Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.

learn more… | top users | synonyms

13
votes
4answers
5k views

In Puppet, how would I secure a password variable (in this case a MySQL password)?

I am using Puppet to provision MySQL with a parameterised class: class mysql::server( $password ) { package { 'mysql-server': ensure => installed } package { 'mysql': ensure => ...
101
votes
8answers
17k views

Best practice: Should I always install a fresh OS for new employees?

I had an argument with a superior about this. Though at first glance the prior user of a laptop only did work in his own documents-folders, should I always install a new OS for the next user or is ...
29
votes
6answers
3k views

How can I prevent accidentally jacking with a production database?

Just recently, I had a developer accidentally try to restore a database to production, when he should have been restoring to a staging copy. It's easy to do, given that the db names are similar, i.e., ...
9
votes
2answers
7k views

Best strategy to keep chef cookbooks versions under control

I'm looking for ideas about chef cookbooks versions management. I know that you pin specific versions in the environment, but I'm not sure how to go about it. We use librarian-chef which installs 3rd ...
0
votes
4answers
847 views

Best pratice to implement free and affordable VPN between branch offices

I need to find a good software solution to implement VPN so a new branch office can use without security problems applications in our main office. I need it to be very reliable and almost transparent ...
1
vote
3answers
95 views

Secure Administration AD Domain

I have a project to securize my Active Directory infrastructure. To do that, one of my colleague told me about the possibility to create another AD domain in the forrest just for administration. That ...
2
votes
2answers
102 views

Best Practices for AD DS Backup and Recovery?

So Microsoft claims that "you cannot use a network shared folder as a backup target for a system state backup", but I've seen plenty of posts where people indicate that they are able to do this from a ...
1
vote
1answer
32 views

Is there a memcached memory limit best practice?

Is there a best practice or general rule of thumb when setting the memory limit for memcached? I'm currently running memcached with the default memory limit of 64 megabytes. The server has 8 ...
75
votes
6answers
54k views

Top level domain/domain suffix for private network?

At our office, we have a local area network with a purely internal DNS setup, on which clients all named as whatever.lan. I also have a VMware environment, and on the virtual-machine-only network, I ...
1
vote
1answer
75 views

Fastest method to deploy Linux to large numbers of workstations

A nonprofit has received a donation of a large number (>100) decommissioned workstations. What would be the most efficient method of taking a standardized ISO image of a Debian Linux distribution (for ...
1
vote
2answers
763 views

ProFTPD - What is intended use of IdentLookups config option?

I have just recently got annoyed enough at my own dedicated server's FTP connection delay to go hunting for what causes delay. "Perpetrator" was IdentLookups configuration option. It defaults to on, ...
30
votes
7answers
14k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
0
votes
0answers
9 views

Using one powerful computer in a virtual environment vs using one powerful computer? [duplicate]

The title explains most of it, I want to know if it's more efficient to have one computer using VMWare vSphere to host servers on different virtual operating systems that only has one server per ...
-4
votes
3answers
116 views

How to debug and prevent flaky unreliable IT environment? [closed]

I am not an IT admin, I'm a software developer (microsoft stack) and I'm trying to understand what is wrong with the IT environment of one of our customers. We have deployed our client\server ...
1
vote
1answer
133 views

Install DHCP failover on domain controllers vs member servers?

What is the recommendation for installing DHCP failover; domain controllers or member servers? I can't seem to find any recommendations either way. I did find an old question here pertaining to ...
4
votes
3answers
5k views

How to get php-fpm to log to stdout / stderr when running in a docker container

I have php-fpm in a docker container and in the Dockerfile I edit the fpm config file (/etc/php5/fpm/pool.d/www.conf) to set up access logs to go to /var/log/fpm-access.log and error logs to go to /...
0
votes
1answer
34 views

domain controller naming group policy [closed]

i have two domain controller setup one on 192.168.1.10 companyname.local and 192.168.1.20 companyname.local as backup. i was task of rebuilding the backup and make it the main domain controller. i ...
2
votes
1answer
576 views

