Joe's Tech Blog

Just another Tech Blog

Joseph Klimczak

Blog

🛡 How to Turn an Alpine Linux Server into a Tailscale Gateway for Your LAN

Joseph Klimczak No Comments

Why a Tailscale Gateway?

Tailscale normally requires each device to run the Tailscale client. That works fine for laptops, phones, and servers, but what about devices like printers, cameras, or NAS boxes?

With a Subnet Router, a single Tailscale-connected server can act as a bridge to your entire LAN — so any device on your Tailscale network can reach those local-only devices securely.

What You’ll Need

  • A small Alpine Linux server (VM, bare metal, or Raspberry Pi)
  • An active Tailscale account
  • Access to your LAN network (e.g., 192.168.1.0/24)
  • Your Tailscale auth key (from the Tailscale admin panel)

Step 1: Update & Install Tailscale

First, update Alpine and install Tailscale:

apk update && apk upgrade
apk add tailscale tailscale-openrc

Step 2: Enable IP Forwarding

This allows the Alpine box to forward traffic between your Tailscale network and LAN.

Edit /etc/sysctl.conf:

nano /etc/sysctl.conf

Add:

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

Apply:

sysctl -p

Step 3: Start Tailscale & Advertise Routes

Start the Tailscale service:

rc-update add tailscaled default
rc-service tailscaled start

Now bring Tailscale online, advertising your LAN subnet:

tailscale up \
  --auth-key=tskey-auth-XXXXXXX \
  --advertise-routes=192.168.1.0/24 \
  --accept-routes

Step 4: Approve Routes in Tailscale Admin

Log in to Tailscale Admin Routes and enable the route for 192.168.1.0/24.

Step 5: (Optional) Adjust Firewall Rules

If Alpine’s firewall is active, you’ll need to allow forwarding:

apk add iptables
iptables -A FORWARD -i tailscale0 -j ACCEPT
iptables -A FORWARD -o tailscale0 -j ACCEPT
/etc/init.d/iptables save

Done! 🎉

Now, any device on your Tailscale network can securely reach devices on your LAN without needing a VPN client installed.

Example:

  • From your laptop on Tailscale, you can hit http://192.168.1.50 to access your NAS dashboard — even from across the world.

Why This Rocks

  • Zero Trust Security — Every connection is authenticated via your Tailscale identity provider.
  • No Port Forwarding — Works through NAT and firewalls.
  • Cross-Platform — Works for Windows, macOS, Linux, iOS, Android, and even cloud VMs.

💡 Pro tip: Combine this with Tailscale ACLs to restrict who can access which LAN devices.

Blog

CrowdStrike MacOS Workspace One Setup

Joseph Klimczak No Comments

After weeks of troubleshooting Verese issues I thought it would be good to document a working process. Hopefully this helps not go through some of the pain that I have been through due to some of corks.

I have a few profile to enable CrowdStrike with no user interaction needed. 

macOS - CrowdStrike - Content Filter

Filter Name: falcon
Identifier: com.crowdstrike.falcon.App
Organization: CrowdStrike, Inc.
Filter Socket Traffic: Enabled
Socket Filter Bundle ID: com.crowdstrike.falcon.Agent
Socket Requirement: identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = X9E956P446
Filter Grade: Inspector

macOS – CrowdStrike – Login and Background Items

Rule Type: BundleIdentifier
Rule Value: com.crowdstrike.falcon.UserAgent
Team Identifier: X9E956P446
macOS - CrowdStrike - Notification Settings
App Bundle ID: com.crowdstrike.falcon.UserAgent
Allow notifications: Enable
Show in Notification Center: Enable
Show in Lock Screen: Enable
Allow badging: Enable
Allow sounds: Enable
Allow critical alert notifications: Enable
Alert Type: Temporary Banner

macOS – CrowdStrike – System Extension

Allowed System Extension Types
Team Identifier: X9E956P446
Endpoint Security & Network Enable

Allowed System Extensions
Team Identifier: X9E956P446
Bundle Identifier: com.crowdstrike.falcon.Agent

Now this is what gave me and so many people issue. I dont know if this is a bug or undocumented need for Workspace one and Crowd Strike Profile.

