Live data from Hacker News

Zero-Trust RDP and SSH Access to VMs on Google Cloud

github.com

61–70 of 90 posts

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#61

I didn't know big tech companies were still capable of making GUI's that look like this.

It looks like this because it's C# and probably using standard UI frameworks instead of hot new buzzword tech or Electron.

it's .net framework 4.X and I really do wonder why...

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#62
post #51

Earlier quoted context omitted.

Because when your herd of cattle is sick, you need to grab one and have a vet look at it before your whole herd dies from the plague.

No, part of managing a heard is having the right tools in place. Like monitoring, logging, and observability tools. There is nothing I can learn from accessing a VM in production that I can't learn from my monitoring system. In prod where I work, if someone logs into a production VM we mark it tainted and replace it with a fresh instance. This keeps things nice and consistent. Of you need an interactive session on a…

> There is nothing I can learn from accessing a VM in production that I can't learn from my monitoring system.

Other than how to fix gaps and other problems with your monitoring? As you get experience, you’ll learn this is done like a garden — you can heavily reduce your need for interactive sessions but it never goes to zero.

I think you’re making the classic mistake of treating a guideline as more of a religious mandate. Yes, it’s good to have servers be easily replaced but that desire does not magically rewrite all existing software or retrain every IT worker.

Similarly, automation is great but you need to develop and maintain it - which almost always involves interactive work. The taint process you mentioned is a popular way to balance those needs long-term.

Finally, if you are thinking of “server” as only a production-hardened network service you’re missing out on a lot of other things enterprises use cloud services for, such as developer workstations or general virtual desktops. Many places heavily expanded that over the last year because you avoid the security concerns about having your data on easily lost/stolen laptops and can avoid turning your VPN into a massive bottleneck for the entire company.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#63

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

RDP is pretty easy to explain: if you need a GUI, RDP is infinitely smoother than VNC or anything else the Linux ecosystem has to offer. I even use it on Linux for things like livestreaming (OBS running in a minimal GUI like openbox). The are many similar workloads that are less "servers" and more "cloud workstations" that use GUI apps. As for Windows in general, 90% of the Windows servers I see fall into one of the…

> RDP is pretty easy to explain: if you need a GUI, RDP is infinitely smoother than VNC or anything else the Linux ecosystem has to offer.

The last time I was assessing Windows remote * for performance, VNC* implementations with a mirror driver provided far better performance than vanilla RDP.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#64

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

In a large scale enterprise environment, say 100k+ seats with a mix of MS Office, scientific/engineering use-cases, Windows, Linux & OSX, Windows is still the way to go for the forest, tying it in with JAMF and Linux integrations.

Less the legacy use-case than how do we integrate everything with everything.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#65

I didn't know big tech companies were still capable of making GUI's that look like this.

To me it looks very much like mRemoteNG ( https://mremoteng.org/ ). Is this just because the same WinForms libraries were used or is there some meat to this?

It looks like it's just the same WinForms - they don't seem to share any code.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#66

Earlier quoted context omitted.

It's gorgeous. Like a breath of fresh air after all that electron nightmare.

I don't see the correlation. I get that people don't like electron bloat, but that is orthogonal to UI/UX, no?

The issue with Electron is that devs tries to mimic the browsers UI in a desktop environment. Our desktop OS need to have a desktop UI instead of the mobile webpage with Material/Flat UI design (no visual box line, no separators, no multi-windows, pushing the setting menu as a sidebar, etc). It should be treated as a desktop app with the benefits of desktop, not a mobile app which is the issue.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#69
Inspired by Fly.io's post a while ago[0] I also did something similar to this on my small k8s cluster with the help of stunnel, sslh, and traefik[1].

Weirdly enough I thought this was the ability to provision a wireguard-esque proxy to any machine you want, operated at the edge of the cloud, but it seems like it's really TCP-over-HTTPS.

It's easy to imagine doing the former (dynamic wireguard proxy surfacing) too though -- wireguard sidecar container with shared network namespace with the workload in question + open-to-the-world port somewhere and you'd theoretically have access to any port you wanted on said machine as well. Feels like an easy set up to trust as wireguard is pretty reliable/sound.

[0]: https://fly.io/blog/ssh-and-user-mode-ip-wireguard/

[1]: https://vadosware.io/post/stuffing-both-ssh-and-https-on-por...

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#70

I'm sorry if this sounds completely ridiculous to some people, but what do people use RDP/Windows server for in 2021? Given that ASP/Dotnet is portable to linux, what are people building that isn't better deployed to linux? It can't just be the legacy use-case, can it?

RDP is pretty easy to explain: if you need a GUI, RDP is infinitely smoother than VNC or anything else the Linux ecosystem has to offer. I even use it on Linux for things like livestreaming (OBS running in a minimal GUI like openbox). The are many similar workloads that are less "servers" and more "cloud workstations" that use GUI apps. As for Windows in general, 90% of the Windows servers I see fall into one of the…

meshcentral is pretty nice open source software for remote access multi platform:

https://github.com/Ylianst/MeshCentral

It has a free instance here

https://meshcentral.com/info/

Post reply on HN