ADMIN Network & SecurityMay/June 2021的目錄

Security is everyone’s problem but, as a sys admin, you will take the blame should something go wrong with security on your systems or any device within your jurisdiction. My purpose in telling you this isn’t to bum you out about your job but to inform you to be proactive in your security measures, follow industry best practices, follow your company’s security policy guidelines (if you have any), and, most importantly, document your work. Be sure that someone knows that you did configure those host-based firewalls; you did use enforcing mode in SELinux; you did enforce complex passwords or, better still, set up two-factor authentication and Active Directory integration; you did secure the SSH daemon; and you did limit connectivity to a few systems. Make better system security your number…

The Ansible IT automation tool makes it easy to introduce automation into your environment. In this article, I introduce Ansible and its basic capabilities and how to use them, and I discuss which components in the Ansible camp make an admin’s life easier. Toward that end, I venture a look at Ansible’s future under the current owner Red Hat. Early Steps In 2014, the world of automation on Linux was very different from today. I had just started a job in Berlin that involved building an OpenStack platform. Puppet fans set the tone in the company, so the idea was for the OpenStack cloud to be something for the Puppet players, too. However, OpenStack was far removed from its current level of maturity at the time, and the modules offered…

Puppet is the Methuselah among solutions for configuration management, matured for a proud 15 years and currently at version 7. In contrast to Ansible, Puppet takes a declarative approach (i.e., it describes the state of a resource and not how to achieve it). Listing 1 declares the kermit account, which must exist and must belong to the muppets primary group. A gonzo user must not exist at the same time. Puppet must therefore be able to determine the current state and independently change it to the declared, desired state. Listing 1: Resource Declarations Resource Abstraction Layer A major role in how Puppet accomplishes this task is played by the resource abstraction layer (RAL). This core element in Puppet is also responsible for platform independence. To do this, RAL distinguishes between…

The Hypertext Transfer Protocol (HTTP) no longer just serves as the basis for calling up web pages, it is also the basis for a wide range of applications. The best known version, which is still used on most servers, is HTTP/1.1 – even though HTTP/3 has already been defined. In this article, I look at the history of the protocol and the practical differences between versions 1.1, 2, and 3. The foundation for today’s Internet was laid by British scientist Tim Berners-Lee in 1989 while working at CERN in Geneva, Switzerland. The web was originally conceived and developed to meet the demand for an automated exchange of information between scientists at universities and institutes around the world. As a starting point, scientists relied on hypertext, which refers to text with…

Traefik wants to make “networking boring … with [a] cloud-native networking stack that just works” [1]. The program aims to make working in DevOps environments easy and enjoyable and ultimately ensure that admins who are not totally network-savvy are happy to deal with DevOps and related areas. Traditionally, this has not been the case. Many administrators who grew up in the classic silo thinking of IT in the early 2000s see networks (and often storage as well) as the devil’s work. Traefik counters this: It aims to make software-defined networking (SDN) approaches in container environments obsolete by replacing them with simple technology. Traefik acts as a reverse proxy and load balancer, but also as a mesh network. I put the entire construct to the test and look into applications where…

Ransomware was regularly responsible for the failure of large and critical infrastructures in 2020. Protection against ransomware Trojans once again, or still, has to be the focus of IT security this year. Unfortunately, no panacea is yet in sight, but some security approaches are always worth testing. The 2020 publicly known attacks with ransomware mainly relied on encryption Trojans. Although the perception was that mostly public institutions were affected, the number of companies affected also increased significantly. The sad highlight of an attack against University Hospital Düsseldorf was the death of an emergency patient who could not be admitted and could only be treated an hour later in a distant hospital. Blackfog [1] has compiled the publicly known ransomware incidents in different sectors. Most affected were manufacturing, services, and government.…

