Moving everything off site...

[MrB398]

I have been working for a small company for about 3 months now, and I am the only IT person here on site. My primary duties include setting up and maintaining software, keeping the website up to par, ect.

However there is this other guy who we call in for technical stuff, like networking maintenance, hardware installation, ect. I'm more of a programmer than anything.

My boss swears by this guy, but I think this guy is simply abusing my boss's trust in him, but I'm not much of a technical buff, so thats why I'm asking for opinions here.

We have 3 servers on site
1 holds and runs our accounting software,
1 is our mail server
1 performs functions I can't quite determine. I believe this guy is using it host his non business related websites, but it's password protected and I can't see to much when I log in.
I believe all these things could have been easily put on 1 server, but our guy recommended the extra servers (my suspicion is so he can host his sites for free)

I just got an off site server package to put our website on. It has a 1000GB monthly limit, and our website might use 25-30GB per month at the most.

Our guy wants to move everything off site now, but he won't consider using the server I just orders recently. He is persistent we get 2 off site servers with unmetered bandwidth. My belief is he wants to order these other two servers because he will have access to them and can run his websites off site without risk of getting caught because no one here knows anything about computers except for me and he won't hardly ever have to ever come here to fix anything.

However I brought up a few points about moving everything off site, such as the security risk I would imagine all our customer information would be faced with as it traveled from point A to external point B, how we will use our accounting software if the internet goes down (which it frequently does here because this guy rigs stuff to break). But since I'm newer and younger than this guy, my boss really wont hear my points, he tells me to ask this guy cause he's the best.

Is their anything I can do or bring up to make it obvious this guy just uses us for our servers?

 

[OoteR02]

I would get permission from the boss and portscan the outside IP (found by browsing to www.ipchicken.com from within the companies network) and see what is running on that box.

Do you login to a domain? it could be as simple as that extra PC is a domain controller, but outsiting that is just insane.. Offsiting the accounting software seems foolish as well.

As for moving the hosting to a shared account, that doesn't seem like a bad idea depending on what is on the site itself.

Otherwise, I dunno, maybe the guy is legit, and knows more than you or I do about what the company needs.... The offsite accounting software seems like bad news though... not to mention unmetered servers cost a premium (10mbps can be cheap.. anything more is mid to higher $$$ a month)..

 

[nweaver]

Yeah, I wouldn't do "unmetered" stuff, just get what you think, pay overage fees and up the amount next month. It's like getting "unlimited" gas, and only using 20 gallons a month. Makes no sense. Unmetered is for VERY specific things, such a testing and busy sites. I have 4 unmetered sites, and we pay a lot for those.

Ask the guy to provide a buisness case for moving servers. Yours should be to move ONLY the web site (as it will have faster speeds, not be prone to dark periods if you net access goes down, then have rudundent power/network etc. The reason to NOT move the other 2 servers is they are local stuff (accounting, and whatever "other" duties this one is running.) Also, when you have the boss there, point blank ask him what network services that other server is running.

 

[kevnich2]

Haha, this sounds exactly like what happened to my last company 2 years ago, haha. Oh well, anyway. As far as moving servers offsite, I would ONLY recommend moving your web server offsite. A web server for business needs to have maximum uptime and for about $100-$150/month, you can get a server or a VPS account with a company that has multiple backbones and is setup just for this. Everything else needs to stay onsite, there is absolutely no reason to put the other servers offsite, you're just asking for trouble. As far as the other 3rd server, I would do as others have said and run an outside port scan and find out what exactly is running on that box.