@dbeato said in Protek Support MSP Ransomware Hits Customers in Salt Lake City, Utah:
I think that if it was VPN, still bad practice to have VPN from MSP or any other systems that unprotected. MSPs should not need to have VPN to customers at all.
And vendors wonder why I won’t let them VPN into my network.... ha
Last week was fantastic!
Drove to Greeley, CO - ok that was boring.
Drove to Moab - visited Arches National Park - drove a 4x4 trail - my friend nearly freaked out.. It was awesome!
Drove to Zion National park - walked The Narrows! - man, can't wait to go back.
Drove to Las Vegas - at at Gordan Ramsey's Steak - had the tasting menu - the Beef Wellington was meh at best, the rest was fantastic!!!
Drove to Hoover Dam took some dam pictures
Drove to Grand Canyon Skywalk - paid for the skywalk - was a let down!!! visit other viewing point in that area - SO MUCH BETTER than the over priced, no pictures allowed skywalk...
Drove to AZ south rim Grand Canyon - hiked the 3 mile trail, very scenic!
Visited Bedrock - Fred Flinstone's home town and watched a raptor show - and got to hold the raptor (on a a glove of course).
Drove to Four Corners - it was exactly what I expected - a plaque marking where the four states meet, took a picture and continued on...
Drove back to Greeley, CO -
and lastly,
Drove home.
58 hours in the car, 3200 miles, 5 states, 3 National Parks, a million pictures - great time!
As some might recall, I ran into Wiztree a month ago. I asked the author to look into adding it to Chocolatey.
And he did.
https://chocolatey.org/packages/wiztree/3.17
It's been a good year for Dashrender - down 40 Lbs since January!
Brought my mile time from 8:29 to 6:47.
Only bad thing - good cholesterol is a bit low (but bad cholesterol is in the good range). Doc suggested I drink Red Wine to improve the good Cholesterol.
Just read about this free book on that other site, thought i would share a link to it here.
I was restoring some files from our backups when I ran across this.
These files have been sitting there for a month plus. Unbelievably it appears that non of my other network shares were affected by this.
OMG - I think we some how dodged this bullet.
@dbeato said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
@dashrender However centrally managed doesn't mean site to site VPN. I don't get MSP that have site to site VPNs to their customers. It is not feasible to maintain, it is a high risk and very old school.
of course it doesn't.
using a tool like ScreenConnect - having all customer machines in a single account - means SC's hacked, then ever client is hacked...
@pete-s said in Where are MSP managed on-prem workloads moving?:
Thanks, it does makes sense to move to SaaS solutions for a single customer that is doing their own IT.
But a MSP is in a different position because they, besides know-how, have a larger scale. So it can make economic sense to host things for their customers that doesn't make sense for each individual customer.
For instance does it makes sense for a company to have a server to host their website on? No, it doesn't. But if you're an MSP and your customers have a thousand websites that needs to live somewhere, it might make sense for you to host them.
I guess it also depends if you're an MSP that just manages things or if you also have your own hosting/cloud infrastructure or use another provider for that.
All good points. I have no view into that world, the few ITSPs I know are using other companies solutions, not rolling their own, or even hosting their own. Though some of them, we'll take JB for example, do manage all the stuffs other than hypervisor and hardware for things like a Ubiquiti controller, and PBXs.
If you really do have need to host 1000's of websites (or really massive sites, it could make sense to manage the whole stack, but then again, it could be better to get services from someone like Vultr, or in extreme cases like Amazon/Azure.
@pete-s said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
@dashrender said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
@pete-s said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
@dashrender said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
I agree, in this day and age - that's super risky, i.e. you get compromised and all of your customers are now compromised.
though just because you have 100 passwords, one for each client, that info has to be stored somewhere and perhaps it would be compromised as well - and your clients are still compromised...
Risk has to be managed but it's not more risky having 100 customers with one server each on-prem than having 100 servers in one location.
Oh, I completely disagree. Now if you tell me all the creds for those 100 on prem servers are in one place, then I tend to agree with you, but if they aren't then they are a tiny bit, if not a lot more secure.
In this situation - it really comes down to them being managed by and MSP/ITSP that's the weak link.... If the MSP/ITSP is breached and the hackers get all the creds, be it one cred or 100 creds, then the customers are fooked either way.I think I was a bit unclear.
What I mean is VPN is just an extension of the LAN. So 100 physically spread but centrally managed servers have the same risk as 100 servers in the same location managed locally.
If the managing thingy is compromised, then every server is potentially compromised as well.
If you on the other hand have a 100 servers physically spread and managed locally and not centrally, well than the risk is a lot smaller. But you don't get any of the benefits of central management either or economies of scale.
As you said it's the central management from the MSP/ITSP that's the weak link.
aww, yeah, in that case, yep, we agree.