Current developments such as computational storage or storage class memory as future high-performance storage are receiving a great deal of attention, but you still must understand whether, and to what extent, block and file storage, storage area network (SAN), network-attached storage (NAS), object storage, or global clustered filesystems continue to provide the basis for the development of new technologies – especially to assess possible implications correctly for your own IT environment. In the storage sector in particular, experts and manufacturers bandy about abbreviations and technical terms, and the momentum in the pace of development also seems undiminished. Above all, the speed at which innovations enter the market is surprising. On the other hand, the storage protocols that guarantee data access at the block or file level are extremely old, although…

Configuration management is the term used to describe the most automated and uniform management of systems possible with standardized tools. By means of special configuration languages, you feed your tool of choice instructions designed to convert target systems to the desired state and keep them there, taking the burden of implementing system management off the system administrator’s shoulders. Installing and configuring software, starting processes and services, creating users and groups, setting file permissions – the system administrator defines all these tasks once only and then lets the tool do the work. If a system deviates from the defined standard, configuration management straightens it out again. In this way, even small teams can automate the process of managing large system landscapes. The most frequently used automation tools of this type include…

In 2013, we were faced with a move to a new data center, combined with a change in infrastructure – away from classic bare-metal servers to well-dimensioned virtual machines (VMs). Until then, Puppet was used for configuration management, which brought with it many architecture-related problems and shortcomings. On the other hand, not all Puppet manifests could be immediately replaced, which is why the only solution was one that could be used in parallel. After some comparisons, the decision was made to go with SaltStack, which even then came with its own Puppet module, allowing us to control Puppet from within SaltStack. Additionally, SaltStack (Salt for short) impressed with its modular architecture and high speed. Where Ansible and Chef’s runtime was often unpredictable, SaltStack reliably delivered results after just a few…

Founded in 2003, US manufacturer Untangle Inc. offers a security solution in the form of NG Firewall [1] tailored to networks in small and medium-sized enterprises (or larger companies with many branch offices). The idea is to empower small companies in particular to achieve a security standard that is otherwise only available to far larger companies, with the integration of successful open source applications combined with an easy-to-use and flexible user interface. Untangle Firewall is available as a free version with limited capabilities, or admins can purchase individual functions or the complete range of functions as commercial products. The Untangle NG Firewall can be installed on various systems, and the manufacturer offers hardware appliances, but you can also put together your own system according to your individual requirements. However, you…

The year is 50 BC. Gaul is entirely occupied by the Romans. Well, not entirely …. One small village of indomitable Gauls still holds out against the invaders. Like those indomitable Gauls, you face down legions of mysterious invaders who would love to conquer your Amazon Web Services (AWS) resources. In this article, I look at how many AWS attacks happen and what you can do about them, but before I get started, I’ll take a moment to explain how permissions work on AWS. AWS Permissions A principal, which can be a human or a machine, makes a request for an action on any AWS resource. Principals must authenticate with their credentials to send a request to AWS, unless the resource permits anonymous access, which is not the case for most…

Pattern matching is a symbol processing technique that uses a pattern to identify discrete structures or subsets, such as strings, trees, or graphs. It is found in functional or logic programming languages that use a match expression to process data on the basis of its structure (e.g., in Scala [1], Rust [2], and F# [3]). A match statement takes an expression and compares it with successive patterns, which the programmer specifies in terms of one or more cases. This method is superficially similar to a switch statement in C, Java, or JavaScript, but far more powerful. Python 3.10 is now also set to receive such a match expression. The Python enhancement proposal (PEP) 634 [4] describes the implementation. More information about the plans can be found in PEP 635 [5]…

Rocky Linux RC1 Now Available Rocky Linux, from the creator of CentOS, has officially been released as an RC candidate. This Linux server distribution came into being after Red Hat shifted gears with CentOS, to make it a rolling release distribution. When that came about, Gregory Kurtzer (the creator of CentOS) decided to step back into the Linux server distribution game with a Rocky Linux. Rocky Linux will be a community-based 1:1 binary replacement for Red Hat Enterprise Linux and currently ships with Gnome 3.32, Linux kernel 4.18.0-240.22.1.el8, SQLite 3.26, virt-what 1.18, Samba 4.12.3, DNF 4.2, RPM 4.14, glibc 2.28, libgcc 8.3, and plenty of other foundational tools to get you started on a more stable and reliable track than what you might find with the now rolling release CentOS.…

