Questions tagged [best-practices]
Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.
353
questions
4
votes
1
answer
544
views
Best Practice Moving a Hard Drive from one VMWare ESX Guest to Another
When removing a hard disk from a VMWare ESX virtual machine running Windows, is it best practice to shut down the server first or is there a minimal risk (if the drive is not being written to at the ...
4
votes
2
answers
504
views
AD | Prevent admins from changing passwords to the same thing
I have an interesting security problem: Admins with ad access have been changing their password to the same thing, and breaching the company security policy.
User side, standard AD complicated ...
4
votes
1
answer
601
views
Should DirectAccess be deployed to all Windows clients that support it?
As our organization is slowly rolling out Windows 10, I made the observation of a DirectAccess GPO linked to the Windows 10 PCs OU (which contain internal desktops, laptops, and even VMs for VDI). ...
4
votes
3
answers
526
views
New Server hardware verification tests
Is there any kind of best practice when it comes to verifying the hardware of a new server, before putting it into production?
For instance, running it through the manufacturer's hardware test, or ...
4
votes
1
answer
2k
views
call binary from docker container inside another docker container?
What would be the way to load a certain binary from a certain container in docker from inside another container?
container 1: web
container 2: ffmpeg
I would want to call ffmpeg binary living in ...
4
votes
1
answer
2k
views
Acceptable level of hard write errors on tape?
What is an acceptable level of hard write errors on tape? Specifically, what is acceptable on HP LTO-2 media? Is it a hard number of errors, a ratio of hours in use to errors, or something else ...
4
votes
2
answers
313
views
On Windows 2003 Server as File Server what it is better creating groups by directory or by profile?
I have a file server with 20 shared folders one for each department and their emploees have write permission through a AD group with same name of that folder.
The thing is some people have to write ...
4
votes
1
answer
13k
views
Best Practice: iDRAC & NIC Selection
I am setting up a new Dell server with iDRAC 6 Express.
My options for the NIC are:
1) Shared
2) Shared with failover to LOM2
3) Shared with failover to all LOMs
The server has 4x LOMs.
My ...
4
votes
0
answers
2k
views
Docker + IPv6 - what is the best practice?
I want to build IPv6-ready services with Docker that can reach v6 hosts on the external network and can be reached from the external v6 network. I'm really confused with all that right now, so I want ...
4
votes
0
answers
326
views
What is the best practise to autostart unprivileged lxc containers on Ubuntu 14.04 64bit? [duplicate]
The current implementation of the LXC technology deals nicely with an issue of starting the privileged containers upon system start.. Users of the unprivileged containers (which arguably promise ...
3
votes
7
answers
732
views
DDOS Attack Victim - How much to Admit?
Here's the environment:
Website that hosts a forum/journal/bboard/email/socialmedia application in walled garden (ie you pay to get to use it or are invited to do so
Many Clients pay to use the site ...
3
votes
1
answer
247
views
AD IT Helper Permissions
My apologies if this has been asked before. If I knew the proper search terms then google would be more effective.
I would like to add a user that can join computers to the domain, Install software ...
3
votes
2
answers
3k
views
What are best practices for creating a system account? (*NIX)
I've manually installed a service called Gate One into /opt. I want to harden its security, so I thought I'd create a system account for it to use, because of least necessary privileges, and all that.
...
3
votes
2
answers
10k
views
How can I check access of a Group/User in AD before I delete it?
I'm cleaning up an inherited domain that is not well documented. How can I check that a particular group or user has no ACEs across the AD?
Things like searching DACL/SACL for AD objects and file ...
3
votes
3
answers
1k
views
How much failover redundancy is enough? [closed]
I'm working on a client-server system where all clients currently submit their transactions to essentially a single west-coast IP address to reach what is called the "gateway" application. The ...
3
votes
2
answers
684
views
Internal Network/Server Separation Best Practices
I have a block of 5 static IP's, and am going to be running a exchange and web server on-site. I am wondering if I should separate the web server IP, Mail IP, and internal network IP. What would the ...
3
votes
1
answer
1k
views
Current Best Practice for using AD to auth Linux (2013)
As far as I'm aware, there are 3 (common) ways to use Active Directory as the Authentication and Authorization for Linux hosts:
LDAP
Kerberos
Samba/Winbind
Is there a (current) consensus on which ...
