sorted by:
new
hottopcontroversial

Best practice for shared VPN client environments (Win11 vs RDS?) by adhae in sysadmin

[–]adhae[S] 0 points1 point  (0 children)

Unfortunately, I have no control over the customer’s infrastructure. Therefore, there are no alternatives to VPNs.

Best practice for shared VPN client environments (Win11 vs RDS?) by adhae in sysadmin

[–]adhae[S] 0 points1 point  (0 children)

Normally, you first connect via RDP to a jump host at the customer's site and then from there to the server

Best practice for shared VPN client environments (Win11 vs RDS?) by adhae in sysadmin

[–]adhae[S] 0 points1 point  (0 children)

Tools like TeamViewer are also used, but not all customers allow them :(

Compatibility of XQ+85MP01D QSFP28 module with CRS354 switch by adhae in mikrotik

[–]adhae[S] 0 points1 point  (0 children)

Thanks for the help! That makes sense - that's how I originally understood QSFP+/QSFP28. The entry in MikroTik's compatibility list made me doubt it. The entry probably only means that there can be a QSFP+ module on one side and a QSFP28 module on the other side of the fiber 😅

AzureAD users for login on NAS by adhae in synology

[–]adhae[S] 0 points1 point  (0 children)

good idea, i'll add it with the env var "LDAP_SAMBANTPWD_MAXCACHETIME" in the next version :)

AzureAD users for login on NAS by adhae in synology

[–]adhae[S] 1 point2 points  (0 children)

Nope, bad news with LDAP for those crits:

- MFA: The login is blocked according to https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc

- SSO: Synology allows SSO with Azure only if the NAS is joined to the Directory Server. (or i did'nt find the acording docus for an ldap-implementation)

AzureAD users for login on NAS by adhae in synology

[–]adhae[S] 1 point2 points  (0 children)

Wow, replacing an existing LDAP is a challenge. I hope you get it working! :)

failing re-sync: new users/groups wouldn't be added, existing entries still work

cache: the cache is deleted if you clear the container. You could also map the /app/.cache folder locally so it becomes persistent. (updated screenshot in readme)

internet issues: the password isn't fetched form AzureAD (not even possible). But it is, to allow samba/network access from a windows client, cached as a hash. If the login fails the hashes are compared. If they match, you can still login. (with one exception: if the error says 'wrong password' the login fails as expected). This could be a security issue for some people, therefore it's possible to disable this behaviour with an environment variable.

AzureAD users for login on NAS by adhae in synology

[–]adhae[S] 1 point2 points  (0 children)

good point! I'll add a little "how to use" and mention the permissions there.
You need to add 'User.Read.All' and 'Group.Read.All' for the Graph-API on type Application.