Upgraded from F29 to 30, also switched to Deepin.
So far, I'm liking the Deepin desktop.

IMG_0747.jpg

dhcp

@flaxking said in Domain Trust Group Permissions:

@Obsolesce said in Domain Trust Group Permissions:

I use Domain Local groups for access control to local resources. You can have other group types as members, as well as groups from other trusted domains.

Right, but you can't then add that Domain Local group that has members from the trusted domain to a local group on the server.

Right, you wouldn't want to.

@manxam said in USG to EdgeRouter VPN:

Interesting. The last time that I looked at the GUI (as we typically use CLI for VPN), it didn't give the option of DH group like so :

alt text

Wonder in what version this changed?

It has had it for as long as I recall. At least 1.5.

The CLI has had it 100% of the time since release at version 1.2.0

Circling back to GPP. Thanks to @FiyaFly , who was able to help me out with the syntax for the fields. Do not use quotes in the target or start in paths.
Target Path:

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Arguments:

--incognito --proxy-server=squid1.domain.com:3128 --user-data-dir="%LOCALAPPDATA%\Google\Squid1\User Data"

Start in:

C:\Program Files (x86)\Google\Chrome\Application\

I also used the create option and desktop (standard, not all users desktop).

@Pete-S said in ZeroTier vs VPN:

@Kelly said in ZeroTier vs VPN:

In the strictest sense ZT is a VPN. It is just a one to one IaaS that is routed through the cloud on ZT's systems instead of your edge. You can achieve the same effective security through rules on most VPN servers. ZT just makes it simpler, and reduces your ongoing effort assuming that 1 to 1 or 1 to few is your primary access model.

I haven't used it but why does ZT makes it easier? You have to install it on every machine you want access to, right? And I assume you have to setup some kind of routing on a computer if you want access to something on the network where you can't install ZT, like an appliance or something like an ilo interface.

With an OpenVPN (SSL VPN) connection through the firewall you have a routable VPN and no NAT problems. You can put whatever access to whatever resources you want without installing anything anywhere. And you have everything in one place.

I though ZT was a peer to peer network. So it would make most sense when there are no LAN or central resources and everything is spread out. But that not the network layout in this case.

You do have to install it on every machine. It is easier in the sense that to achieve the same level of lockdown paired with user specific access you would need to do a fair bit of work on your edge and keep it maintained. Deploying software to clients should be pretty straightforward if you're using quality tools: https://chocolatey.org/packages/zerotier-one.

@dave247 said in Foreign B1 Visa employee scam?:

@scottalanmiller said in Foreign B1 Visa employee scam?:

Yup. Its decently well known. Happens in the US too.

What's the scam called so I can learn more?

That I do not know. I'm sure someone has come up with a name, but it's a simple impersonation scheme. It's not so much a specific scam as just generally one person impersonating another.

A ghost ship is when a ship (at sea) has lost its crew but doesn't sink and keeps on drifting. Software shops will often make software and keep selling it for years or decades after the "crew" who made it have left the company and the company can no longer maintain or update it (which often remains can't fully support). This is why client server software often exists... it was actually made by someone in the 1990s who has left and the company keeps selling it, but they can't modernize it because they don't have the skills remaining in house to work on the software.

@brandon220 said in Choosing KVM over Hyper-V....:

I have not tried to run a Windows vm on KVM yet....

KVM is specifically good for that.

@dafyre said in SSH-Copy-ID Being prompted for password:

@DustinB3403 said in SSH-Copy-ID Being prompted for password:

@dafyre said in SSH-Copy-ID Being prompted for password:

What I've seen is that ssh-copy-id will request your password since the remote machine doesn' thave you ID. After entering your password, it transfers the id, and you should be good to go.

Which password, the password for the local server that I'm running the copy from, the user password for that server?

The user password for the remote server.

That makes literally no sense, as it asks for the remote computer credentials after the 3rd Password prompt. . .

Personally my thing when advising people on this is £££££ you need to decide on what your budget is before looking at parts.

Some of my friends say they want high end 4K gaming but only want to spend £400 😄

So start with the budget then work around that 🙂

@black3dynamite said in Salt - Can't Connect to Minions After Adding Them to Master:

I sometimes have to add --timeout 60 so I can see a response
salt FP01.domain.local test.ping --timeout 60

Seems to be working. I think that it was the firewall needing the exception AND using the

--timeout 60

Thanks!

@scottalanmiller StarWind performance is really great! It's able to give 2 times better performance on read operations on HA device! Link to the Benchmark Best Practices document: https://www.starwindsoftware.com/best-practices/starwind-virtual-san-starwind-benchmarking-best-practices/

@Obsolesce ReFS is unstable, unfortunately. I saw the case when after power outage ReFS volume become RAW...

@manxam said in Phishing testing / awareness / training suggestions?:

MSPs can only purchase Platinum or Diamond I was told, and at a minimum of 101 seats @ MSRP -20%. So, a minimum spend of $2400 CDN for us and $3000 for the customer for their "recommended" tier (platinum).

Does the old adage apply here? "Gotta pay to play"...?

Well if you are approaching as an MSP, this is to be expected. You are assumed to be reselling the service. This is the only thing they allow to be resold.

You as the MSP buy 101 licenses and resell 10 each to a few clients at MSRP -5%.

If you get external DNS to go to the nginx proxy you could probably allow all traffic to the URL path that lets encrypt needs and then create a whitelist for everything else.

@DustinB3403 said in Fedora Salt Master - New installation:

@scottalanmiller said in Fedora Salt Master - New installation:

@DustinB3403 said in Fedora Salt Master - New installation:

And really, all I'm looking for is a convenient way setup my user workstations, and update them without the Apple overhead, including with brew commands.

This is my ML How Tos are better 🙂

I looked but didn't find one that was current.

Yeah, not sure that there is one. On Fedora 28 it was broken. On Fedora 30 I think it is just "dnf install salt-master -y" and you are done. So nothing to write up.

I think we are running Salt on Ubuntu now because of the breakage issues on Fedora.

@Dashrender is correct, you need to use a real VLAN for this.

Because this:

but ICMP, DNS, and DHCP are never isolated between lan and SSID, so pinging is not a valid test.

Is not true on a VLAN.

@black3dynamite said in FreePBX Desktop Video Conferencing Options:

Have you already check with linphone if it does video conferencing?

In theory it does. Linphone desktop has been pretty flaky for us so were looking at alternatives.