Questions tagged [best-practices]

Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.

Filter by
Sorted by
Tagged with
1 vote
2 answers
311 views

Should I change root password

I manage about 50 servers mostly by remote access using ssh on a custom port (root login disabled and users need a public/private key to log in, password login are disabled). each servers have a ...
9 votes
3 answers
881 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
1 vote
1 answer
3k views

Minimum level of access required for service account to run a scheduled task on server?

We have 2 domain administrator accounts in Active Directory: "Administrator" and "Robocopy". Robocopy is a service account associated with a scheduled task which executes a batch file- which runs ...
3 votes
1 answer
1k views

Current Best Practice for using AD to auth Linux (2013)

As far as I'm aware, there are 3 (common) ways to use Active Directory as the Authentication and Authorization for Linux hosts: LDAP Kerberos Samba/Winbind Is there a (current) consensus on which ...
1 vote
3 answers
85 views

Using drivers not supplied by server motherboard manufacturer

Is it considered bad practice/risky to use drivers for servers not provided by the motherboard manufacturer? My on board NIC drivers supplied by the manufacturer of my motherboard were released in ...
3 votes
2 answers
3k views

What are best practices for creating a system account? (*NIX)

I've manually installed a service called Gate One into /opt. I want to harden its security, so I thought I'd create a system account for it to use, because of least necessary privileges, and all that. ...
2 votes
1 answer
1k views

Default NTFS permissions for shared folders

I'm looking for best practices around share files and there NTFS permissions. I'm upgrading servers from SBS 2003 to Server 2012 Standard and thought this would be a good opportunity to do our ...
1 vote
0 answers
642 views

Enable shadow copy where VHD files are stored?

Should I enable Shadow Copy on the volume that stores our Hyper-V VHDs? This same volume also has all our file shares, which is why I want to turn on shadow copy. If I do enable it, will it eat up ...
1 vote
1 answer
339 views

Install Apache from Source or from Binary?

I work on a platform which serves several different projects. For the most part, all of the projects install their web server using Red Hat's RPM. We never created a policy for this which would ...
-2 votes
2 answers
321 views

how to limit directory size without quota (vserver)? [closed]

Hope the question is not too general. As I have a vserver (Ubuntu 12.04) I cannot restrict the size of directories by using quotas. I wonder if there are other possibilities to achieve this. The only ...
1 vote
1 answer
4k views

what would be a better practice instead of chmod g+r /etc/shadow so I can use Unix user/group database for Jenkins authentication?

I don't want to run Jenkins as root, nor giving public access (or even group access) to /etc/shadow seems to a good idea. as suggested by "Manage Jenkins" when selecting Linux user/group database: "...
1 vote
3 answers
790 views

ESXi running 2 x Windows 2012 setup advice

After much deliberating and advice I'm intending to use an element of virtualisation for deploying some new servers. The original (physical) plan was one server running as domain controller, SQL (...
0 votes
1 answer
2k views

Integrity checking vs. audit

In RHEL5 Security Guide using of AIDE for checking software integrity is recomended. And also built-in RPM integrity checking functionality. But frequent checking can be resource demanding and rare ...
11 votes
1 answer
9k views

Server room wiring questions

I'm looking at rewiring our server room to be more presentable, organized, and easier to troubleshooting. Right now we currently have 4 HP racks (don't know the model right now). We do not have a ...
1 vote
1 answer
2k views

When moving a server from behind a firewall into a DMZ, should you move a test server first? [closed]

We have to move a server from within the firewall to a DMZ (not a true DMZ, but a space that's between 2 firewalls. Is it typically a good idea, when moving a server in this fashion, to stand up ...
5 votes
4 answers
17k views

How can I investigate sustained high CPU usage by Microsoft.Exchange.Rpc.ClientAccess.Service.exe?

