059 - How Should SysAdmins Handle Remote Access in 2026?

Which protocol you use to reach the box is the least interesting decision you will make about remote access.Andy Syrewicze and Eric Siron go after the piece they cut from the tools episode. Eric lands the sharpest version half an hour in: what you are actually doing is moving from one-sided authentication to mutual authentication. Around that sit overlay networks against the VPN concentrator, the RMM console as the most attractive target in an MSP estate, the outbound tunnel nobody watches for, and whether just-in-time access holds up at 3am with something down and nobody awake to approve it.Chapters:00:00:00 - Cold Open: Remote Access Gets Its Own Episode00:01:20 - Welcome and Show Plugs00:04:16 - News React: Anthropic Safety Researcher Resigns00:12:54 - News React: Broadcom Pulls Public VDDK Access00:16:21 - Nerd Hour: Eric's Hugo Migration00:17:24 - Three Gates Against a Runaway API Bill00:20:38 - Main Topic: The Tooling Is the Small Part00:23:08 - SSH on 22, and the Port Change Experiment00:24:21 - Name a Reason to Expose a Management Port00:27:10 - Overlay Networks, Tailscale, and WireGuard00:29:31 - Eric: This Is About Mutual Authentication00:32:20 - RMM Tools and the Central Console Problem00:33:41 - Do You Need Remote Management All the Time?00:34:36 - Just Enough Administration Meets Just in Time00:36:00 - Eric: I Attack the Endpoint, Not the Protocol00:40:16 - Risk Assessment Is a SysAdmin Skill00:42:47 - The Firewall Is Also the VPN, and Fortinet00:45:17 - Outbound Access, Attacker's Side00:47:32 - Is Anyone Watching Outbound Traffic?00:50:52 - The 3am Phone Call00:52:46 - Eric: MFA Everything, No Remember Me00:55:44 - PAM, PIM, and Where to Read Up00:56:14 - Nothing Revokes Itself Unless You Build It00:58:13 - Key Takeaways: Never Rely on One Control00:59:40 - Access Should Be Ephemeral01:01:46 - Risk Profiles: Tomcat vs Medical Records01:03:52 - The Tools: Tailscale, SSH, Remmina01:07:56 - Eric's Kit: PuTTY, WinSCP, rsync01:11:17 - Do This Monday01:13:52 - Wrap Up and OutroResources / Show Notes:- NBC News, Anthropic researcher Jacob Coxon resigns: https://www.nbcnews.com/tech/tech-news/anthropic-safety-researcher-resigned-warning-rapid-ai-development-gamb-rcna596767- RentAHuman, where AI agents hire people for real world tasks: https://rentahuman.ai- Brandon Lee (vExpert), Broadcom pulled public VDDK access: https://www.virtualizationhowto.com/2026/09/leaving-vmware-just-got-harder-after-broadcom-pulled-vddk-downloads/- CISA, hardening Fortinet devices after credential exposure: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure- Microsoft Learn, Entra PIM, eligible versus active access: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure- Tailscale, free Personal plan covers 6 users: https://tailscale.com/pricing- WireGuard, what Tailscale manages under the hood: https://www.wireguard.com- Cisco Duo, free tier for teams of 10 or fewer: https://duo.com- Remmina, open source RDP, VNC and SSH client: https://remmina.org- PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/- WinSCP: https://winscp.net- SysAdmin Weekly: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions