ADMIN Network & SecurityNovember/December 2023的目錄

In the Welcome column, I write about jobs, careers, trends, and sometimes random but relevant topics. For this issue, I’m discussing a new direction in system administration that you might know as computer forensics, cyberforensics, or digital forensics. Digital forensics is the discovery, recovery, investigation, and examination of data found in computer systems. Computer systems is a broad category that includes databases, network devices, and mobile devices. It may also include other devices (e.g., supervisory control and data acquisition (SCADA) instruments) that store, process, or use data. Although digital forensics isn’t new, it can be a new direction for those who have traditionally held system administration jobs. You might wonder why I’m discussing a security topic for a column focusing on system administration. I’ve mentioned before that security is everyone’s…

Domain-driven design (DDD) is a software development approach that develops a domain model – an abstraction of the behavior and data of a system – and refers to the entire design of the software, from the code level to the architecture, and the interaction of the development teams involved. For a consistent domain orientation to work, everybody involved needs to exchange information, especially technical experts and developers. Ultimately, domain strategies can only form the basis of development if all stakeholders communicate them clearly; otherwise, only the subject matter experts have the required detailed knowledge of the domain – not the developers. This point is exactly where the first tie to agility can be found. One of the 12 principles of the agile software development manifesto includes: “Business people and developers…

Scalable databases have mushroomed in recent years and, in some cases, rely on completely new architectural approaches. For example, YugabyteDB is a key-value store, but it offers a MySQL compatibility layer. Vitess, on the other hand, uses native MySQL databases in the background but inserts an abstraction layer between the user and the database management system (DBMS) that takes care of sharding and, in turn, horizontal scalability. The Apache project takes a similar approach with its ShardingSphere [1] variants but promises easy handling, seamless extensibility with plugins, and support for most common databases. Redundancy and Scalability Databases are a central component of most complex setups. True to the motto “a special tool for every task,” a long-established practice is to let databases take care of data management because they solve the…

If you check out the undisputed star of the container scene and its serverless capabilities, you might be somewhat disappointed to find that Kubernetes (K8s) really does not shine out of the box. Ultimately, Kubernetes sees itself as an orchestrator for container workloads across the boundaries of individual compute nodes. The keyword is “orchestrator.” Kubernetes looks to manage existing containers and sees its strengths precisely there. Creating matching workloads is something it tends not to consider its job. At times, this perspective has devastating consequences from the user’s point of view. When you look at the K8s landscape from the Cloud Native Computing Foundation (CNCF), you will find countless solutions from which you are expected somehow to put together your own setup, including many continuous integration/continuous delivery (CI/CD) tools that…

The Ansible automation platform does not require an agent on the systems to be managed, which is both a curse and a blessing. Without a client, Ansible can control any system directly by SSH and Python, or even Windows Remote Management (WinRM) and PowerShell, whereas other platforms like Puppet or Salt need their agents. On the other hand, tools with agents can react quickly to incidents on the managed system because the client is in constant communication with the automation tool. These applications also take a “reactive” approach, which Ansible has been unable to do thus far because of its push-only architecture. The community’s new Event-Driven Ansible (EDA) [1] project now aims to change this situation, while still doing without an agent. Modular Architecture Red Hat first introduced the concept…

If you want to search for specific strings in code or files, you can turn to a number of powerful Unix tools for the command line, such as Ack [1] and Grep [2]. Both use regular expressions for the search patterns. Grep is often used for this type of search, although Ack has a slight edge in terms of functionality. Silver Searcher [3], with a similar orientation, is an Ack fork that aims to boost the search speed. But these old-timers are not the subject of this article. In fact, I’m only mentioning them because they form the basis of Ripgrep. Ripgrep [4] is a speedy implementation of Grep in the Rust language. The tool searches directories recursively with a pattern of regular expressions (regexes) and outputs all the matches…

Red Hat Announces Ansible Lightspeed with IBM watsonx Code Assistant Red Hat has released Ansible Lightspeed with IBM watsonx Code Assistant — a generative AI service for Ansible operators and developers, aimed at helping organizations accelerate IT automation. Ansible Lightspeed (https://www.redhat.com/en/technologies/management/ansible/ansible-lightspeed) “accepts prompts entered by a user and then interacts with IBM watsonx foundation models to produce code recommendations built on Ansible best practices,” Red Hat says. The service also helps keep codebases updated. It “scans existing content and automatically provides update recommendations that are ready to review, test, and apply, making it easier to maintain quality and consistency across the development life cycle,” Red Hat says. Dell APEX Cloud Platform for Red Hat OpenShift Announced Dell has announced the availability of the Dell APEX Cloud Platform for Red Hat…

When greenfield teams start a software project, it’s all fun and easy. The developers respond to new requirements at lightning speed, and the users are thrilled. Development proceeds in leaps and bounds. However, this picture changes over the lifetime of the system as the complexity of the software inevitably increases, making the system more prone to error, slowing progress and affecting maintainability. When worst comes to worst, even the smallest change can take months to reach production. What was initially a flourishing green meadow has turned into a brownfield. “Legacy system,” “old software,” “big ball of mud,” and “monolith” are the unflattering names teams use for these kinds of systems, but don’t give up hope: You can bring flexibility, error resilience, and development speed back to aging systems. The core…

The second question I need to answer from the top three storage questions [1] a friend sent me is “How do you know where data is located after a job is finished?” This is an excellent question that HPC users who use a resource manager (job scheduler) should contemplate. The question is straightforward to answer, but the question also opens a broader, perhaps philosophical question: Where “should” or “could” your data be located when running a job (application)? To answer the question with a little background, I’ll start with the idea of a “job.” Assume you run a job with a resource manager such as Slurm. You create a script that runs your job – this script is generically referred to as a “job script” – and submit the job…