Best practices with managing log files on my server

My system is generating log files, e.g. for apache, nginx, tomcat, and other things and they grow pretty fast. I am looking for best practice recommendations because there are so many options to ...
1
vote
0answers
22 views

Ruby on Rails Debian best practice

I've seen in various places people using Ruby compiled from source through a cloned rbenv git repository, and then installing Rails through RubyGems to get the latest version. But, from what I know, ...
1
vote
3answers
8k views

Enabling Receive Side Scaling & IPsec Task Offload v2 on a Network Adapter

Running the Best Practice Analyzer on a Windows Server 2012 RTM (this virtual server runs on a hyper-v host), I receive two configuration warnings. Enable Receive Side Scaling (RSS) on a network ...
0
votes
0answers
17 views

Separate domain admin accounts - are password tokens stored for run-as?

I am considering separating our domain admin accounts as suggested in this previous thread. However, are password tokens stored for "run as" instances? If so, running MMC and other tools with "run as"...
7
votes
2answers
398 views

Transition away from Domain Admin only account

In our Windows environment, our Domain Admins only have one user account. This single user account is used across the board including running on a day to day workstation. In our transition away from ...
-1
votes
1answer
452 views

Are there any problems installing Office 2016 over Office 2013 directly?

Are there any problems if I install Office 2016 over Office 2013 without uninstalling Office 2013 first?
1
vote
0answers
38 views

Installing consumer software on a server

I am in need of a simple low-maintenance off-site backup solution for one or more Windows servers. I have had great success using some consumer-grade backup software that allows me to backup files ...
1
vote
1answer
43 views

How to keep a reproducible server admin log?

So here is something I am always wondering about when setting up a new Linux machine, be it desktop or server: How can I keep a reproducible log of what administration tasks I did on the machine, so ...
1
vote
1answer
50 views

Wordpress Anti Virus exclusions list

Problem background: I am contractually bound to install a system Anti Virus solution on every host. For this product I am running Linux (Red hat derived). These instances are hosting Apache/PHP ...
0
votes
0answers
12 views

Strange AD replication issue between different subnets DC. (Alternative solution is working)

I'm facing very strange issue of AD replication in with different subnets DC. Site A : 172.16.1.0/16 Site B: 192.168.20.0/24 sites are connected through P2P and IPsec tunnel (two different way). ...
4
votes
1answer
173 views

Should DirectAccess be deployed to all Windows clients that support it?

As our organization is slowly rolling out Windows 10, I made the observation of a DirectAccess GPO linked to the Windows 10 PCs OU (which contain internal desktops, laptops, and even VMs for VDI). ...
1
vote
0answers
16 views

Should each task/process/role run as its own user on a Windows server?

I know that on Linux servers, it's widely considered best practice to run each task/role/process/server/program as its own user and usually in its own group. How should separate tasks be handled on a ...
13
votes
4answers
4k views

How bad is it to run Exchange 2016 on a Windows 2012 R2 domain controller for a small organization with assuredly fewer than 25 users?

I know that it has been officially unsupported forever and yet I have seen or heard about many small business installations of a single host running AD DS and Exchange simultaneously. For a resource-...
20
votes
9answers
2k views

Best practices for backup checking?

