We have about 150 terminals in about 12 offices that are used by folks to access email, print, and the Internet. Previously all of those were under our MS EA - so all had full versions of windows on them and we were paying a desktop license and SA on each one. But we also have terminal server CALs for everyone for other apps.. so we went "hey, wait a second..".
Now we have 150 Ubuntu terminals that on login go straight to the terminal server(s) in fullscreen thanks to rdesktop via.xsession. They have no idea what's happening because it's actually faster this way because most of the terminals were old P4's, and most were infected with something or other half the time. The TS is locked down tight, lots of filtering + flashblock + firefox = win.
Granted we still have a ton of "fat" desktops, but for right now this saves us a ton of money and is much, much, much easier to support. We'll likely need to up our bandwidth in some spots, but that's a lot less cash than the MS licensing.
This is precisely why I'm moving back to hosting my own website on my own server and hosting my own email. Facebook has always made me a bit wary, and while I'm cool with Goog - their ads are just a little TOO targeted as of late.
I second every suggestion to get a hardware firewall, and use VPN if possible. But I know with many large hosting providers, particularly those who specialize in VM's, this isn't an option. I have a couple of VM's through one of those hosts (and I *love* said host), so you have to do the next best thing: some sort of software protection.
If you are running Ubuntu, UFW does excellent. I use UFW and allow SSH connections only from two spots - my work IP, and my shell server. My shell server sits in a co-lo behind my PIX, and I VPN into it. I'm kinda weird like that, I'll admit. I have a PIX at home as well. Okay I'm a bit of a freakshow.
Anyway, if you aren't running ubuntu, hosts.deny, PKI, and moving SSH to a very high numbered port will *help*. Other than that, contact the hosting provider and see if they will help you on a consulting basis. Remember many of them are running barebones to give you good prices - don't expect too much, and you never know - if you offer they might not even take you up on it.
Finally - good luck.
Slashdot Mirror
We have about 150 terminals in about 12 offices that are used by folks to access email, print, and the Internet. Previously all of those were under our MS EA - so all had full versions of windows on them and we were paying a desktop license and SA on each one. But we also have terminal server CALs for everyone for other apps.. so we went "hey, wait a second..". Now we have 150 Ubuntu terminals that on login go straight to the terminal server(s) in fullscreen thanks to rdesktop via .xsession. They have no idea what's happening because it's actually faster this way because most of the terminals were old P4's, and most were infected with something or other half the time. The TS is locked down tight, lots of filtering + flashblock + firefox = win.
Granted we still have a ton of "fat" desktops, but for right now this saves us a ton of money and is much, much, much easier to support. We'll likely need to up our bandwidth in some spots, but that's a lot less cash than the MS licensing.
This is precisely why I'm moving back to hosting my own website on my own server and hosting my own email. Facebook has always made me a bit wary, and while I'm cool with Goog - their ads are just a little TOO targeted as of late.
I second every suggestion to get a hardware firewall, and use VPN if possible. But I know with many large hosting providers, particularly those who specialize in VM's, this isn't an option. I have a couple of VM's through one of those hosts (and I *love* said host), so you have to do the next best thing: some sort of software protection. If you are running Ubuntu, UFW does excellent. I use UFW and allow SSH connections only from two spots - my work IP, and my shell server. My shell server sits in a co-lo behind my PIX, and I VPN into it. I'm kinda weird like that, I'll admit. I have a PIX at home as well. Okay I'm a bit of a freakshow. Anyway, if you aren't running ubuntu, hosts.deny, PKI, and moving SSH to a very high numbered port will *help*. Other than that, contact the hosting provider and see if they will help you on a consulting basis. Remember many of them are running barebones to give you good prices - don't expect too much, and you never know - if you offer they might not even take you up on it. Finally - good luck.