Mesh Central

scottalanmiller

@AdamF Usernames, passwords, SSL/TLS and 2FA are the lockdowns you'd use anywhere. It's secure by default. If you can, do IP locking. But it is rare that you can do that.

AdamF

@scottalanmiller said in Mesh Central:

@AdamF Usernames, passwords, SSL/TLS and 2FA are the lockdowns you'd use anywhere. It's secure by default. If you can, do IP locking. But it is rare that you can do that.

Excellent, just wanted to verify with someone else as well. Thanks Scott.

scottalanmiller

@AdamF said in Mesh Central:

if I don't want to put this behind any proxy

That doesn't do much anyway. There's really very little to do. It's a web page, so basically think of it link a bank website.

AdamF

@scottalanmiller Hopefully getting those Pi's connected this weekend. (from the other thread)

AdamF

@scottalanmiller I am missing the 2FA option in the my account settings. I am missing something I suppose?

scottalanmiller

@AdamF said in Mesh Central:

@scottalanmiller I am missing the 2FA option in the my account settings. I am missing something I suppose?

Because the name is dumb?

My Account >> Manage Authenticator App

syko24

They also added CrowdSec recently. @Ylian the developer also releases YouTube videos covering a lot of these topics and how to implement.

Youtube Video

AdamF

@scottalanmiller said in Mesh Central:

@AdamF said in Mesh Central:

@scottalanmiller I am missing the 2FA option in the my account settings. I am missing something I suppose?

Because the name is dumb?

My Account >> Manage Authenticator App

Nope. I just didn't RTFM. By default, it is in WAN and LAN mode. You have to switch it to WAN mode and give it a valid DNS name. Then that option shows up.

scottalanmiller

@AdamF said in Mesh Central:

@scottalanmiller said in Mesh Central:

@AdamF said in Mesh Central:

@scottalanmiller I am missing the 2FA option in the my account settings. I am missing something I suppose?

Because the name is dumb?

My Account >> Manage Authenticator App

Nope. I just didn't RTFM. By default, it is in WAN and LAN mode. You have to switch it to WAN mode and give it a valid DNS name. Then that option shows up.

Oh right, been a long time since I did a new install. Forgot that they default to LAN. Why I wonder?

scottalanmiller

@syko24 said in Mesh Central:

They also added CrowdSec recently. @Ylian the developer also releases YouTube videos covering a lot of these topics and how to implement.

Youtube Video

Says unavailable. I think because it is a channel and not a video but ML thinks it is a video link.

syko24

@scottalanmiller said in Mesh Central:

@syko24 said in Mesh Central:

They also added CrowdSec recently. @Ylian the developer also releases YouTube videos covering a lot of these topics and how to implement.

Youtube Video

Says unavailable. I think because it is a channel and not a video but ML thinks it is a video link.

Yeah that was supposed to be to the channel. Here is the CrowdSec video. Lots great videos on his channel for setting things up.

Youtube Video

AdamF

Well, this tool is amazing and just works. Nice job @Ylian !

scottalanmiller

@AdamF said in Mesh Central:

Well, this tool is amazing and just works. Nice job @Ylian !

Yeah, it's definitely the best tool for this on the market. It's blown past everyone else. We are doing the AMT integration now and rolling out vPro anywhere that we can. It's just amazing.

AdamF

@scottalanmiller said in Mesh Central:

@AdamF said in Mesh Central:

Well, this tool is amazing and just works. Nice job @Ylian !

Yeah, it's definitely the best tool for this on the market. It's blown past everyone else. We are doing the AMT integration now and rolling out vPro anywhere that we can. It's just amazing.

I know you use it for remote agents that are always installed (or at least I assume so), but are you also able to use it for "one off" remote sessions? For example, sometimes I will open a screen connect session for a quick support session. Then when finished, close the session, the end. Can we do that as well with MC?

scottalanmiller

@AdamF said in Mesh Central:

@scottalanmiller said in Mesh Central:

@AdamF said in Mesh Central:

Well, this tool is amazing and just works. Nice job @Ylian !

Yeah, it's definitely the best tool for this on the market. It's blown past everyone else. We are doing the AMT integration now and rolling out vPro anywhere that we can. It's just amazing.

I know you use it for remote agents that are always installed (or at least I assume so), but are you also able to use it for "one off" remote sessions? For example, sometimes I will open a screen connect session for a quick support session. Then when finished, close the session, the end. Can we do that as well with MC?

Yes, works fine for that. The end user just chooses "Run" instead of "install" and it works that way.

AdamF

I have the agent running on 2 Pi's The 4 GB version of the Pi. The screen lag is incredibly SLOW. (running Raspian)
Installing an agent on my windows laptop (8GB ram) is incredibly responsive and quick. Are there some tweaks to run on the Pis to improve the screen lag for remote viewing?

AdamF

@AdamF said in Mesh Central:

I have the agent running on 2 Pi's The 4 GB version of the Pi. The screen lag is incredibly SLOW. (running Raspian)
Installing an agent on my windows laptop (8GB ram) is incredibly responsive and quick. Are there some tweaks to run on the Pis to improve the screen lag for remote viewing?

It was 100% Pi related as suspected. Here's what I did to speed things up. (found on https://forums.raspberrypi.com/viewtopic.php?p=1983061&sid=eaf6504ffd4e15374cbd86907d954c67#p1983061)

in /boot/config.txt
uncomment this line:
hdmi_force_hotplug=1

commented out these lines:
#dtoverlay=vc4-kms-v3d
#max_framebuffers=2

Then the resolution was really low despite the VNC resolution set in raspi-config, so after setting the above and rebooting I then set the 'display options' resolution in raspi-config to be the same as the VNC resolution.

In my case I'm using 1920x1080, so that modified my config.txt to have these lines:

hdmi_group=2
hdmi_mode=82

scottalanmiller

@AdamF said in Mesh Central:

I have the agent running on 2 Pi's The 4 GB version of the Pi. The screen lag is incredibly SLOW. (running Raspian)
Installing an agent on my windows laptop (8GB ram) is incredibly responsive and quick. Are there some tweaks to run on the Pis to improve the screen lag for remote viewing?

RP is pretty slow on that. The screen rendering on Linux for remoting isn't as robust.

4GB 32bit is the fastest option.

scottalanmiller

Make sure to update firmware.

AdamF

This tool set is amazing. The branding and customization options are really nice. I want to setup 2fa for ALL users of the system. I want to force the users to enable 2fa. I put this in the config.json file, but it is still not prompting/forcing users to setup 2fa. Is anyone else using this?

      "passwordRequirements": {
        "min": 8,
        "max": 128,
        "upper": 1,
        "lower": 1,
        "numeric": 1,
        "nonalpha": 1,
        "reset": 90,
        "force2factor": true,
        "_skip2factor": "127.0.0.1,192.168.2.0/24",
        "oldPasswordBan": 5,
        "banCommonPasswords": false,
        "twoFactorTimeout": 300
}