf on node 1 - node x ...
1
vote
1answer
211 views

Reusable piece of code in Chef to be used several times in recipe(s)

I need to reuse some scenario in my cookbooks - create several users on a single machine and install same software for each of them. Installing the software is a repeating operation which I'd like to ...
0
votes
0answers
20 views

Need advice on IIS (7.5/8) for web service for querying AD

In order to standardize how our internal web application talk to AD, we are creating a web service that applications can call. Our AD requires user authentication to query, so this also prevents ...
12
votes
5answers
18k views

A secure, standard iptables rule-set for a basic HTTP(s) webserver

I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only ...
1
vote
1answer
1k views

Nginx & long poll: Best practices to reduce memory and bandwidth footprint

I use nginx in this mode for BOSH and chat clients along with gzip. location ~* /http-bind/ { proxy_buffering off; keepalive_timeout 55; access_log off; tcp_nodelay on; ...
6
votes
4answers
419 views

powershell vs GPO for installation, configuration, maintenance

My question is about using powershell scripts to install, configure, update and maintain Windows 7 Pro/Ent workstations in a 2008R2 domain, versus using GPO/ADMX/msi. Here's the situation: Because ...
1
vote
2answers
220 views

How to go about rotating logs which are arbitrary named and placed in deeply nested directories?

I have a couple of hosts which are basically a playground for developers. On these hosts, each of them has a directory under /tmp where he is free to do all he wants - store files, write logs etc. Of ...
5
votes
1answer
188 views

BPA for AD Server 2008 and 2008 R2 DCs W32Time setting complaint

I have been going through some of the warnings raised by BPA against our DCs to make sure everything is as it should be. Everything has been going well until I got to the following warnings: The ...
1
vote
1answer
226 views

Video hosting: Host files on web server, storage server, NAS? [duplicate]

I inherited responsibility for the back-end of a growing distance education program. They have a Proliant DL160 Gen8 web server which serves video from a ReadyNAS Pro 6. We currently share the ...
2
votes
1answer
102 views

Structuring an OU to properly model an Organizational Hierarchy

I'm experimenting with using OUs in my network's Active Directory and group policy. However, I'm having a little trouble figuring out the right way to structure my OUs so that I can have individual ...
2
votes
0answers
20 views

Domain Controller's DNS NIC configuration [duplicate]

I've seen conflicting information on this online, but say you have an environment with two domain controllers: one Forest, one Site, one Domain; simple as it gets. How should each domain controller's ...
2
votes
1answer
148 views

Seeking alternative to storing binaries in git for devops

I'm not sure how to ask this best practices question since I know many StackExchange users evidently think best practices are a bad thing ... We've got Salt and Vagrant configured to stand up servers ...
3
votes
1answer
222 views

Synchronizing RODCs to NTP servers?

I've read this nice article from Gareth Hooper regarding Domain Controller syncing to external time sources. In essence, he wrote that although Microsoft don't actually condone the practice, it's a ...
0
votes
1answer
82 views

Best practice to migrate Server 2003 x64 to Server 2008 x64

We have 2 Domain Controllers running Windows Server 2003 R2 x64. DC1 has the FSMO roles and DC2 acts as a 'secondary' DC. Both are Global Catalog servers. DC1 has these roles installed: Domain ...
6
votes
1answer
106 views

When should an org invest in a private infrastructure as opposed to a partially or fully hosted solution? [duplicate]

Not referring to militaries or governments, but for other organizations or shops that needs an IT infrastructure (who doesn't nowadays). Similar to this question, but purely in regard to hardware ...
29
votes
7answers
7k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
1
vote
5answers
240 views

Windows network shares organization

I would like to have some feedback about the best practices you use to publish your network share. Now, we have on our file server : one named directory for each of our user, which is backed up ...
4
votes
3answers
325 views

Keeping Track of Enterprise Desktops [closed]

Part of my job is to make sure that for computers in a specific OU, whats Actually in use = whats listed in AD = whats listed in SCCM. This is for an environment with 250k PCs, but i specifically ...
11
votes
4answers
35k views

Best Practice: vCPUs per physical core

I am trying to find some documentation or best practice guides for virtualization with respect to provisioning vCPUs per physical core (of a CPU). If it matters, I am looking at vmWare for the ...
3
votes
3answers
320 views

How much failover redundancy is enough? [closed]

I'm working on a client-server system where all clients currently submit their transactions to essentially a single west-coast IP address to reach what is called the "gateway" application. The ...
16
votes
3answers
5k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an ...
7
votes
5answers
2k views

Nagios server best practices?

I run a medium-sized Nagios server. It monitors roughly 40 servers with 180 services currently and is only growing by the day. I migrated from an old Nagios setup that was configured in a very ...
2
votes
3answers
99 views

Is a dashed hostname preferrable to creating subdomains for an application and its environments?

I am working to standardize our DNS names for our various applications, and I proposed the following scheme: webappname.environment.system.company.tld So, my application named BackOffice in my ...
0
votes
1answer
2k views

IIS 7.5 webfarm setup best practices

I am looking to rebuild the current webfarm setup where I work. Currently we have 4 regions. Each region has 3 WFE's on a ViP. Each of the three has a separate implementation of IIS 7.5 and ...
2
votes
1answer
69 views

Is it best practice to have mail sent from the root domain when the service is accessed via a subdomain name?

Running an outward facing server for contractors who's hostname is sub.example.com. The service needs to send mail to the contractors for various reasons (new projects, login details, etc). I have no ...
1
vote
1answer
443 views

Why is PHP open_basedir not considered a security model

On servers doing shared web hosting, or sharing the PHP environment between different PHP applications, I usually implement a security policy that uses PHP open_basedir to restrict each user to ...
1
vote
1answer
197 views

Pre-Staging Computer Accounts

I hear that you can create the computer account in AD before you join the computer to the domain so that the computer immediately gets the right groups and such. I created the account by running ...
3
votes
2answers
114 views

Should i put all my servers into my domain?

