Skip to main content

Questions tagged [best-practices]

Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.

Filter by
Sorted by
Tagged with
0 votes
1 answer
34 views

DNS and PTR names for mail servers - best practice?

Should the hostname of the mail server you send mail from always have an rDNS (PTR type) of the same name? I ask because I notice the name of my mail server doesn't have the same name as the PTR ...
TommyPeanuts's user avatar
0 votes
1 answer
92 views

Best practices on managing Terraform project repositories

As part of a new job role, I have started learning Terraform recently. Before, my main orchestration/provisioning tool was Ansible, and the best practice at my previous place was to hold the state for ...
Yuri's user avatar
  • 3
0 votes
0 answers
92 views

Disabling unnecessary Apache modules for simplicity and performance

I noticed that my simple LAMP application does not need most of the default modules the official Docker PHP-Apache image bundles by default: a2dismod -f access_compat auth_basic authn_core authn_file ...
Pere's user avatar
  • 141
0 votes
1 answer
110 views

Securing a secret key on a linux server to be consumed by a software running on the server

I'm not an expert in server security and I have a question regarding a situation where server is being compromised. I have a nodejs app which is a bot that only have https connection to read from some ...
Mostafa's user avatar
1 vote
1 answer
593 views

Practice of high frequency scheduled Ansible playbook runs

I'm fairly new to administrating servers with configuration managers such as Ansible. I plan on running playbooks automatically on a schedule (via something like Ansible Semaphore, or even just Cron) ...
corvus-migratorius's user avatar
0 votes
2 answers
52 views

Why not nuke an machine after malware cleanup? [closed]

So this is a noob question. Why do we perform a clean up on a machine that has been infected with malware and not nuke it directly instead? I understand that in some situations this would not be ...
mcry's user avatar
  • 3
0 votes
1 answer
760 views

Best practices for PHP ini settings for large wordpress site?

I own a large wordpress site that gets 500k+ visitors 30+ plugins (some heavy) server with 128 GB RAM Wondering if there are "best practices" for php.ini settings for larger sites on Linux?...
user8749042's user avatar
0 votes
1 answer
125 views

Is Cloud Best Practice To Still Have Multiple Disks (Volumes) For a Server?

In the old days of physical servers, it was considered good practice (at least at the places I have worked at) for a server to always have at least two disks (volumes) no matter how simple an ...
P Burke's user avatar
  • 183
1 vote
1 answer
47 views

Is it bad form to create an Ansible role just for setting facts?

I've got one of those situations where I could write a three task role to lookup, sort and extract a set of values like: - name: Lookup available AMI instances amazon.aws.ec2_ami_info: filters: ....
J. Gregory Wright's user avatar
1 vote
0 answers
184 views

Add some text to curl's user agent string? (i.e. curl with a UA that includes curl's default UA & my text)

I am writing a shell script which uses curl(1) to download files. By default curl will set a HTTP User-Agent (UA) to something like curl/7.74.0. I want to be a good internet citizen and set the UA to ...
Amandasaurus's user avatar
  • 32.5k
2 votes
1 answer
2k views

IPv6 connectivity suddenly lost, IPv6 neighbour router status becomes STALE at the same time. How can I avoid it?

I have a VM on a host with bridged networking (hence, with its own MAC address). Both host and VM run CentOS. Their network is managed by simple /etc/sysconfig/network-scripts/ifcfg-enpXsY files ...
Ned64's user avatar
  • 323
1 vote
0 answers
262 views

How to limit users to their home directory SFTP on Ubuntu 20.04

Is there any way to limit users to certain home directories with sftp on Ubuntu OS 20.04 and giving them write access to their directory?' I was able to keep each user to only see their directory and ...
Jflores0515's user avatar
0 votes
2 answers
2k views

Active Directory (DNS) BPA: Interface should register its IP addresses in DNS with Server Core

How to solve the following compliance error message when using the Best Practices Analyzer with DNS running on Windows Server Core? Problem: The interface Ethernet 2 is not configured to register its ...
Vinícius Ferrão's user avatar
3 votes
0 answers
116 views

Why not shorten a single :0000: field in IPv6

rfc5952, section 4.2.2 "Handling One 16-Bit 0 Field" goes: The symbol "::" must not be used to shorten just one 16-bit 0 field. For example, the representation 2001:db8:0:1:1:1:1:...
Melissa Boiko's user avatar
1 vote
2 answers
1k views

On a single machine, re-use SSL certificate between services, or generate multiple certificates?

Assume a machine has multiple management UIs, like for example Cockpit and Monit. Both can do SSL. Do best practices dictate using distinct certificates for either service? Or is it OK to reuse a ...
wzzrd's user avatar
  • 10.5k
-1 votes
2 answers
730 views

How many subnets are best practice?

