Why you don't need a VPN or not?
-
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
-
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
It's not the only way to be secure, but it does make it much easier.
-
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
It's not the only way to be secure, but it does make it much easier.
So, in your post - https://mangolassi.it/topic/15325/lanless-explained/2
The second diagram shows the red security perimeter, housing "Servers, SANs, etc. All applications, files, and every other resource needed". What is securing the perimeter?
-
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
It's not the only way to be secure, but it does make it much easier.
So, in your post - https://mangolassi.it/topic/15325/lanless-explained/2
The second diagram shows the red security perimeter, housing "Servers, SANs, etc. All applications, files, and every other resource needed". What is securing the perimeter?
Generally VPN in the form of HTTPS connections.
-
@wrx7m said in Why you don't need a VPN or not?:
@scottalanmiller So in a transitional phase of moving away from LAN-centric practices, I have Windows firewall enabled on all Windows clients and Windows servers. Is that it, or would I have servers behind a hardware firewall with an ACL?
Firewalls are nearly always a good thing. Not always necessary, but rarely "bad". Certainly you want the OS firewalls on servers and desktops, always. LANless won't mean necessarily dumping your hardware firewalls, they are necessary as the routing layer, anyway. So using ACLs and NATing are going to continue to be useful.
The key difference is ensuring that they are a "secondary defense layer" and not a primary one. Make sure you'd feel safe putting your server on the Internet... then add that hardware firewall as icing, not as your security cake.
-
@travisdh1 said in Why you don't need a VPN or not?:
LANless is about making everything accessible through web services.
And securing them as if they will be accessed over the Internet.
But not web services, necessarily, although commonly. Accessed as if they are remote is a better way to phrase it.
-
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
Do you really want "servers versus clients?" Making servers secure individually is great, but generally servers need to talk to clients more than to other servers. Keeping servers away from each other is often more important than keeping servers away from clients. Same deal with clients, they almost never should talk to each other, but constantly must talk to servers.
-
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
LANless requires removing LAN-based approaches. I understand you are talking about a transition period.
But some things, like SMB shares and Active Directory are LAN-based at their cores and really have to effective way to be made LANless, even transitionally.
I mean you can do something like taking ZeroTier and encapsulating SMB and creating a poorly performing LANless file sharing service in that way. But it is hokey and won't behave all that well. SMB is just not suited to that, it was designed with the thought that LAN containment would always define it.
-
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
No. Web isn't more secure. Web might be easier to secure and to make LANless, but only because people are used to thinking of web as LANless and SMB as LAN-based. So assumptions go a long way.
NextCloud is not LANless only when used via web, but when used other ways, too.
-
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
It's not the only way to be secure, but it does make it much easier.
So, in your post - https://mangolassi.it/topic/15325/lanless-explained/2
The second diagram shows the red security perimeter, housing "Servers, SANs, etc. All applications, files, and every other resource needed". What is securing the perimeter?
I think that this diagram can be misleading. It's showing a single service. But in a normal LANless infrastructure, you'd have a "red zone" for every workload, rather than just one, it might be dozens.
-
@scottalanmiller said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
It's not the only way to be secure, but it does make it much easier.
So, in your post - https://mangolassi.it/topic/15325/lanless-explained/2
The second diagram shows the red security perimeter, housing "Servers, SANs, etc. All applications, files, and every other resource needed". What is securing the perimeter?
I think that this diagram can be misleading. It's showing a single service. But in a normal LANless infrastructure, you'd have a "red zone" for every workload, rather than just one, it might be dozens.
Honestly, it is completely wrong and confusing IMO.
-
@JaredBusch said in Why you don't need a VPN or not?:
@scottalanmiller said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
It's not the only way to be secure, but it does make it much easier.
So, in your post - https://mangolassi.it/topic/15325/lanless-explained/2
The second diagram shows the red security perimeter, housing "Servers, SANs, etc. All applications, files, and every other resource needed". What is securing the perimeter?
I think that this diagram can be misleading. It's showing a single service. But in a normal LANless infrastructure, you'd have a "red zone" for every workload, rather than just one, it might be dozens.
Honestly, it is completely wrong and confusing IMO.
So, would you say more like the previous comment where it would be services/servers with their own, respective perimeters? If so, what is the perimeter built from?
-
@scottalanmiller said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
Do you really want "servers versus clients?" Making servers secure individually is great, but generally servers need to talk to clients more than to other servers. Keeping servers away from each other is often more important than keeping servers away from clients. Same deal with clients, they almost never should talk to each other, but constantly must talk to servers.
Clients can't talk to other clients per the Windows firewall rules I've configured. I will have to audit the servers to identify and prevent unnecessary communication between them.
