@Grey said in Looking for solutions to allow remote users access to their internal psychical computers:

Yes, but I like https://xkpasswd.net/s/ more.

Thank you! I have a new favorite toy to play with!

We used to use that product for redundant monitoring of SCADA system. We would monitor door latches, pumps, water levels, etc. It worked great.

We have since moved to Raspberry Pi to meet the needs of other controls we wanted to include in our management systems.

The control by web device will do what you have asked for above. It's very inexpensive too.

If you have, or plan to add, custom alerts, you may want to consider something like a Raspberry Pi to give you unlimited flexibility when it comes to PLC.

@Grey said in Looking for solutions to allow remote users access to their internal psychical computers:

@dave247 said in Looking for solutions to allow remote users access to their internal psychical computers:

@scottalanmiller said in Looking for solutions to allow remote users access to their internal psychical computers:

@dave247 said in Looking for solutions to allow remote users access to their internal psychical computers:

@scottalanmiller said in Looking for solutions to allow remote users access to their internal psychical computers:

@dave247 said in Looking for solutions to allow remote users access to their internal psychical computers:

I wanted to figure out a solution for allowing the users to login to their company issued laptops and then click one or twice and get to their remote desktops as easily and as efficiently as possible.

You CAN make all or most of the credentials between that laptop and the resulting device be cached or saved. So that it is a really quick and painless process.

True but if a user's password expires or they change it, they may get themselves locked out. We try not to encourage saving passwords too much.

For security reasons, we avoid expiring passwords. That's what makes users write them down and make them easy to guess. Non-expiring, or rarely expiring passwords, are shown to be far more secure and make things like this much easier.

yeah I know its a balance. We have had a few trade offs between password length and expiration time

https://cdnapisec.kaltura.com/index.php/extwidget/preview/partner_id/684682/uiconf_id/31013851/entry_id/0_svsg82xf/embed/dynamic

NIST guidelines were updated in 2017. They mostly follow XKCD.

I've been using this infographic for years! I love it.

Have you seen this: http://correcthorsebatterystaple.net/

@scottalanmiller said in Looking for solutions to allow remote users access to their internal psychical computers:

RDP uses the same tech as most VPNs. It's extremely safe as a protocol. It's the assumed ties to AD that make it risky.

We connect with VPN to the Gateway Appliance, then RDP to the LAN desktop. You can't do #2 until you've done #1.
So, we have an added layer of protection by preventing access to AD until after you VPN to the appliance.

Good discussion here....

@WrCombs said in Proposal to my Boss - Thoughts?:

Proposal to my Boss - Thoughts?
......I want to propose to my boss

Thoughts? Yes, make sure her husband is okay with it!

@scottalanmiller said in Looking for solutions to allow remote users access to their internal psychical computers:

Just adding 2FA to RDP is a better option.

Wouldn't you need to open port 3389 to the public if your users had dynamic IPs at home? We prevent a lot of RDP login attempts by only allowing 3389 through our VPN tunnels.

@Pete-S said in Looking for solutions to allow remote users access to their internal psychical computers:

And you have zero or little control over the traffic outside the VPN, unless you have some security in place for this.

We use our Firewall appliance to restrict traffic to port 3389 in the VPN, RDP is a pretty safe protocol. Jared said we don't know of anything that can penetrate it. Maybe he can add some light to the safety of RDP if you need more info.

@Dashrender said in Looking for solutions to allow remote users access to their internal psychical computers:

I'm not entirely sure how you solve that?

If you allow the RDP to save credentials, you remove the clunk after connection for the first time. Then they authenticate with VPN and 2FA, followed by a saved credential RDP connection. Not my preference, but it is a way to de-clunkify the double login.

@scottalanmiller said in What Are You Doing Right Now:

OMG AMAZING!!! Finally.
This changes everything.

What are you referring to? A new feature? Inquiring minds want to know.

Just sitting down after finishing the painting of bedroom number one. Two more to go!
(I got new and improved Honey-Do list last week.)