Practical advices from experienced administrtors wanted.

[JnPson]

Bump

[vikramk.ibs]

really good advice.

Thank you

[cprofitt]

I use Cacti to monitor the server (uses SNMP) and OSSEC to monitor the log files, etc. OSSEC is a Host Based Intrusion Detection System.

[JnPson]

Thank you. Much appreciated advices. I will gather all links to the different software and read-up to learn what it does and how it works.

[LHammonds]

Something not mentioned yet is the configuration of your partitions. It is usually the 1st thing that must be setup and impacts your system long after initial setup. There are a million ways to configure your system and the default layout is not the best for long-term management of your server. The major thing you need to avoid is the root partition filling up and running out of space. For security reasons and to keep data/temp files isolated, I separate my partitions out so that the root does not have ever-growing data in it. Look in my sig for info on how I configure my partitions using LVM and how I manage the growth automatically and how I allow myself time to grow my system by adding new drives far before they are needed.

I use Nagios to monitor my switches, printers, Windows servers and Ubuntu servers. It lets me know when there are problems but more importantly, it allows me to track growth over time so I can accurately predict space consumption since I monitor each drive individually. The reports allow me to show consumed/free space for a particular drive/partition over time.

I use a custom BASH script to automatically apply security patches. However, I do not let the server automatically reboot after a kernel update. I want to be there in case something goes wrong and it cannot boot up (prior experience with an infamous grub bug on 10.04). Nagios lets me know when a Linux server is wanting a reboot to apply a kernel update. I login to a non-critical server 1st and do the reboot to make sure the basic process will work. I then continue up the ladder to the most important servers. You can see the same script I use to automatically apply security updates in the Ubuntu Server link in my sig. I also have a link to how I setup a Nagios server (step-by-step)

I don't login to my servers daily. I only login when Nagios reports a problem (or a server wants a reboot) or a customer reports a problem with the system.

I don't "enable" the root account like many tutorials for Ubuntu 10 and below have recommended in the past. If I need root access for more than one command (such as during initial setup), I simply use "sudo su" which will give me a root prompt. However, I don't usually do that unless I need to manage the server in some way. I do have an "opm" script that I have setup for each of my servers that allows anyone in my IT group to login to a server and perform the usual tasks such as a reboot, restart of primary services or apply a security patch even if they are not very familiar with Linux systems. All they need to know is how to login and simply type "opm" to start up the menu. This is also in my Ubuntu server link in my sig.

I must also recommend that you have a good backup system put in place that will handle various likely scenarios. You need to know if your data should be restored by the hour, by the day, week, etc. and how far back you are expected to go and how granular. People always want the most for the longest amount of time but physical limitations usually prevent it. So you have to find a middle ground that handles the bulk of your risk. Such as being able to restore data/files to a certain point within the last 24 hours and maybe to the day for the last 7 days and maybe to the week for the last 4 weeks and one backup for the last 2 quarters and 1 for the year. Completely depends on your server, the data stored on it and how valuable the data is to the people using it. If it is a DNS server, you may only care about having a couple of good backups before the latest kernel update. If it is a mail server, it might be the most critical and require the most backups, etc. But no matter how your backups are configured, they need to be automated to a point, they need to be documented, they need to be verified and you need to have the restore process documented and verified periodically. I cover some ways to backup and restore at the partition level in the Ubuntu Server link in my sig. Other methods such as Rsync for data are covered in other application-specific threads in my sig.

Good luck,
LHammonds

[SirWeazel]

This is a great thread. The responses have been great reads and sound like the are from experienced people. I saw you asked about file permissions in a previous post. One of the best tutorials I've read was when i was setting up a media server. Maybe this read will help you.
http://wiki.plexapp.com/index.php/Pl...missions_Guide

[JnPson]

Thank you guys. Will read, will test and will learn.