Accessing applications outside the network

[oododkodkdo]

Hello all,

 

I need some recommendations of which Remote Program should I install on the network for students and staff.

I have a budget of £25,000 to spend on this solution.

I have found some options which I can go for:

 

Option A: Citrix Netscaler, Xenserver and XenDesktop deployed with RSA 2FA tags to prevent unauthorised access for staff.

 

Option B: Home Access Plus+ Deployed

 

Option C: Windows Server RDS installed.

 

Option D: Parallels Deployed.

 

Option E: Give staff SIMS Installs to install on their computers and they can use a VPN Solution.

 

The Headteacher wants a simple to use system.

 

Anyone got any other ideas?

[free780]

Azure App Proxy with Ericom Access Now for RDCB. An html 5 RDP client behind 2FA. This is on the assumption your an Office 365 organisation.

[Norphy]

I would knock option E on the head right away. Far too much trouble and too reliant on your staff having a decent internet connection.

 

HAP+ is good at what it does but it’s reliant on the user having whatever they need to work on their computer which you can’t necessarily assume.

 

Options A, C and D are effectively the same thing, albeit achieved with different software stacks. One of these would be my preferred option as no data would leave your network, unlike the other two.

 

We used to have Citrix but found it over complicated for what we wanted to achieve which is just a Remote Desktop. This is why we’ve gone with plain RDS with an RDP gateway. You can use Azure MFA with it and there is an HTML5 portal for it these days as well. Citrix is expensive, it’d eat quite a lot of that £25k budget whereas with RDP, you could spend more on the hardware.

[pete]

We use Option C combined with MFA via Duo Mobile.

[PlantHead]

A or C are your best options.

Citrix is far and away better than RDS for application deployment, especially if you want students to use school owned apps when they are not at school - Citrix is also better for network usage but it does cost more.

[oododkodkdo]

I would knock option E on the head right away. Far too much trouble and too reliant on your staff having a decent internet connection.

 

HAP+ is good at what it does but it’s reliant on the user having whatever they need to work on their computer which you can’t necessarily assume.

 

Options A, C and D are effectively the same thing, albeit achieved with different software stacks. One of these would be my preferred option as no data would leave your network, unlike the other two.

 

We used to have Citrix but found it over complicated for what we wanted to achieve which is just a Remote Desktop. This is why we’ve gone with plain RDS with an RDP gateway. You can use Azure MFA with it and there is an HTML5 portal for it these days as well. Citrix is expensive, it’d eat quite a lot of that £25k budget whereas with RDP, you could spend more on the hardware.

 

If we do deploy Windows Server RDS, can it integrate with RSA because, we are concerned about a student having access to a teachers credentials and creating havoc.

Or is there a solution that you know and we could deploy easily?

[theeggmaster]

£25000? Option C with RemoteApp and give the curriculum areas money to spend on pens and books. That's more than my entire hardware budget.

[MatthewL]

C - RDS best way.

[pete]

If we do deploy Windows Server RDS, can it integrate with RSA because, we are concerned about a student having access to a teachers credentials and creating havoc.

Or is there a solution that you know and we could deploy easily?

 

Look at Duo (https://duo.com/) and try it out. It's free for less than 10 users, so you can play with it for as long as you like. We use it with soft tokens on phones, but it also supports hardware tokens.

[oododkodkdo]

Look at Duo (https://duo.com/) and try it out. It's free for less than 10 users, so you can play with it for as long as you like. We use it with soft tokens on phones, but it also supports hardware tokens.

 

How do you acquire these hardware tokens and do they expire?

[pete]

You can buy directly from Duo or use a third-party token. Eventually the battery dies - it's guaranteed for 2 years and will probably be good for 3-5yrs.

 

Scroll down to Security Token FAQ:

 

https://duo.com/product/trusted-users/two-factor-authentication/authentication-methods/security-tokens

 

It's worth emailing them to ask about compatibility - they're pretty responseive.

[oododkodkdo]

You can buy directly from Duo or use a third-party token. Eventually the battery dies - it's guaranteed for 2 years and will probably be good for 3-5yrs.

 

Scroll down to Security Token FAQ:

 

https://duo.com/product/trusted-users/two-factor-authentication/authentication-methods/security-tokens

 

It's worth emailing them to ask about compatibility - they're pretty responseive.

 

Will check out! :-)

[oododkodkdo]

Azure App Proxy with Ericom Access Now for RDCB. An html 5 RDP client behind 2FA. This is on the assumption your an Office 365 organisation.

 

We are not a no-server school so, everything is on site.

I just hate using Azure.

[Davit2005]

With Citrix you will still need to consider MS licensing on top, as other have said it is very complex and not cheap but is the best in my opinion.

 

So my choice would be A or C.

Edited August 7, 2019 by Davit2005

[Tefters]

Option C all day any day.

 

As already mentioned use it with Azure for 2FA don’t go down the RSA root, it’s old, outdated and staff will lose their tokens unlike their phones!

 

Also if you are worried about kids getting hold of staff logons and causing havoc then you already have that issue internally and will after.

Edited August 7, 2019 by Tefters

[oododkodkdo]

Option C all day any day.

 

As already mentioned use it with Azure for 2FA don’t go down the RSA root, it’s old, outdated and staff will lose their tokens unlike their phones!

 

Also if you are worried about kids getting hold of staff logons and causing havoc then you already have that issue internally and will after.

 

How many virtual machines do you use on RDS for client use?

We are a school of 900 and 150 staff and we need to make sure that vms are available.

I plan on giving the teacher systems 6GB RAM and students 4GB RAM.

And also, is it dangerous to open rdweb to the internet?

Edited August 7, 2019 by SamA2V2

[free780]

Well the other issue is RDWeb in its own won't work with chrome/fitefox/ipads/chromebooks/macs without extra steps. The new html 5 client will work but I'd put it through the Azure app proxy as to not expose your RDWeb Server to the Internet.

[oododkodkdo]

Well the other issue is RDWeb in its own won't work with chrome/fitefox/ipads/chromebooks/macs without extra steps. The new html 5 client will work but I'd put it through the Azure app proxy as to not expose your RDWeb Server to the Internet.

 

We have servers on site.

How do we get it working with Azure app proxy?

We might use Azure MFA but, we have no idea how to get it working with our servers on site.

Edited August 7, 2019 by SamA2V2

[DrCheese]

Azure App Proxy with Ericom Access Now for RDCB. An html 5 RDP client behind 2FA. This is on the assumption your an Office 365 organisation.

 

This is what we use - Works brilliantly.

[free780]

This is what we use - Works brilliantly.

Yep it does. Shame you can't SSO Ericom AccessNow without buying an additional product. You can SSO the Microsoft Html 5 client but you have to install the myapps extension and don't expire passwords. Edited August 8, 2019 by free780