ADMIN Network & Security的September/October 2023目录

Virtual local area network (VLAN) tagging on an IEEE 802.3 network is defined by the 802.1Q standard, which makes it possible to separate traffic from different logical networks within a physical network. Special VLAN tags are attached to each Ethernet frame to assign unique VLAN IDs, allowing a switch to determine the VLAN to which a frame belongs and forward it accordingly. Therefore, traffic from different devices or user groups is separated and isolated without the need for physically isolated networks. Virtual extensible LAN (VXLAN) is a tunneling technology used to create and connect VLANs across a physical network and extend the maximum number of supported 802.1Q VLANs from 4,094 to up to 16 million. Generic Network Virtualization Encapsulation (GENEVE) is a newer tunneling protocol developed by the Internet Engineering…

Docker makes it easy for developers to deploy applications and ensure that the local development environment is reasonably close to the staging and production environments. Remember the times you found a great app only to discover the installation instructions extended over several pages and involved configuring the database, populating tables, installing many packages and corresponding libraries – and then because of a tiny glitch in the docs, things didn’t work as expected? Thanks to Docker, these days are mostly over. You can develop your app and test it locally and then deploy it to the testing and production environments with few or no changes. But Docker itself is not enough. Modern apps rarely consist of just one container. If you have more than one container, you need a way to…

Typically, developers invest consider able time and effort to secure their Internet property with methods such as access control lists and rotating IP addresses or with complex solutions like Generic Routing Encapsulation (GRE) protocol tunnels and virtual private networks (VPNs). In 2018 Cloudflare introduced the Argo Tunnel as a solution to alleviate this problem. Individuals can create a secure and private connection between their source server and Cloudflare, even without a publicly accessible IP address and port. Cloudflare Tunnel [1] allows you to access your servers and applications securely from anywhere in the world. It creates an encrypted tunnel between your secured server and Cloudflare’s network, allowing you to bypass firewalls, geolocation constraints, and all other network restrictions (Figure 1). You can access your server from anywhere without worrying about security…

Cloud rollouts with Ansible, in which administrators create virtual machines (VMs) in clouds and set up their applications there, have changed as companies have increasingly started using containerized applications instead of VMs. Containers can greatly simplify managing, maintaining, and updating applications and infrastructures. However, the prerequisite remains that the application in question is suitable for containerized use. The platform of choice is, of course, Kubernetes, and in the concluding part of this article I introduce you to managing Kubernetes applications with Ansible. However, sometimes Kubernetes is too large and complicated. In branch installations, remote offices, and at the network edge, Kubernetes might not be needed, and a simple container setup with Podman will suffice. Kubernetes-style functionality for small installations can be implemented quite easily with the “LANP” stack. LANP Instead…

Every business is an IT business at the back end comprising physical and virtual servers. The backbone of modern IT systems is a cloud-based infrastructure made up primarily of GNU/​Linux servers. In the cloud-native world of modern IT, servers should be intelligent and designed to auto-heal proactively in case of internal problems. Unfortunately, many businesses still operate in old world reactive mode when it comes to server operations. Sooner or later enough server issues pile up to create frequent outages and resulting revenue losses. Listing 1: Dockerfile_UbuntuJammyJellyfish A solution to this problem is Monit [1], a lightweight, free, open source solution that monitors *ix systems and performs automatic maintenance and repair. I use Footloose container machines to test everything covered in this article. A commonly available Docker engine is the…

A successful post-quantum cryptography migration will take time to plan and conduct, states the quantum-readiness fact sheet jointly issued by CISA, NSA, and NIST. The Quantum-Readiness: Migration to Post-Quantum Cryptography (PQC) (https://www.cisa.gov/sites/default/files/2023-08/Quantum%20Readiness_Final_CLEAR_508c%20%283%29.pdf) fact sheet includes recommendations for creating a quantum-readiness roadmap, preparing a useful cryptographic inventory, as well as understanding and assessing your supply chain. The US agencies are urging organizations “to begin preparing now by creating quantum-readiness roadmaps, conducting inventories, applying risk assessments, and engaging vendors.” “Early planning is necessary as cyber threat actors could be targeting data today that would still require protection in the future (or in other words, has a long secrecy lifetime), using a catch now, break later or harvest now, decrypt later operation,” the fact sheet says. In other quantum computing news, Google recently…

One benefit of using Azure Management Services is that servers managed with Azure Arc are displayed as objects on the Azure portal. These servers can therefore be inventoried, updated, and monitored by a consolidated approach along with the servers that reside in Azure. Azure Arc also offers other features that help you manage databases and Kubernetes clusters, but in this article we focus on managing what Microsoft refers to as Azure Arc-enabled servers. Fortunately, Microsoft offers the features of the Azure Arc control plane free of charge. The feature set includes tag-based server management, Azure management groups, the ability to find and index servers with Azure Resource Graph, access rights management with the help of Azure role-based access control (RBAC), template- and extension-based automation, and update orchestration. However, Azure Arc…

Fluentd is an open source data collector designed to simplify the process of log management. It serves as a unified logging layer that sits between your applications and various log outputs. Its primary function is to ingest logs from different sources, transform them as needed, and then send them to the appropriate destinations. One of the key strengths of Fluentd is its flexibility. It can collect logs from a wide variety of sources, including logfiles, system logs, and network protocols. It can also output these logs to a similarly wide variety of destinations, including databases, cloud storage, and other log analysis tools. In a typical system, logs might be produced in different formats and sent to different locations, which can make it difficult to aggregate and analyze the logs in a…