One CAS server in our array has nearly 90% of its 4 CPUs used. The remaining CAS servers are at 30 percent. How should I investigate what is causing this increase? Below is a graph of: Six (6) ...
2 votes
1 answer
16k views

Active Directory Domain Controller in Multiple Sites - Server 2012

So I'm not used to setting up DCs in multiple subnets/locations, I was hoping to get some guidance. I'm just messing with virtual servers at the time being. DC1 = Apollo DC2 = Cronos Pre-AD Config ...
1 vote
2 answers
2k views

remote access/vpn to windows server 2012 production server best practice

I' need to access my production environment from remote ,outside the lan for emergency. I don't want users are prompted for remote desktop credencials and try to guess username and password. So what ...
0 votes
1 answer
756 views

DNS Server 2008 R2 from 2003 - Stand Alone -

We have just implemented two new windows 2008 r2 stand alone servers running dns and they took the place of our old 2003 stand alone servers. Is there residual clean up that would need to be done on ...
11 votes
2 answers
566 views

Outlook Email Abuse - Guide for email etiquette?

I've spent a lot of time performing mail migrations for companies that either had very little IT focus, or no fulltime staff to handle common issues. As a result, policies governing email use and best-...
1 vote
1 answer
95 views

best practice renaming ssh login server [closed]

quick question: let's say you have a ssh login computer called sshlogin.example.com. Now for some obscure reason, your company decided to rename that machine to ssh.example.com. What's the best ...
5 votes
3 answers
192 views

What protocol should be followed if website is actively under attack?

When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there ...
1 vote
2 answers
332 views

Is there a reason I shouldn't use iptables port forwarding?

I have a small application running on port 8888, and as a quick fix to remove the need to append the url with the port, I used the iptables program to forward all requests to port 80 to 8888. sudo ...
1 vote
5 answers
2k views

Best Practices for Open Relay Email Server

I have a scenario where I need to setup postfix with no TLS, no SMTP authentication, and open relay allowing from only one remote IP address. Emails from this remote IP may have spoofed "from" address ...
0 votes
1 answer
438 views

Is it a good practice use LDAP for auth in a public webapp beside the app DB?

Internet app needs to be really secure. So LDAP for auth got into the game. Instead doing the traditional db with users table, we want to authenticate agains a LDAP server. How good/bad you think it ...
0 votes
2 answers
276 views

NginX installation-source best practice

I'd like to install NginX as a reverse proxy on CentOS. I know three different ways to install NginX: Compile itself Install over EPEL Install over official NginX package repository Which way would ...
-1 votes
1 answer
84 views

Disabling/hiding rather than deleting [closed]

From what I understand, it's generally best practice to design a system with user access to delete "records" to only hide/disable that record and not actually delete it. This typically ends up being (...
7 votes
2 answers
9k views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
1 vote
1 answer
130 views

Avoiding sudo to root with an alias, is it possible? [closed]

I've developed a bad habit of constantly sudoing to root. I was wondering if its possible to create an alias that prevents straight sudo but allows sudo -u. Or possibly echoes a warning when using ...
1 vote
1 answer
463 views

Best practices for IPv4/IPv6 hosts in DNS zones?

I've got a VPS with IPv4 and IPv6 addresses, and I'd like to use them both for my website and other services I might use. I've added a "www" register both with "A" and "AAAA", and I've done the same ...
2 votes
1 answer
4k views

Is there a good reason to change session.save_path?

On shared hosting, we had occasional problems when the server's /tmp directory was full. Our hosting company suggested we change the session save path to be unique for each site. ini_set('session....
3 votes
2 answers
190 views

One active directory server for one geographical site?

we have an 2008 R2 active directory server on our main site. Recently we opened a small secondary site. My question is pretty simple : our 2 sites are connected with a VPN, is it mandatory for us to ...
1 vote
1 answer
422 views

Best practice for replacing failing drive in a TWO Domain Controller domain

Hi I have a two domain controller domain and i will refer to them as DC1 and DC2, here is some info on them. DC1 is or has all FMSO roles DC2 serves as another Domain Controller for replication DC1 ...
9 votes
1 answer
1k views

What are the best practices for service accounts?

