@adamf said in Reboot on ping loss:

@pete-s

I would also do that, but have other requirements that require us to use the Comcast provided modem.

It is what it is. Unfortunately I don't know any products that does what you want.

I would want to have some control over the automatic reboot process though and would be reluctant to have another consumer grade gadget controlling it.

If I had the choice I would go for a standard PDU that can switch outlets on/off and run a script on some server controlling when to power cycle the modem. Have it write some log files and such.

@adamf said in Reboot on ping loss:

@pete-s said in Reboot on ping loss:

@adamf said in Reboot on ping loss:

@pete-s said in Reboot on ping loss:

Doesn't sound like a great solution to a problem.

Have you ruled out problems with the actual modem, it's power supply, high ambient temperature, main power fluctuations and such?

Or tried replacing the modem with something higher grade - if that is a possibility?

Yes.

Had the modem replaced twice already. Power is fine, environment is also fine. It’s just Comcast in my area.

That's good. But even if Comcast goes down temporarily, it's odd that the modem doesn't establish the link automatically again.

Agreed. If I had other GOOD options, I would switch ISPs. But for now , oh well.

For our own gear, we always try to stay away from the provider supplied modems and routers. They are almost always the lowest quality possible and the weakest link in the connection.

But it's not always possible to put you own gear in place. I don't know if Comcast supports business customers installing their own modems.

@adamf said in Reboot on ping loss:

@pete-s said in Reboot on ping loss:

Doesn't sound like a great solution to a problem.

Have you ruled out problems with the actual modem, it's power supply, high ambient temperature, main power fluctuations and such?

Or tried replacing the modem with something higher grade - if that is a possibility?

Yes.

Had the modem replaced twice already. Power is fine, environment is also fine. It’s just Comcast in my area.

That's good. But even if Comcast goes down temporarily, it's odd that the modem doesn't establish the link automatically again.

Doesn't sound like a great solution to a problem.

Have you ruled out problems with the actual modem, it's power supply, high ambient temperature, main power fluctuations and such?

Or tried replacing the modem with something higher grade - if that is a possibility?

Maybe you should look into automating windows 10 installs instead.

A gold image is not ideal because you are doing lots of step, usually manually, to create the gold image. The image is large and it's basically out of date just a couple of days after creating it.

With an automated install you are basically installing windows from scratch with your own customizations and additional software and settings. It's much smaller and easier to maintain long-term.

https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/automate-windows-setup?view=windows-10

@adamf said in Zerotier issues:

Weird

Not particularly weird at all. All services have outages, partial or full.

Could be anything. Redundancy doesn't prevent outages when the redundant nodes have a common failure mode - such as running the same software or being centrally automated by the same thing.

@irj said in Job offer:

@scottalanmiller said in Job offer:

Has anything changed to make you feel it is worth accepting now when it wasn't a few days ago?

I feel like shitty employer isn't a reason to do anything out of fear or just to get out. For me accepting a new role is always a well calculated decision. Sure, he should make the decision that he's gonna leave his current employer. That's an easy one to make.

However, the decision of choosing the new role needs to be well thought out and calculated as a career move. Not a knee jerk reaction.

If someone truly devoted themselves to finding a job in 6 weeks, you can do it if you have the actual skill set required for your new role. In 6 weeks time you should have received several offers.

This. ↑↑↑

Is it really a calculated career move after 4 years experience in this position? Is it possible to find something better than a lateral move if you give it month or two?

Changing job is like moving. It requires a certain amount of work and energy. It will probably take a while before you're going to change again. Actually 2.8 years on average for most people that are not at the end of their career or in management.

So take that into account when you consider the offer. It might not seem like it, but you're making a commitment for a couple of years and your pay is going to stay more or less the same more during that time.

@scottalanmiller said in ZeroTier & Security:

@pete-s said in ZeroTier & Security:

@notverypunny

If you assume that being connected to an ZeroTier network is the same as having the host sitting directly on the internet, you'll be fine.

That is the basic premise of the zero trust security model - assuming that the network is hostile.

Ding ding, exactly. It's a connectivity tool, not a security tool. The security has to be provided normally. Any ZT provided security, is purely extra.

