Questions tagged [best-practices]

Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

Upgrade-Insecure-Requests with lighttpd

I'm using lighttpd to serve a site over HTTP and HTTPS (the two versions are identical). I do not wish to stop serving it over HTTP or to forcibly redirect users to the HTTPS version, and I do not ...
0
votes
0answers
15 views

nginx best practie: Listen to IP wildcard or public IP only

So I was wondering on which one of these was considered to be best practice IP Wildcard server { listen 80; listen [::]:80 ipv6only=on; # I know ipv6only=on isn't needed on older ...
0
votes
0answers
22 views

Security best practice: revoke execution (-x) permissions for directory, or do recursively to change every contained file?

I have a question about security best practice when configuring a device to be used to users, who should be able to use a programme, but not modify the system. Let's say I have a folder /opt/myapp ...
0
votes
1answer
99 views

DMARC strict vs relaxed alignment?

I've been configuring DNS records for a mail server and got stuck when it came to DMARC's alignments. I know that both relaxed and strict are valid options, as well as relaxed being default setting. ...
0
votes
0answers
44 views

Best practice installation of Docker on Ubuntu

When installing Docker on an Ubuntu machine, there are several competing ways to install it, that seem to be the best practice according to someone. Specifically, you can install according to the ...
0
votes
0answers
20 views

Providing Support from Jumphosts using Site-to-Site VPNs

To provide support for our customers, our support staff has to establish VPN connections in order to connect to hardware devices that are located in the networks of our customers. Due to security ...
2
votes
0answers
34 views

ZFS3 Lost Resilience. Is Read-only Safer than Letting Users Carry on Writing Files?

Three lovely ST8000NM0075 Seagates drives supplied by Dell, all suddenly failed in a RaidZ3, that's now four within 3 years and 4 months. I didn't anticipate this and only have one spare to plug in. ...
0
votes
0answers
17 views

Is there a best practice for storing sensitive data in Amazon RDS?

I've got an Aurora DB that's going to contain a key and two sensitive fields, like so: | Key | Sensitive1 | Sensitive2 | |--------------------------------------|----...
3
votes
0answers
350 views

Docker + IPv6 - what is the best practice?

I want to build IPv6-ready services with Docker that can reach v6 hosts on the external network and can be reached from the external v6 network. I'm really confused with all that right now, so I want ...
1
vote
2answers
109 views

Should I partitionning a disk LVM?

I have some few servers (Ubuntu 16) and it's a mess who LVM was configured and used by my predecesor (for me, maybe is not). I have to install new server (Ubuntu 18) but I won't do a mess like is it ...
0
votes
0answers
34 views

Looking for best practice network configuration

I'm looking for a best pracitce approach for the following scenario. (simplified) There is a service running in the network multiple times (cluster, master/slave, ...). In this example let's take ...
2
votes
3answers
211 views

Server OS on an internal USB flash drive - is this standard practice today?

While chatting with a sysadmin colleague of mine about setting up a small server for me, I found out something interesting - most servers these days apparently contain an internal USB port which can ...
0
votes
1answer
64 views

Allow caching of share - roaming profiles - WS2016

I have a WS2016 that is running roaming profiles for users. Within the SMB file share, the option: "Allow caching of share" is enabled and was enabled by accident upon creation. There are already ...
1
vote
2answers
289 views

Migrating application servers to new domain

I work in a corporate environment which has recently been merged with another like business. There is an ongoing project to take our legacy Windows Servers and migrate them to an entirely new Windows ...
0
votes
1answer
44 views

How to react on vulnerability scanning?

We noticed that our server is being scanned for standard vulnerabilities like publically exposed myphpadmin and other common security configuration mistakes / failures. What is best locations to ...
0
votes
0answers
528 views

Backup best practice with lsyncd: delete or not delete

I have set up a backup of some working folders of a server (running with Centos 7) to a remote disk using lsyncd. It's great, however I'm quite undecided about what to do about file deletion: If I ...
2
votes
1answer
32 views

Advertise HTTPS support without using HSTS

I have a website which supports HTTPS: all pages of the form http://example.com/foo can be accessed as https://example.com/foo (the query will return the same content). That said, the website doesn't ...
1
vote
0answers
31 views

How to install hadoop reusable on a local network?