In this order Create a MacOS – Crowdstrike – Privacy Preference in this order 

Identifier: com.crowdstrike.falcon.Agent
Identifier Type Bundle ID
Code Requirement: identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
Comment: agent
System Policy All Files: Allow
System Policy Sys Admin Files: Allow

Now add a second Prefrences inside the same one for Falcon App 

Identifier: com.crowdstrike.falcon.App
Identifier Type Bundle ID
Code Requirement: identifier "com.crowdstrike.falcon.App" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
Comment: app
System Policy All Files: Allow
System Policy Sys Admin Files: Allow

I hope this helps save you time: The big issue was not having something in the comments. Once that was added the rest your app should not go green in some cases I need to reboot

Bonus: Install Script 

Post Install Script
#!/bin/bash
sudo /Applications/Falcon.app/Contents/Resources/falconctl license "Your Key"

Blog WorkSpace One

Omnissa Pass

Joseph Klimczak No Comments

Omnissa Pass: Elevating Enterprise Authentication with Passwordless Security

In today’s digital landscape, traditional passwords have become a significant vulnerability, often leading to security breaches and user frustration. Recognizing this challenge, Omnissa introduces Omnissa Pass, a cutting-edge multi-factor authentication (MFA) solution designed to enhance security while simplifying the user experience.

🔐 What is Omnissa Pass?

Omnissa Pass is a mobile application that provides secure, passwordless authentication for enterprise applications and services. By leveraging FIDO2 passkeys, it offers a modern approach to authentication, eliminating the need for passwords and reducing the risk of credential theft. Users can authenticate using biometric methods or device-based credentials, ensuring both security and convenience.

🚀 Key Features

  • Passwordless Authentication: Utilizes FIDO2 passkeys to enable secure, password-free logins.
  • Multi-Factor Authentication (MFA): Combines device-based credentials with biometric verification for enhanced security.
  • Device Compliance Checks: Integrates with Omnissa Access to ensure that only compliant devices can authenticate, enforcing organizational security policies. 
  • Seamless Integration: Works across various platforms and integrates with existing enterprise systems, facilitating a smooth transition to passwordless authentication.

📱 Availability

Omnissa Pass is available for download on major mobile platforms:

🛡️ Enhancing Security with Omnissa Access

When paired with Omnissa Access, organizations can enforce strict access controls based on device compliance and user authentication. This integration ensures that only authorized users on compliant devices can access sensitive corporate resources, aligning with Zero Trust security principles. 

🌐 Embracing the Future of Authentication

By adopting Omnissa Pass, enterprises can:

  • Reduce Security Risks: Eliminate vulnerabilities associated with traditional passwords.
  • Improve User Experience: Offer a seamless and intuitive authentication process.
  • Ensure Compliance: Meet regulatory requirements with robust security measures.

Transitioning to passwordless authentication with Omnissa Pass not only strengthens security but also enhances overall user satisfaction.

For more information and to explore how Omnissa Pass can benefit your organization, visit the Omnissa Tech Zone.

Blog WorkSpace One

Fetch – Windows Application Lifecycle Tool for Workspace ONE UEM Omnissa

Joseph Klimczak No Comments

Fetch Review: Simplifying Windows Application Management

Hi there folks!

After spending some time with Fetch, I’m excited to share my review of this innovative tool that addresses one of the biggest challenges in Windows Desktop management—Application Management.

The Challenge of Application Management

Workspace ONE Administrators know how complex and time-consuming it can be to make applications available on managed devices. Traditionally, the process involves manually downloading installers, preparing binaries, and creating detailed application entries within Workspace ONE UEM. This often leads to delays and inconsistencies in deployments.

What is Fetch?

Fetch is a Windows application designed to streamline and automate the deployment of native Windows applications within Workspace ONE. By automating the process of downloading installers, uploading binaries, and creating Native Windows Application entries complete with all required metadata, Fetch drastically reduces the manual workload and potential for errors.

With a robust database boasting over 7,000+ unique applications and a staggering 62,000+ application versions, Fetch offers an extensive resource that simplifies the deployment process.

Below is a snapshot of the tool in action:

Key Workflows Offered by Fetch

Fetch enhances the application management process with four main workflows:

1. Application Search and Creation:

• Simply search for an application by name and automatically generate its corresponding Native App entry in Workspace ONE UEM.

2. Software Asset Management Integration:

• Upload a Software Asset Management or Application Report (like the Installed Apps report from Workspace ONE Intelligence, Software Deployment Report from SCCM, or a Powershell report of network devices). Fetch checks its extensive database for matching applications, then assists in creating the corresponding Native App in UEM.

3. Application Version Management:

• Interrogate your current Workspace ONE UEM environment to discover if updated versions of applications are available. Fetch then enables you to upload and create the updated application version seamlessly.

4. Manifest-Based Deployment:

• Upload a manifest (template) containing details of your organization’s existing Native Windows Applications along with your installer files. Fill in the necessary metadata, and Fetch processes the manifest to upload the installers and create the apps in UEM accordingly.

