Oxygen Cloud Platform Deploys Russian VDI Solution for Heavy 3D CAD Work in One Month
Oxygen Cloud Platform has shared details of a compressed one-month project that delivered a fully domestic VDI environment capable of running heavy 3D CAD applications for design engineers.
The unnamed customer, a Russian company that designs and manufactures complex equipment, required remote access to resource-intensive applications including Siemens NX, SolidWorks, and Kompas-3D on import-substituted hardware and software over a dedicated channel. Data had to remain inside a protected data center while remaining accessible to remote facilities located 1,500 km away.
From six-month R&D to one-month production rollout
After an earlier large-scale Astra Linux VDI deployment completed in ten days, the team allocated six months for thorough testing. When the new request arrived with an “as soon as possible” deadline, the accumulated knowledge had to be applied under tight time constraints.
Key technical challenges and resolutions included:
- High rendering latency with NVIDIA T4 cards — resolved by switching to NVIDIA A40 GPUs.
- Variable resource demands across user profiles — addressed by tuning vCPU, RAM, and vGPU allocations for NX and Kompas-3D workloads.
- Failure to detect a second monitor — fixed by updating thin-client firmware.
- Network-induced performance issues — mitigated through optimization of the Loudplay protocol and deployment of newer releases of Astra Linux, Termidesk, and Loudplay Client.
- Manual desktop assignment — automated via Termidesk broker with separate resource pools in Active Directory.
Virtual GPU functionality is provided by the Russian Forsite vGate solution running on domestic hypervisors, combined with NVIDIA GRID vGPU profiles. The resulting infrastructure supports both office users and engineers working with large assemblies while satisfying regulatory requirements for Russian software and hardware.
Related articles
Secure Boot on Arch Linux: Enabling Protection for UKI Without Replacing Factory Keys
A detailed guide explains how to configure Secure Boot on Arch Linux for Unified Kernel Images without replacing the motherboard's factory keys or relying on Microsoft certificates. The author chose the minimal-intervention approach of adding a custom key to the existing DB section via the UEFI interface instead of using sbctl enroll-keys or shim. The process begins with backing up existing keys to a FAT-formatted USB drive directly from the BIOS menu. New keys are then generated using sbsigntools and openssl, converted to DER format, and enrolled through the ASUS Prime 790-P UEFI interface. A post-hook script for mkinitcpio automatically signs the UKI after every kernel update, ensuring the entire unified image remains protected. The method preserves the original Microsoft and vendor certificates while adding only the user's own signing key.
What Server Logs Reveal About Attackers: Analyzing Suspicious Requests on Linux
Server logs provide critical insights into potential intrusions by recording events from the operating system, SSH authentication, and web applications. The guide explains how to examine Linux system journals with journalctl, review authentication logs on Debian and RHEL systems, and inspect Nginx access logs for unusual HTTP requests. Analysts learn to identify patterns such as rapid failed login attempts using multiple usernames from a single IP address, which may indicate brute-force or automated scanning activity. The article also covers counting the most active IP addresses with awk and sort commands while stressing the need to compare findings against normal traffic baselines. Additional recommendations include logging structured security events in JSON format with fields for timestamp, user ID, resource, and outcome, following OWASP guidelines. The text warns against storing sensitive data like passwords in logs and highlights limitations such as possible log tampering or unsynchronized server clocks. A practical seven-step investigation plan helps responders preserve evidence and verify hypotheses before taking action.
UserGate Details FPGA Acceleration to Turbocharge Next-Generation Firewalls
UserGate product manager Pavel Molodan explains why adding security features like IDS/IPS, SSL/TLS inspection, and application control turns a high-performance NGFW into a bottleneck. The company outlines four groups of acceleration methods, with a focus on FPGA-based hardware offloading for packet parsing, firewall rules, NAT, and encryption tasks. Research from 254 respondents shows strong demand for these functions in data center B2E segments at 50-200 Gbit/s. Experimental platforms including Katun-2 PCIe cards and the FG system demonstrate concrete gains, such as scaling IDPS from 5 to 90 Gbit/s and achieving 85 Gbit/s firewall throughput on EMIX profiles. FPGA delivers microsecond latency and better energy efficiency compared with CPU-only designs while preserving full NGFW functionality for elephant flows.
Curator Reveals Detailed Architecture of Its Network Filtering System After October 2026 Outage
Curator published a technical post-mortem analyzing the 38-minute outage that affected its entire traffic filtering network on October 8, 2026. The company operates nine filtering sites across Russia, each containing multiple nodes connected via high-performance switches to upstream providers. Traffic is isolated using two VRF contexts—external for inbound dirty traffic and internal for cleaned traffic—ensuring sequential processing through the protection system. Each node runs a custom Linux kernel firewall and a watchdog service that monitors BGP sessions to detect failures and remove unhealthy nodes from rotation. Centralized configuration management via CControl allows rapid rollout of rules but also introduces systemic risk when faulty changes propagate across all nodes. The post-mortem emphasizes the need for isolation, staged deployments, and independent recovery mechanisms in large-scale filtering infrastructures.