Ephelyon

Well, the point is it's IT in general, not specifically in education but everywhere. And when you look at it like that, there are a lot of things that go wrong in IT that could have a potential impact on someone's life. Banks go down and people can't get to their money... a data breach occurs owing to poor security and the company goes bust (we've all seen the figures) so both owners and employees are out of a job, and potentially their house if they can't find another one in time... a database corruption/indexing issue results in mixed-up data so people are given the wrong medication (could be life-threatening), etc... it's all possible!

... but should it be? I'd argue that if the baseline is that much more variable, that's even more of a reason to regulate further along the line... it would mean an end to "my husband's good with computers", for sure! So in this scenario, that person wishing to take on an IT role formally (i.e. actually being employed, not just helping out) would have to firstly join the BCS (a requirement of which would be baseline competence), then have their competence for that level of role assessed. I mean, come on, there are reasons why we don't let unlicensed people practise medicine, or law, or electrical work... why should it be okay for the profession that manages/develops/maintains the technology we've decided to hang half the bl**dy planet off the back of?! It would be part of the "coming of age" of people taking IT seriously as a "proper" profession, which it has all the other hallmarks of if you ask me, just not these professional structures that you see elsewhere. I know and understand the historical reasons behind why that's the case, but it's now 2017 and I think it's "growing up time" for the world's view of this...

I agree it's a myth at the moment, although I do think a more regulated IT profession managed by the BCS and other international equivalents could be incredibly helpful. By this, I mean a structure perhaps similar to the medical (or legal) profession - example image attached. So your actual position and job title with your employer would of course continue to vary according to their requirements, but individual professionals would also hold some manner of "rank", such as Junior, Practitioner, Senior, Consultant etc. That would serve three purposes that can be sorely lacking at the moment: 1) Providing some semblance of career structure, progression and professional recognition for individuals, regardless of the sector they happen to work in (as IT is everywhere); 2) Providing employers with some idea of the quality of the people they're getting in (as was attempted for schools with the BECTA Skills Framework), to make IT less of a "dark art"; 3) Providing rigour and discipline for IT professionals - who could face being struck off by their professional body for e.g. malpractice around stealing corporate secrets - as opposed to having to go through the courts every time (which is not to say you wouldn't do that also). I know the BCS already offer RITTech and Chartered status, but what I'm talking about is a finer and more involved grading structure that is actually mandatory for IT professionals, all of whom must be licensed to practise in just the same way that doctors, lawyers and electricians are. (Just tagging @GrumbleDook here as these are issues we've discussed in the past.)

I agree it's a myth at the moment, although I do think a more regulated IT profession managed by the BCS and other international equivalents could be incredibly helpful. By this, I mean a structure perhaps similar to the medical (or legal) profession - example image attached. So your actual position and job title with your employer would of course continue to vary according to their requirements, but individual professionals would also hold some manner of "rank", such as Junior, Practitioner, Senior, Consultant etc. That would serve three purposes that can be sorely lacking at the moment: 1) Providing some semblance of career structure, progression and professional recognition for individuals, regardless of the sector they happen to work in (as IT is everywhere); 2) Providing employers with some idea of the quality of the people they're getting in (as was attempted for schools with the BECTA Skills Framework), to make IT less of a "dark art"; 3) Providing rigour and discipline for IT professionals - who could face being struck off by their professional body for e.g. malpractice around stealing corporate secrets - as opposed to having to go through the courts every time (which is not to say you wouldn't do that also). I know the BCS already offer RITTech and Chartered status, but what I'm talking about is a finer and more involved grading structure that is actually mandatory for IT professionals, all of whom must be licensed to practise in just the same way that doctors, lawyers and electricians are. (Just tagging @GrumbleDook here as these are issues we've discussed in the past.)

This is similar to a question I raised with the team earlier today: once signed up, is it £3/device "forever", or will that pricing then "revert" at some (unspecified) point in the future? Information from Sales today indicated that the pricing would be "forever" for schools that take advantage of this deal now. I guess it's like those "half price for six months" deals you get on e.g. broadband contracts...

I've been speaking to the team today and I think we're going to go with this... On a side note, though, there's a missing letter on the animation in the top-right corner of the EduGeek homepage:

I've shared mine previously and it was cross-posted back by @speckytecky here.