We're running several services in our company using a shared domain account. Unfortunately, the credentials for this account are widely distributed and being used frequently for both service and non-...
0 votes
1 answer
341 views

How to delay and queue commands for execution at a later time? [closed]

My site receives numerous uploads and I can't afford to waste cycles and time processing them on the spot (e.g., trimming, optimizing, resizing, etc.). What technologies exist to delay and queue these ...
20 votes
6 answers
4k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
3 votes
3 answers
3k views

Win7 Domain User Profile- Desktop Icon management best practices request

Here's the situation: We have a large (5,000+ user) organization that is currently using folder redirection to manage the windows desktop icons. This folder is redirected to a network share where we ...
2 votes
1 answer
5k views

Best way to override 1024 process ulimit

On CentOS distros, there is an /etc/security/limits.d/90-noproc.conf that sets a process limit for all users: # Default limit for number of user's processes to prevent # accidental fork bombs. # See ...
3 votes
2 answers
12k views

Using RAID1 vs. rsync pros and cons [closed]

I am building myself a Linux NAS/home server. I am considering either using sw RAID-1 (mdadm) to replicate data or alternatively just rsync them periodically. What are advantages/disadvantages of both ...
2 votes
1 answer
1k views

Best Practice for "fastcgi_pass" Directive Location in NGiNX

Is best to put the fastcgi_pass 127.0.0.1:9000 directive in the fastcgi_params file for NGiNX, or to explicitly state it in the location for \.php$? Or does it not really matter?
4 votes
1 answer
4k views

Active Directory Split-Zone vs SubDomain Domain Name

Note - I know there are a ton of questions around AD Naming. I do not believe though that this is a duplicate question. If it is please link me to a relevant one :). We are implementing AD. Our big ...
14 votes
4 answers
805 views

IT lead does not have a backup, DR plan in writing [closed]

This is a general management question to IT managers out there. We are a small firm with about 4 servers in our colo cabinent. No full time IT manager. But we do have one person on monthly contract ...
2 votes
1 answer
733 views

How should I configure my Active Directory servers so that if one goes down, users are not kicked off SQL?

Today, we shut down one of our Active Directory servers during office hours to check the loading on a UPS. Since all the server did was provide Active Directory in a separate building incase the main ...
1 vote
1 answer
84 views

Best practices for backup on a massively parallel grid system

I work in the research group of a large company. We do a lot of work on a grid processing system with many nodes (More than 200, I'm not sure exactly how many) and several harddrives. More than 1000TB ...
1 vote
5 answers
148 views

Granting access to user's file store without their knowledge or consent [closed]

As a system administrator, if you were asked to facilitate access to your users' file store so that a director could look at what types of files are being stored, what would your response be? The ...
0 votes
2 answers
417 views

Best Practice: Implementing a Full Disk Encryption on laptops

We are thinking about using TruEncrypt full disk encryption to protect the data on our laptops (roughly 15-20 in the healthcare field - XP & Win7). And I was wonder about backups, and not per say ...
4 votes
1 answer
205 views

A separate user for each task?

I just got a VPS sver the other day, I'm new to server administration, but not that new to Ubuntu (11.04). I use it in my living room as the HTPC, and I had a previous VPS that I used on and off for a ...
0 votes
3 answers
184 views

Top Infected Machines - Dealing with Threats?

I printed out a list of the top 25 infected machines (associate machines only) a bit of detail. Associate machines are only for sales associate. The domain login is the same for every machine, ...
2 votes
2 answers
310 views

How accurate is the 'supersede' term regarding older updates in WSUS?

Been recently playing around with different options for management of my servers. One of these is WSUS. Getting a beginning list of updates was simplistic enough (though, the list is a bit...long) ...
5 votes
1 answer
5k views

Best Practices for rotating syslog logs on RHEL with different schedules?

OS: Running RHEL 5.6. Situation: I need to rotate /var/log/messagees on a different schedule than the rest of the syslog logs. By default syslog logs are rotated weekly based on the /etc/logrotate....

1
4
5
6 7 8