I think this will do nothing but make MSP's and ITSP's even more expensive, as you said, we need to loose the economy of scale for protection reasons.
@pete-s said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
@dashrender said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
I agree, in this day and age - that's super risky, i.e. you get compromised and all of your customers are now compromised.
though just because you have 100 passwords, one for each client, that info has to be stored somewhere and perhaps it would be compromised as well - and your clients are still compromised...
Risk has to be managed but it's not more risky having 100 customers with one server each on-prem than having 100 servers in one location.
Oh, I completely disagree. Now if you tell me all the creds for those 100 on prem servers are in one place, then I tend to agree with you, but if they aren't then they are a tiny bit, if not a lot more secure.
In this situation - it really comes down to them being managed by and MSP/ITSP that's the weak link.... If the MSP/ITSP is breached and the hackers get all the creds, be it one cred or 100 creds, then the customers are fooked either way.
@notverypunny said in Patch your Windows DCs - else they will break in July 2022 from a patch:
How about this month's updates that sent 2 of our DCs into a wonderful boot loop first thing this morning...
it could be related.
@dustinb3403 said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
@pete-s said in Goodbye hardware monitoring on HPE Gen10 and newer equipment running ESXi:
Unfortunately tech that goes obsolete always causes problems but it's more technically sound to monitor through the OOB management interface.
It's after all independent of the OS running on the hardware, independent of the server's NICs, independent of most hardware failures and can be used for a lot more than just monitoring.
And in any modern installation, the OOB management should have been setup and in use already.
Absolutely I agree with that, except the only OOBM that existed before OneView was Ilo and smtp emailing. Which is hardly reliable.
And I do agree that moving to an OOBM like OneView makes sense, it doesn't make sense for an ITSP to have to use though, as it's setup per customer, and would be running on the same hardware it's monitoring in most cases.
Edits are corrected typos
How are you doing those things today? If you're using a centralized server to manage all of your clients, why can't you manage iLo the same way?
I agree, in this day and age - that's super risky, i.e. you get compromised and all of your customers are now compromised.
though just because you have 100 passwords, one for each client, that info has to be stored somewhere and perhaps it would be compromised as well - and your clients are still compromised...
@dustinb3403 said in Where are MSP managed on-prem workloads moving?:
Even colod workloads make little sense to a lot of our customers.
If you've seen Scott's old posts, that doesn't really seem possible - unless the cost of a big pipe between the colo and you is to expensive.
I've recently moved my email to M365, so SAAS for that.
We're about to start planning our move of file share data to Sharepoint/ODfB - again SAAS.
That leaves me with two items left on-prem - and old EMR I have to keep alive for at least 2 more years and our accounting software.
Additionally, we have a laboratory interface for some of our testing equipment that only runs on Windows Server (legally) so that needs to live somewhere as well.
We'll definitely keep the old EMR on-prem until we retire it.
It looks like we can buy a hosted solution of BusinessWorks if we really want to go that route - it's slow as molasses over a VPN connection pulls all kinds of data down locally - very old school solution. So for good performance I'd assume we'd have to remote into a desktop that's more local to the host of BusinessWorks, driving the price up.
I'd love to move the laboratory software to a tiny 'nix box, lock it down and forget about it - basically only allowing it to talk to a control IP inside my network and the Lab itself, but again, the software is for Windows only. I suppose I can do the same with Windows, but that would require potentially 3 licenses so I don't have to worry about VPNs back to a central server for all three locations.
https://thestack.technology/active-directory-updates-july-2022/
A series of welcome Active Directory updates from Microsoft that patch serious vulnerabilities need careful review by IT admins. They include a fix that will break any unpatched domain controllers from July 2022, so patching will need to be highly consistent across enterprise IT estates: you have been warned.
@stuartjordan said in SSH Chinese Bots:
honeypots maybe? that these Chinese IP Addresses have these ports open, they have been blocked by fail2ban trying to hit my ssh port, find it interesting with the ports they have open.
nmap 112.85.42.89 Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-12 19:43 GMT Nmap scan report for 112.85.42.89 Host is up (0.22s latency). Not shown: 993 closed ports PORT STATE SERVICE 135/tcp filtered msrpc 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds 593/tcp filtered http-rpc-epmap 4444/tcp filtered krb524 5679/tcp open activesync 8008/tcp open http Nmap done: 1 IP address (1 host up) scanned in 11.40 seconds [email protected]:~$ nmap 112.85.42.128 Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-12 19:46 GMT Nmap scan report for 112.85.42.128 Host is up (0.21s latency). Not shown: 993 closed ports PORT STATE SERVICE 135/tcp filtered msrpc 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds 593/tcp filtered http-rpc-epmap 4444/tcp filtered krb524 5679/tcp open activesync 8008/tcp open http
I think there were some attacks if you could get a client to attempt to connect to a server (presumably on one of those ports) you could compromise the client.
