Need advice on implementation

[dknutson]

Hi All - Need a bit of advice. I am thinking of using UltraVNC for remote control of some 250 systems. I need to provide some 50 users with access to these systems - actually, each user will only need access to a subset of 5-8 systems, with some overlap. Problem is, the 250 systems are on a private satellite network (ie, using 172.x.x.x subnet) and the 50 users are all on external networks - working from home on cable or DSL. I would also prefer these 50 users connect using the web client.

So, is this possible? If so, what mechanism do I need to investigate to make it work? Thanks!!

[Oxyacetylene]

You could do it, question is how you want to.
You could:
1. Use a VPN solution for the users to connect to the private network and then use NT authentication for the VNC servers and grant access to just the systems they need access to.

2. Use a VPN solution for connection to private network but use a seperate password for each VNC server and give each remote user just the passwords they need.

3. Use a different port for each VNC server and forward that port through the firewall to the appropriate machine in the private network and use seperate passwords for each one. Then give each user only the password they need.

Solution 3 is not desirable at all since you would be opening a big security hole with that many forwarded ports. You cannot effectively restrict access through the firewall based on client IP address since they are on cable/DSL with dynamic IP's.

Solution 2 could involve more administration since you might want to change passwords when someone's access is revoked. You would also want to disable that particular person's VPN access, although they wouldn't have network access to the servers anyway if you disable their VPN access...

[dknutson]

Thanks for the tips. Have you heard of anyone using a combination of a repeater and a web site to do this?