For a multi-node image cluster on an institute, we have sevaral laptops and machines and we want to create a hadoop cluster with hbase on the top for indexing the data/images. I have tried some VMare ...
-2
votes
1answer
272 views

Should I open Active Directory to public Internet? [closed]

I am a network administrator and my windows support partner recommended to open active directory to public internet. reason is dns is configured on active directory with same server. But I never done ...
0
votes
1answer
289 views

puppet best practices: share variables among profiles

I'm using the roles&profiles approach for my current puppet project. The puppet best practices tell me: Expose all necessary profile parameters in the main class parameter list. Perform hiera ...
8
votes
2answers
2k views

How to plan an Active Directory domain rename without it killing me?

It's looking more and more like I'll have to rename my Active Directory domain. There is a well-known process for making this change, including some very good answers on Server Fault already (like ...
1
vote
2answers
312 views

What is the downside of deleting an iptables rule as an attempt to check if it exists?

I want to add a rule using iptables, but only if it does not exist already. There's option -C which will allow us to check if a rule specification exists already. The option is described in this Q&...
0
votes
0answers
46 views

Use default `ubuntu` user to deploy an app or make separate users?

I have a Ruby on Rails app and use Capistrano to deploy it to the server. The deploy user and the user running the app is the same - the default ubuntu user. (this has sudo access: ubuntu ALL=(ALL) ...
-3
votes
1answer
63 views

Accepted standards for incremental or differential backups

I need to choose software for network backup (this is not a software recommendation question). I wonder if there are accepted standards for incremental or differential backups, so different software ...
-2
votes
1answer
63 views

What is the Industry Best Practice for Updating Dell Drivers ? [closed]

Is it ok to upgrade to latest drivers whenever we provide it to end-user ? or we should keep the Drivers with OS which has been shipped by Dell along with OS Kindly suggest if there is any document ...
5
votes
1answer
109 views

What are the pros/cons of running Chef/Puppet at regular intervals?

I always worked where they used to run Puppet at regular intervals. So, distributing changes was easy and on the fly. In the new team, they frown upon running the Chef agent at regular intervals. They ...
0
votes
3answers
994 views

Best Practice: What domain admin credentials to use when adding/joining computer to network domain?

Environment: 1 Win2008R2 Network Server (also domain controller) 13 or so Workstations. Traditionally we've always used the server administrator credentials to join a workstation to a business domain ...
21
votes
2answers
2k views

Is it bad practice to declare MX from differing networks?

We're using a 3rd-party service provider to send transactional email. I recently noticed increased failure rates for a given receiving domain. The sends fail with the error "498 No MX for example.com"...
3
votes
2answers
781 views

New domain controller on a branch office: it is better to create a new AD site?

I am going to install a new DC on a recently grown branch site. I know that is a best practice to create a new site in Active Directory Site and Service, with the relative IP link cost and related ...
0
votes
1answer
33 views

Should I create a new user for each web app?

I have a VPS and I'm trying to gather the best practices in terms of user setup for web services. I have different services in my server (a cloud app, a streaming app, etc). What I do know is that I ...
4
votes
1answer
110 views

Best Practice Moving a Hard Drive from one VMWare ESX Guest to Another

When removing a hard disk from a VMWare ESX virtual machine running Windows, is it best practice to shut down the server first or is there a minimal risk (if the drive is not being written to at the ...
1
vote
1answer
169 views

Should apex (or zone root) records have a matching PTR/pointer record

I am aware that apex records (records at the zone "root") can have PTR records, but frequently I see that zone root records do not have a matching PTR, or they are pointing to a different place than ...
3
votes
1answer
219 views

Storing saltstack server configs in version control

I currently have a few servers that are managed by saltstack, every now and then saltstack fails to deploy the new configs because of an issue somewhere and it can take a while to work out what ...
0
votes
1answer
340 views

Best practice: Wowza SSL Configuration

Screenshot: Server with Wowza running using a SSL certificate with basis configuration I get this result from the SSLLabs with the default configuration (see screenshot). The only places I can change ...
1
vote
2answers
1k views

Do password expiry rules reducing the security of the system?

