ADMIN Network & SecuritySeptember/October 2020的目錄

System administrators are a creative lot, but that creativity is often overlooked. I personally love being creative and coming up with new solutions and new ways to do things. I’m especially happy when I can solve an expensive problem for free by using native tools and utilities, and I know other sys admins are just like me. It’s funny how the brain of many organizations is in their feet rather than in their heads. I think this is the reason we go unnoticed and often unrewarded for the innovations we bring to the corporate table. System administrators are too often thought of as necessary evils – overhead, introverted basement dwellers, and dungeon masters. The fact is, we’re creative people who deserve a lot more than the occasional eye roll from…

If you think of Wikipedia first when considering a freely expandable, hierarchical knowledge database, you are not totally wrong, but you have overlooked one classic example: The Simple Network Management Protocol (SNMP). This time-honored protocol can also conjure up a very wide range of very different information through a formalized protocol and Management Information Base (MIBs) modules. MIBs are readily available from device and software manufacturers, but application developers looking to expose the internal metrics of their software can create them, as well. They can be equally useful for sys admins who want to monitor complex infrastructure setups such as DNSSEC. At first glance, implementing your own MIB might seem complex, but with the right tools, it’s not that difficult. This article shows how to create a MIB for monitoring…

Regular backups are a routine task for every system administrator. However, complicated software tools with countless options, slow backup sessions, and unwieldy procedures for restoring data can lead both professionals and home users alike to skip making backups or only make them sporadically. Especially in heterogeneous environments, setting up cross-platform backup software often involves some major overhead. For smaller environments, Rescuezilla [1] lets you create a backup with just a few mouse clicks and without having to edit configuration files. Live System Rescuezilla, maintained by an Australian developer and based on Ubuntu 20.04 LTS, is designed as a Live system and comes with a graphical user interface. Because it runs in Live mode, it does not change any data on the data carriers connected to the computer. You can pick…

In the past, network duties in the data center were strictly separated: admins took care of the Linux systems, storage admins of the network storage, and network admins of the routers and switches. For individual customers, specific configurations were built on the data center’s own hardware; everything was set up once, and the job was done. Recently, however, responsibilities have shifted considerably – largely because of the cloud, which has made IT services far more dynamic. Customers no longer want to wait weeks or months for a custom infrastructure to be set up; they want storage and compute immediately. As a result, IT providers have become platform operators. Instead of customerspecific setups, a generic platform of compute and storage resources greets customers, who then consume bit by bit according to…

Listing 1: K3s Running Successfully After the explosive adoption of containers, resulting in Kubernetes stoically taking the orchestrator reins, a number of useful tools were created in order to assist the orchestrator run containers efficiently. Every possible advantage is welcome when you’re trying to keep a critical service online, and StatusBay is “an open source tool that provides the missing visibility into the K8s deployment process” [1]. In this article I look at the clever Status- Bay, which is available on GitHub courtesy of an international company called SimilarWeb [2]. According to a posting on Reddit, StatusBay was recently released as open source, having been a tool “that was used internally for a long time now” [3]. To demonstrate Status- Bay in action, the tech stack will include a miniscule…

Cockpit [1] offers a graphical user interface for managing servers that takes care of network configuration, displays the server load, starts and stops system services, manages users, and more. All of these tasks can be handled conveniently in a web browser. Cockpit’s feature scope is ideally suited to managing individual servers or server farms in corporate environments. Unlike comparable products such as Webmin [2], which accesses the basic system through Perl scripts, Cockpit works exclusively and directly with systemd, as can be seen in the software versioning: The current version is 217. A glance at the blog [3] reveals that new versions of Cockpit are released approximately every two weeks. In an article from 2015 [4], ADMIN looked into the topic of managing Linux servers with Cockpit; since then, much…

Ceph has become the de facto standard for software-defined storage (SDS). Companies building large, scalable environments today are increasingly unlikely to go with classic network-attached storage (NAS) or storage area network (SAN) appliances; rather, distributed object storage, now part of Red Hat, is preferred. Unlike classic storage solutions, Ceph is designed for scalability and longevity. Because Ceph is easy to use with off-the-shelf hardware, enterprises do not have to worry about only being able to source spare parts directly from the manufacturer. When a hardware warranty is coming to an end, for example, you don’t have to replace a Ceph store completely with a new solution. Instead, you remove the affected servers from the system and add new ones without disrupting ongoing operations. The other side of the coin is…

Some websites overdo advertisements, piling on pop-ups, video snippets, and product placements in your browser. If the editorial content only appears as an afterthought, it’s time to filter out the ads. An ad filter can be applied to each individual device or make the ad invisible for all clients on a network at a central location. In this article, I compare ad blockers that run on the router or on a device on the network, in which case, the terminal devices do not require any additional software. Requirements The ideal setup would have an ad blocker running on low-cost hardware or directly on the existing router, and I would like to be able to make changes to the blacklists if the software filters out too much (or too little). The…

Installation by npm Installing Dockly with the npm JavaScript package manager [4] is clear and straightforward. If npm is not available on your local machine, you can install it with the command (for my Linux Mint 19 laptop running Ubuntu 18.04 under the bonnet): $ apt install npm Now you can install and run Dockly with the commands $ npm install g dockly $ dockly Incidentally, according to the docs, Dockly requires Node.js v7.6 and upward, so if you have trouble running the tool, try upgrading npm, installing from source, if required. Sometimes a relatively small but crucial piece of information is enveloped in screeds of command-line output. Thankfully, you can sort the wheat from the chaff with complementary command-line tools, ideally those with some form of graphical display. Developer…

