ADMIN Network & SecurityMarch/April 2022的目錄

Just about every week that I read articles on tech sites, I see at least one that touts the virtues of one Linux distribution over that of another. It’s a strange thing to see in a way; this same thing doesn’t happen with Windows or Mac because there’s only one – no other choice is available. It reminds me of that old Devo song, “Freedom of Choice,” the last chorus of which is shown above [1]. I believe no truer words have ever been spoken or sung, at least for the Linux community. As Linux users, we do have a choice, but some of us spend an inordinate amount of time trying to convince everyone that there exists this one best distro. For Linux users, it’s not as simple as…

No matter how an admin twists and turns, there is no avoiding the fact that automation at the network level makes as much sense as at the server level. Unfortunately, implementing this kind of automation is far more difficult. Juniper, Cisco, and Huawei, for example, have their own ideas and strategies relating to how their devices can best be given a valid configuration automatically. On the other hand, approaches such as Open Networking rely on standard tools because standard interfaces are available on the device side. Another powerful competitor in the network infrastructure automation game is Ansible, which impresses with its diversity when it comes to communicating with devices from any vendor. Not so long ago, many system administrators viewed the topic of automation with a mixture of indifference and…

What do you do when you need to deploy a large filesystem that is scalable to the exabyte level and supports a large-client, simultaneous-access workload? You find a parallel distributed filesystem such as Lustre. In this article, I build the high-performance Lustre filesystem from source, install it on multiple machines, mount it from clients, and access them in parallel. Lustre Filesystems A distributed filesystem allows access to files from multiple hosts sharing the files within a computer network, which makes it possible for multiple users on multiple client machines to share files and storage resources. The client machines do not have direct access to the underlying block storage sharing those files; instead, they communicate with a set or cluster of server machines hosting those files and the filesystem to which…

As more staff work from home, the importance of corporate phone systems has increased, along with demand for leading edge telephony features like follow-me, voicemail to email, secure video conferencing, and so on. As a result, many companies have upgraded their legacy phone systems to Voice over IP (VoIP), including changing to open source solutions like the private branch exchanges (PBXs) Asterisk [1] and FreeSWITCH [2]. At the same time, call centers have been migrating to VoIP at a harrowing rate because of the feature and cost benefits associated with open source solutions. Even critical call centers (e.g., emergency services or high-volume retail order placement centers) have embraced open source VoIP, moving products like Asterisk and FreeSWITCH into the mainstream of telephony. What all these environments have in common is…

Availability is one of the three most prominent protection goals of IT security. In contrast to encryption and integrity, both of which can be ensured with cryptographic processes, availability is often ensured by access control and redundancy. However, access control in particular is rather difficult for resources that are basically publicly accessible. To be prepared for emergencies, it is important to determine the performance of your systems to give you reliable figures on how many requests your services can handle well and at what point an overload situation will occur. In this article, I introduce you to Locust [1], a powerful tool that can simulate an incredibly large number of users. The Right Time Of course, you should not run a stress test against a production system, if possible. Therefore,…

Scholars argue about whether history repeats itself. Clearly, however, some trends will return, and administrators will repeatedly encounter various technical approaches in IT – maybe in a slightly different guise and perhaps under a new name, but the principle always remains the same. Helm is like that. It is a kind of package manager that the vast majority of admins have at least heard of in the context of Kubernetes. In fact, Helm comes from a completely different technical background from the package managers of classic distributions (e.g., rpm and dpkg), aiming to make distributing software for Kubernetes easier. The Helm skills of many admins do not extend beyond knowing that the tool exists. As a result, many myths circulate around the solution, and the resulting uncertainty puts Helm in…

IT without automation is simply impossible to imagine today. One of the many mantras of strict advocates of automation is: “If it’s not automated it doesn’t exist.” In view of a continuing shortage of skilled workers, companies have virtually no choice – if you task expensive personnel with performing the same banal maintenance chores time and time again, you will simply be unable to achieve the high degree of innovation required in present day business. It comes as no surprise that many large and small providers want a piece of the pie. One automation topic has seen much attention in recent years: workloads in the cloud. A separate sub-genre of automation has even emerged – orchestration – which, although it takes automation up several levels, is ultimately still automation at…

Google’s software product Flutter [1] is not the first attempt to unify mobile app development. Competitors like Microsoft’s Xamarin or Facebook’s React Native already offer solutions in the same vein. However, Flutter impresses with excellent documentation, great performance, and the ability to generate apps for Linux, macOS, Windows, and the web on top of Android. In combination with the free Android Studio development environment, apps for all these platforms can be developed comfortably and easily. The website [2] also offers developers a place to find packages that can be sorted on a number of criteria for every conceivable purpose to extend their Flutter apps with desired feature sets. At first glance, the need to learn a new language for Flutter, the integrated Dart programming language, seems to be an obstacle.…

The principles of Dev(Sec)Ops are based on test-driven development, which states that you need to consider how you will test before you write a single line of code. Monitoring and alerting, as well as security compliance and detection tests, should be in place from the beginning. The ability to enact and clean up a VM-based environment quickly is important for unblocking on-demand development and testing (and is a vital part of continuous integration and continuous delivery or deployment, CI/CD). Many admins like to model their infrastructure in advance from a personal laptop or lightweight test system, but multiple VMs can be quite demanding for a single system. For instance, if you have used the combination of Vagrant and VirtualBox for deploying and managing virtual machines, you probably realize the virtualization…

