In this lesson, we were going to talk about some basic management tests to keep your Mako's server
running.
Well, first we will discuss security.
This is by no means an exhaustive overview of all you need to do to harden a production MAC server,
especially if it is going to be Internet facing the hyperlink included in this lesson.
We'll cover this in much more detail.
This is simply a few basics that I want to make sure I cover.
First is encryption using firewall to secure the bootable drive is recommended, although depending
on the environment your Mac is housed in and may not be necessary, and there may be a trade off in
disk speed and performance depending on the use of your server.
I recommend using the recovery key and keeping a copy of that key somewhere safe, once you enable file
vault, it will begin encrypting.
Next, we have the built in firewall, this only monitors inbound connections, so be aware that if
you want to monitor outbound connections, you will need to purchase a third party firewall solution.
Clicking on firewall options provides us with some additional options and allows you to block all connections
except basic services.
You can see the defaults for allowing built in software and software to run without issue.
Stealth mode may be a good idea for your server.
Enabling this will not allow it to respond to scanning applications or ping requests, for example,
allowing it to not be found by malware or other things that may be running on the network scanning for
available open ports and servers.
Next, let's talk about the login window, if you're a Mac server is not running headless or if you're
allowing a remote desktop screen sharing, you will want to double check some options here for good
measure, you're going to want to make sure that all log in is turned off and to display the login window
as a name and password, not a list of users.
You should also uncheck the show sleep restart and shut down buttons on the login window.
So a user who has access to the login window cannot shut down your server without authentication.
First, next click on guest user and make sure it's off or disabled, specifically the guest user access
to shared folders.
All right, next, let's talk about backing up your server, first of all, set up an external device
as a time machine backup.
I have a USB disk attached to my Mac, and I'll begin by formatting it for HFS plus only in a time machine.
Next, let's open the time machine system preference and select the drive as our backup disk because
the server will likely have sensitive data on it and because it's possible that someone in my organization
may get physical access to the server and could remove my time machine drive, I'm going to encrypt
my backups so that it can't be mounted on another device without my password.
Make sure you use a password for the encryption that you won't forget.
Now we will let it format the disk and prepared for usable time machine.
If you aren't familiar with time machine, MapQuest uses it to back up several iterations of the entire
startup drive until the time machine disk is full and then it overrides older backups, you always have
a full disk backup and iterative backups basically happen daily or on a regular basis when anything
changes on the drive.
I like to add time machine to my menubar so that I can get a visual indicator if it's backing up or
if there's a problem with the backup now, having a backup on an attached disk is good, but it's far
from a foolproof method.
In fact, I wouldn't really call it a backup at all.
Ideally, you should be using a cloud service to back up and take this data off site.
A popular one that's used often is crash plan, which is pretty moderately priced and backs up your
data to their cloud server.
So it's not on the same premises as your server.
Other options, if you're inclined to do a little more manual backup or have data that is static enough
to be scheduled weekly or biweekly, consider a Google Drive one drive Dropbox or even iCloud if you
do purchase the additional storage option.
Next, let's talk about energy saver settings for your server from a connectivity and performance standpoint,
you want to make a few changes here.
First, check the box that prevents the computer from sleeping when the display is off.
That is important to make sure your server is online and available immediately when needed.
I also recommend on checking the box for putting the hard disk to sleep when possible.
Another thing you may want to do is schedule automatic restarts of the server during maintenance periods,
click on the schedule button and set your desired time and date.
I'm going to set this for Sunday's at 3:00 in the afternoon so I can verify my server has rebooted and
is ready for the work week on Monday.
Finally, let's talk about software update, it's always a good idea to keep your server patch to the
latest security updates.
However, depending on the applications you are running on the server, you may not want to leave it
to automatically update the OS and Appstore apps.
While you may be tempted to check the box to automatically update note that it will also include OS
and application updates, so you may want to modify this a bit to suit your specific needs.
I like to control OS and app updates myself, but leave system data and security updates to automatically
install in most cases.