ADMIN Network & Securityの March/April 2021 の目次

I still remember telling one of my computer consulting clients that I was quitting my business and going back to a regular job, while also pursuing my dream of being a technology writer. He responded, “Oh, that’s very competitive, are you sure you’re doing the right thing?” Fast forward to now, almost 20 years later, and my answer is still, “Yes. Yes, I am.” I heard pretty much the same thing from everyone I told. Everyone told me that writing, especially writing for a living, was too competitive and unrealistic. I’m glad I didn’t listen to the naysayers. You see, people will take every opportunity to discourage you from exploring your dreams. Sure, there’s some rejection associated with writing, acting, filmmaking, or really doing anything you want to do, but…

The shortage of addresses and the quest for efficient resource usage established web server virtualization well before the topic of virtual machines and containers gained its current prominence. In this article, I demonstrate how to use different fully qualified domain names (FQDNs) on the same physical system with virtual hosts. Listing 1: Virtual Host Output Virtual Hosts In the mid-1990s, a single web server (usually the Apache server, which quickly became the de facto standard on Linux) typically ran with a single IP address. Once installed and configured, it reliably delivered a web page – always the same page – after requests to that IP address. Not only was it impractical to have a separate computer for each web server, no matter how small, but IPv4 addresses were becoming scarce.…

Dynamic IP address assignment by the Dynamic Host Configuration Protocol (DHCP) usually performs its service reliably. However, some implementations lack modern interfaces to connect them to existing management systems and databases. Some outdated solutions also lack functions for IPv6. The Kea project, launched in 2014, modernizes the DHCP server. Kea was designed as a successor to the Internet Systems Consortium’s open source DHCP server (ISC DHCP), which has been widely used on enterprise networks since 1999. Version 1.8.1 [1] of the DHCP server was recently released and is available for the Linux, Unix, and macOS operating systems. The service has a modular structure with, for example, separate daemons for DHCPv4 and DHCPv6, as well as for dynamic DNS registration. The Kea server configuration relies on a JSON-based data structure. Configuration…

In the beginning, running containers in a stateless mode seemed to be the best and simplest approach because it was possible to scale container-based applications by starting additional containers on additional hosts. If you had problems with a container, it could simply be terminated and restarted on another node – or at least that was the theory. In practice, users unfortunately achieve less with stateless containers than they would like, prompting the Kubernetes container platform in early days to add new features in each release, such as the stateful sets or the storage interface for persistent volumes. Kubernetes also implemented the Container Storage Interface (CSI), which the Cloud Native Computing Foundation (CNCF) made standard. In addition to the persistent volume capabilities, numerous storage vendors in the Kubernetes world cater to…

While chatting with some colleagues, we discussed how some applications return unusual results, even though previous runs had produced the expected results. As they were discussing ways to tell whether applications were running correctly or incorrectly, I thought it would be great to get a snapshot of what was happening on all of the nodes involved in a job. I like to think of this as “application telemetry.” A simple search on “telemetry” [1] brings up a definition like “… the process of recording and transmitting the readings of an instrument.” In this case, the instrument is the high-performance computing (HPC) system, and the readings are resource aspects of the system (e.g., CPU, memory, network and storage usage, etc.). Here, the telemetry is used to help the user understand what…

Often, you find yourself attempting to eke out a bit more performance from the computer system you are attempting to either build or recycle, usually with limited funds at your disposal. Sure, you can tamper with the CPU or even memory settings, but if the I/O hitting the system needs to touch the underlying storage devices, those CPU tunings will make little to no difference. In previous articles, I have shared methods by which one can boost write and read performance to slower disk devices by leveraging both solid state drives (SSD) and dynamic random access memory (DRAM) as a cache [1]. This time, I will instead shift focus to a unique way you can configure redundant storage arrays so that you not only boost overall data access throughput but…