In the past, we ran applications on physical machines. We cared about every system on our network, and we even spent time discussing a proper naming scheme for our servers (RFC 1178 [1]). Then virtual machines came along, and the number of servers we needed to manage increased dramatically. We would spin them up and shut them down as necessary. Then containers took this idea even further: It typically took several seconds or longer to start a virtual machine, but you could start and stop a container in almost no time. In essence, a container is a well-isolated process, sharing the same kernel as all other processes on the same machine. Although several container technologies exist, the most popular is Docker. Docker’s genius was to create a product that is…

The Visual Studio Code ecosystem continues to thrive and expand. With thousands of extensions available for download from the marketplace, developers have a bewildering selection to enrich their daily coding experience. The Remote-Tunnels extension [1] [2] is an example of powerfully expanding a developer’s remote capabilities. This extension integrates with vscode.dev hosting Visual Studio online services, allowing GitHub users to access a lightweight Visual Studio (VS) Code experience directly through a web browser. Pairing the remote tunneling capabilities of VS Code Server with GitHub integrated cloud services powers this secure remoting capability. As a result, developers can establish remote connectivity to Linux servers hosted in private networks, further expanding the possibilities of their development workflows. In this article, I unpack the details. Remote SSH Connectivity Revisited Before diving into the developer…

Keeping the lights on round the clock in a modern IT infrastructure is pretty complicated. The usual procedure consists of running both internal and external servers and services to deliver end products and services. Keeping a close watch on each and every element of the running infrastructure is a necessity for any technology-driven business. The modern monitoring solutions are devised to address the critical need to be proactive, rather than reactive, and spot problems before failures can impair a business. Having a status page for internal and external servers and services that provides a quick overview of what’s failing where can keep IT teams on top of their infrastructure. Most enterprise monitoring solutions are overkill and way too expensive for many companies, especially small to medium-sized businesses. In this article,…

When Eric Evans wrote his book on domain-driven design (DDD) in 2003 [1], he primarily had enterprise software in mind, wherein project teams develop software for various departments. Since then, a vibrant community has been established around DDD that continues to expand the discipline. As a result, DDD has become widespread in the development of software products. Domain Models To build software that solves domain-specific problems, development teams condense their understanding of the domain’s structures and rules into a domain model that exists in the minds of developers in the form of diagrams, conversations, text, and code. In DDD, the domain model forms the core of a software system. Of course, this core needs to be surrounded by technology (interfaces, persistence, communication, etc.) for the software to be useful. Building…

PyAD [1] is a useful tool for Active Directory (AD) automation with Python in many environments. However, about two years ago, the developer decided to stop maintaining the open source product. The lack of pull requests in the Git repository shows that the library generally works without problems. In practice, however, the library needs to be assessed as a potential risk; after all, it does affect Active Directory. Administrators who are not forced to use Python will want to evaluate their alternatives. Moreover, conscientious testing is strongly recommended before rolling out a new Windows Server version. Getting Set Up Unix operating systems come with a Python runtime in place out of the box. However, Windows Server 2022, which is used in the following examples, does not have Python support. The…

Low-code and no-code methodologies allow users to build applications with no or minimal coding skills. These approaches leverage declarative programming, abstracting the challenges of conventional programming. The biggest difference between low-code and no-code platforms is that low-code provides the option to add code manually, if necessary, whereas no-code platforms abstract the code entirely. Low-code tools typically offer visual interfaces, pre-built components, and access to code libraries, allowing developers to create applications by easily dragging and dropping elements and connecting data sources. Some popular low-code platforms include Appian, Mendix, OutSystems, and Microsoft Power Apps [1]. The goal of no-code platforms is to allow the non-technical user to create basic applications or automate processes without support from IT or development staff. No-code tools make extensive use of visual modeling and pre-built templates.…

Networks are exposed to more than external attacks. Appropriate defenses need to be implemented at the entry point to the internal network or, if third parties have physical access, to access points on the network. Initial authentication during access to the local area network (LAN) without downstream verification of the transmitted packets, as with classic network access control (NAC) systems, is no longer sufficient. One approach is Media Access Control Security, (MACsec), which encrypts in Layer 2, with virtually no loss of speed. The MACsec [1] Layer 2 security protocol is used for cryptographic point-to-point security on wired networks (e.g., on switches). Network access controls compliant with IEEE 802.1X-2004 (i.e., port-based network access control) only provide authentication by the Extended Authentication Protocol (EAP) framework – in the best case combined…

From the IT department’s point of view, it always makes sense to have an overview of your company’s IT infrastructure – or at least be able to create one in a timely manner. In the immediate aftermath of an IT security incident, you need information quickly about which systems an attacker may have accessed and which systems are still operational. Department staff can then look specifically for indicators of compromise (IoCs) with the help of Velociraptor [1]. The developers cite two well-known tools as the basic idea for their own software: the GRR Rapid Response (GRR) [2] incident response tool and the OSQuery [3] monitoring tool. GRR lets you hunt for IoCs and run them over a period of time on all clients connected to your network. The reports are…

Both Windows and Linux can be virtualized in different orientations by Microsoft Azure with the use of various prebuilt images. Azure virtual machines (VMs) can be virtualized not only in the cloud, but also directly in an on-premises data center with Azure Stack hyperconverged infrastructure (HCI), while retaining all the benefits familiar from the Azure cloud. The benefits Microsoft cites include simpler licensing, effective high availability, and a simpler update management process, all of which are discussed here. Free Extended Security Updates Extended Security Updates (ESUs) after the end of support (e.g., for Windows Server 2008/2008 R2 and Windows Server 2012/2012 R2) for up-to-date Azure VM operating systems have been free thus far. This point is interesting because even if companies use Windows Server 2016, they will slowly but surely…