What is the general best practice for subnetting a small (abt 15 servers) network of vms and physical machines? How granular should it be? Do you want to have a logical subnet or vlan for every ...
CorinaLarksExtraMild's user avatar
0 votes
1 answer
110 views

what number of azure subscriptiions is too many?

My organisation has 50 azure subscriptions at the moment and is planning to grow to well over 500 for several reasons: each application will have its own subscription, techies have their own ...
Parsifal15's user avatar
0 votes
1 answer
76 views

What is Microsofts intention regarding centralized access control, flattening Active Directory in Azure?

SF: You should only ask practical, answerable questions based on actual problems that you face. Forwarding: This question may be debatable regarding the answerable-part. However, for me this is an ...
dfuchs's user avatar
  • 109
1 vote
1 answer
623 views

What's the proper way to initially deploy a CloudFormation stack for testing?

I'm writing my first CF stacks and I'm running into failed deploys on the first try of course because I don't know the syntax and available parameters yet fully. I am validating my json and the ...
Chris's user avatar
  • 318
0 votes
0 answers
31 views

Security best practice: revoke execution (-x) permissions for directory, or do recursively to change every contained file?

I have a question about security best practice when configuring a device to be used to users, who should be able to use a programme, but not modify the system. Let's say I have a folder /opt/myapp ...
SLhark's user avatar
  • 1
5 votes
1 answer
3k views

DMARC strict vs relaxed alignment?

I've been configuring DNS records for a mail server and got stuck when it came to DMARC's alignments. I know that both relaxed and strict are valid options, as well as relaxed being default setting. ...
user avatar
1 vote
0 answers
360 views

Best practice installation of Docker on Ubuntu

When installing Docker on an Ubuntu machine, there are several competing ways to install it, that seem to be the best practice according to someone. Specifically, you can install according to the ...
Uberhumus's user avatar
  • 223
1 vote
0 answers
139 views

Providing Support from Jumphosts using Site-to-Site VPNs

To provide support for our customers, our support staff has to establish VPN connections in order to connect to hardware devices that are located in the networks of our customers. Due to security ...
gumlozol's user avatar
3 votes
0 answers
125 views

ZFS3 Lost Resilience. Is Read-only Safer than Letting Users Carry on Writing Files?

Three lovely ST8000NM0075 Seagates drives supplied by Dell, all suddenly failed in a RaidZ3, that's now four within 3 years and 4 months. I didn't anticipate this and only have one spare to plug in. ...
Louis Waweru's user avatar
4 votes
0 answers
2k views

Docker + IPv6 - what is the best practice?

I want to build IPv6-ready services with Docker that can reach v6 hosts on the external network and can be reached from the external v6 network. I'm really confused with all that right now, so I want ...
raxp's user avatar
  • 41
4 votes
2 answers
3k views

Should I partitionning a disk LVM?

I have some few servers (Ubuntu 16) and it's a mess who LVM was configured and used by my predecesor (for me, maybe is not). I have to install new server (Ubuntu 18) but I won't do a mess like is it ...
Alexandre Serrano's user avatar
3 votes
3 answers
4k views

Server OS on an internal USB flash drive - is this standard practice today?

While chatting with a sysadmin colleague of mine about setting up a small server for me, I found out something interesting - most servers these days apparently contain an internal USB port which can ...
Vilx-'s user avatar
  • 863
0 votes
1 answer
335 views

Allow caching of share - roaming profiles - WS2016

I have a WS2016 that is running roaming profiles for users. Within the SMB file share, the option: "Allow caching of share" is enabled and was enabled by accident upon creation. There are already ...
bloonacho's user avatar
1 vote
2 answers
2k views

Migrating application servers to new domain

I work in a corporate environment which has recently been merged with another like business. There is an ongoing project to take our legacy Windows Servers and migrate them to an entirely new Windows ...
Kasey's user avatar
  • 111
0 votes
1 answer
55 views

How to react on vulnerability scanning?

We noticed that our server is being scanned for standard vulnerabilities like publically exposed myphpadmin and other common security configuration mistakes / failures. What is best locations to ...
Kote Isaev's user avatar
1 vote
0 answers
3k views

Backup best practice with lsyncd: delete or not delete

I have set up a backup of some working folders of a server (running with Centos 7) to a remote disk using lsyncd. It's great, however I'm quite undecided about what to do about file deletion: If I ...
DylanM's user avatar
  • 113
2 votes
2 answers
61 views

Advertise HTTPS support without using HSTS

I have a website which supports HTTPS: all pages of the form http://example.com/foo can be accessed as https://example.com/foo (the query will return the same content). That said, the website doesn't ...
a3nm's user avatar
  • 919
1 vote
0 answers
39 views

How to install hadoop reusable on a local network?

