On 26 Sep 2013, at 01:16, Steve Davidson <jeep at scshome.net> wrote: Make a standalone system with either its own VLAN or an IP subnet that has no route to anywhere. If you choose the second path then, stop the IP stack and start DECnet when you have to do maintenance, then revert to normal operations when maintenance is done. Not that difficult... Sure it's not hard, both my switch and router support multiple VLANs. But I frankly cannot be arsed to do it :) So I let people request accounts, but don't grant them automatically, only after manual vetting. It's a bit more work but I'm happy with. sampsa