Just playing with this today... Let's say we are in our jail and we want to set up a FAMP stack! We will do the following... Firstly, let's become "root": su Now let's install the packages we need for this: pkg install apache24 mysql56-server mod_php56 php56-mysql php56-mysqli We'll make sure the OS is aware of the new packages we've installed with: rehash We want Apache and MySQL to start with the jail, so let's add the required lines to /etc/rc.conf to make that happen using the built-in tool for this: sysrc apache24_enable="YES" sysrc mysql_enable="YES" Next, let's set up PHP. We'll need a php.ini file, so let's copy the default production-ready one into place: cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini Now we need to set up Apache to use PHP, so we'll create a php.conf file to do so: vi /usr/local/etc/apache24/Includes/php.conf We'll need to copy and paste the following into it (in the same manner as my original post): DirectoryIndex index.php index.html SetHandler application/x-httpd-php SetHandler application/x-httpd-php-source Then save and close. We'll also want to be able to test our PHP functionality, so let's create a .php file in our web server's root directory for that purpose: vi /usr/local/www/apache24/data/info.php We can copy and paste the following into it for our purposes: Now we come to MySQL. This next step is often left out of tutorials. Inside a jail, the "mysql" user can't write to /tmp by default, so let's rectify that: chmod 1777 /tmp So now we want to start the MySQL daemon: service mysql-server start MySQL installations aren't all that secure by default, so let's run a pre-packaged script to sort that out like so: mysql_secure_installation We should then restart MySQL to use the new configuration: service mysql-server restart Finally, let's start Apache: service apache24 start Voilà! If we browse to our jail's IP address, we should now see the default Apache page. If we add /info.php to the end of that URL, we should see some PHP config details that confirm PHP is up and running too. Testing MySQL would be rather more involved, but at least we know it's working because the "mysql_secure_installation" ran successfully against it (it would fail otherwise). What do people think? Could the above be a good first session to work through for a club?

Yes, or Zones on Solaris - they all have real-world applications! The main reasons I'd go for FreeBSD over Linux or Solaris are: 1) Stability - jails have existed since FreeBSD 4.0; 2) Performance - FreeBSD's emphasis is on performance and its raw socket I/O stats can be through the roof. Netflix uses FreeBSD servers for content streaming to millions of users; Microsoft used to use it for Hotmail before the migration to Exchange; 3) Ports - the BSD ports tree is one of the easiest ways to learn the methodology of compiling from source for any package; 4) Bulk operations - I'm using the "qjail" tool for this, as it can create and auto-configure up to 100 jails in bulk with a single command.* *Can you do this with LXC/D or Docker? I've looked around but couldn't find any references to this.

Same here... that's why I'll be going along to the club so we can all have a play around together and students can ask me questions in real-time. A powerful demonstrator of how easily people can get started inside their jail would be: pkg install nginx service nginx onestart BOOM - web server running! @garethedmondson - what say you?

UPDATE: "da0" may also be "ada0" on some hypervisors.

This is one of those cases where I've just found out the English name for something because I'd only ever encountered it in Dutch before - it's not Miffy, it's Nijntje! Another one would be in the world of Kuifje (Tintin). I knew Tintin's name in English (from seeing the show listed in the Radio Times), but not Snowy's - Snowy is Bobby in the Flemish version, so I got very confused when the trailer for the new Tintin film was shown in cinemas a few years ago...

Following a protracted love affair with FreeBSD recently, I'm now launching an after-school club to "stretch the most able" in Computer Science by offering 100 FreeBSD jails to which students can have full root access, run servers and generally play around with, safe in the knowledge that any mess-ups can be restored from a jail archive if necessary. I'm only going to have the VM running during club hours to minimise abuse (as these jails will need Internet access to do anything very useful, e.g. installing packages). I thought I'd share the method as it's relatively easy to set up. Because a jail is essentially a chroot on steroids (i.e. each has its own unique IP), sharing the same host kernel but not involving full-on virtualisation, the VM doesn't need much grunt (only 2 cores and 4GB RAM here at the moment). FreeBSD images for different hypervisors are downloadable from here, though you'll probably want to embiggen the virtual disk before starting the VM (as each jail gets up to 1GB space if you follow the process below exactly). The following are all the commands needed to take a fresh VM image from scratch to where mine is now. So... we've logged in as "root" with no password. First, let's be British: kbdcontrol -l uk Next, let's give "root" a password: passwd Now, we want to create a setup script to do all the work for us: vi setup.sh Press the Insert key within vi to enter text, then copy and paste the following into this screen, changing the values in italics as appropriate (I'd do this beforehand). Also note that "hn0" (in bold) may be different on different hypervisors - the below is from Hyper-V, while on ESXi it would be em0: #!/bin/sh gpart recover da0 gpart resize -i 3 da0 growfs -y /dev/gpt/rootfs echo keymap=\"uk\">/etc/rc.conf echo hostname=\"[i]ChosenHostName[/i].[i]YourDomainName[/i]\">>/etc/rc.conf echo ifconfig_[b]hn0[/b]=\"inet [i]ChosenIP[/i] netmask [i]YourNetMask[/i]\">>/etc/rc.conf echo defaultrouter=\"[i]YourGateway[/i]\">>/etc/rc.conf echo sshd_enable=\"YES\">>/etc/rc.conf echo qjail_enable=\"YES\">>/etc/rc.conf echo search [i]YourDomainName[/i]>/etc/resolv.conf echo nameserver [i]YourDNSServer[/i]>>/etc/resolv.conf echo PermitRootLogin yes>>/etc/ssh/sshd_config echo net.inet.ip.portrange.randomized=0>>/etc/sysctl.conf sysctl net.inet.ip.portrange.randomized=0 /etc/rc.d/netif restart /etc/rc.d/routing restart service sshd start portsnap fetch extract env ASSUME_ALWAYS_YES=YES pkg upgrade env ASSUME_ALWAYS_YES=YES pkg install qjail qjail install qjail update -p qjail create -n [b]hn0[/b] -d 100 -c -i 1g -4 [i]StartingIP[/i] student qjail config -k student= qjail start qjail stop qjail archive -A Once pasted in, press Escape to leave text-entry mode, then save and close the file with the following command in vi: :wq (and press Enter) Then we make our script executable with: chmod +x setup.sh And now we run it with: ./setup.sh (For StartingIP, if my VM is going to be 172.16.7.100 and I'm creating 100 jails, I would use 172.16.7.101 here as I would then have the host and jails using .100 and then .101 to .200, respectively) Using the script above, jails will be created as "student-001" through "student-100". I then used "dnscmd" with a "for" loop on our domain controller to bulk-create the DNS entries for these so students can get to them more easily. There will be a built-in user whose name and initial password are the same as the jail name. I've got two people interested in the club so far. Anyone else care to try it out where you are?

