ADMIN Network & SecurityJanuary/February 2024的目錄

LibreNMS [1] promises flexible network and system monitoring and combines various functions from tools such as Nagios and Cacti. Another advantage of the software is that, unlike its predecessor Observium, it has no annual license fees for additional features or services such as quick updates, rule-based grouping, and scalability across multiple servers. Monitoring with LibreNMS is easier now thanks to the auto-discovery function, and the web-based interface provides a wide range of customization options for visualizing information. The auto-update mechanism also ensures that the monitoring environment is always up to date, but first you need to get the software set up. Integrating Initial Devices One major advantage of LibreNMS is that the developers make it really easy for administrators to carry out an initial evaluation of the environment. They provide…

When IBM announced that it was restricting access to Red Hat Enterprise (RHEL) source code and moving CentOS upstream, the distros that depended on RHEL and CentOS source code were sent scrambling. It is still a little unclear whether IBM’s moves are legal and consistent with the GNU Public License (GPL), but the litigation to sort it out could take years, and in the meantime, the derivatives need a solution. One enterprise distribution that weathered the storm quite smoothly was AlmaLinux [1] (see the box entitled “Where Do They Get Their Code?”). If you ask the AlmaLinux developers, they will say that one reason for their success in navigating the transition to the post-RHEL era is the AlmaLinux Build System [2]. The AlmaLinux Build System evolved from an earlier system…

ScaleFlux competes with NVMe based drives by offering not only store but compute functions, as well. However, relieving the load on the CPU and ensuring higher bandwidth and lower latency comes at a greater price and begs one question: Is it worth the effort? Where Is the Bottleneck? Every server has a bottleneck that limits its performance somewhere, but the exact whereabouts of this bottleneck tends to differ because the manufacturers of the individual components have been playing a cat-and-mouse game for years. New CPUs usually come with new chipsets that enable higher bandwidths for the connected devices and RAM, which often makes the storage devices the bottleneck. The storage device manufacturers then follow suit and launch faster devices so that the network suddenly becomes the performance limit. The network in…

Installing the Azure Arc agent on local machines lets you integrate these machines with Azure and manage them remotely. Neither a virtual private network (VPN) nor port sharing in the firewall are required for this kind of access, and this approach also supports remote PowerShell sessions and remote desktop protocol (RDP) connections. In this article, I look into how you can manage servers from wherever you are with Azure Arc. The ability to leverage Azure cloud resources locally from the Windows Admin Center (WAC) has been around for quite a while now. It is particularly useful for backing up local data to the cloud with Azure Backup. Azure Arc takes the opposite approach and lets you manage your on-premises servers with WAC in Azure. If you connect WAC to Azure,…

Often the excellent products in the open source community for operating and maintaining IT infrastructures are specialist tools that can do one thing well, but nothing else. Therefore, an admin’s toolbox usually comprises a large number of tools with partly overlapping functionality. Bucking this trend is Ralph [1], a well-designed and powerful asset management, data center infrastructure management (DCIM), and configuration management database (CMDB) system for data centers and back offices. Whereas the IT asset management department is responsible for the efficient management of IT devices throughout their entire life cycles, the CMDB component, as the central database, takes care of IT service management (ITSM). These two functional areas are supplemented by the DCIM component, which provides functions for managing, monitoring, and planning the data center infrastructure and the IT…

Cyberattacks come in many forms, such as secret spying on company networks, sabotage, and disruptive actions. In a disruptive action, denial of service (DoS), the attacker attempts to overload a server with requests until it stops working. This attack is easier said than done, because servers usually have more power in reserve than a single client can call up. The obvious idea is to attack the same server with many clients. The resulting attack is called a distributed denial of service (DDoS). The attacker rounds up a huge number of computers in the form of a botnet. You are not powerless against DDoS attacks, but it is important to introduce appropriate measures up front, because during such an attack, the Internet line is flattened by the flood of client requests…

