![NextDoorNetAdmin](/img/default-banner.jpg)
- Видео 34
- Просмотров 6 152
NextDoorNetAdmin
Канада
Добавлен 31 дек 2023
Ever wondered who runs the Internet, or those "servers" you keep hearing about? I'm a network admin, and I could very well be living right next door to you. Take a step over into my world, and see what you might learn!
A Glimpse of the Office
Thought I'd do something a little different this week! If you've ever wondered where a network admin works, maybe you've imagined a network operations centre (or NOC) as a Mission Control-style room of flashing monitors and readouts and lots of consoles... or maybe you've thought of datacentres, the big facilities with racks upon racks of servers, and the occasional crash cart hooked up to somebody's equipment.
Truth is, my office looks a lot like any other office would! Today, I'll show you my shared office at work and tell you a bit about what projects I have on the go. Work never ends for a network admin!
Truth is, my office looks a lot like any other office would! Today, I'll show you my shared office at work and tell you a bit about what projects I have on the go. Work never ends for a network admin!
Просмотров: 22
Видео
Am I a programmer?
Просмотров 2821 час назад
"Are you a computer programmer?" This is a question I get any time I say I work in IT. The answer is... it's complicated? I don't usually think of myself as a programmer, but I do occasionally work with scripting. What's the difference? The lines are a little blurry, so let's talk about programming and scripting! EXTRA CREDIT: - It's important to know exactly which command shell you're working ...
The Web of Trust
Просмотров 3614 дней назад
Whether we realize it or not, most people on the Internet use a hierarchical trust model every day. There's a selection of root certificates, issued by specific certificate authorities (CAs), and most websites are secured by certificates issued from these authorities. But that's not the only trust model out there! Today, I'm going to talk about the Web of Trust, which is a trust model commonly ...
NDNA: July 2024 Freeform
Просмотров 521 день назад
We all come across those kinds of entitled people: the ones who not only refuse to listen to advice, but actively tell you that they don't pay you for your opinion or advice. All they want it for you to "do your job." (As if our job didn't include giving advice!) And it universally sucks. Today's special: the difference in approach between partnering and puppeting, the possible consequences of ...
Crowdstruck: The Dangers of a Monoculture
Просмотров 35928 дней назад
It's been all over the news: airports, hospitals, mobile payment systems, systems everywhere started bluescreening a few days ago. At fault was a piece of software named Crowdstrike Falcon. There's been quite a lot of talk about what the software was and why it had the effect it did, but I'm going to talk about something related-but-different. Namely, what are the risks we face when we try to h...
A Cast of Traffic
Просмотров 24Месяц назад
There are several ways to categorize traffic on a network, but one which we haven't talked about yet is what "cast" of traffic it is. And there's a few of them! Whether it's your standard unicast traffic, or an all-stations broadcast, knowing how the various casts function will help you plan and diagnose your network. EXTRA CREDIT: - Most IP broadcast traffic is internal to the subnet itself. T...
CIDR house rules: IP network classes
Просмотров 86Месяц назад
IP addresses are often grouped (or summarized) into distinct blocks. These typically have a single administrative authority. But in the past, these were rigidly assigned in different classes. It wasn't flexible, so we moved to something called Classless Inter-Domain Routing, or CIDR. Today, I'm talking about the history of the network classes, including how they are determined, their original c...
More about ZFS - datasets and zvols!
Просмотров 164Месяц назад
Last time we talked about ZFS, I was going on about the physical setup of a ZFS pool and how its vdevs are similar to (and different from!) a standard RAID array. Today, I'm going to talk more about the logical setup of a ZFS pool, including the differences between a dataset and a zvol, and what each of these can do! EXTRA CREDIT: - You can always grow a zvol (add more space to it), but you can...
NDNA: June 2024 Freeform
Просмотров 15Месяц назад
I tend to be a pretty busy guy at work there's always a few projects (and then some!) that need my attention, plus the usual list of emergency situations or on-the-spot training sessions that need to be given... Sometimes, that means I have difficulty getting around to some particularly tricky projects! So, how do I deal with that? Today's special: Tuits and spoons! (Specifically, the circular ...
ZFS vs. RAID - vdevs and more!
Просмотров 1362 месяца назад
I may spend a lot of time in a Windows world, but when it comes to storing large amounts of data safely, ZFS is always my go-to filesystem. There are a lot of concepts that are similar to RAID, but really take RAID to the next level! EXTRA CREDIT: - The original ZFS was developed by Sun for their Solaris systems. Parts of that became OpenSolaris, at least until Oracle bought Sun and made it clo...
802.1q VLAN tagging
Просмотров 472 месяца назад
"Dot1q" (what we network admins use as a shortform for 802.1q) is a standard for using VLAN tags to put many logically-separated networks on to the same physical equipment. Conceptually, this isn't terribly difficult to work with. The complications come when you start working with VLAN trunks, native / untagged VLANs, and VLAN tags over a larger network! EXTRA CREDIT: - There are other VLAN tru...
