Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.

learn more… | top users | synonyms

3
votes
2answers
48 views

AD | Prevent admins from changing passwords to the same thing

I have an interesting security problem: Admins with ad access have been changing their password to the same thing, and breaching the company security policy. User side, standard AD complicated ...
1
vote
7answers
1k views

Employee no longer with the company

When an employee is fired or let go, it is critical to disable their accounts and access to resources immediately. How do you handle this at your organization?
0
votes
2answers
369 views

Cisco ASA 8.4+ redirect multiple ports - best practice?

I was wondering whether anyone could advice on best practices as to the best way to redirect multiple ports for single host in the internal network. As I understand this you can only nat a single ...
1
vote
1answer
41 views

How to test configuration changes before they go live? [closed]

I'm a student volunteer helping to maintain the web server for a small website, along with a few other students. It's a pretty standard LAMP server running on Ubuntu 12.04 and mostly hosts PHP based ...
-2
votes
1answer
55 views

AD Best Practice for the connection specific DNS suffix network setting

What is best practice for this setting? It also goes by DNS Domain Name in DHCP scope settings. The only documentation I can find about these suffixes and domain name settings specifies the the ...
0
votes
2answers
58 views

Should I backup from within each guest, or from the host?

I'm searching for advice on whether backups are better taken from within a guest (e.g. ShadowProtect), or from within the host (e.g. copying virtual disk files, or other software). We have 12 VM's (a ...
31
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
2
votes
1answer
47 views

Puppet: How to use a set of common packages but allow exceptions?

I have about 200 more or less identical Linux VMs. There is a class for all common configuration: class my_packages { class { "::ntp": servers => [ "de.pool.ntp.org" ], } ...
45
votes
7answers
5k views

Cable Management Policy

We've all seen good and bad examples of cable management. What are objective, measurable requirements that can be used in a policy to maintain cabling order in the rack/server room/data center? ...
0
votes
0answers
68 views

Usermod -aG vs gpasswd -a as a best practice

I am aware that usermod -g is not best practice from many posts like this however they normally explain the usermod should not be used as it changes the primary group of a user. These posts dont seem ...
0
votes
1answer
18 views

Process separation on an OpenBSD server

I fear this may be a somewhat open-ended question that gets closed: Apologies in advance, but I'll give it a shot! I'm considering operating an OpenBSD VM with a number of services running on the ...
17
votes
4answers
2k views

Where do companies typically store SSL certificates for future use?

We recently bought a wildcard SSL cert for our domain. We converted all of the certs to a Java keystore, but now we are asking ourselves where we should store these for later use. Do people use ...
3
votes
0answers
306 views

What is the best practise to autostart unprivileged lxc containers on Ubuntu 14.04 64bit? [duplicate]

The current implementation of the LXC technology deals nicely with an issue of starting the privileged containers upon system start.. Users of the unprivileged containers (which arguably promise ...
-1
votes
2answers
101 views

Best practices for secondary DNS in case of a single Active Directory

I have a setup with only one Active Directory (not redundant). What should be configured on the client pc's to ensure the best DNS resolution ? Currently somebody configured the IP address of the AD ...
0
votes
1answer
61 views

Setting affinity for virus protection on workstations - best practice?

Despite the modern virus protection is based on prevention by scanning network traffic and by real-time protection, many companies still have policies, that full scans must be performed regularly. ...
0
votes
2answers
53 views

Active Directory Multi Domain Enviornment

I work for a small organization which will be starting another branch of business here shortly. We have an existing active directory infrastructure and are looking to add another domain to the ...
0
votes
1answer
87 views

How to have automatic file system checks for Linux Software Raid?

In a Linux Software raid, what is the best practice for periodically having the filesystems checked? With single drive or hardware raid, tune2fs -c 5 -i 1w /dev/sda1 means check the filesystem every ...
4
votes
1answer
297 views

Using Public IP addresses for Private Network

I have a network that uses the 192.192.192.x network address for their private network. It looks like publicly those are IP addresses that are assigned in Taiwan. I don't think they do too much ...
4
votes
2answers
244 views

Standard Firewall and Network Change Testing Procedure

I am looking for a standard that advises on the best practice for testing of the following situations: Network Changes Firewall Changes Does any standard exist? If so, please note where I can find ...
3
votes
7answers
650 views

DDOS Attack Victim - How much to Admit?

Here's the environment: Website that hosts a forum/journal/bboard/email/socialmedia application in walled garden (ie you pay to get to use it or are invited to do so Many Clients pay to use the site ...
6
votes
8answers
1k views

System administration standard [closed]

I have been given the responsibility to manage a team of 4 system admins. They are managing 70+ servers. They don't yet have written processes/procedures/practices. I don't much about system ...
0
votes
2answers
329 views

Where to store big data (best practices)

I am installing a fresh Ubuntu on our lab server. We have lots of massive genomes which need to be accessed by Apache www-data user. Currently I backed all the data up on external drives. My goal is ...
8
votes
3answers
606 views

What are some best practices when taking over IT at a new company? [closed]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
7
votes
2answers
334 views

Transition away from Domain Admin only account

In our Windows environment, our Domain Admins only have one user account. This single user account is used across the board including running on a day to day workstation. In our transition away from ...
26
votes
12answers
31k views

Active Directory: delete vs. disable departed employees [closed]

When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed ...
4
votes
1answer
663 views

Merging two companies: Best practice?

Situation: Company A purchased Company B. Offices are 40 miles apart. There are about 10 employees in each office. We want to have everyone be able to access all network resources independent of ...
2
votes
1answer
141 views

What should I do if an necessary client application has to run on an older (vulnerable) framework?