From a security perspective, tier 0 systems such as domain controllers, privileged access workstations, or identity management systems provide direct access to digital resources, so more and more IT teams are making sure these systems have additional protection, which includes monitoring to make sure they are working properly. Regardless of whether you use a tiering model with a formal description (guidelines, firewall rules, and access groups; e.g., the Microsoft tiering model [1]) in your infrastructure or simply apply common sense and good account hygiene in your daily administration, every IT landscape has systems and objects that can be classified as tier 0 – the parts of the environment that enable complete control over the identity and security infrastructure, which makes them both particularly vulnerable and particularly worthy of protection. In…

To protect a private party from hooligans, you could check the guests’ invitations at the entrance yourself, or you could hire a bouncer. Authelia [1] acts as a bouncer for web applications to help you regulate access to services that do not offer their own access controls. Thanks to Authelia, developers do not have to implement complex and time-consuming user management in their own web applications. Instead, they can deploy Authelia upstream of their own software with two-factor authentication and single sign-on (SSO) by default. In other words, you just need to log in to Authelia to access several authorized applications. Authelia requires that communication with the web applications be protected by a reverse proxy. The software then connects to this reverse proxy (Figure 1) and checks all incoming requests,…

Many a developer looking to package their own application in a container for the first time finds themself out of their depth. Administrators who have not had much experience with containers to date are in a similar position if they are looking to containerize small tools for their own use and deliver them locally. The questions are many. Although the required knowledge can be painstakingly gathered, it takes a long time, and it’s not much fun to boot. This article rushes to the rescue. Besides the basics of image building, I look at best practices and continuous integration and continuous deployment (CI/CD) mechanisms, as well as the question of a good DIY image registry. This much can be revealed in advance: The topic is not quite as complex as many…

As a host-based intrusion detection system (HIDS), OSSEC [1] detects and reacts to security incidents in real time. The software is capable of detecting a wide range of security incidents, including attacks on filesystems and directories, changes to system files and configuration files, failed login attempts, and attempts to escalate privileges. The tool also detects changes to logfiles and network attacks such as port scans, connection breaches, and distributed denial-of-service (DDoS) attacks. In this article, I show you how to set up the server and the clients. You can also set up OSSEC as a Docker container. All packages are available directly from the download page [2]. Taking Countermeasures OSSEC offers a range of countermeasures to help you respond to security incidents, such as blocking IP addresses or hosts that…

In the DevOps world, everybody is talking about GitOps. Its increase in popularity in recent years makes it clear that it’s not just a passing fad, but a consistent trend offering significant advantages over legacy approaches. What GitOps Is Not Before I move on to specific examples of GitOps principles in practice, it is important to understand what GitOps is and, perhaps more importantly, what it is not. It’s probably easier to start with what it isn't, because many people see GitOps as a panacea for all problems in managing applications and their infrastructure. Not only is this belief false – in fact, implementing a GitOps strategy usually involves introducing additional steps and software into your usual workflow, which may make it more complex – but if you don’t have…

When configuring a system, a large number of settings are required to meet compliance requirements. Common Criteria [1] is an international standard for the security certification of computer systems. The standard defines the requirements as security targets. Targets look different depending on the system you are using. For example, the requirements for a mobile device differ from those for a desktop system, which explains why protection profiles are different. The Protection Profile for general-purpose operating systems [2] clearly stipulates that user sessions must either be terminated or, alternatively, locked after a certain period of inactivity. However, recent OpenSSH versions block a workaround frequently used to meet this requirement. We show you how to use the systemd‑logind service to solve this dilemma. Compliance Undermined The US Department of Defense (DOD) Defense…

Many standardized interfaces can be set up for applications on the local network. One of the most popular candidates is Webmin, whose strengths lie in managing legacy company servers. As a tool, though, Webmin is too complex and too powerful for many small environments. Administrators looking for a lightweight dashboard system to manage conveniently the links and entry points to various services will find Dashy [1] an interesting alternative. Dashy is jam packed with useful functions for creating individual dashboards. It also lets you integrate status checks and use dynamic widgets and user-defined layouts. Dashy is open source, and the developers offer support on GitHub. Installation Of the various ways to get Dashy up and running, the easiest way has to be the Docker-based installation. A search in the Docker…

