dhicks

All the admin stuff for our network is done on a Windows Server instance accessed via web-based interface - I use a Mac at school anyway, and this setup works very well for us. For home use, I'm tempted to get Shadow's cheapest gaming setup - at £12 a month it's more affordable than buying a new laptop every 3 to 5 years.

Yes, I'm working on this at the moment. We've recently moved to iSAMS from another MIS, for which I had an assortment of Python scripts that would extract data and then format it in various ways as needed - assorted sets of CSV files for importing into various services that need lists of usernames and so on, and some formatted, printable PDF documents. I'm currently working on moving that code over to deal with iSAMS data - hopefully it shouldn't take too much work once I get started as it should just be a case of making sure the data extracted from iSAMS is in the format needed for the rest of the scripts. The scripts I have so far aren't ready for general use yet - they include a general configuration script that I haven't tested much yet, and I wouldn't want someone to run it and mangle a working setup.

I currently have a Dell with a 15" screen and enough room to fit 2 harddrives, with the idea that I have one for video editing storage. That's okay, but it's quite a large computer to lug around, and most of the time when I'm using it in my office it's plugged in to a monitor and external keyboard anyway, so I'm tempted to get an 11" Chromebook. Pretty much all my work is web-based anyway (or, at least, accesing remote services through web-based interfaces), although the handy thing about a Windows laptop is that you have multiple web browsers, making it easier to keep different accounts separate.

At the moment we just run rclone from Windows Task Schedular some time after the Veeam backup job is run - at some point we should probably change that to run as a command-triggered-when-backup-job-complete.

Chromebooks might not be as limited as you think - certainly, we've found WeVideo to be a very capable video editor, and Soundtrap looks like it's become an equally capable digital audio workstation (no direct experience of using Soundtrap myself). There was mention of a relaunch of the Google Creative Apps bundle at the BETT show, but I can't find any more details from a quick search - I think the plan is that you could buy licensing for WeVideo, Soundtrap, Explain Everything and a couple of other applications in a simple manner through the Google Play store, complete with educational discounts, but I can't find a link right at the moment. Chromebooks with styluses: nice idea, but we found keeping track of the styluses tricky. Probably best to keep the styluses in the room (art, probably) where they'll be used.

We run an rclone sync job, after the Veeam job has finished, so rclone simply copies the new backup images up to Backblaze and deletes any older / expired ones. We're just on the default retention setup for Veeam backups at the moment, we might extend that a bit at some point.

These are handily cordless: https://www.amazon.co.uk/Hausen-Fireplace-Bellows-Fireside-Lighter/dp/B00GD8YSGK/ref=sr_1_7

This is, possibly, where a Raspberry Pi could be the right tool. The whole idea is that it's a cheap, self-contained computer - maybe set up with a VESA-mount to the back of whatever monitor you have spare so there's initially not too much to tinker with. Maybe set him to create some kind of information website about the school / IT department hosted on the Pi, that should provide enough of a technical challenge to keep him occupied for a while.

We looked at this comparision chart: https://www.4gon.co.uk/ubiquiti-unifi-uap-product-comparison.php We went for one each of the Ubiquiti UniFi nanoHD (around £150) and the Ubiquiti UniFi UAP-AC-HD (around £270) to try out in two locations before commiting to any more purchases. The UAP-AC-HD can team two 1gbps ports (assuming switch support, which is pretty widespread), both are supplied power via PoE.

We have 300 or so assorted Chromebooks around our prep (primary / middle) school. If you haven't already, sort out a Google GSuite For Education Domain (free for schools), that will give you user and device management facilities. There's an additional one-off license fee per device of about £30 for device management capabilities. We find our younger pupils (Y3-ish and below) struggle a bit with typing usernames / passwords. For managed Chromebooks in junior classrooms we tend to have them boot straight into "guest" mode. We're also looking at using Wonde for user login cards, so you can hold a card with a QR code on in front of the device camera for it to log you in.

Yes, EU Central (Amsterdam).

Backblaze charge $5 per TB per month - currently around £3.80: https://www.backblaze.com/b2/cloud-storage-pricing.html We do a nightly sync of our on-site Veeam backup folder using rclone, seems to be working okay.

Also, pothos ivy being gown for indoor air filtration - this company are doing classroom-sized aquaponics kits: https://www.aquariyum.co.uk/ Basically a fish tank with a tray of plants on top with the water cycled through the plant tray. Speaking to them at BETT, they have a Raspbery Pi based sensor module on the way which should let you measure things like water temperature and dissolved oxygen levels, giving you some nice data to use for science / ICT / maths lessons.

