Geoff

Home | World Backup Day — March 31st

If you have any weakness in security you can bet ransomware will find it. The perpetrators are more motivated than ever due to the amount of money it makes them and the subsequent resources they can bring to bare with that money. CryptoWall Ransomware raised $325 Million in Revenue for Its Developer

The problem is most clients ignore the option sent by the client. You are better off doing a client match in your dhcpd.conf based on the clientid, hardwareid or vendorid and giving out an ip on a separate range that has a matching set of pre generated dns hostnames in bind. That way it's irrelevant what the client calls itself.

Well you can take the components that make up FreeIPA and DIY it. Don't forget you can send the hostname as a DHCP option.

Also check out FreeIPA. It's LDAP with all the extra bells and whistles in one handy dandy appliance. It's the nearest thing you'll get to Active Directory anyway. https://www.freeipa.org/page/Main_Page

We have a separate 'DMZ' domain and use trusts (The DMZ domain trusts the main domain but not the other way round).

It is at the moment, but as I said the move towards cloud and mobile is there. We only have Windows desktops because that's what we've invested in and we will use it until it's obsolete or written off. What we replace it with when 2019 rolls around is an open question we've not chosen to address yet. Maybe it does, maybe it doesn't but maybe it doesn't matter because I don't care what the school runs. The bottom line for a business is that the prospective employees that you produce can read, write, type and have some common sense and problem solving skills. These qualities seem to be on a worrying decline and I'd suggest that the choice of software platform isn't a deciding factor in this result. Actually they are often buried under mounds of paper, technology be dammed and all that. However, when out of the office yes they do solely rely on phones and tablets. So in some job roles a desktop PC is a wholly unsuitable dinosaur. Factually wrong as @MrKJLS has pointed out. Apart from anything else the licensing demands Redhat provides the source code. Granted I have support contracts in place for the systems but that is a separate agreement to actually getting hold of the OS and one does not depend on the other. In house support (with or without certification) is a perfectly valid pragmatic solution too. It all comes down to cost vs benefit.

I misread the thread title as 'caused by amateur astronomers' and was left wondering how powerful their telescope was.

While this might of been true a few years ago, most SMBs are looking or have moved to cloud providers. The obvious choice to keep end users happy is O365 and Azure. Granted we have a legacy estate of windows 7 desktops and 2k8 VMs in a Vmware setup but given a clean slate and the same budget today we would never implement such a system again. It simply isn't cost effective compared to cloud. Economies of scale and all that. Given that the choice of client is fairly irrelevant. In fact given the rise of mobile computing the in the workplace (everyone wants to run their professional lives via their smartphone / tablet) cross platform support is required and 90%+ of the mobile market isn't running Windows Mobile. I can speak from experience and say that our business is mostly blackberry with a smattering of iPhone/iPads for the SMT. I actually have the only company Nokia Windows phone purely for trial purposes. This is manifestly not the case. As a fully paid up commercial enterprise customer of Microsoft we get very few 'free' support incidents a year (I think it's about 3). To the point where we pay again for another MSP for support. I get full support off Redhat for our smattering of RHEL servers as much as we like in contrast and I get to talk to a real engineer instead of an Indian call centre.

You have to put an exception in for the Logmein/Gotoassist/whatever executable to run from appdata. However be aware that many 'Microsoft Technical Support' scammers use the same tools. We avoid this by having a dedicated PC in IT that is exempt from the setup for remote support to use and only use. That way we can categorically blame them if we get infected via that machine. They are generally using a domain admin login anyway.

Also consider whitelisting instead of blacklisting.

Prior to an infection: 1. Tested backups kept offline (ideally offsite). 2. Disable files running from AppData/LocalAppData folders. 3. Take local admin rights of users. 4. Have a separate admin account from your day to day account. Only use the privileged account for 'admin' work. 5. Use FSRM filters to look for common ransomware file names. 6. Filter ALL attachments coming in via email. 7. Lock down USB / Optical drive access. 8. Install an IDS. 9. Use a reputable AV solution and keep it updated. 10. Keep up with patches. Especially web browsers, plugins and the OS. 11. Educate users about dodgy emails, pen drives and general computer hygiene. Test them on it (phish your own users). During / Post Cleanup. 1. Take the network down. 2. Thoroughly record what steps you are taking (important for 7). 3. Identify the source of the ransomware. How easy this will be is dependant on exactly what's got encrypted. Check the file server first. 4. Wipe and reimage any infected machines. 5. Restore your data from your backup. 6. Slowly bring everything back online one by one. If you spot encryption happening again go back to step 1 and try again. 7. Evaluate what happened and make recommendations on how to prevent it (usually due to SMT refusing to let you do something in the other list)

Sharepoint is another option.

The following was posted to the edubuntu-devel mailing list:

This was a while ago, but at the school I worked at we had overcrowding issues in the two dining rooms. We put packed lunch pupils in the nearest classrooms to eat. We never charged pupils, although it was a 'first come first served' basis for the packed lunch students. There were other areas in the school with open plan seating they could eat though.

Also anything running 3rd party firmware. My Netgear WDGN 3700 has been reflashed with OpenWRT. There is a very detailed article on the wiki about the traffic control you have available to you. There are several example configurations to work from so you don't need to start from scratch.

Ripped out our old Cisco and 3com kit for HP Procurves. Our core switches are Dells though.

Is anyone playing this? It's available on Android and iThing. I picked it up because I play Clash of Clans with some real life friends. It's quite a nice mix of a battle card game and tower defence. Also 'pay to win' doesn't really work as levelling up your cards just matches you with other players who've done the same. You can't unlock extra cards with gems either. You need to be ranked high enough to be in the appropriate arena for the card to unlock. ie skill is required. If anyone is interested and wants to join a clan (you can trade cards in a clan and also real time battle clan mates for practice and feedback) I have a clan called 'Loading...' tag is #8UCPJL

Oh yes, forgot to mention. My landline is hooked up to a fax machine to entertain cold callers.

I have a sip account with OrbTalk that has a uk geographic number attached to it (I have an 087 number redirected to it and use that contact number for any signup forms etc). At my home this is handled by FreePBX. I then use the 'follow Me' settings to have it redirect to my mobile or my computer(s) as necessary. Failing that connecting then the call is screened against a number list and then redirected to an IVR infinite loop (Lenny) or Voice mail as appropriate (I have voicemail to email setup). Outbound dialling CallerID either presents my 087, UK geographic number(s) or mobile number based on call prefixes. The outbound call rates are far cheaper than calling over the mobile network. I make around £50 a month on the 087 numbers revenue share after paying for the SIP account.

Is that too narrow though? What about Video Conferencing, Online Collaboration and Instant Messaging? These technologies go hand in hand with VoIP to give you a full platform.

what do you mean by 'gestion' that's not a word.

What switches are you using? They must have 802.1X support and also be supported by packetfence.

Where did you get up to in the documentation?

Samba 4 on Linux uses LVM snapshots for VSS emulation. There is no way to delete them from the client side as they are mounted read only.