ADMIN Network & Security的November/December 2020目录

Does the thought of typing commands into a terminal window or a CMD Command Prompt window transport you back to the days of clacking typewriters, dings, and whir-clunks of returning carriages? If it does, I think that’s OK. There’s no reason to make more of the lowly command line than there really is to it – no need to wax poetic about something as mundane as a flashing cursor and an empty black box on your screen. I, myself, used to scoff at the old school command-line nerds who shunned graphical interfaces and embraced their anachronistic black-and-white terminals that looked like something out of the technology dark ages. I still scoff at them, because that’s who I am. But, I’ve also secretly become one with the terminal universe. I type…

Small and large web applications are becoming increasingly common in the enterprise. Many administrators program small tools to optimize existing system management, and Microsoft’s .NET Core now makes this possible across operating system boundaries. In this article, I look at the part of the .NET Core functionality that enables the development and operation of dynamic web applications – ASP.NET Core – and its use on Linux, with a focus on the peculiarities of providing ASP.Net Core applications and not on their application logic or graphical design. .NET Core Genesis At the beginning of the century, Microsoft heralded a new era in their software development history with the announcement of the .NET Framework. A promise was made that the framework would not be exclusively reserved for the Windows platform. After all,…

As anyone who has spent a couple of years as a Linux admin will note: IT has changed more in the past decade than ever before. The cloud has been shaking up the industry since 2010, and containers have increasingly been the focus of interest since 2015, at the latest. Container automation is being taken one step further in the form of micro operating systems (OSs), which have nothing to do with microkernels; rather, they refer to the software set that comes with the product. Today, the first premise of container automation is to reduce to the max the software needed on systems. The intent is to avoid maintenance overhead, because where nothing is installed, nothing needs updating and maintaining. In this article, I explain the basic principle of the…

Certificate Transparency further secures the TLS ecosystem on the Internet by identifying unauthorized certificates. This transparency, however, offers attackers an opportunity to search for services (e.g., video conferencing systems) that are unprotected on the network. Administrators need to be aware that, thanks to Certificate Transparency, supposedly confidential domains or subdomains are published as soon as a certificate is issued for them. The preventive measures that were implemented this year to protect people against COVID-19 have unexpectedly turned IT landscapes in many countries upside down. All of a sudden, home offices that had previously not been allowed in corporations were now necessary. In view of the lack of alternatives, many managers and IT departments had to establish new processes quickly and expand existing infrastructures. In the heat of the moment, many…

IT compliance is indispensable in both small and large businesses and should be monitored wherever possible. The Chef InSpec open source framework helps admins apply rules on servers in a fully automated process by checking system status against a list of policies and alerting the admin if a system violates them. In this article, I look at setting up and using the software in a practical application. Chef InSpec comes from a company that feels very much at home in the areas of automation and compliance: Chef, the provider behind the automation platform of the same name. The software is based on its own declarative script language (DSL), a kind of pseudo-programming language. In this language, the administrator describes the rules in a fixed syntax, which InSpec checks later. InSpec…

Container runtimes continue to evolve at a fast rate, and Red Hat has shifted their focus in the direction of their own Podman container runtime in favor of Docker. Red Hat’s open source contributions to Kubernetes also means that CRI-O has been adopted by their OpenShift enterprise platform as the runtime, and Red Hat Enterprise Linux will offer Podman for user interaction with containers in the future. Although Docker still continues to be used as the universal container runtime, the popular Kubernetes container orchestrator moved over to CRI-O as a lightweight default runtime alternative a number of versions ago. CRI-O (Container Runtime Interface) began life at Red Hat in 2016 and was passed on to Kubernetes in 2019. Red Hat described the runtime when it was launched as benefiting from…

Most administrators are familiar with the Exchange Web Services from the virtual directories and as a means for Outlook to publish out-of-office messages. But the services can do much more and provide useful functions such as sorting out attachments. In this article, we look at EWS mailbox access via PowerShell and possibilities for in-house development. Exchange Web Services (EWS) is an important interface that lets applications access Exchange content. Outlook uses the services to call the availability service and the Out of Office Wizard, among other things. Exchange has been using EWS since version 2007, which is the basic prerequisite for using the corresponding API. In addition, you need the Exchange Web Services Managed API 2.2 [1]. If you only use Exchange locally, the EWS API is available as described…

Almost everyone has a Google account, so synchronizing calendars (such as your Thunderbird calendar) between your computer and an Android device with Google seems like an obvious solution. If you enter a date on your Thunderbird calendar, it automatically appears on your smartphone calendar. However, this choice comes with drawbacks: Google makes its money by collecting and evaluating your data, among other things. Luckily, an alternative based on open source software gives you another option. This alternative option involves Nextcloud [1] on the server, Thunderbird and its Lightning Calendar extension on the desktop [2], and DAVx5 [3] and Etar [4] on the Android device. I did not test the Nextcloud alternative ownCloud [5], but calendar sharing may also work with ownCloud due to its similarity to Nextcloud. In Figure 1,…