The Verdict

As a reviewer, I found that Fetch effectively addresses many of the hurdles traditionally faced by Workspace ONE Administrators. Its automation of repetitive tasks not only saves time but also reduces the likelihood of manual errors, ensuring that application deployments are both consistent and efficient. The extensive database is a clear highlight, providing a strong foundation that supports a wide array of applications and versions.

If you’re looking for a tool that simplifies and accelerates Windows application management, I highly recommend giving Fetch a try. For more detailed instructions and to download the tool, check out the documentation and download Fetch.

Happy managing!

Blog WorkSpace One

Windows Server Management is coming to Workspace ONE UEM

Joseph Klimczak No Comments

Omnissa is enhancing Workspace ONE UEM with Windows Server support, enabling seamless management of all Windows computing devices. With a beta launch on the horizon, users can expect robust features like enrollment, software distribution, and server-specific analytics. Join our upcoming webinar for in-depth insights and to participate in the beta!

As an extension of the robust Windows Desktop functionality, Omnissa is introducing Windows Server support.  Windows Server will be added to the long list of Workspace ONE UEM computing devices–first in beta introduction, with general availability to follow. 

Soon you will be able to manage all Windows computers via Workspace ONE UEM.  Below is a high-level overview, as well as an invitation to a webinar where more details will be discussed. 

Find out more in [THIS] Techzone post by Jo Harder.

Blog

Health & Environment

Joseph Klimczak No Comments

Introducing the Health & Environment Tile in the New Omnissa Cloud Services Portal

The Omnissa Cloud Services Portal is evolving, and one of the most exciting updates is the addition of the Health & Environment tile. This new feature is designed to streamline critical processes, centralize management tasks, and provide a comprehensive view of your Workspace ONE Cloud Managed Hosting environment.

What Does the Health & Environment Tile Offer?

The Health & Environment tile brings together several key services that were previously spread across platforms, including My.WorkspaceONE.com. As part of the broader transition to the Omnissa Cloud Services Portal under Omnissa Connect, this tile will enable you to:

1. Schedule UEM Upgrades

Effortlessly manage upgrades for your Workspace ONE Cloud Managed Hosting environment. The scheduling tool ensures minimal downtime and keeps your environment up-to-date with the latest features and security updates.

2. Sign and Renew Certificates

Certificate management is now more accessible than ever. Whether you need to sign or renew certificates for your environment, this tool simplifies the process, ensuring compliance and operational continuity.

3. Monitor Omnissa Products and Services

Stay informed about the status of all Omnissa products and services in one centralized dashboard. Whether you’re tracking performance metrics or troubleshooting potential issues, the Health & Environment tile provides real-time insights to keep your operations running smoothly.

Transition to Omnissa Connect

The integration of these features into the Omnissa Cloud Services Portal is part of a larger effort under Omnissa Connect. This initiative focuses on creating a seamless user experience by consolidating tools and services into a unified platform. As more features transition from My.WorkspaceONE.com to the Cloud Services Portal, you’ll enjoy a cohesive and efficient management experience.

Why It Matters

The Health & Environment tile is more than just a new feature—it’s a step forward in simplifying cloud service management. By centralizing tools and services in one portal, Omnissa is reducing complexity and empowering users to take control of their environments with ease.

Stay tuned as more features make their way into the Omnissa Cloud Services Portal, further enhancing your ability to manage and optimize your Workspace ONE environment.

Ready to explore the new Health & Environment tile? Log in to the Omnissa Cloud Services Portal today and experience the next generation of cloud service management!

VMware

Why You Should Update to vCenter 8.0.3.00400

Joseph Klimczak No Comments

In the ever-evolving landscape of IT infrastructure, VMware vCenter remains a cornerstone for managing virtualized environments. The latest release, vCenter 8.0.3.00400, brings with it enhancements that promise improved performance, better security, and expanded features for modern data centers. Here’s a closer look at what’s new and why you should consider upgrading.

What’s New in vCenter 8.0.3.00400?

1. Enhanced Performance and Scalability

• Optimized Resource Utilization: This update includes performance tweaks that enhance resource allocation and efficiency for large-scale deployments.

• Improved API Responsiveness: Faster response times for API calls improve automation workflows and integration with external tools.

2. Advanced Security Features

• Strengthened TLS Protocols: This version enforces stricter TLS protocols for encrypted communications, ensuring compliance with modern security standards.

• Bug Fixes and Vulnerability Patches: Critical vulnerabilities reported in previous releases have been addressed, making this the most secure vCenter version yet.

3. Streamlined Operations

• Improved User Interface: New UI updates reduce clutter and streamline navigation for administrators, making complex operations more intuitive.

• Proactive Insights: The update improves integration with VMware Skyline, delivering actionable insights to preemptively resolve issues.