-
@wrx7m said in Why you don't need a VPN or not?:
@JaredBusch said in Why you don't need a VPN or not?:
@scottalanmiller said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@travisdh1 said in Why you don't need a VPN or not?:
@wrx7m said in Why you don't need a VPN or not?:
@Obsolesce - Right, I have an edge firewall for the WAN to the LAN where all endpoints on the wired network (servers and clients) reside, but I am wondering how to move to a tighter circle to get the servers segregated from the clients.
That involves making network services available with a different method.
IE: Files served from NextCloud instead of a file server.
OK, so if I am not doing that, there is no point to make a change?
Yes, exactly.
The takeaway is - The only way to be secure is to use a web app?
It's not the only way to be secure, but it does make it much easier.
So, in your post - https://mangolassi.it/topic/15325/lanless-explained/2
The second diagram shows the red security perimeter, housing "Servers, SANs, etc. All applications, files, and every other resource needed". What is securing the perimeter?
I think that this diagram can be misleading. It's showing a single service. But in a normal LANless infrastructure, you'd have a "red zone" for every workload, rather than just one, it might be dozens.
Honestly, it is completely wrong and confusing IMO.
So, would you say more like the previous comment where it would be services/servers with their own, respective perimeters? If so, what is the perimeter built from?
Generally just firewall and service rules. The service should be secure itself without relying on access to the LAN on which it sits to protect it.
-
There are two key aspects to this...
The first is security, which you are asking about now. LANless requires a "workload by workload security" approach. Instead of a "shared location security" approach.
The second is accessibility. Can it be accessed, or can it be accessed well, without a LAN to enable the access mechanisms?
-
The speedbump in this whole discussion is the use of shared files. WebDav can create a SMB like connection (but is SMB/Samba really that much less secure than WebDav?)
Personal files are often resolved by a sync solution of some type, but shared files are a huge pain. Searching through GBs of shared files on a webapp, then downloading them to open using a local app is a huge PITA. At least with Office and SharePoint, it's integrated and works seemlessly.
I haven't used NC enough to know - is there an Office add-in that allows this type of integration?
I see in the OnlyOffice thread that there is now talk of that kind of integration between NC and OnlyOffice local install - this will be a huge boon.
Assuming you can deal with the online versions of the apps - then NC webapp - auto-launching OnlyOffice in the same tab/new tab could be doable, and would solve a lot of issues. But I don't see that working very well for large files - say AutoCAD or even some graphics files.
-
@Dashrender said in Why you don't need a VPN or not?:
WebDav can create a SMB like connection (but is SMB/Samba really that much less secure than WebDav?)
WebDav is a protocol that is an extension of http. It itself has nothing to do with SMB.
I know besides the point, just clarifying.
-
@Obsolesce said in Why you don't need a VPN or not?:
@Dashrender said in Why you don't need a VPN or not?:
WebDav can create a SMB like connection (but is SMB/Samba really that much less secure than WebDav?)
WebDav is a protocol that is an extension of http. It itself has nothing to do with SMB.
I know besides the point, just clarifying.
LOL - yep I know - my point was only that it allows people to map a drive like we've been doing forever in Windows and browse around, then launch directly from the share. Unlike searching a NC webpage, which would then require downloading the file, then opening it, saving it locally, then copying it back to the NC webpage.
-
@Dashrender Kind of. SMB is an inherently LAN-Centric protocol that wouldn't work well over the WAN and can be much harder to secure without central authentication/authorization.
WebDAV is a protocol built on top of HTTP and thus has none of the latency related downfalls of SMB. It also can use dozens of different forms of authentication/authorization which makes it a bit more modular.
-
@Dashrender said in Why you don't need a VPN or not?:
@Obsolesce said in Why you don't need a VPN or not?:
@Dashrender said in Why you don't need a VPN or not?:
WebDav can create a SMB like connection (but is SMB/Samba really that much less secure than WebDav?)
WebDav is a protocol that is an extension of http. It itself has nothing to do with SMB.
I know besides the point, just clarifying.
LOL - yep I know - my point was only that it allows people to map a drive like we've been doing forever in Windows and browse around, then launch directly from the share. Unlike searching a NC webpage, which would then require downloading the file, then opening it, saving it locally, then copying it back to the NC webpage.
IMHO, you've paid more in resources putting together hardware, time, energy, maintenance, planning, etc... doing it yourself with NC/OnlyOffice/proxy/backup/etc, for up to 20 users with many limitations... than it would cost for a hand full of O365 licenses and be done with it.
Yeah it's great for home use or for a PoC before purchasing a non-CE edition, or just for simple basic needs in a small SMB up to 20 users... which I'm sure there are quite a bit of cases that would work great for.