Graphite [1], which started life in 2006 as a side project of a monitoring tool for an airline and travel portal, has evolved into a powerful system today that, according to developer Chris Davis, helps Etsy, Booking.com, GitHub, Salesforce, Reddit, and many other companies monitor their business processes. The software has been under the Apache 2.0 open source license since 2008. The ecosystem has grown considerably in the meantime and offers a complete set of collection agents and voice connections for all typical application scenarios. Inner Workings At its core, Graphite handles two tasks: It stores numerical time series data and renders the data in the form of graphs. Feeding raw data into the system is particularly easy. To bundle raw data in all its diversity, Graphite relies on the…

Friends and workmates often tell me that email is obsolete as a means of communication. Everybody is using some mobile messaging app or another these days. Solutions such as Signal Messenger or WhatsApp let users send and receive documents and messages, and they are comparatively free from the spam and scam campaigns that plague the email ecosystem. Thus, I am told, email is irrelevant. People couldn’t be more wrong. Email is vital for many businesses because it allows them to deliver messages to both customers, employees, and associates by standard, open protocols that are not controlled by a single organization. Servers can be configured to email error reports to a system administrator with every incident, and email is still the most popular password recovery mechanism when somebody forgets the password…

In practice, switching to a consistent scale-out architecture with stateless containers means that users have to rewrite their existing applications – not necessarily the application logic, but the data storage and structural components. Existing database technologies such as SQL can only handle stateless scale-out operations with major limitations. Object databases would be far better suited but entail a fairly extensive redesign of existing applications. I already described this problem in detail in a previous article [1]. In this article, I look at some methods for backing up your Kubernetes applications, preferably SQL databases. The main aim is to ensure that these data backups can be restored quickly in the event of a failure. The overview is deliberately restricted to the architectures; you will always need to adapt the code to suit…

The complexity of modern IT landscapes becomes particularly apparent in the event of emergencies caused by cyberattacks. It is not just the recovery of the individual subsystems that needs to be considered when you restore, but also the interactions. The failure of basic services such as authentication as the result of an attack is a particularly serious worry. Regardless of whether a company still has its IT firmly anchored locally or is already on its way into the cloud, most directory services now have a hybrid design. The legacy Active Directory (AD) is the primary identity store, and users, groups, and, increasingly, computer accounts are synchronized to Entra ID (formerly Azure AD) or other cloud-based directories to enable seamless access to applications in the cloud. The prime example is Microsoft…

The Internet comprises a mix of autonomous systems (ASs) – networks and systems each under the administrative control of a specific provider – that have officially registered numbers known as AS numbers (ASNs). The Border Gateway Protocol (BGP), the latest version of which is BGP4, ensures accessibility between the autonomous systems and is designed and optimized for handling high volumes of routing information with a high level of stability. Besides providers, large corporate and government customers also have to deal with BGP if they use or want to use multihoming (i.e., connecting your own autonomous system to several providers). BGP is also used on some internal networks and forms the basis for multiprotocol label switching (MPLS) in wide-area network (WAN) structures, but can also be used for Ethernet virtual private networks…

I continuously explore options for cost-effective (or just plain cheap) parallel computing rigs, and while next-generation, cutting edge hardware is always interesting, I find that retired options from yesteryear can also show potential when their significantly lower cost is part of the overall assessment. Retrofitting a retired Dell workstation with high-core-count CPUs and the maximum allowable RAM, I built a 44-core compute behemoth for less than $600 to run Monte Carlo [1] simulations. Let me dive into the details! Bill of Materials Table 1 details my hardware configuration. I found a refurbished Dell Precision T7190 workstation [2] on eBay in nearly perfect cosmetic condition with a motherboard sporting two LGA 2011-3 processor sockets – which were both vacant (Figure 1). The stock power supply is rated at 1,300W, more than…