Table of contents for July/August 2022 in ADMIN Network & Security

A few months ago, I wrote this column describing “The Great Resignation.” Now, I think I must write this one as “The Great Stay Put,” because things have changed so rapidly since then. I had real wide-eyed optimism about the IT job market, but all that has changed. Now, just as was seen in the early 2000s, you might be lucky to have a job in six months. I hope that’s not the case, but you need to prepare yourself. One way to prepare is to change to a safer position, and by “safer,” I mean one that is essential to business operations. The other way is to stay where you are and ride this thing out. There’s no way to predict accurately what’s going to happen six months from…

Information technology (IT) is indispensable for core processes in companies that face a tremendous threat to their IT systems. Cybersecurity has moved beyond the IT department to become a central management task. Laws, regulations, and the associated rules of critical infrastructures (CRITIS) make it clear how great is this threat and the need for suitable countermeasures. Manufacturers and service providers have long since responded with an almost countless range of products and services, from traditional software products such as antimalware to artificial intelligence (AI)-based systems for identifying security incidents and the complete operation of security operations centers as a service. One of the biggest challenges is not the lack of suitable technology, but how to use it correctly and the personnel and knowledge required to do so. Even where technology…

The ideal scenarios for using Apache Mahout are in teams with the flexibility to adapt as their needs change over time. Mahout can easily swap back-end compute engines (e.g., batch or micro-batch systems such as Apache Spark) or streaming systems (e.g., Apache Flink). Additionally, Mahout is able to perform compute on multiple software and hardware systems, ranging from the Java Virtual Machine (JVM), to whatever multicore CPU is available, to on-board GPU for high-volume parallel computation. Typical users of Mahout are advanced data engineers and data scientists who have experience writing transformations and models in other languages but who are looking for an approach that does not require they rewrite their work, depending on the system they use from month to month or year to year. Moreover, mathematics-oriented software engineers…

Both internal and external services rely on encrypted communication with SSL and TLS. For external services, administrators use officially signed certificates, although Let’s Encrypt is absolutely fine in many scenarios. In contrast, internal services predominantly rely on self-signed certificates, which always cause a stir with web browsers on the local area network (LAN) by generating messages such as The server’s certificate is unknown. Administrators would prefer to see a nice lock icon displayed in the browser for a trusted TLS connection – for their intranet applications, too – instead of requiring users to create an individual exception in the browser for every internal application. This also means that stricter security policies can be applied for browsers on the corporate network, preventing users from opening untrusted connections at all or from…

Azure Automation is not just about automation tasks in and for Azure. It is a cloud-based service that provides automation features for a wide range of scenarios that can be roughly divided into three basic areas, all three of which share a number of Azure Automation features, such as schedules, modules, credentials, and certificates. The first area covers repeatable and consistent infrastructure provisioning according to the infrastructureas-code principle. Azure Resource Manager Templates (ARMs), Azure Bicep, and Terraform are three popular technologies that can be used for this purpose. Another large sector revolves around event-based automation, such as for diagnostics and problem resolution. The second area is automated threat analysis, which can be performed in the context of incident detection in a security information and event management (SIEM) system – one…

Terminal devices increasingly reside outside the corporate network and can be reasonably trusted on there to access applications and resources – if they use VPNs, multiple-factor authentication (MFA), and certificates. However, if the application, parts of the infrastructure, or the data itself are not on the internal network, a VPN is not a very elegant approach, to put it mildly. The catch is that the VPN configuration is installed once only – presumably along with a certificate – on a user’s smartphone or PC to provide the return channel to the corporate network. Does anyone actually check whether the certificate matches the device, if it has been sniffed, or even if the device is still in use by the user who originally commissioned it? The same applies to the intended…

In a previous article [1] I discussed prolog and epilog scripts with respect to a resource manager (job scheduler). Most of the prolog examples were simple and focused on setting up the environment before running a job, whereas the epilog example cleaned up after an application or workflow was executed. However, prolog and epilog scripts are not limited to these aspects. One aspect of prolog/epilog scripting that I didn’t touch on was checking the health of the nodes assigned to the job. Generically, you can think of a node health check as determining whether a node is configured as it should be (i.e., setting the environment as needed, which I discussed somewhat in the previous article) and is running as expected. This process includes checking that filesystems are mounted correctly, needed…

