Installing X2Go NX Server on Linux Mint 17.2
-
@scottalanmiller said:
Not really. If I'm connected to an NX server at a client site, they cannot infect me nor can I infect them. We are firewalled from each other except for the graphical protocol. It's dramatically safer than a VPN.
Right, but an End User can still get themselves infected. (Yes, it's Linux, no, it isn't bullet proof, but you know this already).
@scottalanmiller said:
Well then don't bypass the security by allowing shares to be added making the channel an more generic VPN again. That's not an exposure that you want.
Any direct LAN, ZT, VPN, etc. connection opens you up to huge exposure.
So I have allowed my end-user to connect to their X2Go / RDP server and say "Here's all your applications" ... but what about their Data?
If their data lives on file shares, then what? They can have their apps but not their data?
Okay. Let's use ownCloud... Their files still get encrypted, and we still have to restore them from backups.I do not disagree that there is more exposure. But how is this any different than being on a LAN? If my laptop worker is sitting at their desk connected to my LAN, or if they're 500 miles away, connected to my LAN?
[Maybe this would be good to fork off into its own discussion, lol... Title suggestion: VPN vs Port Forwarding ?].
-
@dafyre said:
@scottalanmiller said:
Not really. If I'm connected to an NX server at a client site, they cannot infect me nor can I infect them. We are firewalled from each other except for the graphical protocol. It's dramatically safer than a VPN.
Right, but an End User can still get themselves infected. (Yes, it's Linux, no, it isn't bullet proof, but you know this already).
All the more reason to keep them from infecting everyone else
-
@dafyre said:
So I have allowed my end-user to connect to their X2Go / RDP server and say "Here's all your applications" ... but what about their Data?
They access it via the remote session, not the local one.
-
@scottalanmiller said:
@dafyre said:
So I have allowed my end-user to connect to their X2Go / RDP server and say "Here's all your applications" ... but what about their Data?
They access it via the remote session, not the local one.
Right. But in their remote session where they have web browsers and emails open? That makes it no less vulnerable to poor decision making by the end-user than it does if they are working directly on their laptop.
-
@dafyre said:
I do not disagree that there is more exposure. But how is this any different than being on a LAN? If my laptop worker is sitting at their desk connected to my LAN, or if they're 500 miles away, connected to my LAN?
So you agree that there is more exposure but what how there is more exposure? I don't follow.
LAN and VPN put the user's local machine right in the network, exposed to everyone. Eliminate that and the massive majority of infection vectors go away. Something like 90% of the risks are gone because the local machines are not talking to the remote ones.
www.smbitjournal.com/2012/08/how-i-learned-to-stop-worrying-and-love-byod/
-
@scottalanmiller said:
And X2Go is natively secure running over SSH so unlike RDP you don't need to worry about setting up a separate secure tunnel to protect it.
I thought RDP had encryption today, no?
-
@dafyre said:
Right. But in their remote session where they have web browsers and emails open? That makes it no less vulnerable to poor decision making by the end-user than it does if they are working directly on their laptop.
Not exactly. They can't go offline and make bad decisions. They aren't able to physically interact. They aren't bringing their whole lives, only a portion of them into exposure. It's a pretty massive level of risk reduction for a normal business. For an MSP, it's an insane amount of reduction.
-
@scottalanmiller said:
So you agree that there is more exposure but what how there is more exposure? I don't follow.
More exposure having a device VPNed or connected via ZT/Pertino vs just using port forwarding for something like RDP / NX
LAN and VPN put the user's local machine right in the network, exposed to everyone. Eliminate that and the massive majority of infection vectors go away. Something like 90% of the risks are gone because the local machines are not talking to the remote ones.
www.smbitjournal.com/2012/08/how-i-learned-to-stop-worrying-and-love-byod/
Here is where things come to light. You are talking about BYOD. I am talking about a company owned and managed laptop being connected to ZT, not an end-user's personal device.
BRB while I go read that article that I think I've read once or twice before, lol.
-
@dafyre said:
@scottalanmiller said:
So you agree that there is more exposure but what how there is more exposure? I don't follow.
More exposure having a device VPNed or connected via ZT/Pertino vs just using port forwarding for something like RDP / NX
Exactly. Open ports are the most secure option for reaching in, always. There is no technology to improve on that yet. The VPN is only additional exposure in this case.
-
@dafyre said:
Here is where things come to light. You are talking about BYOD. I am talking about a company owned and managed laptop being connected to ZT, not an end-user's personal device.
Nope, I'm talking about both. Treat the company owned equipment as BYOD and you get a ton more security.
-
NTG Does this.... we provide 100% of employee gear from desktops to laptops even to cell phones. But we treat that equipment as BYOD and wall it off from the systems. If @Minion-Queen gets ransomware, she can't infect me or vice versa. We are always isolated.
-
@scottalanmiller said:
NTG Does this.... we provide 100% of employee gear from desktops to laptops even to cell phones. But we treat that equipment as BYOD and wall it off from the systems. If @Minion-Queen gets ransomware, she can't infect me or vice versa. We are always isolated.
I thought you guys used pertino?
-
@johnhooks said:
I thought you guys used pertino?
We used to, Windows 10 made that redundant and so we've phased it out for security reasons. AD doesn't need a VPN anymore, so no need to carry that kind of risk for authentication.
-
@scottalanmiller said:
We used to, Windows 10 made that redundant and so we've phased it out for security reasons. AD doesn't need a VPN anymore, so no need to carry that kind of risk for authentication.
Which means now that all of the remote workers do everything via X2Go / RDP / SSH ?
-
@dafyre said:
Which means now that all of the remote workers do everything via X2Go / RDP / SSH ?
No, we only do that for accessing clients' networks so that we are not cross exposing. We communicate with each other through applications like Skype, Office 365, ownCloud, etc. We work locally but store remotely.
-
So what do you do when you need to access a resource inside NTG while you are bouncing all over the planet?
IE: How is it that you are able to connect to the Lab and manage the Scale systems?
-
@dafyre said:
So what do you do when you need to access a resource inside NTG while you are bouncing all over the planet?
What does "inside" mean to you? Everything is SaaS, we have no legacy apps.
-
@dafyre said:
IE: How is it that you are able to connect to the Lab and manage the Scale systems?
The Lab is a separate entity, we would never comingle the lab with the corporate network. So we treat it just like any customer, it's NX to reach it.
-
@johnhooks just had a thought... and it got me to wondering..
What about ownCloud. Assuming you guys share files back and forth... Do you block any types of files with it? If somebody puts a trojan or worm or other nasty in ownCloud and you are all sharing folders, everybody gets that file.
(Assume AV doesn't catch the trojan )
Aren't you guys still sharing the same type of risk, despite being isolated?
-
@scottalanmiller said:
@dafyre said:
IE: How is it that you are able to connect to the Lab and manage the Scale systems?
The Lab is a separate entity, we would never comingle the lab with the corporate network. So we treat it just like any customer, it's NX to reach it.
If that's the case, do you even really need anything other than a laptop that is capable of connecting to a Terminal Server to get you access to your work environment?
Why run email, et al, all on your laptop, when you can just remote into a server and do it there?