It is a common situation, when administrator makes system for automatic backuping and forgets it. Only after a system fails administrator notices, that backup system has broken before or backups are ...
1
vote
1answer
86 views

Windows Server Applicaton Administration Best Practice [closed]

I've recently switched from using a linux server for private hosting (things like a WebServer, Teamspeak, Gameservers etc.) to a Windows Server 2012 R2 machine. Under Debian I installed my services ...
2
votes
2answers
76 views

Which symbols to avoid when naming AD DS groups?

can somebody point out to the symbols which is better not to use when naming AD DS groups? I want to have some explanations/links to documentation on why those should not be used. For example Windows ...
0
votes
1answer
55 views

Active Directory Domain Naming

Planning a new domain and I keep seeing that best practice is to name the forest/domain after a subdomain of our publicly registered domain. So if we own and use company.com publicly, we should use ...
6
votes
2answers
5k views

Distinguish Between Users and Service Accounts in Active Directory

Question Is there a "correct" / standard way to distinguish Service Accounts from User Accounts in AD? More Info In certain scenarios we have systems running under AD Credentials (i.e. under a ...
1
vote
3answers
692 views

What is recommended size of hard disk for a Server?

I have heard that large hardisk >= 1TB are not recommended on the server because they can cause synching issues if one fails + their chances of failure is greater over a longer period of time as the ...
0
votes
1answer
137 views

Docker best practice for storing application generated content and calling ffmpeg?

I have this setup container #1 "web" container #2 "db" Now this web container holds my application that uses ffmpeg to record streams. The problem is Im not quite sure where to store my recorded ...
2
votes
1answer
224 views

call binary from docker container inside another docker container?

What would be the way to load a certain binary from a certain container in docker from inside another container? container 1: web container 2: ffmpeg I would want to call ffmpeg binary living in ...
-1
votes
1answer
61 views

Is installing Windows Server 2012 R2 using .com versus .local going to cause future problems? [duplicate]

I know using example.com would cause a conflict, but what about ad.example.com, corp.example.com or internal.example.com? I have a web .com domain. Will need to remote in and/or VPN etc. I am being ...
3
votes
2answers
77 views

AD | Prevent admins from changing passwords to the same thing

I have an interesting security problem: Admins with ad access have been changing their password to the same thing, and breaching the company security policy. User side, standard AD complicated ...
1
vote
7answers
1k views

Employee no longer with the company

When an employee is fired or let go, it is critical to disable their accounts and access to resources immediately. How do you handle this at your organization?
0
votes
2answers
555 views

Cisco ASA 8.4+ redirect multiple ports - best practice?

I was wondering whether anyone could advice on best practices as to the best way to redirect multiple ports for single host in the internal network. As I understand this you can only nat a single ...
2
votes
1answer
94 views

How to test configuration changes before they go live? [closed]

I'm a student volunteer helping to maintain the web server for a small website, along with a few other students. It's a pretty standard LAMP server running on Ubuntu 12.04 and mostly hosts PHP based ...
-2
votes
1answer
219 views

AD Best Practice for the connection specific DNS suffix network setting

What is best practice for this setting? It also goes by DNS Domain Name in DHCP scope settings. The only documentation I can find about these suffixes and domain name settings specifies the the ...
0
votes
2answers
202 views

Should I backup from within each guest, or from the host?

I'm searching for advice on whether backups are better taken from within a guest (e.g. ShadowProtect), or from within the host (e.g. copying virtual disk files, or other software). We have 12 VM's (a ...
31
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
2
votes
1answer
74 views

Puppet: How to use a set of common packages but allow exceptions?

I have about 200 more or less identical Linux VMs. There is a class for all common configuration: class my_packages { class { "::ntp": servers => [ "de.pool.ntp.org" ], } ....
46
votes
7answers
6k views

Cable Management Policy

We've all seen good and bad examples of cable management. What are objective, measurable requirements that can be used in a policy to maintain cabling order in the rack/server room/data center? I'...
2
votes
0answers
368 views

Usermod -aG vs gpasswd -a as a best practice

I am aware that usermod -g is not best practice from many posts like this however they normally explain the usermod should not be used as it changes the primary group of a user. These posts dont seem ...
0
votes
1answer
34 views

Process separation on an OpenBSD server

I fear this may be a somewhat open-ended question that gets closed: Apologies in advance, but I'll give it a shot! I'm considering operating an OpenBSD VM with a number of services running on the ...