3
votes
2
answers
12k
views
Using RAID1 vs. rsync pros and cons [closed]
I am building myself a Linux NAS/home server. I am considering either using sw RAID-1 (mdadm) to replicate data or alternatively just rsync them periodically. What are advantages/disadvantages of both ...
3
votes
3
answers
123
views
Compiling and maintaining applications?
What configure format do you use for
compiling and why ?
Example (you don't have to reply as the example but do state your directory setup):
<Layout MyPersonalizedLayout>
prefix: /...
3
votes
3
answers
4k
views
Server OS on an internal USB flash drive - is this standard practice today?
While chatting with a sysadmin colleague of mine about setting up a small server for me, I found out something interesting - most servers these days apparently contain an internal USB port which can ...
3
votes
1
answer
311
views
How to test configuration changes before they go live? [closed]
I'm a student volunteer helping to maintain the web server for a small website, along with a few other students. It's a pretty standard LAMP server running on Ubuntu 12.04 and mostly hosts PHP based ...
3
votes
2
answers
423
views
Should i put all my servers into my domain?
I am setting up a lab/mock-up network and i'm wondering if is considered bad practice to add all my servers to my Windows Domain. Of course the DC must be part of the domain, and any server that users ...
3
votes
2
answers
7k
views
things to check prior to moving all FSMO roles to a new domain controller before decommission original old domain controller
need to move a domain controller, the first in the forest that holds all the fsmo roles, to another location in a clients building. it will require turning off this dc, call it dc1 for this question. ...
3
votes
2
answers
2k
views
New domain controller on a branch office: it is better to create a new AD site?
I am going to install a new DC on a recently grown branch site. I know that is a best practice to create a new site in Active Directory Site and Service, with the relative IP link cost and related ...
3
votes
1
answer
430
views
Storing saltstack server configs in version control
I currently have a few servers that are managed by saltstack, every now and then saltstack fails to deploy the new configs because of an issue somewhere and it can take a while to work out what ...
3
votes
1
answer
1k
views
Group Managed Service Accounts per service per server (Best practice?) and long names?
I've talked with a few colleagues about what might be best practice for using group managed service accounts in our environment.
It seems that ideally, we would create 1 gMSA per service (e.g. SQL ...
3
votes
2
answers
3k
views
Why is PHP open_basedir not considered a security model
On servers doing shared web hosting, or sharing the PHP environment between different PHP applications, I usually implement a security policy that uses PHP open_basedir to restrict each user to his/...
3
votes
1
answer
666
views
SAN design: File & Block level access?
The short question: can I share file and block level traffic on the same SAN? Perhaps more importantly, should I? The gory details are below...
I'm hopefully putting the finishing touches on a new ...
3
votes
3
answers
553
views
Disk-to-disk backup to same storage array?
We're looking to get a new SAN, and so we're re-examining our storage, network and backup issues. Our plan is to get an EMC VNXe 3100 with SAS drives for production data, then buy an expansion shelf ...
3
votes
1
answer
2k
views
Fibre Channel zoning best practices
I'm hoping that this will be useful for more people than just me.
Right now I've got a fibre channel switch, a NetApp filer, and some servers running Oracle. All of the servers can see the same LUNs ...
3
votes
3
answers
3k
views
Win7 Domain User Profile- Desktop Icon management best practices request
Here's the situation:
We have a large (5,000+ user) organization that is currently using folder redirection to manage the windows desktop icons. This folder is redirected to a network share where we ...
3
votes
2
answers
276
views
Best practices for managing a web-server
Hi I want to ask what are the best practices when installing new software on a web-server,
I'm pretty much self-taught, I have on my home PC: Ubuntu 11.04 with LAMP installed,
and a VPS that I manage ...
3
votes
2
answers
227
views
IT Considerations for a company name change
Nothing is "for sure" yet but there is a good chance my company will be changing it's name in the future.
Our IT requirements are relatively modest - Exchange server, IIS, MSSQL, etc.
My question ...
3
votes
2
answers
864
views
Best Practices for Webserver Benchmarking
I have a webserver that I wish to benchmark before I make some optimizations to it to see if they have any effect.
However, I want to know what are the best practices for benchmarking?