Which way??? (How routers choose where to send your traffic!)
Просмотров 72 месяца назад
Network traffic flow at layer 3 can be incredibly complicated! This is really the main layer at which most pathing decisions are made network-wide. That being said, there's a few key principles that you can keep in mind to help figure out where each device along the path will send the traffic, and I'm going to explain some of those today! EXTRA CREDIT: - Most routing protocols such as RIP, OSPF...
NDNA: May 2024 Freeform
Просмотров 92 месяца назад
Whew! Not only has it been quite a long month for me, it's also been quite a busy weekend as well! My apologies if this isn't quite as polished as usual being "on the road" while recording and uploading is not as seamless an experience as I could hope! Especially with the time constraints involved in this case... Today's special: volunteering to run a convention's IT infrastructure, and the cre...
Hubs, Bridges, and Switches (oh my!)
Просмотров 283 месяца назад
If I asked you to explain the difference between repeaters, hubs, bridges, and switches... could you? After today, you probably can! Take a walk with me down the history of Ethernet devices at layers 1 and 2 of the OSI model... EXTRA CREDIT: - There used to be a helpful way to remember the size and limitations of your network, back when you had to deal with repeaters and a physical bus architec...
A Penguin Said That Nobody Drinks Pepsi
Просмотров 403 месяца назад
It's a bit of an odd title, isn't it? What, do I have something against Pepsi? Nah! This is just a network mnemonic to help us remember the layers of the OSI network model! EXTRA CREDIT: - If you want to remember the OSI layers from 1-7, try "Please Do Not Throw Sausage Pizza Away!" - I talk about what I called "Carrier Detect / Collision Sense Multiple Access". I'm wrong! The technology is CSM...
Installing OPNsense via the iDRAC Enterprise
Просмотров 956 месяцев назад
Installing OPNsense via the iDRAC Enterprise
Glad they finally gave you an office!
I'm only 6 minutes in, and it seems this is about exchange. Do you have any suggestions on how to get a relay set up in windows 10 without exchange? Using hmail as server at the moment. Trying to find information on how to get a proper mail server set up on a linux machine, but all tutorials are strictly for VPS/docker systems.
You should find the bits about SPF records are still useful to you, since that applies whether you're running an SMTP server or setting up an SMTP relay. I don't have any information about hmail specifically. But it looks like that's an actual server. I'm not clear on whether you're attempting to send directly from that machine (from the SMTP server), or whether you're setting up a Windows 10 machine to send outbound email via the server (SMTP relay, from sending machine to server to Internet). If you're doing relay, then there's nothing special for Windows 10. Just point it at your SMTP server, and as long as you've configured the server correctly to allow relay from that machine, you should be able to send outbound. :)
@@NextDoorNetAdmin hmail is the mailserver I have running on a windows 10 machine. I'd need a relay service to actually enable the server to send mail. Receiving works perfectly. I found that it isn't maintained anymore since 2021, so I'm going to look for a complete solution. Might as well go for a linux server for everything, since I'll need web hosting, file server, chat server etc. anyway. And I have an old HP proliant lying around anyway. Thank you for your quick reply! I'll definitely watch the entire video too. There's no such thing as learning too much after all ;)
Heartbleed disproved _many eyeballs make a bug shallow_. I'm happy this outage proved that we still need supe secure mainframes. Also, i wonder if Intel Itanium (EPIC, not EPYC) created the monoculture, because it killed off a lot of non-PC (RISC) architectures.. 🤔
I'm not sure I would agree that Heartbleed disproved the aphorism you mention. If anything, I think Heartbleed proved the general point that those who use a product commercially should contribute to its development. Crypto in general is a hard subject to do well, and the OpenSSL devs were chronically short on money and people who were both skilled enough and had sufficient free time to contribute. They didn't have the "many eyes" they needed to make the bugs shallow, nor did they have the resources to hire more. I don't think Itanium created any sort of a monoculture. Other RISC lines (including SPARC, ARM, and the IBM Power series) continued for decades after Itanium's introduction. They may not be especially common (certainly not as common as the x86-64 CISC microarchitecture), but they're still out there, and many are still being actively developed and sold today. Itanium, on the other hand, has itself been discontinued.
If you have only one backbone you've lost all redundancy. In the good old days when it was the wild west I had a provider no one had heard of, people be bellyaching about outages and downtime but my little insignificant outfit was still chugging along. It was bought out and of course we're all forced to swim in the same pond. It's like driving 10 cars sharing one engine, lose one engine and you've lost 10 cars.
Maybe its a problem (root cause) about alternatives, quality of service and a sprinkle of opensource and open access.