The microservices architecture that has become so popular lately offers a number of benefits, including agile development. If the individual parts of an application no longer have to be squeezed into the release cycle of a large monolithic product, development becomes far more dynamic. However, if you suddenly have to deal with – from the developers’ point of view – many small components, you have to define interfaces that talk to each other. All of a sudden topics such as load balancing, fault tolerance, and security start to play a significant role. Service mesh solutions such as Istio, which I reviewed in an earlier article [1], are currently enjoying great popularity, promising admins an automated approach to networking. As a closer look at the Istio architecture (Figure 1) reveals, the…

S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) is a monitoring system for storage devices that provides information about the status of a device and allows for the running of self-tests. Administrators can use it to check on the status of their storage devices and periodically run self-tests to determine the state of the device. IBM was the first company to add some monitoring and information capability to their drives in 1992. Other vendors followed suit, and Compaq led an effort to standardize the approach to monitoring drive health and reporting it. This push for standardization led to S.M.A.R.T. [1] (Although S.M.A.R.T. is the correct abbreviation, it’s not nearly as easy to type, so I will be using SMART throughout the remainder of the article.) Over time, SMART capability has been added…

Usually I focus on the latest hardware available, but this month I break with tradition to show how 10-year-old hardware can be brought back into service easily and effectively – not to mention in a really cost-effective way. Return to ThinkPad Island Upgrading a desktop-class system would be in no way remarkable, because the venerable ATX family of standards [1] enables replacing a system’s board entirely, if needed, retrofitting a wholly new system in place when an upgrade warrants it. Upgrading a laptop sets a higher bar and has become essentially impossible in the current era of ultrabook-class manicely chines with soldered-in components. However, this feat can be achieved with 10-year-old hardware, with surprisingly practical results. Choosing the right equipment is critical, because only some laptops are upgradable, and even…

Nextcloud Hub Now Supports End-to-End Encryption Get the latest IT and HPC news in your inbox Subscribe free to ADMIN Update and HPC Update bit.ly/HPC-ADMIN-Update The pandemic has caused many admins and users to migrate from public to on-premise, private clouds. And with Nextcloud being one of the most capable and popular solutions, the developers have made it such that it includes support for all the features you need. One new feature is the production-ready support of end-to-end encryption. This new addition should be considered a must-have for extremely sensitive information (such as social security numbers, medical information, etc.). What the developers have done is create an encryption solution that works with the server never having access to the unencrypted files or keys. Users pick a folder and encrypt that…

Groupware can streamline workflow in a company, but the functionality of different solutions varies greatly. For groupware to facilitate teamwork, it needs to anticipate the diversity of work processes and the historic structures in organizations of different sizes. As a flexible solution, it not only needs to modernize outdated processes, but boost efficiency and productivity, as well. In this article, I discuss the possibilities some groupware packages that are off the beaten track (see the “Not Considered” box) open up in a comparison of EGroupware, Group Office, and Kopano. Not Considered Because of the many groupware packages available, I specifically considered solutions whose functional range stands out from the crowd. The choices appear to be particularly suitable for certain target groups, thanks to a special focus such as security or…

Admins understand that simply operating containers is not enough. Instead, purpose-designed container orchestration is also necessary, which is where the popular Docker was seen to be lacking. Google’s Kubernetes jumped into the breach and developed a busy life of its own far removed from Docker. For decades, VMware was the industry leader in virtualization, offering a virtualization environment from a single source. VMware vSphere, the server virtualization platform, easily docks with other VMware products and has even jumped on the Open- Stack bandwagon with a kind of translation component between the official OpenStack APIs and vSphere in the form of VIO – VMware Integrated OpenStack. It was strange for VMware to have seemingly been asleep through most of the Kubernetes hype. Ultimately, Kubernetes with its containers in the background –…

Listing 1: A Happy K3s The other day I faced a scenario, wherein I wanted to output logs to Elastic Stack (previously called ELK Stack) for visualization through dashboards. Elastic Stack comprises three software components: Elasticsearch, Logstash, and Kibana. When combined, they offer advanced logging, alerting, and searching [1]. The logging was needed so I could dig deeper into what was happening with an application running on a Kubernetes cluster over a prolonged period of time. I turned to Elastic Stack because it became uber-popular as ELK Stack for good reason. It’s widely adopted, helps speed up the process of analyzing massive amounts of data that’s churned out by machines, and is sometimes used in enterprises as an alternative to one of the commercial market leaders, Splunk [2]. To make…

Databases are complex beasts that, if not tamed, can bring your application to its knees. Throwing more hardware at the problem might give you some momentary respite, but this solution to satiate an illmannered database’s unending appetite for resources will only end up breaking the bank. In fact, what is required is to chip away the inconsistencies and optimize the database for maximum performance. This process isn’t a one-time task and is easier said than done. Like security, performance optimization is an on-going process that begins as you roll out and provision the database during development and continues into the production environment. Percona Monitoring and Management (PMM) [1] is an AGPL-licensed open source platform that, as its name suggests, will help you monitor and tweak your databases. PMM supports several…