IT Discussion

• J

  Public Web Meeting Options
  • JasGot  

  14
  0
  Votes
  14
  Posts
  154
  Views

  

  @Pete-S said in Public Web Meeting Options: I'm thinking about setting up Jitsi on one of our colo servers. It works great. We have one, too.
• 

  Distro for school work?
  ubuntu linux desktop • • Pete.S  

  17
  0
  Votes
  17
  Posts
  204
  Views

  

  @JaredBusch said in Distro for school work?: @Pete-S said in Distro for school work?: Installed minecraft as well and it was really easy. Just click on the link to the deb package and you're done. Apt package manager will pull in java and whatever else that is needed. https://launcher.mojang.com/download/Minecraft.deb Webcam works, tested it with cheese, which is installed by default. All in all a smooth experience and mission accomplished. If Roblox worked on Linux I could switch my kids. Those are the only two PC games they play at the moment. Same
• 

  MeshCentral - Anyone tried this?
  meshcentral remote access • • Kelly  

  78
  1
  Votes
  78
  Posts
  1315
  Views

  

  @scottalanmiller said in MeshCentral - Anyone tried this?: @IRJ said in MeshCentral - Anyone tried this?: @JaredBusch said in MeshCentral - Anyone tried this?: @IRJ said in MeshCentral - Anyone tried this?: @JaredBusch said in MeshCentral - Anyone tried this?: @IRJ said in MeshCentral - Anyone tried this?: @Grey said in MeshCentral - Anyone tried this?: @JaredBusch said in MeshCentral - Anyone tried this?: @Grey said in MeshCentral - Anyone tried this?: Does the software establish a connection outside the managed network or do you have to vpn to the network to reach the management server? It all runs on HTTPS connections. I asked if I need to be on the highway to get to my destination, or if I can take surface streets and you told me to use snow tires. WTF? I mean it's up to you how you want to design it. I would say putting it behind a VPN is the smart way to do it. Like mentioned earlier, it isn't necessary. However, it greatly reduces your attack surface. What attack surface? The only thing you access is the web interface. That's still a surface. Why even let attackers get to a management server to attempt a brute force or DoD? And that is different from letting an attacker attempt to brute force or DoS a VPN? You always have an open port to come in. That is true, but it doesn't reveal what's behind it. Something like mesh central would be something an attacker would be interested in, but if it's behind your VPN sever they have no clue its even there. Except VPNs are far better known and more "interesting". Nothing says "I've got something to hide that I think is valuable" like a VPN. VPNs are big advertisers that someone believes they have something worth something. So what? Now you have to break into the VPN and mesh central. It makes it harder for an attacker. Breaking into the VPN doesn't net you much if your traffic is encrypted internally, in fact you are in the same spot as having all your valuable assets public facing. VPN is easy to implement with minimal hardware in an immutable fashion and gives you an extra layer of defense that is quite difficult to breach.
• 

  No more excuses - Get cloud certified
  • IRJ  

  1
  8
  Votes
  1
  Posts
  84
  Views

  No one has replied

• J

  NZ and AU - voip numbers
  • jk  

  3
  1
  Votes
  3
  Posts
  61
  Views

  

  Yessir, I can help. Hit me up and we can talk options!
• 

  RDP to RDP to RDP?
  • Pete.S  

  20
  0
  Votes
  20
  Posts
  247
  Views

  

  @stacksofplates said in RDP to RDP to RDP?: @Pete-S said in RDP to RDP to RDP?: @Obsolesce said in RDP to RDP to RDP?: @Pete-S said in RDP to RDP to RDP?: Purdue Model Except that model is basically dead... https://dale-peterson.com/2019/02/11/is-the-purdue-model-dead/ No, not at all. You have to listen to the whole thing if you are going to draw any conclusions. Can't just google and use the headline It really is. It’s overly complex and has much less return on investment and security than something like the zero trust model. I'm not an ICS infosec expert. I just know what enterprises that have big plants in the oil & gas, pulp & paper, chemical industry have and what they have is what I said they have. And if I look at Homeland Security, NIST etc what they have as best practice is what the customers are doing. Will it change in the future? Sure, everything does.
• 