Yes, and when it comes to security ZeroTier, as any other VPN, shows up as a virtual network adapter. So you can apply the OS' firewall like you could on any network adapter.

And the ZeroTier network itself also has some limited L2 rules to control the traffic, similar to a switch. It lacks tcp sessions and other things though so it's not like a real router/firewall.

There is also the possibility to connect ZeroTier to a compatible firewall and not the host directly.

@notverypunny

If you assume that being connected to an ZeroTier network is the same as having the host sitting directly on the internet, you'll be fine.

That is the basic premise of the zero trust security model - assuming that the network is hostile.

@jaredbusch said in Looking for a remote access solution:

@pete-s said in Looking for a remote access solution:

@dashrender said in Looking for a remote access solution:

@jaredbusch said in Looking for a remote access solution:

Put zerotier on the box in the DC and the user's box. restrict it to only RDP.

Done.

I really like this - sadly - our insurance policy requires MFA for remote access. I'll have to see if ZT has anything for that.

If you can't run over VPN due to latency, you can't run over Zerotier. It will be exactly the same.

Are you stupid?

Always.

@dashrender said in Looking for a remote access solution:

@jaredbusch said in Looking for a remote access solution:

Put zerotier on the box in the DC and the user's box. restrict it to only RDP.

Done.

I really like this - sadly - our insurance policy requires MFA for remote access. I'll have to see if ZT has anything for that.

If you can't run over VPN due to latency, you can't run over Zerotier. It will be exactly the same.

The  Cybersecurity and Infrastructure Security Agency (CISA) published the “Free Cybersecurity Services and Tools” webpage intended to be a one-stop resource where organizations of all sizes can find free public and private sector resources to reduce their cybersecurity risk. The catalog published today is a starting point. Going forward, CISA will incorporate other free services into the catalog.

Source:
https://www.cisa.gov/news/2022/02/18/cisa-launches-new-catalog-free-public-and-private-sector-cybersecurity-services

Link to tools:
https://www.cisa.gov/free-cybersecurity-services-and-tools

Fax will die for sure, just like telegrams and telex have died before fax.

It's said that it's the US health care system that has kept fax alive on borrowed time for years.

Fax machines have actually been dead in many parts of the western world for a decade or two already. With dead I mean that companies, hospitals and government simply don't have any fax numbers anymore and can neither send nor receive a fax. But it's different from country to country and dependent on the laws mostly.

@dashrender said in VDI Options - Modernization:

They are using a web based EMR - there are no local DBs

Many people are not aware that the web browser has a built in database engine (IndexedDB) that webpages can use. It's a persistent database storage space on your local drive. It's stored among your browsers files.

It not something that you install or are normally aware of.

Sites can also use other storage mechanisms on your local browser, besides cookies that are familiar to most, there is also a cache, session storage and local storage.

These storage spaces are not encrypted so if a webpage or a webapp decides to put sensitive information there, well, it sits on your local drive then.

@scottalanmiller said in VDI Options - Modernization:

@pete-s said in VDI Options - Modernization:

I'm not talking cached files here but client side databases and local storage as defined in html5. Another reason you might insert VDI into the chain.

Worth pointing out that this "should be" a configuration thing and not something you need heavy VDI to work around. But here in the real world, it isn't always configurable and VDI can be used to deal with that.

Yeah, it depends entirely on what the html/javascript code looks like. Which in most cases depends on what framework was used.

It was easier to keep track of the data when a html browser was as dumb as a vt100 terminal.

@dashrender said in VDI Options - Modernization:

I know Gene's company is using VDI for access to their EMR - which is cloud hosted.. I can't really understand the gain there.

Cloud hosted doesn't mean it's accessed by a web browser. It might be a Windows application of some kind.

So insert VDI to allow access to the application from any type of client device. And without having to install something locally on the client and without having sensitive data stored on the client.

Accessed by a web browser also doesn't mean that nothing is stored locally. I'm not talking cached files here but client side databases and local storage as defined in html5. Another reason you might insert VDI into the chain.

@stacksofplates said in Organizational charts or similar info?:

This site is pretty popular form what I've seen.

theorg.com/organizations

Not sure if this is what you're asking for or not.

Thanks, that one was interesting, I'll look through it and see how detailed they charts are.

Looking at different ways to organize an IT department and the organization of software companies.