For a multi-node image cluster on an institute, we have sevaral laptops and machines and we want to create a hadoop cluster with hbase on the top for indexing the data/images. I have tried some VMare ...
madik_atma's user avatar
-2 votes
1 answer
1k views

Should I open Active Directory to public Internet? [closed]

I am a network administrator and my windows support partner recommended to open active directory to public internet. reason is dns is configured on active directory with same server. But I never done ...
serverAdmin123's user avatar
0 votes
1 answer
1k views

puppet best practices: share variables among profiles

I'm using the roles&profiles approach for my current puppet project. The puppet best practices tell me: Expose all necessary profile parameters in the main class parameter list. Perform hiera ...
C.Scharfenberg's user avatar
17 votes
3 answers
27k views

Using "include" in Nginx server block and where to save the includes?

All of the examples I have seen, used "include something.conf" in the http block. Is it possible to use "include something.conf" in the server block? If yes, where is the best practice to save the ...
Call Me Hi Hi's user avatar
8 votes
2 answers
4k views

How to plan an Active Directory domain rename without it killing me?

It's looking more and more like I'll have to rename my Active Directory domain. There is a well-known process for making this change, including some very good answers on Server Fault already (like ...
Spencer's user avatar
  • 197
1 vote
2 answers
1k views

What is the downside of deleting an iptables rule as an attempt to check if it exists?

I want to add a rule using iptables, but only if it does not exist already. There's option -C which will allow us to check if a rule specification exists already. The option is described in this Q&...
Adelin's user avatar
  • 129
0 votes
0 answers
204 views

Use default `ubuntu` user to deploy an app or make separate users?

I have a Ruby on Rails app and use Capistrano to deploy it to the server. The deploy user and the user running the app is the same - the default ubuntu user. (this has sudo access: ubuntu ALL=(ALL) ...
Zabba's user avatar
  • 261
-3 votes
1 answer
75 views

Accepted standards for incremental or differential backups

I need to choose software for network backup (this is not a software recommendation question). I wonder if there are accepted standards for incremental or differential backups, so different software ...
hokisajam's user avatar
  • 103
-2 votes
1 answer
164 views

What is the Industry Best Practice for Updating Dell Drivers ? [closed]

Is it ok to upgrade to latest drivers whenever we provide it to end-user ? or we should keep the Drivers with OS which has been shipped by Dell along with OS Kindly suggest if there is any document ...
Pratik Bhatt's user avatar
5 votes
1 answer
159 views

What are the pros/cons of running Chef/Puppet at regular intervals?

I always worked where they used to run Puppet at regular intervals. So, distributing changes was easy and on the fly. In the new team, they frown upon running the Chef agent at regular intervals. They ...
deppfx's user avatar
  • 429
1 vote
3 answers
4k views

Best Practice: What domain admin credentials to use when adding/joining computer to network domain?

Environment: 1 Win2008R2 Network Server (also domain controller) 13 or so Workstations. Traditionally we've always used the server administrator credentials to join a workstation to a business domain ...
PeteB's user avatar
  • 11
21 votes
2 answers
2k views

Is it bad practice to declare MX from differing networks?

We're using a 3rd-party service provider to send transactional email. I recently noticed increased failure rates for a given receiving domain. The sends fail with the error "498 No MX for example.com"...
Oliver Salzburg's user avatar
3 votes
2 answers
2k views

New domain controller on a branch office: it is better to create a new AD site?

I am going to install a new DC on a recently grown branch site. I know that is a best practice to create a new site in Active Directory Site and Service, with the relative IP link cost and related ...
shodanshok's user avatar
0 votes
1 answer
497 views

Should I create a new user for each web app?

I have a VPS and I'm trying to gather the best practices in terms of user setup for web services. I have different services in my server (a cloud app, a streaming app, etc). What I do know is that I ...
Creak's user avatar
  • 101
4 votes
1 answer
632 views

Best Practice Moving a Hard Drive from one VMWare ESX Guest to Another

When removing a hard disk from a VMWare ESX virtual machine running Windows, is it best practice to shut down the server first or is there a minimal risk (if the drive is not being written to at the ...
Gabriel Graves's user avatar
1 vote
1 answer
289 views

Should apex (or zone root) records have a matching PTR/pointer record

I am aware that apex records (records at the zone "root") can have PTR records, but frequently I see that zone root records do not have a matching PTR, or they are pointing to a different place than ...
Watki02's user avatar
  • 627
3 votes
1 answer
434 views

Storing saltstack server configs in version control

I currently have a few servers that are managed by saltstack, every now and then saltstack fails to deploy the new configs because of an issue somewhere and it can take a while to work out what ...
Qwertie's user avatar
  • 205
1 vote
1 answer
687 views

Best practice: Wowza SSL Configuration

Screenshot: Server with Wowza running using a SSL certificate with basis configuration I get this result from the SSLLabs with the default configuration (see screenshot). The only places I can change ...
Thomas Ebert's user avatar

1
2 3 4 5
8