We've used Soundtrap in the past, although we don't have a current subscription (we're a prep school, the current music teacher doesn't do much with computer-based music at the moment, and with younger children the need hasn't come up again yet). They are currently exhibiting at BETT or, as their system is web-based, you can start trialing it straight away. GSuite integration is good, so pupils can just log in with their GSuite accounts and start working, and they support using USB music keyboards from the web browser.

I'm familier with using rclone, so it was pretty much my first choice anyway - it's free, easy to set up and runs with no problems. Plus it supports a huge amount of cloud storage options, so if we move provider we just configure a new storage backend in rclone and carry on with very little effort needed.

Tiger Bridge is possibly not the best solution to use with Veeam: https://www.veeam.com/kb3069 A simple mirror of your backups to Backblaze (or other cloud storage) should be fine, though.

Yes, we've just started using them. We're still moving away from Amazon at the moment, and won't be fully switched over for a while (we have a whole new hardware setup to configure), but estimates for costs are about a quarter of what Amazon is costing us at the moment (£50 a month instead of £200 a month). We're using Veeam to backup locally to a local server (about 80TB in total apparent storage to backup up to 10TB of user data / virtual machines), then syncing from that to Backblaze via rclone. We haven't tried a restoration yet, so I'm not sure how long restore times will be - in most cases we'd be restoring from a local backup anyway, the Backblaze copy is in case something goes really wrong.

And only for G Suite Enterprise for Education customers at the moment, plain (free) G Suite for Education users aren't included (yet). It looks like Google have gotten around to writing a Windows Credential Provider that integrates with their login system. I can't tell from the documentation available so far if this provides singe sign-on for applications within web browsers, i.e. does the credential provider (which is using SAML) pass on login details / tokens to web browser(s) (which are generally using OAuth). What would also be useful is to be able to auto-mount a user's Google Drive folder(s) in Windows in some way, which might be provided by this system. I'm not sure of the device configuration updates able to be pushed to devices would be a replacement for all that can be done with Active Directory / Group Policy.

Ooh, going to give this a try on a couple of portable amps we have with this issue - we've tried screwing a slender screw into the centre of the broken-off bit before, but results tend to be variable.

If the aim is to have staff move laptops between classrooms, I'd aim for something ultra-portable, 11"-sized screen, with a vertical stand and external monitor in desktop locations for users to plug in to (ideally via a one-connection-does-everything USB C cable). Our pupils use the Asus C101PA Chromebook Flip - £200 each when new several years ago, I'm not quite sure what the equivilant Chromebook / Windows is now, but you'd think there'd be something similar available for a similar price. They've lasted better than we thought they might, and are small enough to be stuffed in the front of a backpack. I use a 17" desktop replacement Dell machine in my office, and where it's nice having a capable machine for video editing (the chassis is large enough to hold two harddrives), it's a palavar to lug to and from the office as it takes up most of my backpack space.

I'm part-way through writing an OAuth-authorised gateway service for Guacamole, allowing users to log in to a remote desktop using their existing GSuite / O365 / etc credentials. I have a working Guacamole setup, which might be at least partially suitable or what you're doing. I found getting Guacamole working on Debian 10 to be difficult, and have stuck with Debian 9 for the moment. On a freshly installed Debian 9 VM, I installed: # Cairo (library used by Guacamole for rendering graphics). apt-get install -y libcairo2-dev # libjpeg62-turbo-dev (library used by Guacamole for handling JPEG image data). apt-get install -y libjpeg62-turbo-dev # libpng-dev (library used by Guacamole for handling PNG image data). apt-get install -y libpng-dev # libossp-uuid-dev (library used by Guacamole for handling PNG image data). apt-get install -y libossp-uuid-dev # FFmpeg (library used by Guacamole for handling video encoding). apt-get install -y libavcodec-dev apt-get install -y libavutil-dev apt-get install -y libswscale-dev # FreeRDP (library used by Guacamole to handle RDP connections). # Note that, hopefully, in a future version of Gaucamole, this dependancy is going to # change from libfreerdp-dev to freerdp2-dev. For the moment, we are sticking with # Debian 9 ("Stretch"). apt-get install -y libfreerdp-dev # Pango (library used by Guacamole to support SSH and Telnet connections). apt-get install -y libpango1.0-dev # libssh2 (library used by Guacamole to support SSH connections). apt-get install -y libssh2-1-dev # libtelnet (library used by Guacamole to support Telnet connections). apt-get install -y libtelnet-dev # libvncserver (library used by Guacamole to support VNC connections). apt-get install -y libvncserver-dev # Pulse Audio (library used by Guacamole to support audio over VNC). apt-get install -y libpulse-dev # libssl (library used by Guacamole to support SSL) is installed. apt-get install -y libssl-dev # Ogg Vorbis (library used by Guacamole to support Ogg Vorbis audio). apt-get install -y libvorbis-dev # libwebp (library used by Guacamole to support WebP image data). apt-get install -y libwebp-dev # Tomcat servlet container (used for serving Guacamole client contents to users connecting to the Guacamole server via web). apt-get install -y tomcat8 tomcat8-admin tomcat8-common tomcat8-user How are you handling SSL? I installed Nginx to act as a reverse proxy, along with support for Let's Encrypt: # Nginx web/proxy server (used to proxy the Tomcat server and provide SSL)... apt-get install -y nginx # ...with support for Let's Encrypt. apt-get install -y python3-acme python3-certbot-nginx python3-mock python3-openssl python3-pkg-resources python3-pyparsing python3-zope.interface