Is there a resource or some good place to find organizational charts or similar information from real companies? Or similar to real companies, not just theory.

I'm interested how different companies are organized and what the roles and the responsibilities are for the different positions.

I'm trying to learn more so if I'm asking the wrong questions, please feel free to suggest what I can do about it.

@dashrender said in VDI Options - Modernization:

Now with that said - I'm amazed management is willing to spend over a million dollars updating that PITA of a VDI solution instead of paying developers to make a new system that wouldn't require that VDI knife to do to the job - with the expectation that the long term costs would be much lower.

But 1 million dollars is not much if you have 600-1000 employees using it and it will get the job done for 5 years.
It will be from $17 to $28/month per user.

If you make big changes it will impact the business in other ways such as cost for training, lower productivity while getting up to speed etc.

What I've seen is that companies replace their VDI solutions by doing things differently, but it's done over several years.

So when companies have the long term goal of getting rid of their VDI solution they would one by one remove the reasons for it's existence and as a result get fewer and fewer users on it. Eventually they can retire it.

@jimmy9008 said in VDI Options - Modernization:

@pete-s said in VDI Options - Modernization:

@jimmy9008 said in VDI Options - Modernization:

@jt1001001 said in VDI Options - Modernization:

@jimmy9008 We have a use case involving a legacy client/server app that we've determined we're going to have to go VDI for in order to secure it. One lousy app for approx 5 users that I hope we eventually move away from. We are currently reviewing Azure VDI for this and it so far will fit the bill though we had to go throught a lot of "hoops" to configure networking, VPN back into our infrastructure, etc. We have not yet presented budget numbers to the bean counters but Im hoping when we do they will see the $$$$$ wasted for 5 users and will force them to a new product.

What other products do you plan to look at? Still VDI or something else? Any experience of VMWare Horizon?

We have around 600 - 1000 users globally (mostly developers) on the VDI I need to replace. The company dictates that the VDI must be in the same datacenter as the rest of the developers environments, so I don't think Azure VDI would work for us because of that mandate.

If you have a solution that works, and at the moment VDI is a must, then it makes no sense to change the fundamentals of what you already have. That's just an unwarranted risk.

So keep Citrix and VMware as is. Just replace the hardware and consolidate it. You are only averaging 16 cores per physical server and 370GB RAM per server if my math is correct. You could easily cram 3 to 8 times as much into each server. 128 cores per server is nothing special today as well as several TBs of RAM. AMD is the leader and the way to go.

You could replace your 20 servers and have 384 cores and up to 12TB of RAM with only three Dell R6525 or R7525 dual CPU servers. You might want 4 or more though. But no need to go to blades when you only need a couple of servers. No need for complex hypervisor management solutions either when you only have a couple of servers.

Use vSAN instead of SAN for the VDI. With the proper drives these servers are certified for ESXi and vSAN. You should use U2 NVMe drives and avoid SAS. It will outperform your old SAN - by a lot.

Since you have 1 PB of data, storage for non-VDI workloads needs to be researched. I think I would want to separate VDI from the rest. Gut feeling would be to have completely separate physical environments for everything VDI related and the rest. Consolidation is good but overconsolidation can be too risky.

This could be a great option. New servers with more horse power, running the existing software stack. One problem is that due to another departments projects the underline storage is going from this solution. The storage is being ripped out leaving 20 servers, which need to be replaced, without any of the 1PB storage.

I was considering Dell PowerMax for this storage presented over iSCSI to a server on the Dell VXRail, also running the VDI.

For compliance and security our development environment is totally separate from the production environment. So the cluster of development servers, network hardware etc lives in their own ecosystem.

We have large enterprise customers and they are splitting up their workloads in the similar ways. They're running on EXSi and vSAN but everything lives in different pools and on different networks.

I would try to keep the VDI solution separate including it's storage. Besides technical reasons like noisy neighbor and security there is also management reasons - for example the other department ripping out the storage is one such reason to avoid having all your eggs in the same basket. With software and OS you have dependencies and you have the same type of dependencies in the organization when it comes to who manages, who pays, who decides when to upgrade etc.

That's what I mean about overconsolidation. Just because it's technically possible to put everything into one box, doesn't mean you always should.