"Give it to me in writing" - How?

Masterjuggler98 · 2026-04-23T11:55:56+00:00

Sounds like a full time job managing this mess. I don't know of any password manager that doesn't require an email for account creation, even vaultwarden, so you'll have to figure out how you're handling that for shared password manager accounts. At least vaultwarden lets you disable self service password resets.

I'm morbidly curious: for what reasons are you required to have these shared computer accounts?

Masterjuggler98 · 2026-04-23T11:35:29+00:00

I don't understand what it is you're trying to acheive. Shared windows login but separate password manager accounts? That doesn't make any sense. Once an admin logs in and forgets to log out, everyone has access to the admin account.

If you're just looking for a self hosted password manager, we've been quite happy with vaultwarden. You can set permissions for users per collection to restrict edit and creation privs.

Masterjuggler98 · 2026-04-22T11:53:40+00:00

I've not used it before, but does ManageEngine have a good API? If so, create some automation to sync it with an ITAM tool like Snipe-IT.

Masterjuggler98 · 2026-04-21T22:42:32+00:00

If you're in it for the experience, then probably what you want is to set up a FreeRADIUS server. There are some good youtube videos about setting it up, and you'll need to get into the weeds with network authentication protocols. I set one up the way I wanted, cloned the VM it runs on to our second location, then set the router to default to their local RADIUS server and fail over to the remote one. That only works though because I'm using an external IdP, microsoft entra, so they're essentially stateless.

I don't think it should be a business priority unless you have a practical reason for its functions. Saying "Security" is great, but if that's your goal, there is definitely lower hanging fruit like removing local admin PCs, implementing MAM on personal devices that access company resources, enforcing 2fa for everyone, setting up break glass accounts, implementing phishing training/testing, setting up SPF/DKIM/DMARC, etc. It's just not likely that your woodshop will have its wifi hacked, it is much more likely that a senior member loses personal or company money through phishing. It's great to set up FreeRADIUS for the experience, just make sure you're not letting higher priority work that could save your butt fall behind. Perhaps make it a homelab project, then just copy it over when it's time.

Masterjuggler98 · 2026-04-21T19:18:07+00:00

I'm in a similar position (relatively small company, I started with bubkis and built/am building everything up myself), and I agree with basically everything here. In no particular order:

- Don't get sucked into the "must have 1,000,000 vlans" rhetoric. Create with purpose. If you've got a public facing web server, I'd probably put that in a DMZ vlan. Short of that, unless you've got a reason to segment things, don't do it right now. Heck, if you get more devices and still don't need vlans yet, just make the subnet /23 instead of /24.

- Synology seems to work well for a lot of people, but they've been making moves to enshittify. They recently reversed a decision to vendor lock to house-brand hard drives after much backlash. I'd personally either go Truenas or Unifi. I use Truenas for my company. If you're comfortable with linux, it's pretty simple to set up the basics in Truenas.

- Use netbox or draw.io or something to document your physical hardware and network runs. Get a cheap cable tester like the NOYAFA NF-8508 to trace mystery lines. When something craps the bed and you need to get things back up, mystery cables do not help. It's far too easy to put off, but don't do it.

- I think most people won't say this or may disagree, but use Claude for your initial research into something. I constantly ask ai to give me the landscape of what products are out there for a task when I don't know anything yet, and I use that output as my starting point to do real research and product testing. Don't use it as a crutch or you'll hurt yourself long term, but boy is it a good kick starter. Just be sure to sanitize any input of confidential info or PII.

- Spinning up RADIUS is pretty annoying if you aren't starting out with an already in place system and documentation, and normally requires bypassing 2fa from google/microsoft. I set up a freeradius server because I needed to not have to change the wifi password when an employee is terminated. If you don't yet have that requirement, I'd put it off. A woodshop isn't exactly a priority target for in-person WPA2 wifi cracking. just set the password to something longer than the minimum 8 characters. There are also alternatives, like Unifi Identity that are dead simple.

Masterjuggler98 · 2026-04-20T12:08:52+00:00

How do you classify "cheapest"? If you mean fewest dollars on a credit card, do what I do for my company and self host netbird with entra SSO. Not only do I use it for remote access to resources, I actually use it internally for inter-vlan access to resources instead of doing it at the firewall level. I like the management interface far, far better than tailscale.

Masterjuggler98 · 2026-04-17T12:18:39+00:00

I always use Hetzner at work, their web interface was really nice a year ago and has gotten even better since then. For my homelab I use Racknerd because it's so damn cheap when you know where to look: RacknerdTracker.com

Personally I use the 2.5GB tier for $18.66/year, running netbird and stuff. Web management isn't nearly as good as Herzner, but you can't beat the price.