  Kr00k Wi-Fi Encryption Vulnerability Affects Over a Billion Devices
  • IRJ  

  1
  1
  Votes
  1
  Posts
  63
  Views

  No one has replied

• W

  Fedora 31 Server, podman and SELinux
  • Woti  

  41
  0
  Votes
  41
  Posts
  557
  Views

  W

  As for now the server is rebooting once or twice in a month due updates. There's no big problem to start the service manually. Maybe one day we figure out why it isn't starting automatically. Anyway. Thanx for your effort to get rid of the SElinux problem.
• 

  Virtual team ideas?
  road warrior virtual team • • Pete.S  

  9
  1
  Votes
  9
  Posts
  195
  Views

  

  @DustinB3403 said in Virtual team ideas?: Time sensitivity is important, people have a hard time showing up on time for a meeting physically. Making people wait with a headset on is just additional irritation that they won't take well. I personally always show up early 1-5 minutes for a meeting. If I had to wait an additional 15 I'd be using collage rules and counting my attendance as there even if the host isn't. I think putting a headset on is easier than going to room a people honestly.
• J

  ? Need help getting Postcards from Skyetel working........
  • JasGot  

  7
  1
  Votes
  7
  Posts
  97
  Views

  

  @JaredBusch said in ? Need help getting Postcards from Skyetel working........: when not fully setup to be agnostic and fully contained correctly, docker sucks as a deployment solution. Exactly. It CAN be an amazing tool, when used correct. When not, it is a train wreck. TL;DR: Docker is a tool, not the solution.
• 

  Stop Raspbian Buster on Raspberri Pi Stop Blanking Screen
  linux raspberry pi debian raspberry pi 4 raspbian debian 10 screensaver raspbian buster • • scottalanmiller  

  1
  1
  Votes
  1
  Posts
  56
  Views

  No one has replied

• P

  Apple 2FA
  apple authentication 2fa • • pmoncho  

  29
  0
  Votes
  29
  Posts
  118
  Views

  

  @travisdh1 said in Apple 2FA: @Dashrender said in Apple 2FA: @JaredBusch said in Apple 2FA: @black3dynamite said in Apple 2FA: Allow approval from notifications. But it's disabled if you enable Authy protection PIN. @Dashrender read the entire fucking line.... The app supports it unless you proctect it in the first place. which you should.. It has nothing to do with the service. I don't recall such a conversation - I'm specifically talking about push notifications - I was unaware that third parties were able to register for and receive push notifications like Google and MS (and frankly Apple) provide their MFA apps. This is a whole other topic again. When do you think apps stopped being able to do push notifications? That's all it is. huh? The MS authenticator registers itself for push notifications from MS, GA does from Google - are you saying you can do that with Authy for google and microsoft services? I completely understand that I can add TOTP to Authy for MS and Google, but I quoted and am specifically asking about push notifications from those via Authy. My google foo is finding nothing but people bitching about how authy does NOT support push, but does support TOTP. Now all that said - I see that Authy has created One Touch - and that One Touch as an API that allows push notifications, but I can't find anywhere that says that Google/MS have enabled that feature.
• 

  Automox free for 60 days and we won't call or email you
  • Nic  

  1
  12
  Votes
  1
  Posts
  79
  Views

  No one has replied

• 

  SOLVED Questions on Dell XPS 13 2018 year model
  • Pete.S  

  11
  0
  Votes
  11
  Posts
  143
  Views

  

  I use this 61 watt apple charger for all my USB-C charging needs. It even works for my P1, but only slow charges that, but as you can see, USC-C dishes out high voltage and at 3 amps, as well as lower voltage for phones.
• J

  Access Restrictions for VPN Access to LANs
  • JasGot  

  11
  0
  Votes
  11
  Posts
  146
  Views

  

  If you can limit a client to just one IP and just tcp 3389 in your firewall that should be enough. Disable shared drives or the user is able to infect the work pc with files from his home pc. Typically when we connect with VPN to enterprise networks to do work on certain servers or what not, we get a static ip and then they have firewall rules to determine what IPs / ports we can reach. So yes, the computer we use is on their LAN but only through a very small and restricted opening that just allows RDP to just the one server we need to access. Everything else is blocked.
• 