You don't want to delete those certificate exports altogether because if you have to restore that VM to a reloaded Host or a new Host environment, you cannot boot the TPM enabled VM without importing those certificates.
That's a great tip, thanks! :D
@@NextDoorNetAdmin You are very welcome! I appreciate your video, it assisted me today!
So, IGMP snooping: leave it enabled or disabled for small business networks and/or home networks?
I would leave it enabled. Certainly won't hurt anything! Then if something tries to use multicast and you happen to have a router which supports it, and all the stars align... it should work! If you disable IGMP snooping, that might end up being the piece which breaks it.
😂
Thank you. IP address space has always confused me.
Hi, Comcast and some other ISPs are blocking port 25, and the SMTP authenticators will be removed from Office 365. Do you know how to get around this port 25 issue?
I do! Use a business connection. :) Not to be glib about it, but residential connections often have port 25 blocked in order to combat spam being sent from unaware customers infected with malware. Customers accessing their remote email accounts will usually use a different port--sending directly to port 25 (with or without STARTTLS) is indicative of a server-to-server (relay) connection. Conversely, since a business connection is expected to be running business applications (including email servers), all ports are generally left unblocked. Since you would need a static IP to add into the SPF record to permit the relay, that's also something typically available on a business connection.
@@NextDoorNetAdmin Sorry to say, Comcast in Florida is blocking port 25, even for businesses (which is why I asked). Many companies are dealing with this. To get around it, I set up an SMTP relay server with postfix. It connects to Office 365 using TLS and an account with SMTP authentication enabled.
@@JavierDiaz-zh2jo Ouch! That boggles my mind, honestly. Business connections should be unfiltered, in my mind--it's one of the main reasons to even get a business connection in the first place! I'm going to guess that switching ISPs is likewise not a feasible option. If so, then I would honestly next look at ways of proxying the connection. First thing I would try is probably setting up an SSH tunnel to another endpoint where port 25 isn't blocked. If you had a way to SOCKSify the outbound connection, so much the better--you could use dynamic port forwarding instead of local port forwarding. But I'm afraid that I don't have a ready-made solution at hand for that problem... just ideas that would need more work.
If there are multiple public ip that need to be added, because of multiple locations, would you just add all of them to the spf record? Also, does that not create some other security concerns public the companies public ip on the spf record?
@TheTF01 Every IP address that needs to be allowed to send mail does need to be added... but there's different ways of doing that, depending on the exact circumstances. If they're just single IPs that aren't connected to each other, you can use multiple ip4: entries. If the IPs can be summarized into a CIDR range, you can also enter that. (Example: "ip4:192.168.2.36/30") Does it create a security concern? I don't think it does. For one thing, there's nothing saying that these IP addresses belong to your company. Let's say you have a rule sending all outbound email to a third-party service that adds a signature. (My company does this!) You need to add the third-party service to your SPF record, and they'll typically have documentation telling you what you can put in (it's usually an "include:service.com" entry). But you could just as easily put in the actual IP addresses if you wanted, and it would work the same way. The actual SMTP headers on the email message also include a record of all the machines the email has passed through (using SMTP), including their IP addresses, from start to finish. This not only reveals the sender's IP address (if they used SMTP), but all servers along the mail path. This is standard because it helps to diagnose mail flow issues, as well as allowing things such as SPF to function correctly. And it's been that way since the very beginning of email! As a general security rule, you never want to rely on "security through obscurity"--keeping things safe by keeping them secret. You definitely want to make sure you have a firewall to protect the network, whether you publish the external IPs in an SPF record or not. And if you do have a firewall in place, I think any additional security risk created by an SPF record is minimal, if not negligible.
Thanks! :)
I have a problem with this Microsofts solution. If we need SMTP relay for printers it would mean including all public IPs from each office to our SPF record. what that means is that every office will have permission to send whatever they want on behalf our domain. And I know ppl are capable of doing really amazing stuff, like buying some instagram like counter machine, plugging that to network and all I know is that every IDS and FW will turn on red alerts that there is port sweeping by some unknown linux machine happening. Also they have various visitors etc etc.. So for me allowing IP per each office in SPF will not do the trick at all. To me it is reckless and dangerous and also it would basicaly expose public IP of each of our office in one generaly available text record which is HELL NO. And now to my situation with this in mind we need simple SMTP relay - we could use on-prem exchange, but we are getting rid of that as our steps to cloud and also I do not want to deal with zero day every 5 minutes. We could use really handy SMTP server feature available on win server eddition - securing that would be piece of cake as I could even combine that with the setup you provided and have just one out of physical reach IP in SPF. BUT Microsoft decided in their infinite wisdom to deprecate it without direct replacement. So what can we do? Third party? - I would like to avoid third party funky solutions as plague. High volume mailbox? - feature in preview, so it can stretch and change thousands of time. To me what Microsoft is providing with this is good for some startup hipster office, but in corporate it is half baked and potentialy dangerous. Me sad, me angry, me wanna bonk somebody from Microsoft with bonkstick PS: Great video, there is not much about this topic around. Nicely done :)
0. OBS. Capture multiple inputs, such as camera and desktop (picture in picture). 1. Davinci Resolve community edition. Overwhelming at first, but plenty of help is out there. 2. Excalidraw: draw out complex diagrams as you narrate them. 3. Or a second overhead camera: draw it out on paper while you record. Some very large channels use this retro technique. 4. Learn a little bit of editing each video. It won't all be learned overnight. I'm sure you know this from your network learning adventure. 5. "Keep 'em coming! heh heh" (Duke Nukem voice) subbed
This is genius
Love the content! :)
Underrated channel!