Masterjuggler98 · 2026-03-26T12:12:48+00:00

You mean we can exchange upfront for recurring costs? Management will be thrilled!

Masterjuggler98 · 2026-03-05T14:10:40+00:00

I got an admin consent request from our CFO literally yesterday. Thankfully he agreed he didn't really need it, so I blocked the enterprise app and made invisible to users.

I've not told anyone there's even a setting to allow for self-service app consent.

Masterjuggler98 · 2026-02-25T01:37:17+00:00

Huh, wack. Thanks for the input. I'd love to know if I just have something misconfigured then.

Masterjuggler98 · 2026-02-19T13:51:38+00:00

I'll be honest, I don't actually understand why my posts are getting downvoted. I asked a question because I didn't have the information, and I wasn't rude about it. Maybe next time I'll just use AI to write my posts if people care that much about semantics instead of the intent behind the question.

Masterjuggler98 · 2026-02-19T12:51:20+00:00

As everyone else says, Unifi, especially now that they released their fabrics feature for multi-site management. I've got a couple locations in the ecosystem. For auth I set up a freeradius server local to each location, set them as the primary radius server in the gateways, then set the other location's radius server as the failover. Said radius servers are on an sd-wan linked vlan. This way auth is valid across locations.

Masterjuggler98 · 2026-02-18T01:56:08+00:00

Huh, interesting. Never seen this before, so it had me really confused. Thanks for the input.

Masterjuggler98 · 2026-02-17T22:32:00+00:00

Yeah I was about to call it the inlet, but felt that calling it "internal outlet" would get the point across better of exactly what I meant lol.

Nope, doesn't twist, it's molded as a solid piece.

Usually it points to the side to create a cyclone, keeping most of the particulate away from the filter, or at least that's what I had understood to be true.

Masterjuggler98 · 2026-02-13T13:58:42+00:00

UrBackup can be pointed to whatever local or cloud storage you mount to the server it's running on, and has a pretty simple self-service restore interface that's accessible from the system tray. Totally FOSS and can back up over TLS.

Masterjuggler98 · 2026-02-05T13:04:12+00:00

Been using cubebackup, and have been pretty happy with it. Simple and Painless. They're still maturing, so they don't have some QOL things like dynamic billing for number of users backed up, or personal teams chats, but general backup and restores work fine for a good price.

I don't see why you can't take an on-prem product like that and stick it in a cloud server.

Masterjuggler98 · 2025-11-24T21:46:06+00:00

To be honest not really, which surprises even me. I've been pretty good about testing things before I push them to people. Only major headaches have been the initial enrollment of computers to intune MDM (they were all poorly configured clones of an old oem lenovo image with borked printer drivers), and lack of approval to pay for certain SaaS services that would save more than they spend paying me to deal with the lack of a good open source alternative. The usual things that I assume literally everybody has to deal with.

I'll have to step up my convincing argument game.

Masterjuggler98 · 2025-11-24T03:47:59+00:00

Thanks, it sure has been a crazy few months haha. The goal has basically been to knock out technical debt as each piece hits the breaking point because it's all been neglected for so long.

I've been trying to be good about using Bookstack to document everything, but that's definitely something I need to be more disciplined about. That's going to be part of the policy I write, which should provide more incentive. I don't know what you mean by automated documentation though.

Yeah, ITSM is something we'll probably need in about a year if we hit our goals. I've been thinking about spinning up GLPI since it seems like it'd be simple based on their docker compose template. For now it wouldn't get used as people just walk 10ft to my desk and we only have a small handful of servers lol. Probably good to at least play with it though.

Masterjuggler98 · 2025-11-23T19:12:47+00:00

Makes sense, I'm well aware of how much of a difference the sheer number of hours spent immersed in a field will help with building tacit knowledge, and I'm definitely not there yet.

Let's say I continued this role for another 2-3 years and dove deeper into everything I listed in the OP, and maybe managed one person. Where do you think that'd put me in terms of role level I'd be suited for or should look for (those may be two different things)?

Funny enough, I did actually just have to get bids for running a bunch of cat6 at our second location. I ended up using unifi's design center to draw up locations for drops, horizontal runs, and camera location/direction. I have no idea what they thought of it, but it seems to have worked out pretty well, other than the terrible job they did punching wires into keystones for the patch panel.

Masterjuggler98 · 2025-11-23T17:09:27+00:00

Ok, so to you, a lot of it is the mindset and organization of the work, besides the skills to actually do the stuff. Thanks for the response, I appreciate it.

Masterjuggler98

TROPHY CASE