Chef has been around since 2009 and is one of the most popular systems for configuration management. Originally the company was called Opscode, but it later changed its name to Chef. Since the end of 2020, Chef has belonged to US software company Progress, which added a DevOps solution to its broad portfolio of development tools. Many well-known companies rely on Chef [1] to manage their infrastructure or even parts of their cloud. Facebook, Alaska Airlines, SAP, and Carfax are prominent examples. Chef is written mostly in Ruby and is based on a client-server architecture with various optional components [2]. It can also be used in a standalone setup for simple use cases. Chef is surrounded by a robust toolchain for software quality, testing, and software life-cycle management, and this…

Docker enables the configuration of virtual networks and, for its part, makes extensive use of iptables on Linux to configure network communication between the containers, the host system, and remote computers. However, if you want to secure running containers, it is not enough to just look at the host’s INPUT chain and filter incoming traffic. As a firewall administrator, you might know the feeling when you have added a filter rule to your ruleset and realize afterward that it does not serve the intended purpose. Iptables as a packet filter is still the tool of choice on Linux systems. However, automatically added rules (e.g., those created by the Docker daemon) always lead to side effects in manually or semiautomatically created rulesets. The bigger security problem, however, arises when a rule…

Hosts, and their operating systems in particular, play a central role in secure operations with Hyper-V. The individual virtual machines (VMs) and the operating systems on the VMs naturally need to be secured. The third security-relevant area is the configuration files for the individual VMs and Hyper-V itself – and don’t forget the system services. If available, it makes sense to use a trusted platform module (TPM) chip on Hyper-V hosts to take advantage of technologies such as BitLocker and shielded VMs. As an administrator, you’re adding security in a number of places, and much of it with the help of Microsoft recommendations and templates. Securing the Host and Operating System Minimizing the attack surface is an important security foundation, and it starts with installation. In general, it is recommended…

MySQL security configurations include a range of topics, along with their possible effects on MySQL servers and corresponding applications. In this article, I look at MySQL security encryption services, account-associated authorization systems, and other required security precautions to ensure protection against misuse and attacks. This security guide will help you protect sensitive data, even if the MySQL service is compromised at some point. Most of the advanced MySQL security configurations require changes to the server’s main configuration file my.cnf. This file is generally located inside the/etc/mysql directory or in the/opt/lampp/etc/folder for LAMPP installations. However, you can locate the file with the find or locate command in Linux. Encryption at Rest By default, MySQL stores plaintext data inside InnoDB tables. Any non-admin user with access to these files can read tables…

The sudo tool lets users run programs with any account, as long as it has been allowed explicitly up front. Administrators can thus hand control over certain areas of the system to other users. For example, you could assign someone the rights in the sudo configuration file/etc/sudoers to create, delete, or modify users on a system with the visudo statement: If the <foobar> user now wants to execute one of these admin commands, they simply prepend the sudo command to the program to be executed. For newcomers to the world of sudo, a look at the help pages for the configuration file/etc/sudoers (man sudoers) is recommended to get an overview of how the sudo configuration can look in detail. I/O Logging with sudo A special feature of sudo is I/O…

Raw compute performance horsepower has migrated from the central processing unit into dedicated chips over the last decade. Starting with specialized graphic processing units (GPUs), it has evolved into ever more specialized options for artificial intelligence use (tensor processing unit – TPU). Some emerging applications even make use of user-programmed field-programmable gate arrays (FPGAs) to execute customized in-silicon logic. These enhanced computing capabilities require adopting domain-specific data parallel programming models, of which NVidia’s CUDA [1] is the most widely used. The rise of the cloud has made access to the latest hardware cost effective even for individual engineers, because coders can purchase time on accelerated cloud instances from Amazon Web Services (AWS), Microsoft Azure, Google, or Linode, to name but a few options. This month I look at the tools…