For example, ...
3
votes
1
answer
2k
views
Install DHCP failover on domain controllers vs member servers?
What is the recommendation for installing DHCP failover; domain controllers or member servers?
I can't seem to find any recommendations either way. I did find an old question here pertaining to ...
3
votes
1
answer
2k
views
Synchronizing RODCs to NTP servers?
I've read this nice article from Gareth Hooper regarding Domain Controller syncing to external time sources. In essence, he wrote that although Microsoft don't actually condone the practice, it's a ...
3
votes
2
answers
190
views
One active directory server for one geographical site?
we have an 2008 R2 active directory server on our main site. Recently we opened a small secondary site. My question is pretty simple : our 2 sites are connected with a VPN, is it mandatory for us to ...
3
votes
1
answer
5k
views
Is it a bad idea to do an OVF Export of a VM with snapshot data?
I'm currently using a VM running on ESXi 5.0 to dry-run installation procedures for a software product. We're trying a whole different bunch of things, so I'm making extensive use of snapshots to save ...
3
votes
0
answers
108
views
Why not shorten a single :0000: field in IPv6
rfc5952, section 4.2.2 "Handling One 16-Bit 0 Field" goes:
The symbol "::" must not be used to shorten just one 16-bit 0 field. For example, the representation
2001:db8:0:1:1:1:1:...
3
votes
0
answers
123
views
ZFS3 Lost Resilience. Is Read-only Safer than Letting Users Carry on Writing Files?
Three lovely ST8000NM0075 Seagates drives supplied by Dell, all suddenly failed in a RaidZ3, that's now four within 3 years and 4 months.
I didn't anticipate this and only have one spare to plug in. ...
3
votes
1
answer
720
views
Is having an IPv6 reverse lookup zone necessary for an Active Directory network?
Is having an IPv6 reverse lookup zone necessary for an Active Directory network?
Normally I would just create it and move on, however, in this case the prefix is delegated and changes occasionally. ...
3
votes
2
answers
1k
views
Importance of ha.cf file in a heartbeat/pacemaker environment?
I'm having a few issues trying to understand ha.cf and how the cluster picks up on updates.
For example, when creating a new cluster, I usually:
Set some default options in ha.cf on node 1 - node x
...
3
votes
0
answers
920
views
IIS 7.5 Request Filtering - best practice rules?
Im looking for a set of best practice rules for Request Filtering similar to what UrlScan adds by default.
Any suggestions or an example list of filters is much appreciated. By default IIS 7.5 only ...
2
votes
3
answers
397
views
Is a dashed hostname preferrable to creating subdomains for an application and its environments?
I am working to standardize our DNS names for our various applications, and I proposed the following scheme:
webappname.environment.system.company.tld
So, my application named BackOffice in my ...
2
votes
3
answers
98
views
Where to start with Microsoft Exchange 2003
I am quite new to Exchange in general. I have done some server administration, but never with an Exchange box. Can someone point me in a direction that will give me a good overview and a set of best ...
2
votes
2
answers
631
views
Best Practice: bind, dhcpd, mysql, httpd, etc running on KVM Host?
With respect to "Best Practice" when it comes to virtualization, is it advisable to run services such as bind and / or dhcpd on a KVM host or should these services be run from a guest machine?
How ...
2
votes
2
answers
2k
views
Best practice ACLs to prepare for auditors?
An auditor will be visiting our office soon, and they will require read-only access to our data. I have already created a domain user account and placed them into a group called "Auditors".
We have a ...
2
votes
2
answers
720
views
Apache2.2 vhosts - disadvantages of using one file with many vhosts
As i am working with Apache2.2 more and more lately this thought crossed my mind (apologies if this seems a 'silly' question, still learning alot)
Are there any blatant disadvantages if you use just ...
2
votes
1
answer
156
views
What should I do if an necessary client application has to run on an older (vulnerable) framework?
A client needs to have .NET Framework 4 installed and not patched so their software running on their Windows 2008 R2 Server functions properly.
This sparks the questions:
When is it okay to ...
2
votes
3
answers
181
views
What is the appropriate location for a custom script?
I wrote a script for my Red Hat server that aggregates some system info and shoots it off in an email. What is the appropriate location to place that script?
Right now it is in my /home/jeff ...