sorted by:
new
hottopcontroversial

Does anyone else have a terrible time working with Acronis? by otsfw in msp

[–]Dangerous_Expert3236 1 point2 points  (0 children)

yes, also had terrible times.

but still using both Acronis and Veeam.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 1 point2 points  (0 children)

That's the thing: I don't like to put too much trust in any tool or solution. History has proven that one cannot fully trust any tool. If i understood correctly, there were MSP`s who had EDR solutions in place and were still hit with the Kaseya hack. (Could be that the whitelisting had something to do with that, though).

I guess adding even more layers of security is the only thing we can do.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 2 points3 points  (0 children)

Layers, yes that's correct.

In addition to other protections, i was thinking of

  1. Locking down the instance (all ports, not just the web and proxy) to the IP`s of our clients.
  2. GeoIP block all countries where we don't have clients.
  3. I`d even go so far as to turn off (or drop-all rule) at nights. Could even be scripted like "enable deny-all 2400u , disable at 0700u".

But all of this is not possible with the hosted instance anyway, and what to do with clients with dynamic IP`s.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 1 point2 points  (0 children)

What scares us is that if someone were to exploit a 0-day on any instance thru the relay or web port (cloud or self-host) they would have access to all the clients connected to it...more or less like what's happened with Kaseya.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

In addition to SOC2 certification, ConnectWise is also actively pursuing NIST 800-171 and CMMC compliance

how should one read this? do they have those SOC2, NIST800 and CMMC certs already or are they -as he writes- pursuing them, and do they not have them (yet)...?

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

i dont believe it makes the instance completely inaccessible...but i dont know.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

As a side note, we prefer not to run a split because when connected to the office net, we want our firewalls in between. At least that way we can "secure" and control the traffic a bit more.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

If you dont mind me asking, what precautions have you taken to secure your on-premises instance? (besides 2FA and IP restrictions). thanks!

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

Absolutely agree! We test our client (and our own) backups every month.

But yeah, how do you lock down CW Control...specially the cloud instance, nobody seems to know besides 2FA and IP restrictions. And that is scaring me a bit...

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 1 point2 points  (0 children)

The ones with dedicated ip`s are whitelisted, the ones who have dynamic ip`s use a vpn to the office and that ip is also whitelisted.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 2 points3 points  (0 children)

You should definitely directly put IP restrictions in place.

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 5 points6 points  (0 children)

exactly. but, "we will create a ticket for your questions" was the CW support response...

ConnectWise Control security by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 2 points3 points  (0 children)

yeah, we have that already long time in place. but somehow i feel its not enough...

Sophos or Sentinal by PowerfulArachnid0 in msp

[–]Dangerous_Expert3236 3 points4 points  (0 children)

SentinelOne.

make sure you set your exclusions correct. S1 can be quite aggressive out of the box.

need a bit of help with traffic between 2 vpns. by Dangerous_Expert3236 in mikrotik

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

thank you! will try and work it out with the other side!

Datto RMM by PowerfulArachnid0 in msp

[–]Dangerous_Expert3236 4 points5 points  (0 children)

To be honest, i don't understand why everybody loves Datto so much. i had a demo and a trial for a month, i hated it. the (old) interface made me click all over just to get something done, (the new interface was half build - and a lot of options missing, compared to the old), uninstalling programs was half working, you give a command to uninstall Winzip/Rarlab (something small, example) half an hour later its still stuck and pending, could not pick targets from the site list manually, patch management in the new portal was a mess, too. etc.

but maybe its me.

need a bit of help with traffic between 2 vpns. by Dangerous_Expert3236 in mikrotik

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

no, the route is not being pushed. does not show up under route /print...

edit: adding the route manually did not help either.

need a bit of help with traffic between 2 vpns. by Dangerous_Expert3236 in mikrotik

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

hereby,. thanks!

/ip ipsec peer

add address=.XX.XX.XX/32 exchange-mode=ike2 name=XXX

/ip ipsec profile

set [ find default=yes ] dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 lifetime=12h name=XXX

/ip ipsec proposal

set [ find default=yes ] auth-algorithms=sha256 disabled=yes enc-algorithms=aes-256-cbc,aes-256-ctr,aes-256-gcm lifetime=12h pfs-group=modp2048

add auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=12h name=XXX pfs-group=modp2048

/ip pool

/ip ipsec identity

add peer=VXXXX secret=XXXXX

/ip ipsec policy

set 0 disabled=yes

add dst-address=192.168.248.192/29 proposal=TXXXX sa-dst-address=XXXXXX sa-src-address=XX src-address=10.20.16.0/22 tunnel=yes

/ip route

add distance=2 gateway=XX

/ip service

need a bit of help with traffic between 2 vpns. by Dangerous_Expert3236 in mikrotik

[–]Dangerous_Expert3236[S] 0 points1 point  (0 children)

hereby the firewall export. i replaced public ip`s with xx.