If you’re an IoT or embedded device developer, the release of Ubuntu’s latest “core” edition should have you excited. Why? Because this latest iteration of Ubuntu Core includes a number of features focused on security. In fact, as of this release, Mark Shuttleworth, founder and CEO of Canonical (the company behind Ubuntu), says, “Every connected device needs guaranteed platform security and an app store.” He continues, “Ubuntu Core 20 enables innovators to create highly secure things and focus entirely on their own unique features and apps, with confinement and security updates built into the operating system.” Three specific security-minded features are: Cryptographically-authenticated boot. Full disk encryption. Manual and remote recovery modes. Ubuntu Core 20 also addresses the cost of design by working with silicon providers and ODMs to streamline the…

Since its beginnings, the World Wide Web has primarily been based on two technologies: the Hypertext Markup Language (HTML) and the Hypertext Transfer Protocol (HTTP). HTML is by far the better known technology and the one with the more turbulent past. In addition to questionable technological overkill (e.g., the <blink> tag), conflicts between implementers have been a constant sideshow to the language’s evolution. Some further developments such as XHTML have proved to be a technological dead end, causing considerable additional work in quite a few projects. HTTP/2 at a Glance Compared with HTML, however, the further development of HTTP has taken place rather covertly and has not been determined by political motives or marketing measures to any great extent. As it has become clear that many websites need to be…

Visualizing data trends and issues when they arise is clearly of significant benefit, whether for applications or the systems on which they run. Having access to sophisticated tools that can provide highly customizable options to create bespoke visual dashboards is key and an important facet in being able to maintain high levels of uptime. A welcome bonus is if such tools are compatible with multiple types of data sources, so you can centralize your single-pane-of-glass viewing platform. Listing 1: Check for Running Containers Step forward, Grafana [1]. It has the capability to gather metrics from all types of applications and treat each as an individual data source. From there, it is possible to query and filter results precisely to your needs. Coupled with another exceptional bedmate, Prometheus [2], it is…

For a long time now, load balancers have supported any number of back-end servers. If the load in the setup becomes too high, you just add more servers. In this way, almost any resource bottleneck can be prevented. Understandably, the load balancer is a very important part of almost every web setup – if it doesn’t work, the website is down. Appliances from F5, Citrix, Radware, and others were considered the quasi-standard in the load balancer environment for a long time, although powerful software solutions that ran as services on normal Linux servers (e.g., HAProxy or Nginx) were available. The cloud-native trend is a major factor accelerating the shift toward software-defined load balancing these days, not least because typical appliances are difficult to integrate into cloud-native applications – reason enough…

Podman is considered the standard when it comes to managing containers and pods. Seamless integration into the systemd world is a big help, especially in environments where Kubernetes is not used and users want to deploy arbitrary software within containers. After the release of Podman version 2.0, the two components now work in even closer collaboration. Some readers might frown at the thought of linking Podman [1] and systemd [2] more closely, and with good reason. After all, microservices should run primarily within containers, without the need for a service manager like systemd. This idea is correct as far as it goes, and in an ideal world, Kubernetes exclusively manages orchestration for containers with microservices. However, experience shows that this is not always possible and that other architectures must also…

Recently, FIDO2 and the passwordless authentication that goes with it have been in focus. As long as you base your login on a flexible database system, you can simply add the required fields for one or more public keys. To store the required information in Lightweight Directory Access Protocol (LDAP), as well, you need to extend the schema and define your own object and attribute types. FIDO2 is a milestone of passwordless authentication. When logging in, the user’s browser receives a challenge and has to sign it with the user’s private key so that the service provider can validate the signature against the stored public keys. If validation is successful, the login is considered complete. One advantage of public key procedures such as FIDO2 is that service providers and users…

Recently the drastic rise in cryptocurrency trading prices has led to numerous online systems falling prey to botnets, seeking to mine for profit. This botnet, dubbed WatchDog, was discovered by Unit 42 (https://unit42.paloaltonetworks.com/), who realized this particular threat has been active since January 2019. WatchDog was written in Go and uses outdated enterprise applications as a point of entry. So far, Unit 42 has found 33 exploits, targeting 32 vulnerabilities in open source software, such as Drupal, Elasticsearch, Apache Hadoop, Redis, and the ThinkPHP framework. Unit 42 estimates around 500 to 1,000 infected systems are currently being used by WatchDog to mine for cryptocurrency and the total profit was estimated at 209 Monero coins (worth roughly $32,000). However, the researchers have only been able to analyze a few binaries, so…

