Server Administration Guidelines
As an Application Administrator of a virtual or physical server in the Texas State University data center (whether on-premise or cloud), you and the Technology Resources Systems Administration Team have specific responsibilities and must work together to maintain a safe and secure environment for the university and its data. You are also responsible for ensuring that external vendors and contractors follow these guidelines.
State Laws and University Policies
All parties must adhere to applicable federal and state laws, university policies, and information technology best practices and procedures.
- Texas Administrative Code 202 (TAC 202)
- UPPS 04.01.09 - Server Management Policy
- UPPS 04.01.01 - Security of Texas State Information Resources
- UPPS 04.01.05 - Network Use Policy
- UPPS 04.01.11 - Risk Management of Information Resources
TXST Shared Responsibility Model
| Systems Administration Team | Software | Installation | Install supported Operating System and configure it to TXST IT best practices. |
| Updates | Update operating system on virtual and physical servers in the TXST data center on a scheduled basis defined by the TXST Systems Administration Team. Out-of-band patches may be applied on an accelerated basis depending on severity. Any deviation from the automated process, application administrators may opt to be responsible for updates. | ||
| Shares/Mounts | Create shares which must be restricted per best practices for the specific protocol used. (e.g., Windows SMB Shares must be controlled by a FileShare group, or NFS Mounts must be controlled via an Access List.) | ||
| Hardware | Compute | Responsible for uptime/maintenance of hardware. | |
| Storage | Configuration/maintenance/monitoring of central or dedicated storage. | ||
| Networking | Ensure uptime and connectivity to TXST network. | ||
| Services | Backup | Backups will be available to physical and virtual systems hosted in the data center under IT division control. | |
| Firewall | Ensure the host-based firewall is installed, configured and enabled. Requests for firewall modification can be submitted through a Server Support Request. | ||
| Authentication | Administrative access to the server must be through a Super User (SU) account and local accounts are not permitted. Where Active Directory groups are used to control access, the groups are maintained via the Role Management tool in the Online Toolkit. Two factor authentication (such as Duo) will be required for administrative access. | ||
| Application Administrator | Application Support | Installation | Responsible for installing authorized software that is required for the primary application of the server and is authorized by the data security plan. See below for more information on authorization policies. Note: Microsoft Windows Roles should be installed via a Server Support Request. Note: The software must be authorized by the Information Security Office and the System Administration Team. Services such as FTP, OpenSSH for Windows, and File Sharing may not be installed by the application administrator. Any requirement for this should be requested to the System Administration Team. |
| Configuration | Responsible for configuring application to University policy and best practices. | ||
| Updates | Update applications on a scheduled basis (at minimum quarterly). Urgent security updates should be evaluated and applied as soon as possible. | ||
| Support | Work with vendors to support issues with performance, installation, or configuration of the application. Note: Systems Administration Team will work with the Application Administrator if changes need to be made at the OS level. | ||
| Application Security | Encryption | Any services that make use of authentication must use an encrypted method for passing authentication credentials. SSL Certificates can be requested here. | |
| Logging | Event logging must be enabled on all applications/services to include access and configuration changes at a minimum. | ||
| Auditing | Access to servers must be audited periodically by the application administrator. Potential methods for review can include Role Management and within the application itself. If contacted by Texas State Division of Information Technology staff about software or configurations on a server you maintain, application administrators are expected to respond ASAP. | ||
| Access | Applications and/or services may not be used until they have been authorized for use by the Information Security Office. Depending on the scenario, authorization steps may include, but are not limited to, the creation of a data security plan, completion of a vulnerability scan, and remediation of identified vulnerabilities. All authentication to a server must be via a valid named account. Super User accounts are to be used when remotely administering systems (such as via Remote Desktop or SSH). Service accounts will not be used to remote desktop or remotely administer systems. Any exception to thus must be authorized by ISO and TR. |
Onboarding Checklist
Ensure your software is evaluated and authorized by the Information Security Office.
- Request a server to be provisioned. This will route to the Information Security Office for a review of the system prior to the Systems Administration Team provisioning the server. You may request a DNS alias (CNAME) at this time.
- Install and configure your system.
- Application support issues should be referred to your vendor.
- If your vendor needs access to the system, please see the Server FAQ page.
- Requests for support regarding the server itself can be made through a Server Support Request.
- If your service needs an SSL certificate, please request via the SSL Certificate Request.
- Any file shares should be requested through a Server Support Request.
- IMPORTANT: You are not authorized to use this application in a production manner until ISO signs off on your vulnerability scan.
- Production means having users log in and use the application for its intended design with real data. You may only test until the application is authorized.
- Application support issues should be referred to your vendor.
- Request a vulnerability scan. Issues discovered during the vulnerability scan will need to be resolved before proceeding.
- If your server will only need to be accessible on the TXST network or through VPN.
- Request changes to the server's host-based firewall.
- If your server will need to be accessible via the internet (not through VPN)
- Request a firewall exemption.
- Request changes to the server's host-based firewall.
- If you are requesting a third level (X.txstate.edu), please submit a URL Request.
- These are heavily restricted and governed via UPPS.04.01.08
- Server Support Request
- If you are requesting a third level (X.txstate.edu), please submit a URL Request.
Tasks prohibited on University servers without authorization
Installing or running services that include, but not limited to,
- Active Directory Services
- DNS
- DHCP
- SSH on Windows
- FTP/SFTP/FTPS
- Web browsing
- Checking email
- Using as a primary desktop
- Installing software not authorized by the Information Security Office or Systems Administration Team.
- Free software must still be evaluated for use.
- Installing software not required for the main function of the server.
- Circumventing controls established by TXST IT.
- Modifying host-based firewall.
- File share creation
- Use of packet capture applications such as Wireshark.
Authorization for these tasks must be requested through the Systems Administration Team. You may be required to get additional authorization from the Information Security Office.