Re: Learning on backup systems

On Thu, Dec 24, 2015 at 9:23 PM, Shrinivasan T <[email protected]> wrote:
> Those servers were built by few windows admins and they wanted to manage
> those servers them self.

It is apparent they were not experienced in the basics best practices.
I would have expected them to be aware of the points you have made in
your OP even for Windows server.

> All the setup docs, security settings were provided. But on seeing the
> applications up and running, they were happy and missed to complete the
> security and monitoring stuff.

> Found that the root password was kept very simple for easy to remember and
> same for all servers affected :-(

Please train them (at their expense) or fire them.  This is not
acceptable even in Windows environment.

> We missed to have an audit after the new efforts of windows people setting
> the linux servers.
>
> These caused horrible sleepless days/ nights and data loss. Collected most
> of the data from users machines and their personal backups. Still
> integrating them is another headache.
>
> Realised that security audits and penetration tests can save tons and tons
> of efforts and pains.

It pays to recruit an external company for the audit.  The internal
guys will tend to brush problems "under the rug" (I don't want to rat
on my buddy attitude).

Cheers,
-- Arun Khan
_______________________________________________
ILUGC Mailing List:
http://www.ae.iitm.ac.in/mailman/listinfo/ilugc
ILUGC Mailing List Guidelines:
http://ilugc.in/mailinglist-guidelines