Server Operating Systems and Server Roles Flashcards
server roles (planning)
- determine if multiple roles will be located on the same server or dispersed across multiple servers
- cloud VMs can offer services to other cloud devices/internet consumers/on-premise devices
configuring on-premise connections with VMs
- site-to-site VPN connections
- dedicated connections from on-premise networks to cloud provider networks (bypass internet)
DHCP
- dynamic host configuration protocol
- delivers central IP settings to network nodes
- can run on a server OS or as a service on a router
DCHP port numbers
- UDP 67 (listens for client requests)
- UDP 68 (sends responses to client requests)
DHCP scopes
- IP settings grouped into a manageable unit
- must be activated before they can be used in DHCP process
- IP address ranges
- IP address exclusions
- IP address lease duration
- default gateway
- DNS servers
- DHCP reservation
DHCP vendor classes
- apply specific IP settings to certain types of network devices
- must determine what vendor class data is included in network transmission
APIPA
- automatic private IP addressing
- clients use to assign itself a unique address on the LAN when can’t reach DHCP server
- client not able to communicate outside the LAN
- can only communicate with other APIPA hosts within the LAN
link-local address
- used in IPv6
- unique self-assigned address
- always bound to network interface whether or not DHCP is reachable
considerations for choosing DHCP configuration
- determine which valid IP address ranges can be used
- short lease duration in environments where clients connect for short periods of time
- try to specify at least 2 default gateways for redundancy
- try to specify at least 2 DNS servers for redundancy
- configure DHCP bindings for correct network interface in multihomed (multiple network card) DHCP servers
- high availability
DNS
- find IP address for FQDN (forward lookup)
- find FQDN for IP address (reverse lookup)
DNS port number
listens on port 53 (UDP/TCP)
DNS domains
- root domain at top
- TLDs (.com/.org/.net/etc)
- domains can have subdomains
- subdomains may have their own authoritative DNS servers
SOA (DNS RR)
- start of authority
- contains zone details i.e. serial number/refresh interval
- can exist in forward and reverse lookup zones
A (DNS RR)
- forward lookup record
- FQDN included in query
- IPv4 address returned
AAAA (DNS RR)
- forward lookup record
- FQDN included in query
- IPv6 address returned
CNAME (DNS RR)
- canonical name record/alias record
- additional name for an existing name
- can be used in forward/reverse lookup zones
- return FQDN that can be resolved via an A record
MX (DNS RR)
- mail exchanger
- used for email domain suffixes to locate an SMTP mail server
- return FQDN that can be resolved via an A record
SRV (DNS RR)
- service record
- used to locate a network service i.e. AD
- includes TCP/UDP port numbers for service
- clients query DNS SRV records to locate services
PTR (DNS RR)
- pointer record (reverse DNS record)
- created in reverse lookup zone
- client queries include IP address
- host/DNS domain name returned
- each PTR record should have an associated A record
WINS
- Windows Internet Name Service
- used in Microsoft TCP/IP networks prior to Windows 2000 to resolve NetBIOS computer names to IP addresses
- replicated database of NetBIOS computer names and their IP addresses
- no naming hierarchy
- installed as a feature on Windows server 2019 for backward compatibility
DNS GlobalNames zone
- client devices can point to a DNS server where a zone “GlobalNames” exists
- alternative to WINS
- DNS admins create CNAME records that point to A records
- enables older software using flat computer names to function through DNS
NTP
service running on network host to provide time synchronization
NTP port number
listens on UDP 123
stratum 0 (NTP)
time source/reference clock
stratum 1 (NTP)
NTP server connected to stratum 0 device
stratum 2 (NTP)
NTP server gets time over network from stratum 1 host
directory services (DS)
- centralized network database containing objects (users/groups/computers/network service locators/shared folders/shared printers/software licenses)
- Microsoft AD DS
- OpenLDAP
- Oracle Directory Services
- IBM Tivoli Directory Server
- based on the same LDAP standards
LDAP port numbers
- listens on TCP 389 (plaintext)
- listens on TCP 636 (encrypted)
AD
- Microsoft active directory
- LDAP compliant
- replicated network database
- synchronized between DCs
- group policy
- Windows server role
- installed via Server Manager or PowerShell cmdlets
DC
- domain controller
- server configured to hold a replica of the AD database
- C:\Windows\Ntds\Ntds.dit
- discovered by clients via DNS queries
- creation of DC creates DNS service location records
web server
- use HTTP/HTTPS to present content to web browser
- Microsoft Internet Information Services (IIS)
- Apache
- NGINX
web server ports
- TCP 80 (HTTP)
- TCP 443 (HTTPS)
application server
- serves data with a specific business purpose
- often combination of web/database servers
- Microsoft SQL Server
- MySQL
- Oracle Database
file server
- data stored on equipment owned/managed by the organization (legal reasons)
- Windows servers use SMB to make shared folders available over the network
- UNIX/Linux systems use their own network file system (NFS) but can use SMB via Samba
print server
- manages printers on a network
- spool print jobs from clients using server disk space
cloud printing