VMware has provided classic onpremises datacenter solutions with solid performance and support through ESXi, vSphere, and vCenter. With the rise of public clouds, to keep up with the times, VMware added products such as VMware NSX, an Open vSwitch extension, and the OpenStack compatibility layer. About a decade ago, VMware also added a whole suite of tools under the vRealize label that enables the operation of hybrid workloads in public clouds and private virtualization environments. Since its debut, vRealize Suite [1] has matured, and version 8.1 was released in 2019. In this article, I discuss the components of vRealize and question their usefulness for you in everyday life. VMware Before the Cloud VMware has been making a name for itself in IT for decades as a provider of comprehensive virtualization…

During testing, a local Docker registry for your container images can be useful. Images stored locally within a mini-registry give you more control over them, with improvements in speed when pulling the images. Also, you might be working with an application that needs access to a registry for one reason or another, but you do not want to give the application your Docker Hub credentials. In this article, I look at installing a private Docker registry on a local machine (Ubuntu LTS 18.04 with Linux Mint on top) for testing purposes. On Your Marks The documentation from Docker on private registries is really detailed, but every now and again a local setup has unusual issues. To begin, you need to make sure that the latest version of Docker Community Edition…

In many corporations and institutions, groupware solutions based on Linux serve as productivity tools to free users from Microsoft vendor tie-in for email, calendars, and other functions, as well as save licensing costs on a large scale. Although proprietary solutions such as Microsoft Teams, Slack, Skype for Business, Webex, and Zoom have claimed major slices of the market for themselves, the open source camp is still lagging behind in the groupware sector. Despite a long tradition, with former giants Scalix, Zimbra, and Horde, only a few open source solutions still survive at the enterprise level, even as real-time collaboration becomes more important with a rise in the number of home offices. German-Dutch software manufacturer Kopano [1] is now looking to fill this gap with its open source software of the…

At work, I was tasked to come up with a solution to a problem presented by a web developer who needed some 1,200 static HTML files stripped of the HTML markup, leaving behind only text. Because 1,200 files introduce too much complexity and are generally cumbersome to keep on a web server, a databasedriven approach was necessary. Only a few Perl scripts would be needed to serve the pages. Although 1,200 files is perhaps an attractive approach to a low-tech solution, its simple bulk is unruly. Also, editing the text as database entries would be much simpler, employing only a few more fairly simple-to-implement Perl scripts. In the solution described in this article, a Perl script strips the HTML markup with a simple regular expression and creates the text files…

Red Hat Enterprise Linux 8.3 Available If the cloud (especially of the hybrid nature) is a big part of your business strategy, the latest version of Red Hat Enterprise Linux should probably be on your radar. The latest iteration of one of the most popular server platforms in enterprise computing enjoys a few new features that should make your cloud-centric job much easier. New features include new system roles for identity management configuration, certificate management, Network-Bound Disk Encryption (NBDE), kernel settings, log settings, SAP HANA, SAP NetWeaver, and management. There have also been a number of updates to Tuned, which is a collection of preconfigured performance profiles which enable you (with the help of Red Hat’s extensive knowledge) maximize performance across all types of hardware architecture. As for your cloud-native…

Most messengers require central servers in the background, which means registering with your email address or phone number. This is not the case for the open source Jami. Much like BitTorrent, the Jami messenger uses a distributed hash table to set up its own network, which lets it get by without central registration [1]. You only need to register if you want a unique username that can be found with Jami’s search function – but this does not require providing any personal information. Jami is available for Linux, macOS, and Windows; smartphones with Android [2] and iOS [3]; and TVs with Android TV. The “Free as in Freedom” Jami release offers cross-platform videoconferencing (previously only available in the Linux version), audio and video messaging in the style of WhatsApp, and…

Groupware solutions enable collaborative teamwork. However, conventional documents such as texts, tables, or presentations are often still created conventionally at individual workstations. Office suites for collaborative work on documents have long outgrown their infancy. This article examines the possibilities offered by the individual office packages. Workflow Office solutions for collaborative work support very flexible use. On the one hand, they extend groupware packages like EGroupware, Zimbra, or Kopano. On the other hand, they also integrate into self-hosted cloud solutions such as Nextcloud or ownCloud. Some network-attached storage (NAS) systems also come with suitable apps in their software stores. You don’t necessarily need dedicated servers for collaborative editing. Sometimes the office packages run both in the cloud and on the local workstation and simply synchronize the data. In all cases, collaboration…

Cloud environments are complex, costly installations with countless individual components. Because they should scale seamlessly across the board, their planning is already far more complex than that of conventional setups. Various basic design parameters are set by the platform’s administrator before even a single machine is installed in the rack. If you are planning a large, scalable platform, you need to do it in a way that leaves as many options open for later as possible. These tasks involve varying complexity at the various levels of a setup. Compute nodes, for example, easily need to be more powerful than current generation systems in a few years’ time. If necessary, existing systems are replaced by new ones as soon as the older ones are no longer maintainable. Critical infrastructure is more…

Python, I think it’s safe to say, is the most prevalent language for machine learning and deep learning and has become a popular language for technical computation, as well. Part of the reason for its increasing popularity is the availability of common highperformance computing (HPC) tools and libraries. One of these libraries is mpi4py. If you are familiar with the prevalent naming schemes in Python, you can likely figure out that this is a Message Passing Interface (MPI) library for Python. MPI is the key library and protocol for writing parallel applications that expand beyond a single system. At first, it was primarily a tool for HPC in the early 1990s, with version 1.0 released in June 1994. In the early days of MPI, it was used almost exclusively with…