What happens when you have a server running a Linux distribution that’s reached its end of life? Typically you migrate that server over to a newer release, and hope everything goes well. But what about those instances when you either don’t have the time to make the switch or you know the software on the current platform isn’t supported on the newer release? You desperately hold on to that deployment, trying to figure out a way to get updates, even with the EOL status. That’s where CloudLinux comes into play. The company responsible for AlmaLinux (a 1:1 binary compatible distribution with RHEL) has started offering Extended Lifecycle Support (ELS) support beyond EOL for some distributions. Here’s what they currently offer: ELS for CentOS 6 to June 2024. ELS for Oracle…

In terms of functionality, the small Lighttpd [1] web server need not shy away from comparison with more prominent competitors. Among other features, it supports virtual host strategies and can change its configuration to reflect incoming requests. If necessary, further functions can be added with the use of modules. For example, access to individual websites can be restricted, connections can be secured by TLS, and scripting languages can be integrated over the FastCGI interface, which also has a built-in load balancer that distributes incoming requests to multiple PHP servers. By the way, the web server’s name is pronounced “Lighty”; some websites even use this phonetic spelling as a synonym of the official name. Lighttpd supports HTTP 1.0/1.1 and encrypted connections over HTTPS. Versions 1.4.56 or later support the newer HTTP/2.…

Corporations are increasingly turning to Microsoft’s cloud services in the form of Exchange Online, Share-Point Online, or OneDrive for Business. The environment previously known as Office 365, and now renamed Microsoft 365, is enjoying increasing popularity. The same is true for Microsoft Teams – and not just since the pandemic. In this article, I offer simple but effective tips for the administration of both worlds. Although Microsoft recently changed the name of Office 365 to Microsoft 365, in many cases it’s still referred to as Office 365, and the names are interchangeable. Nothing has changed in terms of administration. I start with user management, which does not always have to take place at a central IT location, because in Office 365 you can delegate administrative authorizations to users or lower…

Whether you compile Apache yourself or use a package from a repository, you need to keep the software up to date and shut down vulnerabilities as soon as possible. One way to keep on top of important information is to subscribe to Apache’s Announce mailing list [1]. In addition to the web server software itself, you also need to ensure that interpreters such as PHP, Python, and Perl and the web applications you use are secured. Last but not least, every security-conscious admin patches the underlying operating system on an ongoing basis. Installation, Modules, and Updates As a first step, you should disable unnecessary modules. On Debian and Ubuntu this task is quite easy thanks to the a2dismod command. Otherwise, you will have to search for the LoadModule directive. The…

In environments characterized by great complexity or the crucial importance of the connected systems, authentication must be clearly regulated. The need for protection is particularly great for privileged accounts such as domain or organization administrators. Active Directory (AD) offers, among other things, the Protected Users group and authentication policies for this purpose. AD entered the market about 20 years ago with Windows 2000 Server. However, it was to be 13 years before Server 2012 R2 introduced one of the biggest security enhancements in the form of Kerberos authentication for highly privileged accounts. Part of the new functionality, the special treatment of the Protected Users group, was automatically introduced on upgrading the domain function level and caused irritation in some cases. Other features such as authentication policies are still unknown to…

According to the Kafka home page [1], “Apache Kafka is an open-source distributed event streaming platform … for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications.” A basic Kafka ecosystem has three components – producers, brokers, and consumers. Although much has been written about tuning brokers, reliably configuring producers and consumers is something of a dark art. All systems are dependent on your local setup, but some standard metrics that you can look at and knobs that can be tuned can increase performance 10 times or more. In this article, I walk through a real-life(-ish) example of how to diagnose and then fix a bottlenecked stream-processing system. Assume you are mirroring data from an edge Kafka cluster into a central Kafka cluster that will feed your analytics data…