  Using Zeit for Serverless
  • stacksofplates  

  7
  1
  Votes
  7
  Posts
  108
  Views

  

  Oh I see. Will have to check that out too then. Thanks!
• K

  This topic is deleted!
  • komalshetty2200  

  1
  -1
  Votes
  1
  Posts
  7
  Views

  No one has replied

• 

  UNSOLVED Need a Powershell script to move these files
  powershell scripting • • JaredBusch  

  10
  1
  Votes
  10
  Posts
  145
  Views

  

  Going to work on this, finally, after dinner tonight. Thanks for those that posted.
• 

  SOLVED 3rd party spam filter solution pricing
  email spam spam filtering • • JaredBusch  

  45
  0
  Votes
  45
  Posts
  505
  Views

  

  @Natchos said in 3rd party spam filter solution pricing: We have been using MS Exchange Online Protection for the last 8 years. It's been working good with our on-premise Exchange server. Price we pay is 18.99$ per user per year. We are almost at 50 users. I signed up for this. It was only $1/user/month Switched things today. So far, all is working normally.
• 

  Nextcloud Talk: Group Convo closes
  nextcloud nextcloud talk nextcloud 17 nextcloud talk 6 nextcloud 18 • • gjacobse  

  1
  0
  Votes
  1
  Posts
  57
  Views

  No one has replied

• J

  Postcards for SMS by Skyetel.
  • JasGot  

  34
  0
  Votes
  34
  Posts
  235
  Views

  J

  @krzykat said in Postcards for SMS by Skyetel.: @JasGot Have you checked your LE credentials to see that its working properly? Not sure how. The only sign of LE I can find in the OS or the Docker is a file called letsencrypt_services_data I can't find a conf file or a binary to do a manual run of LE.
• S

  New to Windows Active Directory and Group Security Management
  windows active directory • • srdennis  

  13
  1
  Votes
  13
  Posts
  139
  Views

  

  @IRJ said in New to Windows Active Directory and Group Security Management: Make an AD group called workstation_admins and add that group to local administrators account on each desktop. This group does not need any AD rights and nobody's account should be in there except for IT admin accounts. Even those IT admin accounts should not be used on local desktops to login on a regular basis. Only when elevation is actually needed, and even then you should use run as. I do this - Those who need it have a workstation admin account and a local non admin normal account.
• P

  Outbound Email group terminology
  • pmoncho  

  18
  0
  Votes
  18
  Posts
  146
  Views

  

  @pmoncho said in Outbound Email group terminology: @Dashrender said in Outbound Email group terminology: @pmoncho said in Outbound Email group terminology: @Dashrender said in Outbound Email group terminology: @pmoncho said in Outbound Email group terminology: Thanks group. At this time, we currently we use Kerio Connect for email (users use webmail function not Outlook connector). That will hopefully change in the future based on changes that are currently happening at work. I will check into the shared mailbox scenario also. Nice to know that there are possible options out there. Armed with the search terms, it definitely helps when researching my current and future email apps. What's wrong with kerio? It was bought by GFI. That is the biggest issue. Large price increase and development prior to their purchase was much better. Support is not what it use to be either. I'm being a little @scottalanmiller'ish as it has become more of a moral issue. Plus, I would like to eventually SasS. EDIT: Prior to GFI, I really liked Kerio. Stable release updates and support was awesome. Felt they had a huge chip on their shoulder and wanted to kick MS Exchange A$$. That trait is now gone and it reflects in their product. If you're being Scottish.. then you don't want to look at Hosted Exchange. If you're like him, you'll look at Zoho. They will be on the list if they can help me with this situation. That's who we use and we are very happy.
• 

  Notification by MeshCentral after a computer comes back online
  meshcentral meshcentral 2 • • CCWTech  

  7
  2
  Votes
  7
  Posts
  95
  Views

  

  @JaredBusch said in Notification by MeshCentral after a computer comes back online: This is not a MC request or support forum. I'll make a note.
• 

  ONLYOFFICE online editors v5.5 released
  • hellonadya  

  1
  2
  Votes
  1
  Posts
  58
  Views

  No one has replied

• 

  Spoofing Caller ID
  • Dashrender  

  14
  0
  Votes
  14
  Posts
  130
  Views

  

