Re: [gentoo-user] {OT} Allow work from home?

[Rich Freeman]

On Sun, Jan 17, 2016 at 6:38 AM, lee <lee@××××××××.de> wrote:
> Suppose you use a VPN connection.  How do does the client (employee)
> secure their own network and the machine they're using to work remotely
> then?

Poorly, most likely.  Your data is probably not nearly as important to
them as their data is, and most people don't take great care of their
own data.

As I mentioned in my other post, there might be some exceptions if
you're dealing with highly-skilled IT security employees or something
like that, but most people don't take nearly the level of care with
their clients as you're probably going to want them to.


> What's the Linux equivalent of RDP sessions?  Some sort of VNC seems to
> usually require a lot of bandwidth, and I wouldn't know how to run it as
> a service so that someone could just start a client (like rdesktop) and
> log in to the server as they can do with Windoze servers. --- I only
> found x11rdp which appears to be incompatible with current X servers.

There is stuff like xtogo and other NX-like technologies, but the
trend seems to be towards client-side rendering which makes them
perform about as well as VNC.  I mostly gave up on it ages ago - it
was fairly fragile to keep working as well.  I do know one of the
maintainers - perhaps it has gotten better in recent years.

However, while an RDP-like solution protects you from some types of
attacks, it still leaves you open to many client-side problems like
keylogging.  I don't know any major corporation that lets people RDP
into their applications in general.

It sounds like Grant is concerned enough about his application to
restrict logins to a specific IP (presumably it uses SSL and sign-ons
as well).  If you care THAT much about where valid users can connect
from, I don't see why you'd just let them VPN into your LAN running
who-knows-what-rootkit on their workstations.

If you're truly 100% web-based I'd just go the chromebook route.  If
not, I'd issue laptops that you control with full-disk encryption, and
you can then set them up however you need to.

-- 
Rich