- remove any printing dependencies i.e. OS versions/print drivers/printing devices/etc
- can be used with mobile devices
mail server
- run as services (daemons)
- enable connections on specific ports
- need to support mobile device connections
MDM tools
- mobile device management
- mobile device partitioning solutions for personal/work data
- restrict file attachments from corporate messages from being stored on personal cloud storage locations
- can run on-premise or in cloud
SMTP
- simple mail transfer protocol
- port 25
- used to transfer email between SMTP hosts
POP
- post-office protocol
- port 110
- enables clients to download email messages from POP server
IMAP
- internet message access protocol
- port 143
- enables clients to use different email clients running on different devices to access email
- email synchronized between devices
multihomed servers
servers with more than 1 interface
RRAS
- routing and remote access service
- Windows server
- configure IPv4/IPv6 routing
- NAT
- VPN
UNIX/Linux RRAS services
- IP routing via ip command
- NAT configuration via iptables command
- OpenVPN
common virtualization solutions
- VMWare vSphere Hypervisor
- Microsoft Hyper-V
- Citrix Hypervisor
- Oracle VM VirtualBox
host in virtualization
hypervisor
guest in virtualization
VM
type 1 hypervisor
- hypervisor has direct access to physical hardware
- controls hardware resource access between VMs
- bare-metal hypervisor
- don’t rely on another OS (increased security)
- Microsoft Hyper-V
- VMware ESXi
type 2 hypervisor
- application that runs on top of existing OS
- doesn’t have direct access to hardware
- VMware Workstation Pro
- Oracle VM VirtualBox
hypervisor host configuration
type of IT workloads running in each VM is most important consideration
VM guest configuration
- similar to planning physical hardware for new server
- amount of startup/minimum/maximum/dynamic memory
- number of vCPUs and compatibility settings
- storage
- vNICs/connected virtual switches
- virtual MAC address
- network bandwidth throttling
- VLAN tag settings
- display settings for number of monitors/accelerated graphics
- integration tools with host hypervisor for time synchronization/backup services/etc
- snapshot/checkpoint settings
bridging (VLAN tag settings)
connects to physical network
NAT (VLAN tag settings)
uses hypervisor host IP address to access the network
VM to VM (VLAN tag settings)
enable communication only between VMs
VM and host (VLAN tag settings)
enables communications between VMs and hypervisor host
server installation
- hardware compatibility lists (HCLs)
- provide details about which specific hardware is supported by a given server OS
- also have to consider specific drivers/applications
- server OS minimum requirements
server licensing
- open source (Ubuntu Linux)
- per server models
- per instance models
- per core models
- volume licensing (Microsoft Key Management Service)
- subscription based licensing (AWS/O365/cloud)
- per user concurrent licensing
- node-locked (tied to specific device)
- digital rights management (signature-based used for gaming/use of media files)
installing type 1 hypervisor
- most modern type 1 hypervisors require 64-bit architecture/virtualization support
- not an issue with server class hardware
- firmware updates (BIOS/UEFI) may be required before installation
- may have to change boot order is installing from DVD/USB
common server OS’s
- Microsoft Windows Server
- Microsoft Windows Server Embedded (purpose specific hardware appliances)
- UNIX BSD/AIX/Solaris
- Linux Red Hat/Ubuntu/SUSE
server installation from an image
- apply already created image to new physical server or VM
- capture server OS image by booting from alternative media and using DISM
- multiple images can be stored via Windows Imaging Format (WIM)
- specify image with index DISM parameter
server installation from image tools
- Ghost Solution Suite
- Microsoft System Center Configuration Manager
- Microsoft Deployment Toolkit
- Microsoft DISM.exe command line tool
server cloning
- option to create linked clone (uses minimal disk space/linked to original VM)
- linked clone changes made after the clone is created are independent
- option to create fully independent clone (uses more disk space)
- work well when multiple VMs with same standard initial OS configuration are needed
- physical-to-virtual (P2V) cloning uses physical server as the source/results in a VM with same settings
VM deployment templates
- can be used to partially/fully automate VM deployment
- specify hardware details/OS options/network settings/etc
scripted server installations
- create answer file to automate some/all of the OS installation
- unattend.xml file created via Windows System Image Manager (SIM)
- name answer file tounattend.xml and place on root of removable media to be automatically read
PXE booting
- boot over network from a PXE
- enables OS installation from image/installation files
- can apply updates to source installation files before install via slipstreaming
- must be supported by physical/VM BIOS/UEFI settings and NIC
- must have PXE boot server listening on the network
- relies on DHCP to assign IP settings to PXE clients
- uses trivial file transfer protocol (TFTP) to download a small boot image OS used for installation/imaging
- Microsoft Remote Installation Services (RIS)
- Windows Deployment Services (WDS)
- don’t have to carry around storage devices containing installation media
- demanding on network bandwidth
installation details
