Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

243
active users

shakedown.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#itadvice

0 posts0 participants0 posts today
Raglan Niall :lk: :tinoflag:<p>Next one for the hive mind. You've suggested Synology but not Qnap. Both are Taiwanese so not US (Good).<br>Why Synology over Qnap?<br>If Synology why not the j (the cheaper one)?<br>With this many questions am I even qualified to embark on this project?!<br>and yes, I've tagged everyone who chimed in on the HDD questions...</p><p><a href="https://mastodon.nz/tags/NAS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NAS</span></a> <a href="https://mastodon.nz/tags/ITAdvice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITAdvice</span></a> <a href="https://mastodon.nz/tags/LazyWeb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LazyWeb</span></a> <br><span class="h-card" translate="no"><a href="https://mastodon.nz/@leighelse" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>leighelse</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.nzoss.nz/@futuresprog" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>futuresprog</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.nz/@thomasbeagle" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>thomasbeagle</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.nz/@stojg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>stojg</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@haydng" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>haydng</span></a></span></p>
Phillip<p>Long toot, but TL;DR I’m looking for advice from fellow IT and network managers/maintainers. </p><p>Planning a network overhaul for my ~20 person employer for a few months from now. Likely going Unifi for as much as possible for the tight integration and simple management for this poor solo IT guy. I’m not looking for input on that decision at this time, unless you have a really good reason. </p><p>Unfortunately, everyone is used to a BYOD system when it comes to WFH. They download the NetExtender VPN on their personal machine and RDP into their workstation in the office. I am trying to figure out how best to lock this down without pissing everyone off (yet). </p><p>Obvious measures already in effect include MFA for VPN access and geo-based IP blocking. I’d love to lock it down further though, and for that I am looking into an RDP gateway in combination with VPN. </p><p>For off-site company-owned devices, those would use the Unifi VPN authenticated via AD and MFA. Connections would be based on an allowlist of known safe workstations and they would be allowed normal network access. </p><p>For personal devices, I’m considering an RDP gateway (with MFA?) to monitor and limit connections from personal devices to employee workstations only (I.e. no server access). I _could_ expose that publicly and ensure it’s locked down with MFA and give the host server minimal permissions and access. However, I’m wondering if it would make sense to place that behind the VPN as well.</p><p>Untrusted VPN connections could go to their own VLAN, only allowed access to the RDP gateway and nothing else. Both would authenticate with the same LDAP credentials, so not much benefit there. My main consideration is 0 days and other vulns. A 2 layered approach would ensure that a vulnerability in one system is still mitigated by the other. </p><p>I could see this creating unnecessary overhead for employees to connect though, and may not be worth the perceived extra security. </p><p>Anyone have any input? I’d love some advice here!</p><p><a href="https://infosec.exchange/tags/it" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>it</span></a> <a href="https://infosec.exchange/tags/networking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>networking</span></a> <a href="https://infosec.exchange/tags/networksecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>networksecurity</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/infrastructure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infrastructure</span></a> <a href="https://infosec.exchange/tags/ITAdvice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITAdvice</span></a> <a href="https://infosec.exchange/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tech</span></a></p>
abracadabra holmes<p>Thinking of switching Internet to a 5G Home hotspot. Anyone have good/bad experience they can share?</p><p><a href="https://mastodon.world/tags/ITAdvice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITAdvice</span></a><br><a href="https://mastodon.world/tags/5GHomeInternet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>5GHomeInternet</span></a></p>
ExploreLive feeds
About