ADMIN Network & Security的March/April 2023目录

It’s funny how tech companies always do what other tech companies do. If one company puts a Ping-Pong table in the breakroom, they all do. If Company A starts having catered lunches, they all do. If Company B puts TVs in conference rooms, they all do. You’d think tech CXOs would be more creative, but they’re not. From Ping-Pong tables to salad bars to big layoffs to offshoring – they want to do what everyone else is doing. One company brought remote workers back into their offices, and then every tech company brought their workers back into their offices. When one company decides to rehire the people they laid off during The Great Layoff, they’ll all do it, and so will begin The Great Rehire. I look forward to The…

Distributors such as Red Hat and SUSE have been working to turn their large enterprise distributions into container runtime environments to outsource much of the hassle of package maintenance to the vendors of programs. In this and many other places, the motto “Kubernetes first” applies. Infrastructure as Code and continuous integration/​continuous deployment (CI/​CD) pipelines with all kinds of automatisms, including implicit error correction, are attractive factors simply missing in conventional deployment models. For some admins, however, getting used to the world of containers and fleet managers quickly becomes a nightmare. Kubernetes and the container lobby promise that they will make everything far simpler and easier to manage. However, if you are setting up Kubernetes (K8s) for the first time and need a configuration that is not provided in the default…

How often have you been caught out by an application that has suddenly and catastrophically failed, only to discover deep in the logs of some unexciting but critical component a message – such as Unable to connect to https://​database.service.local – expired TLS certificate – and smacked your head in frustration at how such a preventable failure mode brought down your carefully crafted microservices-based architecture? With an expired TLS certificate, your database could no longer prove its identity or play a part in a zero trust network (Figure 1). Certificate expiry is just one example of how the human factors involved in identity management can be high maintenance, prone to error, and the source of vulnerabilities. Yet, cast-iron workload identities are, by definition, the foundation of zero trust application architecture. No two…

Container virtualization is not a new invention; in fact, it wasn’t that even 10 years ago when Docker made it socially acceptable on Linux. Much to the chagrin of many administrators, there is still have a long way to go to achieve everything positive claimed by the container vendors. Many system administrators dealing with containers for the first time give up in frustration: It seems you have to learn a new language to find your way around the dictionary of container terms, and each platform has individual concepts that need to be understood. No matter how you spin it, not much is left of the once loudly trumpeted promise of easy container handling on Linux. That complexity doesn’t have to be the case, claims Portainer, which provides administrators a tool…

Working with containers has become a standard task for administrators, but in addition to plain vanilla container operation, it is also important to take care of security – a task that is sometimes neglected when faced with relatively new container technology. Aqua Security offers the open source Trivy [1] tool, which scans filesystems, Git repositories, and Kubernetes clusters and resources, as well as ensuring container image security. Additionally, the software can find operating system packages and software dependencies (the software bill of materials, SBOM), known security vulnerabilities (CVEs), infrastructure-as-code (IaC) misconfigurations, and sensitive information and passwords. Installation Trivy can be installed on all popular Linux distributions and macOS. Alternatively, you can run Trivy as a container. Detailed installation instructions can be found online [1]. Type the commands in Listing 1…

Passwords typically suffer from one or more of the following problems: They are not complex enough, they are difficult to remember, or they are saved in a far too insecure way. Although admins are supposed to use a separate, strong password for each IT system, many don’t, and they write down their credentials somewhere they can be easily found; the classic worst case is a sticky note on the monitor. Passwords pose a challenge, not only for the user, but also for admins. For example, you can never be sure whether the password used was entered by the legitimate user or by someone else (e.g., a cybercriminal or bot). Microsoft, Google, and Apple are now tackling the problem. Google and Apple unveiled the passkey method at their developer conferences to…

Building a private cloud is time consuming and complex. Some use OpenStack, but many OpenStack projects fail because companies underestimate its complexity. antMan does not rely on OpenStack – or any of the other major open source applications for private clouds – but brews its own potion. The tool claims that you just need to install antMan on one or more systems. The rest of the setup is then easy, and the process is largely automated. Ants Everywhere Before I get started, a brief clarification of the terms used in the context of ant-Man will be useful. For the most part, they are contrived and have something to do with ants. The likelihood of knowing the technical terms used here is pretty low if you have never used antMan before.…

A Warewulf-configured cluster head node with bootable, stateless compute nodes [1] is a first step in building a cluster. Although you can run jobs at this point, some additions need to be made to make it more functional. In this article, I’ll show you how to configure time so that the head node and the compute node are in sync. This step is more important than some people realize. For example, I have seen Message Passing Interface (MPI) applications that have failed because the clocks on two of the nodes were far out of sync. Next, you will want to install a resource manager (job scheduler) that allows you to queue up jobs, so you don’t have to sit at the terminal waiting for jobs to finish. In this example,…

Identifying and fixing security vulnerabilities before an attacker exploits them is one of the most difficult tasks an administrator faces. Virtually any infrastructure component can become a target for crooks. Web applications, with their cornucopia of cross-site scripting (XSS) and other injection attacks, are a problem, as are systems with unpatched software, insecure user accounts, misconfigured firewalls, poorly protected network devices, and so on. At the same time, IT setups are becoming increasingly complex, comprising increasing numbers of components. What’s more, sometimes you do not know exactly what components you are dealing with locally. The best way to prevent attacks is to identify and eliminate security risks before an attack happens. Of course, you cannot hope to do this manually if you have thousands or more virtual instances running the…