Something can't be quite right with the way you've edited the file then. That's a direct screenshot from ours and it's working fine on Server 2016. Alternatively, perhaps some modifications are needed for 2012 R2 after all - can anyone else confirm who got it working?

This is how that whole section of code should look:

Weird - working here! What does it think the username is when it pops up the second time?

(Side-note: I've also edited login.aspx on our setup to change the string on the sign-in page from "Domain\username" to just "Username" to ease any confusion.)

If you follow the instructions in my later post beginning with "Update!", they will ensure that the username taken forward will always be in UPN format, whether it's entered on its own or with the DOMAIN\ prefix. No, I don't believe there's a way for the @DomAin suffix not to be shown, though of course it's only brief (unless their Internet is dreadful, of course)...

Yes (Lowercase "true", though, and don't forget the semicolon at the end!)

Apologies, my error. Just change the "objTSFormAuthTicketInfo.PrivateMode" to "true". Think I must've come back to it after trying a lot of other edits and assumed what I'd changed to "true" must have originally been "false". Could a mod perhaps edit my original post to reflect this please?

I like that find - may give it a go. Crusty old WDS here on Server 2016 (though at least it's not RIS!), and it's nice to see someone else using manual scripting to handle renaming and domain joins...

UPDATE! This is apparently not the behaviour for all clients. My clean Win10 test environment was fine, but then a colleague's Win7 school laptop didn't like having e.g. "GREENABBEY\[email protected]" as the username and would prompt twice without accepting the latter, so I've now corrected for this too. In webscripts-domain.js, just above the previous edit beginning with if ( -1 == strDomainUserName.indexOf("@") ), insert this: if ( -1 != strDomainUserName.indexOf("\\") ) { strDomainUserName = strDomainUserName.substring( strDomainUserName.indexOf("\\") + 1, strDomainUserName.length ); objForm.elements["DomainUserName"].value = strDomainUserName; } So that section of the code should now look like this: strDomainUserName = objForm.elements["DomainUserName"].value; if ( -1 != strDomainUserName.indexOf("\\") ) { strDomainUserName = strDomainUserName.substring( strDomainUserName.indexOf("\\") + 1, strDomainUserName.length ); objForm.elements["DomainUserName"].value = strDomainUserName; } if ( -1 == strDomainUserName.indexOf("@") ) { strDomainUserName = strDomainUserName + strDomainName; objForm.elements["DomainUserName"].value = strDomainUserName; } strPassword = objForm.elements["UserPass"].value; This should ensure that, regardless of whether the user enters "username", "GREENABBEY\username" or "[email protected]" for the initial sign-in, it will go down as "[email protected]" and should work fine!

You can tell by what comes up in the certificate prompt for the users.

Ah, yes, sorry - as @FN-GM says, that's something else I did, although it didn't fix it by itself. Subject alternative names should be fine also. So, instructions for that: Let's assume our external FQDN for remote access is "remote.greenabbey.org.uk", we have a certificate for RemoteApp and other RDS services that matches that name and our server's internal IP address is 172.16.253.120. Run the attached script on your RDS box (specifically, the Connection Broker if the roles are not centralised) with the following syntax: .\Set-RDPublishedName "remote.greenabbey.org.uk" Then edit the hosts file on that server in: %WinDir%\system32\etc\hosts ... and add the line: 172.16.253.120 remote.greenabbey.org.uk Set-RDPublishedName.ps1

That is the problem the instructions above should hopefully correct. I would revert your original change first, then try these instructions - taking backups of the files in question at every stage of course. The various solutions floating around on the web seem to be about removing the need to type the domain name (in DOMAIN\username format) on the initial sign-in screen, but this doesn't then carry over to launching apps, as you say. My original post changes the logon name to use UPN format but without users needing to type anything extra, and then for some reason I don't understand, RemoteApp seems much happier for SSO, even without being domain-joined...