11

An AS doesn't need to necessarily be constrained to a single physical location. When anycasting, you run routers in many physical locations, each peering with different ISPs as the same AS, advertising a route to the anycasted IP addresses. From BGP's perspective, it's not terribly dissimilar to what you'd do for redundancy with multiple ISPs from an AS in ...


5

There is no requirement that IP addresses or Internet routes for a prefix come from a single AS. ASNs are assigned to organizations, and addresses are also assigned to organizations. Registrars like ARIN don't link my address allocation to my ASN allocation. Even in new systems like Resource Public Key Infrastructure it still allows for multiple ASs to ...


4

If the client passes the user credentials as plain text then yes, it will be possible to see them in the http packets.


3

Generally you want to apply your restrictions at the NTFS level. Make your share permissions as open as you can (i.e 'Authenticated Users' or 'Everyone' modify access at least) then nail it down with the NTFS security permissions. I would recommend creating three security groups for each share (Read, Modify and Write) and then assign the permissions for ...


2

This (and resources like this page) seems to imply a mapping of 1 public IP to 1 AS. Yes. That is true. However, anycast seems to work by advertising the same public ip address from multiple locations, Simply exactly by "just doing it". An AS is the entity that defines it's own routing internationally. It can connect the same IP address to ...


2

I see two idea. First is like your openvpn's idea, as treat your line like a normal wan link, and put some router there to do a site-to-site vpn. Second idea, never used it, but I would try MACsec between the two switch uplink; MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two MACsec-capable devices. The ...


1

I guess this is not possible on the TCP/IP level. You could either secure every single service using AD authentication. If a service doesn't support this natively, you can try using a proxy (e.g. SOCKS) that does. Another approach would be on a deeper level, by using 802.1x port-based authentication on the switches. This will require a machine to ...


1

You may want to get acquainted with fail2ban: it's a software that monitors log files for suspicious activity and bans the originating IP address for the desired amount of time, even indefinitely. It is also able to send you an email notification with the threat details and the action taken. Fail2ban scans log files (e.g. /var/log/apache/error_log) and ...


1

Sure. Everything, including this kind of monitoring, is possible for almighty sysadmins, but: It would be unethical. Work computers can be used both for personal and professionally confidential tasks. Monitoring such could be illegal. We have actual work to do. No time for spying employees. We don't have any interest in what kind of porn turns users on, as ...


Only top voted, non community-wiki answers of a minimum length are eligible