Probably the best idea - we found wiping-and-reinstalling our iMacs to be very easy, with the Mac itself handling the reinstallation of the OS via the Internet (make sure you reformat the disk first, otherwise the OS will be re-installed but all the existing applications will stay in place). Upon rejoining a freshly-installed Mac to ZuluDesk it was recognised and had the appropriate policies applied straight away.

Hmm. What version of Mac OS? We're on Mojave, which binds okay to Active Directory - and we're using a .local domain at the moment, too. Maybe more security restrictions if you're on Catalina (we haven't dared tried upgrading anything yet).

I got part-way through the setup above, then came accross the cloud service - I did try to get it set up, but nothing seemed to download from the Ubiquiti setup page after login, and there didn't seem to be much of an explanation on the site itself. I need a proxy service for other things anyway, so I figured I might as well get this proxy set up and working so I understood what it was doing.

Hello All, We are using Ubiquiti's UniFi Video application to record and view our 15 CCTV cameras. This is an application with a web-based front-end, hosted on-site on a Debian VM. We have an issue where some (but not all) workstations that need to access CCTV have issues with the self-signed certificate provided by the application. Everything worked fine, as far as I know, up until a few months ago, when some browsers started to simply stop accepting the self-signed certificate. I figured this was an issue with a browser update, so we tried with Firefox 32-bit ESR, but still with the same issue. We then figured the issue might be a Windows update, so re-imaged a workstation back to Windows 10 1803, still with no success. Therefore, I figured the solution was to sort out a proper SSL certificate for the CCTV server. The process for replacing UiFi's certificate with another one comes under the "advanced" section of its documentation, so I figured the easiest (and best) solution would be to set up a reverse proxy server to allow us to connect to the server from outside, all with properly set-up SSL via Let's Encrypt. I set up a separate Debian 10 VM, installed Nginx, and have the follwing configuration: server { server_name cctv.myschool.com; listen 443 ssl; # See: https://gist.github.com/vidia/fbef2ee643b23848d8b24211d5860b78 # I'm not sure why the "/ws/" location needs separate settings, but the comments in the config given at the above URL # state "needed to allow the websockets to forward well". location /ws/ { proxy_pass http://192.168.x.y:7080; proxy_http_version 1.1; proxy_buffering off; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_read_timeout 86400; } location / { # Note that here (and above) we are forwarding to HTTP on port 7080 on the Ubiquiti server. Traffic is sent # unencrpted, but only over the local network on the one switch in the server rack. We use equally easily have # used the HTTPS port, 7443, but that would add some further overhead (30%?) for extra encryption. proxy_pass http://192.168.x.y:7080/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forward-For $proxy_add_x_forwarded_for; } ssl_certificate /etc/letsencrypt/live/cctv.myschool.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/cctv.myschool.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; } # Proxy port 7446, used by Ubiquiti for Websocket connections. # Note that we're passing 7446 here (video-over-HTTPS websockets) to port 7446 on the Ubiquiti server - passing to 7445 instead (video-over-HTTP) # doesn't seem to work. server { server_name cctv.myschool.com; location / { proxy_pass https://192.168.x.y:7446/; } listen 7446 ssl; ssl_certificate /etc/letsencrypt/live/cctv.myschool.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/cctv.myschool.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; } # Redirect any HTTP requests to HTTPS. server { if ($host = cctv.myschool.com) { return 301 https://$host$request_uri; } listen 80 ; server_name cctv.myschool.com; return 404; } We're forwarding ports 80 (HTTP), 443 (HTTPS) and 7446 (websocket data) on the gateway to the proxy server. Port 80 is only open so Nginx can redirect any requests made to it to HTTPS instead. The above seems to be working fine. I don't get what the "/ws/" section is doing - I assume the URL is somerthing to do with Websockets, but why does Websocket functionality need its own namespace as well as a whole dedicated port? Also, we're proxying HTTP served from the Ubiquiti server with HTTPS on the proxy server, but why doesn't that work for the Websocket port, i.e. why can't I send data to port 7445 on the Ubiquiti server instead of 7446?