- disk layout (partioning/file system formats/swap file/partition)
- server name
- IP configuration settings
- administrative user credentials
- additional drivers for nonstandard hardware
- product key or subscription details to activate installation/receive updates
- additional software that should be installed
- all of these can be included in Windows unattend.xml/autounattend.xml files
server administration methods
- GUI (MMC)
- command line
- physical serial ports
- remote server administration tools (RSAT)
KVM
- switches connect servers to a single keyboard/video/mouse
- KVM solution has to match connectors for devices
out-of-band remote administration
- provides hardware-level remote access to a host
- doesn’t rely on OS software running
- more secure than software-based tools
WBEM
- web-based enterprise management
- standardized way of managing/monitoring servers/devices from different vendors
LOM
- lights out management
- remote management solution supported by most vendors
- monitoring of server components i.e. CPU use/temperature/OS health/etc
KVM over IP
- enables remote server access even over internet
- can enable hardware level remote access if supported by server hardware
- not dependent on underlying OS
- TCP/IP settings must e configured at hardware level to enable remote access across WANs
KVM-over-IP switches
hardware appliances with centralized management/auditing tools
IPMI
- intelligent platform management interface
- remote server management solution
- commonly used with various vendor blade enclosures
- remote power on/off
- disk access
- server monitoring/inventory functionality
BMC
- baseboard management controller
- interface between server management tools and physical hardware being managed
iLO
- integrated lights out
- secure remote management capabilities
- server monitoring/alert capabilities
iDRAC
- integrated Dell remote access
- Dell servers
- connect to servers at hardware level
- web browser interface
- remote power on/off
- access to server storage media
in-band remote administration
relies on software running within OS
SSH
- needs server-side listener for clients to be able to connect
- standard listening port = TCP 22
- typically used for command line management
- can use public key authentication
X-forwarding
can be enabled within SSH to redirect graphical UNIX/Linux applications to show on client computer
RDP
- listens on UDP/TCP 3389
- newer versions of Windows server supported network level authentication (NLA) for RDP sessions
- get command prompt when RDP into server with core OS installed
benefits of NLA
- entering username/password uses client resources (not server)
- RDP sessions are encrypted with SSL certificate
powershell
- depends on Windows remote management (WinRM) service to be configured
- desired state configuration (DSC) enables configuring/managing Windows/Linux hosts centrally via a declarative syntax
WinRM port numbers
TCP 5985/5986
using winrs command outside of powershell
- execute commands remotely on Windows host
- need to ensure WinRM has been enabled
automating server administration via scripting
- placing commands in 1 or more script files
- invoking the script file
- have script invoked automatically during machine bootstrap process
server documentation
- each server needs documentation and change log
- ideally automated/inventoried in a database
- vendor manuals
- how solutions have been implemented
- keep documentation secure/encrypted
asset life cycle
- complete process of establishing new server/resource all the way to decommission/upgrade
asset inventory
- modern systems for inventory are automated
- physical equipment needs to be labeled or inscribed
- RFID tags easier in large environments
hardware inventory components
- make/model/serial number
- physical server owned/leased
- motherboard/device serial numbers
- physical/digital asset tag
- RAM
- storage
- network interfaces
- peripherals
reasons for hardware inventory
- inventory audits
- asset tracking
- determine asset use
- asset repair/warranty
- asset recall
- asset security
software inventory
- specific version of OS/drivers/applications in use
- software license compliance
- should be automated on scheduled basis
SLA
- service level agreement
- contract outlining expected service from a provider to consumer
- uptime
- response time
- providers may offer credits when SLA isn’t met
other documentation
- network infrastructure diagrams
- workflow/dataflow/application architecture diagrams
- baseline documentation
- recovery documentation
maintaining servers
- automation
- firmware/software updates timely deployed
- reports to confirm patches deployed successfully
patch management
- critical security updates
- functionality updates
- centralized update management
- Windows Server Update Services (WSUS)
- Microsoft System Center Updates Publisher (SCUP)
- vendor specific patch management solutions
- test updates in controlled environment before deploying them into production
proactive maintenance
- keep servers clear of dust
- keep obstructions away from intake fans
- keep servers cool
- plug servers in UPS to ensure graceful shutdown
reactive maintenance
- LED indicators on equipment indicate potential issues
- Error/beep codes
DNS server root hints
allow for internet name resolution
how to encrypt communications between web clients/server
- issue PKI certificate for web server
- install certificate on web server
- clients don’t need PKI certificate for secured web server traffic