Remote Access from home

[SueRobberts]

Hi, i work in a school and we have file servers where shared drives are which staff use as data storing, is there any secure way staff can access these file servers/Network drives from home? like a remote access website, they are willing to pay

 

Thanks

[chris11256]

Can always do a remote desktop gateway/web access? Can also be configured with Office 365 MFA if you use it already. Or something like HAP+, it has a sub forum here.

[3s-gtech]

This is what Always On VPN is for. Cost is the cost for a server (can be a VM), OS license for it and an external IP for it. The setup takes a bit of work but it's commonly used.

 

Don't use HAP+ now.

[chris11256]

In our case specifically we use the remote desktop web access HTML5 portal for the few non cloud resources, plus select staff using the gateway for remote desktop to their office PC.

[jmcdermott]

VPN is the cheapest simplest answer, just be sure to use a random server name not vpn.schoolname.sch.uk, these address get constant attacks.

[Koldov]

We use Cisco AnyConnect (VPN) for remote access (supplied with our LGfL connection bundle which handles the config and 2FA side of things).

 

Are you the ICT support for the school, if not have you got any?

 

This isn't something I would suggest doing without it (it can be complicated and has the potential for data breaches if not set-up correctly).

 

Also, on that note, you would might need to consider updated AUPs as effectively a teacher could be connecting from an insecure location (or device depending on the route you take).

Edited September 28, 2022 by Koldov

[SueRobberts]

Yes they are LGFL Scools, they used to used RAV3 which they discontinued and now it is called Freedom2Roam, which is remote access to the desktop in the school from anywhere, the thing with that is, the staff outnumber the computers in the school and are alwasy complaining

[Alex0x7F]

We use Cisco Connect Anywhere (VPN) for remote access (supplied with our LGfL connection bundle which handles the config and 2FA side of things).

 

Are you the ICT support for the school, if not have you got any?

 

This isn't something I would suggest doing without it (it can be complicated and has the potential for data breaches if not set-up correctly).

 

Also, on that note, you would might need to consider updated AUPs as effectively a teacher could be connecting from an insecure location (or device depending on the route you take).

 

+1 over here for Cisco AnyConnect, supplied to use by our internet and Smoothwall security ran by the local council's IT service.

[Koldov]

Yes they are LGFL Scools, they used to used RAV3 which they discontinued and now it is called Freedom2Roam, which is remote access to the desktop in the school from anywhere, the thing with that is, the staff outnumber the computers in the school and are alwasy complaining

 

Ah, ok I see.

 

We don't use it like that.

 

Each teacher laptop has Cisco AnyConnect (aka LGfL - Freedom2Roam) installed on their laptop and the module for pre Windows authentication to the VPN (Cisco AnyConnect Start Before Login Module).

 

It was set-up so that once the laptop is started up, if they use that to sign into the VPN and then sign into Windows, it appears that the laptop is actually on the Domain**.

 

If they are an LGfL school, the support site will be able to help you.

 

**EDIT: Should clarify... it works as if the laptop is on-site in the school (so they have access to everything they would at school).

Edited September 28, 2022 by Koldov

[Delgado]

Linux. SSH tunnel. Get your ISP to port forward SSH to a non standard SSH port on your LAN server. Get your clients to use SCP at home to upload/download. All free and secure.

[dmj]

Linux. SSH tunnel. Get your ISP to port forward SSH to a non standard SSH port on your LAN server. Get your clients to use SCP at home to upload/download. All free and secure.

 

I'd dispute that, SCP isn't secure and had been deprecated. You probably mean SFTP? Either way it's probably too complex for end users to setup. If you're going to the trouble of setting up an SSH tunnel you might as well tunnel SMB over it. https://github.com/sshuttle/sshuttle is great for this, but again probably over complex for your average teacher.

 

There are loads of other ways to do this; I'll try and summarise methods I've worked with in the past:

 

1) VPN: Staff login to a gateway and use the applications installed on their own computers to access resources such as shares and databases.