  @Dashrender said in Spoofing Caller ID: @JaredBusch said in Spoofing Caller ID: @Dashrender WTF does this ahve to do with Caller ID? Doximity allows licensed medical pros to spoof their outgoing number to that of their office (I'm guessing it's just a softphone into Doximity's system) so it solves the problem I have for my licensed medical personal, but not my none medical staff - like billing personal, or myself. FFS. You are not spoofing. You own the number. You can send it.
• 

  Running Plex in Multiple Vehicles
  plex • • wirestyle22  

  50
  1
  Votes
  50
  Posts
  348
  Views

  

  @IRJ said in Running Plex in Multiple Vehicles: This just seems like a bad idea all-around. Offering it free Several thousand dollar investment in equipment and labor (free I suppose) Wonky setup that isnt user friendly and doesn't give a good user or driver experience This isn't setup and forget about it. Don't forget to factor in maintenance Relying on celluar data whats wrong with being free? the equipment listed in this thread are pretty cheap - though frankly, 60 person bus, not sure a R-Pi could handle that many streams (worse case) hard not to agree here - Plex wasn't designed for this. You likely want something like the airlines have, and yeah, it's going to be expensive as hell! yep, will likely require maintenace cellular - well no, OP already said connection for this system will be WiFi to the headquarters only. But I have some followup - How much WiFi bandwidth is needed to support 60+ devices for streaming media? will the media distributing device have enough bandwidth to support 60+ devices? The OP mentioned that passengers can use the WiFi to get online via the cellular link in the bus - will there be only one WiFi network on the bus, to get to both the internet and the local video streaming? Are there any security concerns with this?
• K

  Mesh Central Device on more than one Login
  • krzykat  

  9
  1
  Votes
  9
  Posts
  75
  Views

  

  @black3dynamite said in Mesh Central Device on more than one Login: @scottalanmiller And there's no way to assign a device to multiple device groups or user groups? No
• 

  Subnetting help
  • G I Jones  

  15
  1
  Votes
  15
  Posts
  159
  Views

  

  @Dashrender said in Subnetting help: @scottalanmiller said in Subnetting help: s this, but they didn't pay attention to their own example. Because they use the old, silly notation it is less obvious how they They, the authors, are probably assuming old school classes for the network on 192.168.123.0 of /24... which is horrible writing, and lack of explanation.. but possible. Right, and if they are, it means they don't know the most basic pieces of IPv4. Classful subnets were replaced in 1993. And even pre-1993, it was still less solid than would make what was presented by the author here accurate. Given that it has been 27 years, there is really no excuse for the oldest, most out of touch networking person to think in classful terms. For 95% of the industry, classful networking hasn't existed during their careers. For 50% of the industry, it hasn't existed in their lifespans. In "IT generational" terms, it's been like five or more generations of IT pros since classful existed, so the "mentors teaching interns" problem has had five or six generations for people to catch on. This means that the authors not only aren't doing a good job explaining, but lack the skills required for the A+ and certainly aren't prepared to sit for the Net+. This is the first stuff you have to learn about IP networking, because without it, you can't determine how to document or know what the network addresses of your network are!
• 

  ADV200005 | Server Message Block 3.1.1 (SMBv3) Vulnerability & Workaround
  vulnerability smbv3 mitigation workaround • • Obsolesce  

  2
  0
  Votes
  2
  Posts
  98
  Views

  

  @Obsolesce said in ADV200005 | Server Message Block 3.1.1 (SMBv3) Vulnerability & Workaround: ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client. To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it. Workarounds The following workaround may be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as they become available even if you plan to leave this workaround in place: Disable SMBv3 compression You can disable compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 Server with the PowerShell command below. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force Notes: No reboot is needed after making the change. This workaround does not prevent exploitation of SMB clients. You can disable the workaround with the PowerShell command below. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 0 -Force Keep in mind that the vulnerability is only listed for Windows 10 1903 and up and Windows Server Semi-Annual Channel 1903 and up. Folks should have inbound file/print turned off at user endpoints via Group Policy anyway so that eliminates that vector. We don't deploy containers so no Server SAC anywhere in our stable.