dmj

I don't agree with the 'proper tools argument - at the end of the day you manage windows clients using either standard or well documented protocols which usually boil down to applying registry settings to the clients which are published as ADMX files. How you deliver it is all pretty standard. LDAP/SMB/DHCP/DNS all integrate really well with windows clients. Back when I was school NM we used to pay for server licenses/CALs perpetually and get the workstation licenses with the PC. It was vastly cheaper than the annual licensing. As far as 'damaging the school' it sounds more like saving the school money, ensuring job security and getting a better paid job at the end of it.

I don't really understand why this is the case. Something like 95% of the internet runs on linux/unix operating systems so you'd think the opposite would be true. Is it just that there is higher demand for linux and that puts the pay higher meaning schools can't compete?

I wouldn't trust MS with security of SCP: https://www.redhat.com/en/blog/openssh-scp-deprecation-rhel-9-what-you-need-know Edit: WinSCp actually supports STFP so it's a moot point I guess as long as your ssh server is set to disable scp.

I'd dispute that, SCP isn't secure and had been deprecated. You probably mean SFTP? Either way it's probably too complex for end users to setup. If you're going to the trouble of setting up an SSH tunnel you might as well tunnel SMB over it. https://github.com/sshuttle/sshuttle is great for this, but again probably over complex for your average teacher. There are loads of other ways to do this; I'll try and summarise methods I've worked with in the past: 1) VPN: Staff login to a gateway and use the applications installed on their own computers to access resources such as shares and databases. 2) Remote Desktop/Virtual Desktop: Staff use the applications installed on a remote server. Licensing can be complex and expensive. 3) Expose file shares over WebDAV: really simple setup, just requires an HTTP server with access to the fileshare, almost all operating systems support it natively. 4) Third party application such as HAP 5) outsource to cloud provider; Google workspace or Office365 If the requirement is simple access to files then I'd go for webdav, it's a stable system which is easy to use and runs over https . My preferred options would be 5 > 1 > 3 > 2 > 4

Just doesn't happen, schools know it happens in advance and the build times are years. The school can choose to move new kit in.

The IT Specifications for new school builds are listed in section 4: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1077999/GDB_GenericDesignBrief-A-C15.pdf

When I was involved in a new build there was a lot of talk at the beginning about how we would have input but at the end of the day, almost everything was specified by DfE consultants. They basically had a list of things approved by the DfE and they will do the minimum to meet those specs.

A pypi server is simply a directory fronted by an http server, it's quite simple to do using the pypi-mirror package. It's not going to solve the issue of installing in the wrong place. Generally if pip is run as a user it will install in user space, if it's run as an admin it will use the system location (unless you specif --user)

Sensitive networks should have 802.1x on them so you can't communicate on them at all without authorisation. Typically you would give IT Staff authorisation to access the management ports on the management vlan, give school staff access to the 'admin' network etc.

I do a single management vlan for all servers, switches, san devices etc. No point in having separate management network for each type of device. Not quite sure what the question is though, presumably you can't just plug in a laptop on this network without authentication....

Sorry to state the obvious, but have you tried using ping. It's been around for 40 years and outputs nicely for text processing.

Oh I gave up schools as I couldn't afford it. Pay is too bad. Last I worked at was a Uni and had probably 10 webservers in a single zone. I'm now in industry/e-commerce with a variable number of web servers across US and EU. production is currently running 30 nodes. Even when I was working in schools I ran with a load balancers (netscaler, haproxy, istio(envoy))

I see it more as a good practice thing, all important services should be behind a load balancer and easy to take down, update, scale etc. But if you don't care then :shrug:

reliability, You can't have HA unless you have more than one. Plus you want to be able to do updates without downtime or waiting until night!

^ these are really worth doing. I set mine up as a free VPN. For hosting public web/dns you'd need more than one, in different regions and it starts becoming a bit less free. Great for personal use though.

We did a year at a place I worked and it worked well, took some work initially to get staff onboard as to why we were doing it. It saved the admin/HR/SLT immense amounts of the work involved in searching subject access requests (SAR's) and is generally a good way to be compliant with holding out of date info (by deleting it!)

I think the overriding issue of having CP issues stored on disparate systems is that it itself is a risk to the child involved. If staff leave, new staff arrive it's just a terrible idea to have all the important records related to CP in different places. Chances are, when these records need to be accessed it will have to be done quickly and not always by the member of staff who has them in their mailbox.

AFAIK it's a statutory requirement for schools to keep a single central register for CP issues. Ofsted should be checking against this.

If it's a software issue, blitz it and start again - it's IasC right

dodgy HBA perhaps? I'd run a disk speed analysis and start looking there.

That the wasabi prices are not hands down better. Example GCP archive storage is around £2.29 per TB/Month I'm sure Azure/AWS are similar. Wasabi seems to be more than double that, but they are marketing against a hot storage which you don't need for backups. The thread is about backups - not hot storage.

There are a few options: You don't actually need access to github to teach git, the two are completely independent - so I'm guessing the teacher either want to access some github repos or wants the students to have their own repo. If it's the latter you could whitelist the school domain at github.com//* if it's the former you just need to download the repo's and have an on-premise copy. Another option is to host gitlab (free). We did this at a University where I worked previously. https://about.gitlab.com/install/ I mentioned earlier that you could just add the virtualbox clients to an IP whitelist, which I don't think is a terrible idea.

You really need to pin down what the requirements actually are, then cost out a few options. I'm pretty sure you'll end up tweaking the virtualbox deployments when they get the prices for hosted VDI.

I did this many,many years ago with win7 (that long ago) using https://www.ovirt.org/. It was self hosted, but you could just as easily do that in a cloud (which, I think, is your question). The content filter was adjusted for the ip range of those machines. IIRC the clients booted from pxe into an rdp client that connected to their respective vm. It's probably a bit OTT for what you need, I'd be inclined to host a VM on the clients and give the virtualhosts a DHCP scope on a firewalled network with the extra Smoothwall permissions.

unless you use archive storage prices.