Many parts of the world have just survived the hottest summer on record – not unscathed, in many cases. It’s generally accepted that human consumption of fossil fuels is to blame for the drastic and seemingly accelerating effects of climate change. Typical estimates suggest that data centers are responsible for 1.4 percent of global electricity consumption, which, although only a small fraction, still represents hundreds of terawatt hours and, potentially, 90 million tons of CO2 released into the atmosphere [1]. Although data center efficiency and sustainability have advanced in leaps and bounds over the past 10 years, with the advent of hyperscale data centers – meaning that compute capacity has vastly increased while power consumption has remained relatively constant – that’s still 90 million tons of CO2 that the planet would…

Administrators monitor key network connections to detect issues (e.g., congestion) at an early stage. The Simple Network Management Protocol (SNMP) is often used for this purpose to query the metrics of the network interfaces. The measured values can be visualized as time series diagrams, and the user can define threshold values that trigger notifications if exceeded. What happens, though, when the admin is notified? A quick look at the time series chart reveals that the network connection is busy, but this doesn’t tell you which conversations and which applications are using the connection. Information from flows can fill this gap. Today, many network devices let you export this kind of information, but the opportunity often remains unused. In this article, we look into the use of OpenNMS Horizon and monitoring…

As I do at least twice every year, I changed my plans for this column at the very last minute. This time, some interesting hardware came into the lab rightfully deserving of analysis – a new single-board-computer (SBC) that is part of the first production run of the BeagleV-Ahead [1], the latest addition to the BeagleBone family [2] (Figure 1). This new entry is built around a CPU based on the upand-coming RISC-V architecture [3] (Figure 2). RISC-V is a relatively recent open source CPU instruction set available royalty-free and has successfully drawn interest from more than a dozen chip suppliers so far. It cannot yet compete with x86 chips from Intel and AMD, or even the best many-core ARM offerings, but it shows great promise and is therefore worth…

We dwell in an era of glitzy tools and technologies where technological advancements and innovations abound – one in which technology is transforming the underpinnings of human existence. However, along with the benefits of these tools and technologies, you’ll experience certain downsides, as well. With the surge in frequency and complexity of cyberattacks, securing your software development pipelines is more critical now than ever. To ensure the security and integrity of your applications, you should be adept at thwarting security threats and vulner abilities often and from the outset. DevSecOps integrates security practices into the DevOps workflow to create a seamless and secure pipeline from start to finish. In this article, you’ll learn how to secure combined practices of continuous integration and continuous delivery (CI/​CD) pipelines by integrating DevSecOps into the…

Ceph and its core component RA-DOS are considered a prime example of an open source object store implementation that has earned a reputation as a reliable piece of software that need not fear competition with proprietary and commercial offerings. Some observers tend to forget the quite extensive history of the environment. In the eyes of many, Ceph is still quite young, even though it has been around for more than 15 years and has been marketed commercially for more than 10 years. The software is by no means a newcomer; quite the opposite, it is well established. Ceph has not been quiet. To this day, developers continue to surprise users with an explosion of features in a relatively short time, which is reason enough to take a closer look at…

Zing is a zero-packet network utility similar to Ping that I first introduced in December 2022 [1]. Zing has the distinct advantage that hosts without Ping capability can be zinged without sending network packets. Thus, zinging a remote host with multiple zing requests is not a “Ping flood” [2] attack, making Zing a network-safe utility that does not add network traffic. Zing is implemented in a variety of programming languages, is open source, and is available for download [3]. Yet the idea occurred to me to implement zing as a Bash shell script, which has the advantage of avoiding recompilation and of customization or tailoring for specific idiosyncrasies of a system platform or application. Netcat The netcat utility (nc) is a key command-line application and “Swiss army knife” of network…

As an administrator, you will be familiar with the need for automation and have probably already automated updates and backups, creating new users, distributing software, and scaling your infrastructure. Shuffle [1] gives you an automation platform ideal for linking the REST APIs of popular security tools for automation with a view to security orchestration, automation, and response (SOAR). Shuffle fetches the input from your monitoring tools (e.g., an intrusion detection system) and passes this input on to any number of other tools for further action, such as to your network management tool to isolate an affected host. Ultimately, the faster your response, the more difficult you make it for attackers to navigate your infrastructure successfully. Installing Shuffle Even during installation, you can benefit from the advantages of automation because the Shuffle…

MikroTik is a Latvian manufacturer of network equipment whose main audience comprises small Internet service providers (ISPs) and wireless connectivity providers. What makes MikroTik’s offerings interesting for home users and administrators of small business networks is that their low-end products offer a lot of features for the money. Deploying a small router from MikroTik feels like deploying consumer-grade hardware loaded with enterprise-grade firmware (Figure 1). Unplanned IT I was forced to learn network administration when my university migrated to a digital distribution platform for resources and documentation necessary to follow classes online. The University’s plan was built on the premise that every student had a serviceable Internet connection at home; yet, I was stuck with a pitiful one. My ISP provided 3Mbps of symmetric bandwidth in an age in which…