Rocky Linux is an open source, community-developed, production-ready distribution supported by the Rocky Enterprise Software Foundation (RESF). The enterprise operating system is “100% bug-for-bug compatible with Red Hat Enterprise Linux” [1] and has a 10-year support life cycle with regular updates. Rocky Linux comes with the cloud native Peridot build system, which allows you to extend or reproduce Rocky Linux from scratch – thus avoiding end-of-life issues – and manages infrastructure and secure material like keys and secure boot shims. In version 9, you’ll find: ■ Linux kernel 5.14.0-70 ■ OpenSSL 3.0.1 ■ OpenSSH 8.7p1 ■ SELinux performance improvements ■ Automatic configuration of security compliance settings ■ NetworkManager key files for new profiles ■ GCC 11.2.1 ■ Go 1.17.7 The Rocky Linux team recommends a fresh install of major versions…

The number of cyberattacks with ransomware has been rising steadily for several years. WannaCry ransomware attacks caused quite a stir in 2017. Hundreds of thousands of Windows systems were infected through a vulnerability in Microsoft’s SMB protocol, and the data on these systems were encrypted. The malware used a US National Security Agency (NSA) exploit named EternalBlue published for propagation by a hacker group. Although Microsoft released a patch to close this gap before the WannaCry outbreak, many systems had not yet been updated and were therefore still vulnerable (Figure 1). More or less by accident, British security researcher Marcus Hutchins found a way to disable WannaCry. The malware checks for the existence of a special domain before encrypting files. If the domain is not accessible, WannaCry starts encrypting. After…

If you want to see die-hard system administrators go mad, all you need to do is bring up the topic of the Internet of Things (IoT). Virtually no other a topic will unite Linux admins in such a unanimous opinion. Stories offer examples of IoT applications that have gone wildly wrong. Many of these are urban legends and never actually happened, but they fit beautifully into the narrative of technology that doesn’t really help anyone, opens security holes, and, in the eyes of many, simply shouldn’t exist. However, valid IT approaches do exist, and IoT devices perform well every day. The fact that the nation’s discounters regularly offer WiFi-capable cameras with woeful security measures should not obscure the fact that in many places around the world, networked WiFi cameras with good…

Attacks on environments are just as much a part of the daily grind in IT as operating the IT infrastructure itself. The range of attacks is wide and depends on the attacker’s goals. Classic denial-of-service attacks are not complex and quite easy to detect. However, when the focus shifts to sniffing data, the methods are far more subtle, and highly complex IT attacks on different levels are no longer challenging. As complex as the attack scenarios are, one factor remains the same: Administrators want to notice as early as possible that bad things are going on in their setups so they can react promptly. The sooner an attack is detected, the sooner it can be counteracted and the less damage it can cause. Rigid Limits of Limited Use The ability…

Administrators facing a container-based setup with distributed applications for the first time in their career might hark back to the past and secretly think the old ways were better. From their perspective, at least, you might understand how this misconception comes about. People who used to be responsible for troubleshooting had a few fairly obvious starting points. Large monolithic programs such as MySQL simply output error messages. A look at the logfile was therefore often all it took to get at least a hint of where to look. If nothing useful could be found in the logfile, you still had the level below it as the starting point. For example, if communication between server and client did not work as described in the documentation, many an admin would turn to…

One important area of Active Directory (AD) management is replication of domain controllers (DCs), especially across multiple sites (Figure 1). Separate domains for each of the physical locations is not necessary – multiple domains are more complicated to manage in most cases than multiple locations for a single AD domain. Active Directory recognizes the physical subdivision and adjusts replication to reflect this. For example, AD replication between sites uses data compression and occurs far less frequently than on a local network. Active Directory uses its own service to manage replication automatically within and between sites. This service, known as the Knowledge Consistency Checker, connects the domain controllers of the various sites and automatically creates a replication topology on the basis of defined schedules and site associations. If more than one…

shop.linoxnewmedia.com/subs Expand your Linux skills with: • In-depth articles on trending topics, including Bitcoin, ransomware, cloud computing, and more! • How-tos and tutorials on useful tools that will save you time and protect your data • Troubleshooting and optimization tips • Insightful news on crucial developments in the world of open source • Cool projects for Raspberry Pi, Arduino, and other maker-board systems If you want to go farther and do more with Linux, subscribe today and never miss another issue! GET IT NOW! FAST DELIVERY WITH OUR PDF EDITION…