A client needs to have .NET Framework 4 installed and not patched so their software running on their Windows 2008 R2 Server functions properly. This sparks the questions: When is it okay to ...
42
votes
7answers
12k views

Best Practices in Username Standards: Avoiding Problems

I'm interested in finding out what people's experiences with standard usernames is. I've always been in places that used {firstInitial}{lastname} (sometimes with a length-limit). Now I've users that ...
37
votes
4answers
35k views

Windows Active Directory naming best practices?

After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active directory domain named identically to a DNS domain is bad idea (Meaning ...
66
votes
5answers
40k views

Top level domain/domain suffix for private network?

At our office, we have a local area network with a purely internal DNS setup, on which clients all named as whatever.lan. I also have a VMware environment, and on the virtual-machine-only network, I ...
64
votes
5answers
4k views

Choosing between meaningful and meaningless hostnames [closed]

Assume an environment with a puppet-managed cluster of different servers - various hardware, software, operating systems, virtual/dedicated, etc. Would you choose meaningful hostnames ...
0
votes
1answer
70 views

Creating enterprise init script (to support all Linux distros)

I'd like to create my own init script to make my program start at boot and be controlled via "service" utility in most popular Linux distributions. Requirements: it should be portable across ...
0
votes
1answer
36 views

Where should the DB server be and its updates scripts should run from where?

I currently have a web application and database on the same server. I am moving the database to a new server that is spec'd for being a database. Now i have nightly scripts that run on the web ...
1
vote
1answer
206 views

Firewall Security Guidelines

I'm looking for some best practices or Security guidelines for Firewall and VPN. Trying to study a little more about network security and write a sort of decalogue (set of rules). Usefull to follow ...
1
vote
3answers
798 views

Setup Postfix as a null client?

I'm having a bit of trouble setting up postfix as a null client and have some questions. I'll be aiming to use SMTP as this is what most web applications use as a way to connect to the email server. ...
3
votes
1answer
893 views

How to get php-fpm to log to stdout / stderr when running in a docker container

I have php-fpm in a docker container and in the Dockerfile I edit the fpm config file (/etc/php5/fpm/pool.d/www.conf) to set up access logs to go to /var/log/fpm-access.log and error logs to go to ...
26
votes
5answers
3k views

How can I prevent accidentally jacking with a production database?

Just recently, I had a developer accidentally try to restore a database to production, when he should have been restoring to a staging copy. It's easy to do, given that the db names are similar, i.e., ...
-2
votes
1answer
120 views

How do you “prevent powerful accounts from being used on unauthorized systems”? [closed]

I was browsing through Microsoft's Best Practices for Securing Active Directory and saw the chart linked which includes some of the best practices included in the document, rated by importance. At ...
2
votes
2answers
310 views

The impact of Apache graceful restarts and user experience

Is it safe to perform a graceful restart of Apache on a production server? What effects will a graceful restart cause and what would be the impact (if any)? Will there be any detrimental impacts (e.g. ...
0
votes
0answers
101 views

Server 2012 LDAP signing - “Number of simple binds performed without SSL/TLS..”

Here is our log on event 8227: Number of simple binds performed without SSL/TLS: 88 Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing: 0 I have set LDAP Interace Events ...
-1
votes
1answer
47 views

IP Network Best Practice [closed]

On my On Premise network we use IP Span 172.17.101.0-172.17.103.254 I should now connect our Windows Azure network to the On Premise network using VPN. Is it okay to use IP Span 172.16.1.0 in the ...
5
votes
2answers
1k views

Best practices for file layout in a Hyper-V server?

We've got a Hyper-V server set up, and the layout of the files is inconsistent because it was set up by several people. Here are the two different "templates" that were used: Template 1 ...
4
votes
2answers
159 views

Adding an Active Directory to a computer-local group - which scope to choose?

I am aware of the "AGDLP" rule of thumb when it comes to group nesting inside an AD strcture. But now I am wondering if there are any best practises when it comes to adding Active Directory groups to ...
3
votes
1answer
198 views

AD IT Helper Permissions

My apologies if this has been asked before. If I knew the proper search terms then google would be more effective. I would like to add a user that can join computers to the domain, Install software ...
5
votes
1answer
418 views

Managing puppet modules with git

I have a puppet/foreman server running on Debian 7 for managing my systems. I use the community version 3.7 of puppet and foreman 1.6.0. I use directory environments. At the moment I use a rather ...
5
votes
3answers
433 views

What is the name for sorting a directory with lots of files into subdirectories? [closed]

One way to make manageable a directory with a huge number of files into it is to sort the files into subdirectories named after progressive characters in the files' names. E.g.: - ...
0
votes
0answers
328 views

How to handle 802.1x authentication system with incompatible clients devices?

I would like to split my wired network into multiple VLANs. In order to do that, I think I will use dot1x authentication on my Cisco Switchs (2960S and 2960G) RADIUS will be handle through NPS on my ...
2
votes
1answer
185 views

Performing root mysql operations in bash scripts

What is a good practice to execute root operations on mysql databases in bash scripts? For example, I want to create new database and grant privileges, I have to use: mysql -u $ROOT -p"$ROOTPASS" -e ...
0
votes
0answers
56 views

Manage User Specific PowerShell Functions in Active Directory Domain

Given: Windows Server 2012 R2 / PowerShell 4 Do need: a way to manage user/role specific PowerShell functions in an Active Directory domain. Do NOT need: help with coding these scripts. This ...
-3
votes
2answers
61 views

Scheduled Task Naming Conventions? [closed]

I would like to hear of examples of a naming convention for Scheduled Tasks in Windows, along with rationale. Thanks.