I am setting up a lab/mock-up network and i'm wondering if is considered bad practice to add all my servers to my Windows Domain. Of course the DC must be part of the domain, and any server that users ...
0
votes
2answers
56 views

where to put core services in two-node cluster

I'm currently configuring two-node HA cluster based on CentOS with DRBD. Most services are packed in virtual machines with migration available. I have not made decision where to put some core ...
1
vote
2answers
75 views

RAIDs with a lot of spindles - how to safely put to use the “wasted” space

I have a fairly large number of RAID arrays (server controllers as well as midrange SAN storage) that all suffer from the same problem: barely enough spindles to keep the peak I/O performance, and ...
16
votes
8answers
1k views

Best practices for backup checking?

It is a common situation, when administrator makes system for automatic backuping and forgets it. Only after a system fails administrator notices, that backup system has broken before or backups are ...
-1
votes
1answer
71 views

Best practice for setting up a small fileserver for my group? [closed]

My R&D group are setting up our network and development environment. We have a dedicated 'kitchen sink' server machine, running Using Kubuntu 12.04 LTS as the distribution. which is going to run ...
0
votes
1answer
457 views

AWS Elastic IP vs. VPC Usage Recommendations: Suggestions?

I'm working on creating a suite of self-training exercises and guides (perhaps eventually a collection of videos or Slideshare presentations) covering a range of systems administration and "ops" ...
2
votes
2answers
181 views

Can a Windows Server CA separate code-signing keys from keys for other purposes?

I am a software developer. My team encrypts the sensitive sections of our ASP.NET web.config files. aspnet_regiis.exe is used to manage the local key store, encrypt and decrypt. I want to build a ...
0
votes
1answer
80 views

Consequences of exposing VM storage on same subnet as VM's and hypervisor

I recently purchased a RAID array to store my VM's and segregate the storage from the host machine. Since my needs are pretty simple I've configured the VM's to bridge with the host network (I think ...
-3
votes
2answers
248 views

RAID 10, 3 drives or 2 drives?

Drives are very cheap these days. Would it be worth it to increase the group size from 2 to 3. I found 1TB drives for $60. I feel as if the array is very vulnerable to failure in a 2 group setup ...
7
votes
2answers
3k views

Best strategy to keep chef cookbooks versions under control

I'm looking for ideas about chef cookbooks versions management. I know that you pin specific versions in the environment, but I'm not sure how to go about it. We use librarian-chef which installs 3rd ...
0
votes
2answers
528 views

Network design vm virtualization in small office [closed]

I just recently bought a 16gb ram, Intel i7 quad core Mac mini to be used as the central point of entry to my network and am looking for advice on how to design a network suitable for a small office. ...
1
vote
2answers
62 views

Should I change root password

I manage about 50 servers mostly by remote access using ssh on a custom port (root login disabled and users need a public/private key to log in, password login are disabled). each servers have a ...
10
votes
3answers
595 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
1
vote
1answer
674 views

Minimum level of access required for service account to run a scheduled task on server?

We have 2 domain administrator accounts in Active Directory: "Administrator" and "Robocopy". Robocopy is a service account associated with a scheduled task which executes a batch file- which runs ...
3
votes
1answer
379 views

Current Best Practice for using AD to auth Linux (2013)

As far as I'm aware, there are 3 (common) ways to use Active Directory as the Authentication and Authorization for Linux hosts: LDAP Kerberos Samba/Winbind Is there a (current) consensus on which ...
1
vote
3answers
61 views

Using drivers not supplied by server motherboard manufacturer

Is it considered bad practice/risky to use drivers for servers not provided by the motherboard manufacturer? My on board NIC drivers supplied by the manufacturer of my motherboard were released in ...
3
votes
2answers
217 views

What are best practices for creating a system account? (*NIX)

I've manually installed a service called Gate One into /opt. I want to harden its security, so I thought I'd create a system account for it to use, because of least necessary privileges, and all that. ...
2
votes
1answer
494 views

Default NTFS permissions for shared folders

I'm looking for best practices around share files and there NTFS permissions. I'm upgrading servers from SBS 2003 to Server 2012 Standard and thought this would be a good opportunity to do our ...
1
vote
0answers
198 views

Enable shadow copy where VHD files are stored?

Should I enable Shadow Copy on the volume that stores our Hyper-V VHDs? This same volume also has all our file shares, which is why I want to turn on shadow copy. If I do enable it, will it eat up ...
1
vote
2answers
6k views

Enabling Receive Side Scaling & IPsec Task Offload v2 on a Network Adapter

Running the Best Practice Analyzer on a Windows Server 2012 RTM (this virtual server runs on a hyper-v host), I receive two configuration warnings. Enable Receive Side Scaling (RSS) on a network ...
1
vote
1answer
58 views

Install Apache from Source or from Binary?

I work on a platform which serves several different projects. For the most part, all of the projects install their web server using Red Hat's RPM. We never created a policy for this which would ...
-2
votes
2answers
84 views

how to limit directory size without quota (vserver)? [closed]

Hope the question is not too general. As I have a vserver (Ubuntu 12.04) I cannot restrict the size of directories by using quotas. I wonder if there are other possibilities to achieve this. The only ...
1
vote
1answer
1k views

what would be a better practice instead of chmod g+r /etc/shadow so I can use Unix user/group database for Jenkins authentication?

I don't want to run Jenkins as root, nor giving public access (or even group access) to /etc/shadow seems to a good idea. as suggested by "Manage Jenkins" when selecting Linux user/group database: ...