4. Expanded Compatibility

• Support for New VMware Tools Versions: This update ensures seamless compatibility with the latest VMware ESXi 8.0.3 patch and other associated tools.

• Cloud-Ready Enhancements: Improved support for hybrid and multi-cloud environments allows administrators to manage workloads across diverse platforms more efficiently.

Why You Should Update

1. Security is Non-Negotiable

Cybersecurity threats are evolving, and staying on older versions of vCenter exposes your environment to unnecessary risk. With vCenter 8.0.3.00400, critical vulnerabilities have been patched, and security enhancements help safeguard your virtual infrastructure.

2. Performance Gains

Organizations managing extensive virtualized environments will benefit from the performance improvements that reduce overhead and improve the responsiveness of virtual machines and services.

3. Future-Proofing Your Infrastructure

Staying current ensures your system remains compatible with the latest hardware, software, and cloud services. This is especially critical for businesses leveraging hybrid or multi-cloud strategies.

4. Improved User Experience

The updated UI and improved operational insights save time for administrators, reducing the complexity of day-to-day management tasks and freeing up resources for strategic initiatives.

Best Practices for Upgrading

• Backup First: Always create a full backup of your existing vCenter configuration before initiating an upgrade.

• Check Compatibility: Ensure all connected ESXi hosts, hardware, and third-party integrations are compatible with vCenter 8.0.3.00400.

• Test in a Sandbox Environment: Run the upgrade in a test environment to identify potential issues before rolling it out to production.

• Follow VMware Guidelines: Refer to VMware’s official documentation for step-by-step instructions tailored to your deployment.

Conclusion

Updating to vCenter 8.0.3.00400 isn’t just about accessing new features; it’s about securing your infrastructure, enhancing performance, and ensuring compatibility with the latest innovations. By upgrading, you’re setting your virtual environment up for success, enabling your team to focus on what truly matters: delivering value to your business.

Don’t wait until vulnerabilities or compatibility issues force your hand—take a proactive approach and upgrade to vCenter 8.0.3.00400 today.

Explore the official release notes here to learn more about what this update has to offer.

Blog How 2 Docs WorkSpace One

How to Disable Windows Recall in Workspace ONE: A Step-by-Step Guide

Joseph Klimczak No Comments

Here is the updated blog post with the custom XML code:

Securing Your Windows PCs Against Recall Using Workspace ONE UEM

With the introduction of Windows 11 Copilot+ machines, Microsoft introduced a feature called Recall, designed to create an explorable timeline of your PC’s past actions. While useful for users, Recall has raised privacy concerns, particularly due to its ability to capture sensitive data like passwords and MFA codes.

Why Disable Recall?

Recall captures screenshots of a user’s activity, posing security risks. If malicious actors exploit this, sensitive information could be exposed. This poses a substantial concern for IT admins responsible for securing corporate networks and personal data.

Disabling Recall in Workspace ONE UEM

Step 1: Create a Windows Profile

• Navigate to Devices > Profiles & Resources.

• Select Add Profile, choose Windows Desktop, and configure general settings like profile name and target devices.

Step 2: Add Custom XML to Disable Recall

You will need to create a custom XML profile using SyncML commands that disable the Recall feature on managed Windows devices. Insert the following SyncML commands:

To Disable Recall:

<Replace>
  <CmdID>34e7f8c0-1dd4-42ed-bbcc-07da966bc0e0</CmdID>
  <Item>
    <Target>
        <LocURI>./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis</LocURI>
      </Target>
    <Meta>
      <Format xmlns="syncml:metinf">int</Format>
    </Meta>
    <Data>1</Data>
  </Item>
</Replace>

To Re-enable Recall on Profile Removal:

<Delete>
  <CmdID>34e7f8c0-1dd4-42ed-bbcc-07da966bc0e0</CmdID>
  <Item>
    <Target>
        <LocURI>./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis</LocURI>
      </Target>
    <Meta>
      <Format xmlns="syncml:metinf">int</Format>
    </Meta>
    <Data>1</Data>
  </Item>
</Delete>

These commands ensure that Recall is disabled on the initial profile installation and that it will revert to default behavior if the profile is removed.

Step 3: Publish the Profile

Save and publish the profile to all applicable devices. Ensure the affected devices are listed as expected. A reboot might be necessary for the changes to take full effect.

Conclusion

Until Microsoft addresses Recall’s security flaws, disabling this feature using Workspace ONE UEM is a crucial step for organizations prioritizing privacy and security. By following the steps outlined here, IT administrators can ensure their managed devices are protected from potential security risks posed by Recall.

Next Page »