In the open source community, people say that Red Hat has a lucky hand when it comes to acquiring other organizations. Many of the acquisitions have since gone on to enjoy an extremely successful existence, including Ceph and Qumranet, the company that launched KVM. Another example of Red Hat’s prowess in their shopping sprees is undoubtedly Ansible, which to this day is considered a lean and easy-to-use but still highly efficient automation tool. If you don’t like Puppet, Salt, or even Chef, with their complicated syntaxes, you can enjoy true automation with Ansible – and in a format that almost rivals the simplicity of shell scripts. Some people might need a while to get used to the YAML format, but once the few essential basics are in place, Ansible offers…

Containers have become the most convenient method of deploying complex applications. This convenience is shared both by developers, who can comfortably work in the same environment as the final deployment, and by the staff responsible for installing, updating, monitoring, and troubleshooting the application, whether they are traditional sys admins or DevOps. Although several container solutions are present on the market, with varying levels of features, maturity, and flexibility, Docker is by far the most popular. In this article, I offer a couple of useful tips to make your work with Docker images and containers more efficient. Be Careful with the “latest” Tag Despite its name, latest doesn’t mean the image tagged as such is actually its most recent version – it’s just the default value assigned to images that don’t have…

An omnipresent characteristic of current single-board computers (SBCs) is the use of SD cards to provide mass storage functionality, either for system boot or data storage purposes. Unfortunately, SD cards are not particularly reliable devices, and their intended purpose is storing pictures as they are captured by a digital camera – perhaps the most sequential storage access task that could possibly be imagined. Booting an operating system (OS) exhibits a much more randomized access pattern, as I have previously discussed in the case of marginally better USB storage “sticks” [1], presenting the device with challenges to the processing of allocations and deletions at sustained rates. That article examined the performance difference between USB storage with high-end brand names and more generic devices and compared the resulting write performance. Today, I am…

Networks can be virtualized, just like servers, storage, or entire data centers. The technology is based on developments at Stanford University, and today, the Open Networking Foundation is continuing the work with new projects. Proprietary implementations are also available from major vendors. The principle is always the same: The physical hardware and software are separated, and functions previously cast in hardware are implemented in the software. The rewards of software-defined networking (SDN) are greater flexibility and a loosening of vendor tie-in. Providers and enterprises need to design and leverage technologies (e.g., remote, mobile, cloud and Internet of Things (IoT), edge computing, virtual reality, containers, microservices, and service meshes) for flexibility. The idea is to provide connections or change quality of service (QoS) in minutes, rather than months. Users want additional…

The list of successful attacks through web servers is long: first, because attackers can access operating system resources through vulnerabilities that should never be accessible to the outside world; second, because faulty settings or errors are made by admins when setting up their web servers (e.g., configuring aliases and allowing directory listings) or securing certain areas and functions; and third, especially in dynamic web applications, because scripting language interpreters or application servers are allowed to run in the background, which itself causes security problems or lets insecure scripts or programs execute. If you are responsible for the security of your corporate infrastructure, you probably have an overview of the web servers that are accessible from the Internet. Ideally, you will operate these servers in dedicated areas of your demilitarized zone…

In professional IT infrastructures, Docker-based container solutions are becoming increasingly popular compared with traditional virtualization setups. The advantages that Docker containers offer are obvious: By sharing the host system’s kernel (instead of each instance requiring a complete operating system), containers are compact and easier to configure compared with typical virtual machines. Moreover, container solutions offer significantly better scaling than virtual machines. They are easy to set up thanks to the encapsulated images; multiple Docker applications can run simultaneously on a single operating system instance. Encapsulating the individual containers also makes it possible to allocate host system resources to them individually. However, as container systems become more complex, they also become more difficult to manage. Graphical interfaces for Docker containers promise to simplify the handling of these systems, offering the benefits…

Many different tools on the market help enterprise security teams monitor security-related log and network data, with a view to detecting and analyzing acute threats and attacks on their infrastructures. Back in 2008, the open source Security Onion [1] project was launched with the aim of bundling open and free software to analyze threats, establish security monitoring in the sense of an intrusion detection system (IDS), and support central log management on the corporate network. The idea behind Security Onion was to provide a Linux-based operating system that would include a full set of useful tools and give users a suitable environment for their daily work. Security Onion was initially based on Ubuntu. In version 2, though, the installation of the individual tools was shifted to containers so that…

For some initial, crucial findings in Windows during incident and event management, you do not need to look further than the existing Event Viewer logs. After the introduction of Windows Server 2008 and Vista, Microsoft established a more granular approach. The events are sorted into categories along with subcategories for improved monitoring and recording. Typing at the command line lists a quick overview of the possibilities and shows the current configuration (Figure 1). You will usually control the Advanced Audit Policy Configuration settings with a group policy; you can also set it up at the command line. If you want the configuration to be used, it needs to be enabled. On newly installed systems, the correct value is set by default and does not need to be defined explicitly. However,…

When a user is validated by the Kerberos authentication protocol through a key distribution center (KDC), the user is given a ticket granting ticket (TGT) at the end of the process that then enables transparent login to more Kerberos services. Before this can happen, however, the user must initially prove their identity to the KDC. This process is also known as pre-authentication and provides protection against attackers who send an arbitrary request to the server and then go on to use a dictionary or brute-force attack to try to guess the user password. This attack would be possible without pre-authentication because, in such a case, the KDC would simply send data to the client encoded with a key derived from the user password. Attackers would then have plenty of time…