This channel is gold and your personality makes learning fun. Keep it up!
Great video bro!
Thanks for this series! Helped me get comfortable using ACME on OPNsense and Proxmox to setup SSL certificates for both.
you have a wonderful personality you should make more videos teaching
Thank you! I definitely plan to keep going. :)
Thanks man, great video as always!
Thanks, I'm glad you enjoyed it! :)
Thank you for taking the time to explain this, much appreciated.
No problem, glad it was useful! :)
😂😂😂
🤣😂
Thanks, really awesome channel!
Cool. I use pfsense.
I use option 43 for the inform url for unifi gear. The biggest pain is just knowing how each vendor implements setting up options in their respective DHCP servers. We've documented how to implement it for the various routers we sell/deploy for customers
The nice thing about this is it has so much potential & it won't suck the power all from the wall. R250 is a nice unit. Just add a pair of ssd's and a nice 10gig nic and your off to the races ! Good video BTW.
Fun fact: turns out I needed an additional NIC for a redundant WAN connection. The unit accepted it without trouble and keeps on running like a champ!
IT has always had people that were creative and their creations were respected. However there are the others that will these creations as tools and not see the beauty. I feel your pain. From a business point of view the box could be installed minimal fee to get out of trouble then monthly fee doubling to force the business to go for a permanent solution.
You're quite right. I often feel that tension between viewing a network or system as my "creation," versus as a tool to accomplish a business goal. Of course, it can (and should) be both! I do like helping solve problems and achieve goals, so I don't mind building something to be functional and utilitarian, so long as the solution isn't being flagrantly misused. If this little lifeboat system was going to be rebuilt (I'm still not sure it will be), there's already been some discussion around how we would ensure any deployments were actually temporary. I don't think your suggestion had come up yet, though, so thank you for making it!
@NextDoorNetAdmin I was in IT late 70s and 80s. There, we played with bits and bytes pioneered things IBM didn't know was possible. They didn't like me as I worked out by manipulating their software. $60000 network controller's could be doubled in capacity, and what I didn't like about their mainframes. Problem solving is awesome keep doing it. I left IT and set up network systems in disability organisations. With it, I wrote policy and procedures for them, including who was responsible and accountable for maintenance change management backup. Alas, they didn't take advice. Both systems died within a few years, of course. It was the last time I did it.
Bs! For a router all you need is a dual core cpu and a pcie quad Ethernet. Done! But if your customers like to overpay for off the shelf solutions…
If this was strictly a router, I would probably agree with you. But as I noted in the video description, this is a firewall. Specifically, this is going to be a layer 7 firewall inspecting traffic for about 1000 devices using a 1 Gbps synchronous connection. www.zenarmor.com/docs/introduction/hardware-requirements With that established, have I overbuilt a little? Possibly! But then, I need the stated requirements immediately, and I still need to take future growth (device counts, connection speed, newly-required features, increased software requirements) into consideration over the next 5-7 years. I actually started by pricing out a rack-mounted Supermicro-based solution where we would purchase parts only and then I would do the assembly myself. Based on just the cost of parts versus the cost of the Dell system, the Dell was cheaper--which surprised the heck out of me, I don't mind admitting.
why you mad bro
im running opnsense with wireguard and openvpn tunneling on a dell poweredge r640 almost 40 users to a connected to the site, a small router wont be able to do that.
As someone who is currently upgrading my opnsense box from a dual core CPU because it handles routing fine but can't handle routing + firewall I'd have to disagree.
"Hot off the press" That's one spicy fuser😅
Hi can you please help. I need to create a CSV (cluster shared volumes) with smb protocol between 2 Windows physical 2019 servers. This CSV common share should be accessible from a 3rd machine which also has windows server 2019
You want to take a look at setting up a Scale-Out file server in your cluster. This will let you use a CSV as the backing volume. learn.microsoft.com/en-us/windows-server/failover-clustering/sofs-overview
There’s a crowd I know that needs to hear this one, fantastic!