dmj

tftpd on linux. I'm actually pxe booting ipxe https://ipxe.org/ ipxe is good becasue, once its loaded, it can boot from http and you can specify the ignition file location on a webserver.

I should also mention; it's simpler to upload an ssh public key rather than faffing around encrypting passwords. You can put a password on the key if you like and you have instant 2FA. eg: locksmith: reboot_strategy: reboot window_start: Sun 01:00 window_length: 5hpasswd: users: - name: admin password_hash: "$1$TVQ9aoZv$/QoFjBpI7Tj.nn4tlVMfU." ssh_authorized_keys: - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICL37nXpn6eGnlQ0CLYokab/K0egDiIOyQiBTt4OdR+5" groups: [ sudo, docker ] - name: core ssh_authorized_keys: - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICL37nXpn6eGnlQ0CLYokab/K0egDiIOyQiBTt4OdR+5" groups: [ sudo, docker ]storage: disks: - device: /dev/sda wipe_table: true partitions: - label: ROOT filesystems: - mount: device: /dev/disk/by-partlabel/ROOT format: ext4 wipe_filesystem: false label: ROOT files: - path: /etc/systemd/timesyncd.conf filesystem: root mode: 0644 contents: inline: | [Time] NTP=192.168.1.1 192.168.1.2 edit ^ forum made a hash of the ignition! but you get the idea

Yoi don't actually need to install it - I've build ours as ephemeral PXE servers. I install kubernetes onto the disks, but don't install the operating system. Anything goes wrong, just reboot it and it's back to new. works really nicely.

We also do a failover cluster to centralised SAN - I'm not sure why you would setup more than one fileserver unless you were doing this (are they on different domains or something?).If you're not using a load balancer, the config for round robin DNS is really straightforward.

Chromebooks would be good route for students to learn Linux. It's also a good time to evaluate which applications you are running that actually require windows. Minor hijack: How are you getting on with flatcar? I've got a few servers running CoreOS (PXE boot, running a kubernetes cluster in ram). Need to move off coreos by May and toying with fedora coreos (big rewrite and and only viable if I move to openshift) or flatcar. Are you getting support from flatcar? how much is it? Do the ignition files drop straight in from coreos? Have you got any idea how the long term prospects of it? Sorry to ask so many question and the hijack.

If a rack of servers isn't an option, oil filled electrical radiators are quite good.

I'd recommend Digiexam if you are seriously looking at CB's for exams: https://www.digiexam.com/

Technically it's possible, but it would breach the license agreement. You can release the device if it has been damaged and replaced but not as part of a renewal.

Correct, Gsuite has an MDM.

Yes it should work ok, but you'll find gsuite a better platform for schools if you are not using a local MSoffice install. Hybrid cloud is a nice idea, but the firewalling and cross cloud ingress/egress will get expensive. You might find GCE a better option if you are using chromebooks, Also check out Munki, there is a basic MDM for gsuite but I don't think it has macos support yet. Yes, you can do this via SAML with ADFS or Shibboleth, but I don't really see why you need AzureAD - can you not just authenticate the macos against google ldaps ? BTW who came up with this architecture? I think someone is trying to take you for a ride with all the Azure stuff because I don't really see you need any of it if you are going chromebook.

-----BEGIN PGP SIGNATURE-----

*Please* stop using the terminology of signature/signed emails when you are talking about meaningless graphics ! A signed email, in the IT sense, is an email that has been digitally signed to prove that it has come from the sender and that the message has not been tampered with. Putting an image at the bottom of an email isn't going to help with these things and is a security red herring, it just makes the school look stupid. If the SLT has asked for signed emails, as IT professionals we should at least be implementing this properly !

*best* is usually subjective, but I would go with: Build an external DB in Azure using AzureDB for postgresql/mysql etc. Build containers Build the AKS Populate the AKS with your containers Migrate the DB Change the DNS to put the new servers live

If you don't provide staff with the tools they want to use, don't complain if they workaround the problem. In my mind there are two options, ban everything or just give them accounts - it's not going to cost you anything. It actually simplifies things: If you give staff tools that they are already comfortable with it *reduces* your support costs, those that are comfortable with outlook use outlook, those that like gmail use gmail. I don't really see a problem with it, gmail is sensible enough to be able to pull mail from external servers, allow forwarding etc. It's quite a good solution to have a mixed environment, it has very good spam filters, exemplary mobile access and would work with other mail systems.

That would occur if you allow python access to operating system tasks which @mavhc suggestion of containers would prevent (or remove python os) ideally you would set the nicenesss limit per user or group. This is defined in /etc/security/limits.conf. Again, I can't describe the way to do this in windows - but I'm sure it is possible.

I'd advocate this approach; but I would have a RODC at EVERY site and use two cloud providers to host the DC's. BTW @EddyAllen why use VPN ?Does LDAPS / SMB3 not cover this ?

^ yeah, we do have a habit of over complicating things, but I think the renice is a very simple and elegant solution compared to running and entire VM! Plus you don't need to get your hands dirty with banning people.

If this is simply for backups, I would probably use bogstandard LVM (with VDO if you need deduplication https://www.redhat.com/en/blog/look-vdo-new-linux-compression-layer) with XFS over the top. You can do most of the things that you need for backup such as daily/hourly snapshots etc with LVM. ZFS is a good option but it's still not terribly well supported in Linux, my feeling is that you'd get better community (and commercial) support with LVM. Ceph is awesome, but its really for clustered filesystems, it's not what you need here. If you need simultaneous writes then glusterfs is another option. If you needed a hyperconverged storage system across multiple clouds/sites then Ceph with CephFS. Personally I'd just go with Centos > LVM/VDO/XFS/Samba and NFS - quick and easy, but there are plenty of OS/s around for this sort of thing if your not confident.

It doesn't always work like this - if the application is cloud based (thinking Google docs, online O365), the files start on the internet in the first place so theres no real difference. I'd approach the problem by using an external database, and uploading my existing database to that - I like to keep the application ephemeral, as I usually deploy in a container so I don't have to pay for a VM for every application! I'd then build the application containers for papercut (or a vm image if you are old school) and link it to the database.The SAAS solutions for databases are quite varied and good on most cloud providers. My only beef with Azure is that I can't recover a single DB (using postgres) I have to restore the entire server which is a pain if I have a lot of DB's.

some rather elaborate solutions to prevent the operating system for crashing! It probably shows my age, but this problem was solved decades ago and is still heavily used with *nix multiuser systems: simply create a short script that starts the application (python) and changes it's priority to a lower one than default (use renice on linux/mac google will tell you how to do this in powershell). As @mavhc suggests a container is a good idea, but this will only help with python versions and isolation - it won't protect the operating system kernel from being drowned - containers still run on the system kernel; you would need to combine both approaches.

May I ask what the reasons were? We are looking at this too.

Were they CSNewmedia before that ?

It depends upon the style and colour of the beer. For a brown coloured bitter I would suggest "brown trout", and for a summery hoppy beer, how about "golden shower"

Not only that but Google has a single place to export ALL data, not just email: takeout.google.com Email is exported in the MBOX format - it's not google's own format and is very widely used. Mbox is an open standard: https://en.wikipedia.org/wiki/Mbox

There are also some significant downsides with exchange, for example the spam filtering is poor. Your left with the options of spending £££ on mimecast et al or forwarding the email to Google to use the postini for free just to send the filtered email back to exchange !