Get the latest IT and HPC news in your inbox Subscribe free to ADMIN Update and HPC Update bit.ly/HPC-ADMIN-Update Hybrid IT Leads to Complexity and Lack of Visibility, Report Says Nearly half of technology professionals (49%) say the continued adoption of hybrid IT computing is leading to more complexity for IT management, says Sean Michael Kerner, detailing findings from the recent SolarWinds IT Trends Report 2022 (https://it-trends.solarwinds.com/#/). “The complexity comes in multiple forms,” writes Kerner, “including the continued requirement to maintain legacy stacks and the fragmentation between old and new technologies.” Additionally, 49 percent of survey respondents noted that “visibility into their IT operations for infrastructure and applications has been diminished.” This lack of visibility and monitoring capabilities leads to organizational gaps, says Kerner, including the ability to effectively conduct…

The corporate network has long ceased to be a single perimeter with branch offices connected to the outside world by the Internet. In the growing network jungle, however, an overall perspective is often difficult to maintain, which is why dividing the network into individual silos to give it structure seems tempting at first glance. This approach would definitely be wrong, because thinking in silos causes problems. Most important is the often missing ability to communicate between isolated solutions because a wide variety of security tools are implemented in the silos – and usually more than one. Next-generation firewalls, web gateways, email security, endpoint security – the security solutions in the individual sectors are often piled up on top of one another. The unintended consequence of this strategy is that communication…

Recently, I found myself in the need for a trio of Authoritative nameservers to disperse between my company’s data centers. Having used a PowerDNS Recursive server for years, I was anxious to give their Authoritative version a heaping helping of DNS records. Unlike PowerDNS Recursive, the Authoritative server requires a backend system to store records. The list of supported back ends is rather lengthy, including but not limited to MySQL, PostgreSQL, Berkeley Internet Name Domain (BIND), and even Lightweight Directory Access Protocol (LDAP). I consider myself rather skilled at MariaDB, and because the Authoritative server supports MySQL, I knew that MariaDB would be a non-issue. I’ve set up dozens of MySQL replication servers over the years, but I wanted to investigate something different, something a bit better suited to this…

Because Bolt is a member of the Puppet product family, the question naturally arises as to how Bolt [1] differs from Puppet. Puppet is used for continuous resource management. In particular, it provides monitoring functionality and checks at short intervals whether the services in question are still available or whether infrastructure elements have gone missing. Bolt basically zooms in on point-in-time changes. Instead of using declarative statements that define an infrastructure, Bolt is more about when commands are executed and which ones. In particular, the tool simplifies the execution or orchestration of tasks. Admins benefit from the ability to run a script over any number of network nodes. Bolt uses plans that bundle the execution details. The focus is particularly on error handling, but comparatively simple scripts can also be…

A decade and a half ago, when security and compliance were not as dominant in some places as they are today, the number of accounts and passwords was something like manageable and many an admin got rid of local accounts altogether in favor of root on their SSH-only machines. Instead, a password for root worked everywhere in the setup and – with a little luck – was encrypted for storage in a central password store somewhere. Today, however, this practice is completely unthinkable. Various security standards (e.g., Payment Card Industry Data Security Standard, PCI DSS) now stipulate that it must be possible to trace who changed what on which systems and when, which makes individual accounts mandatory. Today, even the toughest deniers of the need for compliance tend to avoid…

Low-code or, even better, no-code solutions are en vogue. These products are designed to enable users to automate small tasks without programming or scripts, removing the need for tedious manual work. Apple Shortcuts are already old acquaintances on iOS and iPadOS. Whereas users formerly needed to download the Shortcuts app from the App Store manually, it became an integral part of Apple’s mobile operating systems in version 14. With macOS Monterey 12, Apple has now also added Shortcuts to its desktop operating system. Almost Identical Apple helps newcomers with a brief introduction [1]. If you have already familiarized yourself with the app on mobile devices, you will immediately feel comfortable with it on macOS, too. Apps use Apple’s SwiftUI GUI framework on both platforms and share the codebase. Because you…

Everyone has probably heard of machine learning, but how exactly does it work? Does it mean that an intelligent machine makes decisions on behalf of humans? In a way, yes, but strictly speaking, no. You might want to replace the term “intelligent machine” with “efficient algorithm” and add that this algorithm works with data. In doing so, it delivers a view that captures the essence of the data. Simply put, machine learning focuses on building models that learn from existing data and then uses those models to make logical decisions without requiring human intervention. The methods used to learn these models are the algorithms. A variety of algorithms exist, but no one of them is suitable for every case and everywhere. An algorithm that performs well on one data collection…