 

2) Remote Desktop/Virtual Desktop: Staff use the applications installed on a remote server. Licensing can be complex and expensive.

 

3) Expose file shares over WebDAV: really simple setup, just requires an HTTP server with access to the fileshare, almost all operating systems support it natively.

 

4) Third party application such as HAP

 

5) outsource to cloud provider; Google workspace or Office365

 

If the requirement is simple access to files then I'd go for webdav, it's a stable system which is easy to use and runs over https .

My preferred options would be 5 > 1 > 3 > 2 > 4

[Boredguy]

These days offloading your file storage to Office 365/G-Suite for access from anywhere is sometimes the easier option than having to go to the trouble of VPN tunnels or third party apps.

[Delgado]

I'd dispute that, SCP isn't secure and had been deprecated. You probably mean SFTP? Either way it's probably too complex for end users to setup. If you're going to the trouble of setting up an SSH tunnel you might as well tunnel SMB over it. https://github.com/sshuttle/sshuttle is great for this, but again probably over complex for your average teacher.

 

There are loads of other ways to do this; I'll try and summarise methods I've worked with in the past:

 

1) VPN: Staff login to a gateway and use the applications installed on their own computers to access resources such as shares and databases.

 

2) Remote Desktop/Virtual Desktop: Staff use the applications installed on a remote server. Licensing can be complex and expensive.

 

3) Expose file shares over WebDAV: really simple setup, just requires an HTTP server with access to the fileshare, almost all operating systems support it natively.

 

4) Third party application such as HAP

 

5) outsource to cloud provider; Google workspace or Office365

 

If the requirement is simple access to files then I'd go for webdav, it's a stable system which is easy to use and runs over https .

My preferred options would be 5 > 1 > 3 > 2 > 4

Sorry. I should clarify that with 'WinSCP', which looks a lot like explorer as an interface to the users. Not aware of that being deprecated as its available from the Microsoft store.

 

https://apps.microsoft.com/store/detail/winscp/9P0PQ8B65N8X?hl=en-gb&gl=gb

[dmj]

Sorry. I should clarify that with 'WinSCP', which looks a lot like explorer as an interface to the users. Not aware of that being deprecated as its available from the Microsoft store.

 

https://apps.microsoft.com/store/detail/winscp/9P0PQ8B65N8X?hl=en-gb&gl=gb

 

I wouldn't trust MS with security of SCP:

 

We’re making this change because the SCP protocol is decades old, and carries multiple security risks and issues that have no straightforward solutions. New issues are being reported frequently (CVE-2020-15778 is the most recent as of this writing, but we can’t be sure it will be the last) and it is rather difficult to fix them all properly because the protocol is inherently trustworthy of authenticated sessions.

https://www.redhat.com/en/blog/openssh-scp-deprecation-rhel-9-what-you-need-know

 

Edit: WinSCp actually supports STFP so it's a moot point I guess as long as your ssh server is set to disable scp.

Edited October 9, 2022 by dmj

[Delgado]

I wouldn't trust MS with security of SCP:

 

 

https://www.redhat.com/en/blog/openssh-scp-deprecation-rhel-9-what-you-need-know

 

Edit: WinSCp actually supports STFP so it's a moot point I guess as long as your ssh server is set to disable scp.

 

Yup. I read that WinSCP can also use SFTP instead of SCP. Cloud as a solution is undeniably less of a compliance issue.

[dapaulio]

I second aovpn. Normally zero/low cost to setup.

 

If you haven’t got a lot of domain joined laptops to give to staff

 

You can always use session host rdp for staff and students with personal laptops

 

Practically all of schools have both setup

[browolf]

We use Accops Hysecure https://www.accops.com/products/hysecure for remote access to Sims and desktops which our previous NM got through Hanco global solutions.

[mdrabble]

I currently have student resources on SharePoint and all home drives and staff resources on premise.

 

Only staff can use RDS (html5 interface) with MFA enabled to access home drives and staff resources.

 

Plans are to move staff resources to Teams/SharePoint and then user areas to One Drive.