The way distributions deliver software is changing. The new package formats (e.g., Flatpak and Snap) are becoming more and more widespread, and for many reasons, containers are becoming increasingly important, even in the everyday lives of average desktop users. Developers want to see their software reach users more quickly without having to create packages in different formats. Some approaches allow you to install multiple versions of a program simultaneously. Sandboxing as a security feature can play a role, or isolating apps so that they do not interfere with other programs. Additionally, not all software can be easily packaged and kept up to date with the use of traditional package formats, especially for distributions like Kali Linux that ship hundreds of highly specialized applications. Many of these applications are not available…

Many articles have explored the performance aspects of filesystems, storage systems, and storage devices. Classically, performance results are reported with statements such as Peak throughput is x MBps or Peak IOPS is x. However, what does “IOPS” really mean and how is it defined? Typically, an IOP is an I/O operation, wherein data is either read or written to the filesystem and subsequently the storage device, although other IOPs exist that don’t strictly include a read or write I/O operation (more on that later). The number of input/ output operations per second (IOPS) sounds simple enough, but the term has no hard standard definition. For example, what I/O functions are used during IOPS testing? If the I/O functions involve reading or writing data, how much data is used for a…

Get the latest IT and HPC news in your inbox Subscribe free to ADMIN Update and HPC Update bit.ly/HPC-ADMIN-Update AlmaLinux 8.5 Now Available For PowerPC Hardware Both PowerPC and IBM Power Systems hardware can now enjoy that fresh feeling brought about by the drop-in CentOS replacement, AlmaLinux. This support for 64-bit PowerPC architecture includes the release of binary and source RPMs, container images, and cloud images. According to Jack Aboutboul, community manager for AlmaLinux, “We’re looking beyond just the base operating system, in providing containers and cloud images as well, since those are of extreme importance and utility to our users.” Aboutboul continues, “We’re currently working to deliver support for S/390 as well for eventual full parity with RHEL. The community shouldn’t settle for anything less.” This is a fully…

The DevOps world without YAML [1] is difficult to imagine. In fact, YAML is a superset of JavaScript Object Notation (JSON) [2]. However, the focus of JSON is more on data serialization (e.g., to make data available to an API). In contrast, YAML plays to its strengths when used as a configuration language because the format is more easily readable than JSON. Python programmers love YAML because, unlike JSON, it uses indentations instead of parentheses to define objects. Basic YAML Syntax Listing 1 shows a simple YAML document. The --- string in the first line means a file can contain several such documents; it is then followed by typical key-value pairs, which are familiar if you have used JSON. The first key pair is a simple scalar with a string…

Large networks tend to have at least one virtual machine (VM) per service. Small networks do not need this complexity and can combine a whole range of services on a single machine. So that setting up and managing all these services is not too difficult, special small and midsize business (SMB) editions of Linux distributions substantially simplify how services are handled. Alternatively, you could add extensions to regular distros that support service configuration over a web user interface (UI). However, these tools do not typically cover a full suite of services. The special Linux distributions for SMBs provide convenient configuration tools, and they are typically backed by an organization that offers service and support. We investigate four of these Linux SMB distributions: ClearOS, NethServer, Zentyal, and Univention Corporate Server (UCS).…

In legacy IT, dynamic scaling usually meant that you had to start new virtual machines manually. Then, you had to integrate the application into an existing cluster and possibly reconfigure the load balancers. Kubernetes takes all of this work off your plate. The command tells Kubernetes to launch five instances of the web server container and makes sure they are running and reachable. Houston, we have load balancing. The downside is that this only works as long as enough resources are left in the cluster. If the resources are exhausted, you need to add new nodes. Although this might be easy to set up, it means purchasing new hardware and facing a wait, during which the service is not available at the desired performance level. Moreover, if you use autoscaling,…

Identity and access management (IAM) misconfigurations are one of the most common concerns in cloud security. Over the past few years, these security holes have put organizations at increased risk of experiencing serious attacks to their cloud accounts. To some, cloud environments might look like a safe place, where security is set by default. However, the truth is that security follows a shared responsibility model. For example, you are in charge of securing AWS console access. However, what if a misconfiguration over your users or roles is applied in your environment? Attackers can use them to gain the keys to the kingdom, accessing your environment and creating serious damage. In scenarios where attackers are already in, misconfigurations can help them perform cloud lateral movement [1], exfiltrate sensitive data, or use…

Access control is a standard feature of networks, with a general need to reconcile strict security requirements with a greater diversity and larger number of terminal devices, even in times of constantly changing threats. In this article, I look at the options offered by Cisco’s Identity Services Engine (ISE), including the architecture, feature set, and how to integrate guest devices. Internal Barriers The increasing penetration of Internet of Things (IoT) components means new threats. For example, many IoT elements do not support the authentication methods familiar on enterprise networks. The lack of hardening options (e.g., the ability to disable services) and missing or delayed update processes aggravate the situation. At the same time, the larger number of end devices inevitably means more points of access to the network, such as…

PowerShell Crescendo [1] converts commands from other shell environments into PowerShell cmdlets and modules and runs them with all the benefits and convenience of the PowerShell environment. These commands can be piped or controlled with parameters. In this article, I show you how to set up and use a Crescendo environment in Linux. Crescendo was available as a Technical Preview at the time of writing, so all of the approaches discussed here may change in future releases. However, because a Crescendo package and the wrappers it generates work without an Internet connection once downloaded, your environment can remain stable by not applying updates or not transpiling the wrappers again. Crescendo Work Environment Crescendo relies on a two-step process: Before using a command-line tool, you need to transpile a wrapper with…