Windows Via Real Thin Clients

Real thin clients, like the Sun Ray 170, don't run operating systems like Windows or Linux. I like the Sun Ray, since its Sun Ray Server Software runs on either Solaris or Red Hat Enterprise Linux. That's fine for users who want to access applications on Solaris or Linux. What about those who need Windows? I can think of four options:

  1. Run a Windows VM inside the free VMware Player on the Red Hat Enterprise Linux user's desktop.

  2. Run VMware Workstation on each user's desktop.

  3. Run VMware GSX Server on the Red Hat Enterprise Linux server running Sun Ray Server Software, and let users connect to the Windows VMs using the VMware Virtual Machine Console

  4. Run VMware ESX Server on a separate platform, and let users connect to the Microsoft VMs using the Remote Console


Is anyone trying this already?

Update: I noticed a similar issue appeared in the VMTN Blog.

Comments

Ipslore said…
Microsoft offers a product called Windows Thin Client (formerly Windows-based Terminal or WBT) that is a minimal version of Windows CE. There are several brands of thin client hardware that can run this to connect to Citrix or Terminal Services servers for remote application use. You're in the D.C. metro area, right, Richard? If you find yourself on the George Mason Fairfax campus any time soon, you'll see these things deployed about as "public" terminals.
6:29 PM
Anonymous said…
the sun server software provides a connect to windows terminal server. so you need at least two servers to serve up x thin-clients (one solaris or linux + one windows).

the thin-clients then appear (like bootp) to run solaris, linux, and/or windows. a user could theoretically have 3 smartcards, one to access each OS. they can use any thin-client. sun's technology is very beneficial for travelling cross-platform developers.

your ideas are great, but might break the microsoft licensing model...
12:16 AM
Richard Bejtlich said…
Hello last Anonymous poster,

I am not recommending using RDP/Terminal services. That would easily be done from Linux using Rdesktop. I am instead trying to combine the power of VMware with the ease of thin clients. I envision each VM to have a licensed version of Windows. These would be the same licenses used on individual desktops.
8:01 AM
Anonymous said…
We looked at using Sun Rays as thin client desktops for offshoring using the citrix webportal to point users to virtual servers using either MS Virtual Servers or VMWare'd Windows Instances. All the Sun Rays would pop up was a web browser that was locked down to only allow access to the citrix portal. The client in the end opted to use a Windows CE based netpc on the grounds that they were cheaper than the Sun Rays. Of course in the long run there has been a much higher maintenance cost of the devices in terms of configuraiton mgmt. The back ended up being Windows VS.
9:23 AM
pvaneynd said…
Remote consoles are really bad: they are a part of the management console on the ESX, so they can only use 1 CPU and are very limited in the amount of resources available in the standard settings. We've been seeing problems on a lightly loaded machine with 2 active Remote consoles, my advice is to move to RDP or NX as soon as possible.

So I would use option 4, but connect via RDP.

Or option 5: use vmware ACE to distribute images automagicly and force people to run them.
5:41 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more