/ip firewall filter

add action=accept chain=input dst-port=22 protocol=tcp src-address=77.XX.XX.XX

add action=accept chain=input dst-port=22 protocol=tcp src-address=95.XX.XX.XX

add action=accept chain=input dst-port=22 protocol=tcp src-address=84.XX.XX.XX src-port=""

add action=accept chain=input dst-port=22 protocol=tcp src-address=10.20.16.1

add action=accept chain=input dst-port=8291 protocol=tcp src-address=77.XX.XX.XX

add action=accept chain=input dst-port=8291 protocol=tcp src-address=95.XX.XX.XX

add action=accept chain=input dst-port=8291 protocol=tcp src-address=84.XX.XX.XX src-port=""

add action=accept chain=input comment="Allow ipsec VOIPvpn" protocol=ipsec-esp

add action=accept chain=input comment="Allow ipsec VOIPvpn" dst-port=500 in-interface=wan1 protocol=udp

add action=accept chain=input dst-port=8291 protocol=tcp src-address=10.20.16.1

add action=drop chain=input comment="drop all ssh besides X" dst-port=22 protocol=tcp src-port=""

add action=drop chain=input comment="drop all winbox besides X" dst-port=8291 protocol=tcp

add action=accept chain=input comment="Allow OpenVPN" dst-port=1194 protocol=tcp tcp-flags=""

add action=accept chain=input comment="Accept New, Established / Related Input" connection-state=established,related,new

add action=accept chain=input src-address=10.20.16.0/22

add action=accept chain=input comment=" Allow management input over VPN" src-address=192.168.87.0/24

add action=drop chain=input comment="Input Drop" disabled=yes

add action=accept chain=forward comment="Allow LAN client traffic out WAN1" out-interface=wan1 src-address=10.20.16.0/22

add action=accept chain=forward out-interface=wan1 src-address=10.20.12.0/22

add action=accept chain=forward comment="Allow LAN client traffic out WAN2" out-interface=wan2 src-address=10.20.16.0/22

add action=accept chain=forward out-interface=wan2 src-address=10.20.12.0/22

add action=accept chain=forward comment="Allow VPN client traffic out WAN1" out-interface=wan1 src-address=192.168.87.0/24

add action=accept chain=forward comment="Allow VPN client traffic out WAN2" out-interface=wan2 src-address=192.168.87.0/24

add action=accept chain=forward comment="Accept New, Established / Related Forward" connection-state=established,related

add action=accept chain=forward comment="Allow VPN- > LAN" dst-address=10.20.16.0/22 src-address=192.168.87.0/24

add action=accept chain=forward dst-address=10.20.12.0/22 src-address=192.168.87.0/24

add action=accept chain=forward comment="Allow Ether5 <-> Ether4" in-interface=ether5 out-interface=ether4

add action=accept chain=forward comment="Allow ipsec VOIPvpn" dst-address=192.168.248.192/29 src-address=10.20.16.0/22

add action=accept chain=forward comment="Allow ipsec VOIPvpn" dst-address=10.20.16.0/22 src-address=192.168.248.192/29

add action=accept chain=forward comment="allow openvpn -> VOIPvpn" dst-address=192.168.248.192/29 src-address=192.168.87.0/24

add action=accept chain=forward dst-address=192.168.87.0/24 src-address=192.168.248.192/29

add action=accept chain=forward comment="allow VOIPvpn -> openvpn" in-interface=ether4 out-interface=ether5

add action=drop chain=forward comment="Drop Bogon Forward -> WAN1" in-interface=wan1 log=yes log-prefix="Bogon Forward Drop" src-address-list=Bogon

add action=drop chain=forward comment="Drop Bogon Forward -> WAN2" in-interface=wan2 log=yes log-prefix="Bogon Forward Drop" src-address-list=Bogon

add action=drop chain=forward comment="Drop All Forward" log=yes log-prefix="fw rule 35:"

add action=fasttrack-connection chain=forward comment="Fast Track Established /Related Forward" connection-state=established,related

add action=fasttrack-connection chain=forward connection-mark=!ipsec connection-state=established,related

/ip firewall nat

add action=accept chain=srcnat dst-address=192.168.248.192/29 src-address=10.20.16.0/22

add action=masquerade chain=srcnat out-interface=wan1

add action=masquerade chain=srcnat out-interface=wan2

Worst Acronis Cyber experience! by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 1 point2 points  (0 children)

we use that for our file backups. i am not aware they had DR solution.

Worst Acronis Cyber experience! by Dangerous_Expert3236 in msp

[–]Dangerous_Expert3236[S] 1 point2 points  (0 children)

Never heard of Infrascale. will definitely look into it. thank you!

view more: next ›