The problem I regularly have a debate with my CTO which usually begins something like this ... CTO: My password expired, that should never happen. Me : It's a security risk to never expire ...
0
votes
2answers
38 views

Bypass Browser Cache with Server Settings in Large Production Environment

We recently applied a patch to our ERP system that updated HTML, JavaScript and CSS files. After applying the patch a large volume of users called the help desk to report loss of functionality on the ...
-2
votes
1answer
56 views

What are the dangers of buying a windows entreprise key online? [closed]

For multiple reasons I've settled on using Windows 10 Enterprise LTSB. Apart of getting a fake key or getting a legitimate key revoked, what are the dangers of purchasing / applying an unknown ...
20
votes
4answers
12k views

Is there any reason to allow SMB over the internet?

I'm an admin at a hosting company and I deal primarily with Linux machines though we have plenty of customer with Windows servers. In my capacity I have only ever used SMB for a file / print server ...
0
votes
1answer
43 views

Git branches for managing machine specific scripts and timers: OK or bad idea?

I have a bash script that I need to run on multiple (personal) machines, using systemd timers. While largely similar, there is some functionality in these scripts that I need enabled on some machines, ...
96
votes
10answers
10k views

Is it better practice to buy RAID disks individually vs. in bulk?

This may sound like an odd question, but it's generated some spirited discussion with some of my colleagues. Consider a moderately sized RAID array consisting of something like eight or twelve disks. ...
2
votes
3answers
458 views

Hypervisor server Local storage Raid configuration

We have a couple of Dell PowerEdge R630 running Hyper-V and just bought new hard disks to fill all the empty slots. I was wοndering what kind of Raid configuration should we proceed. Currently each ...
2
votes
2answers
513 views

Solaris 11 ZFS Snapshot vs. New Boot Environment

I'm new to Solaris 11 and I have to apply updates. I read that you can create a ZFS snapshot -- apply updates -- then revert the snapshot if things break. I also read that you can create a backup of ...
4
votes
2answers
135 views

best-practice for mid-sized shared storage

Our old 32TB RAID6 (net capacity: 26TB) system is showing its age and requires an upgrade, so we are currently thinking about building up a new 100TB system. The storage is mostly used for our user's ...
2
votes
1answer
688 views

Group Managed Service Accounts per service per server (Best practice?) and long names?

I've talked with a few colleagues about what might be best practice for using group managed service accounts in our environment. It seems that ideally, we would create 1 gMSA per service (e.g. SQL ...
0
votes
2answers
89 views

FTP Server 'Netiquette'; Are fast and frequent Connect/Transfer/Disconnect session acceptable?

some code of mine is using a queue to upload files to an FTP server. When files get queued, a connection attempt is made and, if successful, files are uploaded. Once the queue is empty it disconnects ...
1
vote
2answers
395 views

How should web servers handle requests with incorrect Host header?

I am getting a number of requests to my site with the Host header set incorrectly (most commonly to the IP address instead of domain name). Currently I am returning 400 Bad Request. I am thinking of ...
3
votes
1answer
500 views

Is having an IPv6 reverse lookup zone necessary for an Active Directory network?

Is having an IPv6 reverse lookup zone necessary for an Active Directory network? Normally I would just create it and move on, however, in this case the prefix is delegated and changes occasionally. ...
1
vote
0answers
112 views

Serving dynamic website to multiple domains

I have created a website with a tiny administration panel that lets the owners change attributes about the site (primary color, background image, some content etc). Their changes are stored in a ...
0
votes
1answer
121 views

How do multiple devops manage single chef cookbook?

I have created a cookbook and I am using manage.chef.io to host and deploy it. I have hosted the cookbook in GitHub private repo. Consider a scenario: If I make some changes in the cookbook and ...
40
votes
3answers
19k views

Ansible security best practices

I am going to introduce Ansible into my data center, and I'm looking for some security best practice on where to locate the control machine and how to manage the SSH keys. Question 1: the control ...

1
2 3 4 5
7