ADMIN Network & Securityの July/August 2023 の目次

I’ve had a long and interesting career in technology. I’ve worked as a system administrator, developer, tech writer, instructor, database administrator, and consultant. Many of these positions were held simultaneously with my freelance writing career and various day job roles. I’ve been in the trenches for a long time, lived the dream at Red Hat, and have run the gamut of desirable and undesirable jobs. My career isn’t over yet, and I feel I have a few more things to accomplish as a seasoned technology professional. One of the main things I want to accomplish is to promote the idea of producing a new generation of technology professionals. To do this, I must take on tech. The technology field isn’t necessarily kind to employees. If you follow this column, I…

In early October 2022, the Internet Systems Consortium (ISC) released versions 4.4.3-P1 and 4.1-ESV-R16-P2 of the ISC Dynamic Host Configuration Protocol (DHCP) server. At the same time, the non-profit organization announced that this would likely be the last release of the software and set the end-of-life date for December 2022. Although the DHCP server daemon dhcpd remains functional, according to ISC it will no longer be updated unless serious security vulnerabilities arise. Now is the time therefore for you to take a look at Kea, ISC’s new DHCP server suite. Development of the designated dhcpd successor began in 2014. At the time of writing, the available Kea versions were 2.2.0 (July 2022, Current-Stable) and 2.3.6 (March 2023, Experimental-Development). Most distributions have prebuilt Kea packages in their repositories, and the ISC…

CockroachDB [1] is an open source, distributed SQL database that provides scalability, high availability, and strong data consistency across multiple data centers and cloud environments. It was designed by former Google employees who later founded the company Cockroach Labs. CockroachDB is built on the foundation of the Google Spanner research and is often referred to as “Spanner for the masses” (see the “What is Google Spanner?” box), making the power of distributed databases accessible to a broader audience. One of the key features of CockroachDB is its horizontal scalability. As your application grows, you can add more nodes to the cluster easily without any downtime, allowing the database to rebalance and distribute the data automatically across the new nodes. In this way, CockroachDB can handle increasing workloads efficiently without compromising…

Microsoft announced the general availability of the Azure Monitor Agent back in 2021 after the consolidation of existing monitoring solutions for the Azure cloud environment. Companies that still use the legacy Log Analytics Agent need to think about making the change in good time because it will reach its end of support in 2024. In this article, I look at how the previous agent and the new kid on the block differ and what you need to do to make the switch. Azure Monitor sees itself as a hub for bringing together a wide variety of monitoring signals, as a data repository for metrics, as a collection point for analytics services of various kinds, and as a visualization tool. Thanks to its smart alerting function, the tool is also a…

Cloud services generally have the reputation of achieving significant cost advantages over on-premises installations. However, practical experience shows that many companies fail to estimate the expenses they will incur and the expenses that will arise during ongoing operations. In this context, they also fail to analyze existing services to identify a potential for optimization. Cloud costs can only be meaningfully evaluated by comparing them with the value they generate; that is, optimizing cloud expenses is always related to optimizing applications and balancing performance and cost. Optimization depends on understanding the application performance and the value of all workloads running in the cloud. In this respect, it is no surprise that solutions in the fields of cost, performance, and capacity management are becoming increasingly important – especially with the cloud and…

HTTP/2 is the second version of the hypertext transfer protocol and brings two significant improvements: more efficient network resource usage and reduced latency. Latency (the elapsed time between the user sending a request to the server and receiving the response) can either increase or decrease according to the way network resources are handled, so higher latency means a longer wait for the user. To reduce latency, HTTP/1.1 implemented a request pipelining technique, allowing TCP connections to send multiple requests without waiting for a response. However, although request pipelining facilitates concurrency, it does not avoid head-of-line (HoL) blocking, which occurs when a single data packet queue blocks subsequent transmissions while waiting for a response. This phenomenon affects both the TCP and HTTP protocols, so it appears at both the Transport and…

A new CISA directive requires agencies to “take steps to reduce the attack surface created by insecure or misconfigured management interfaces across certain classes of devices.” The Binding Operational Directive 23-02 (https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02), which outlines the steps required for compliance, defines a networked management interface as “a dedicated device interface that is accessible over network protocols and is meant exclusively for authorized users to perform administrative activities on a device, a group of devices, or the network itself.” “Recent threat campaigns underscore the grave risk to the federal enterprise posed by improperly configured network devices,” the directive states. SUSE Report Reveals Cloud Security Concerns The majority of IT teams (88%) experienced at least one cloud security incident in the past year, according to a recent report released by SUSE (https://www.prnewswire.com/news-releases/suse-releases-securing-the-cloud-industry-trend-report-revealing-challenges-that-threaten-cloud-adoption-301854386.html).…

GitOps is a paradigm or a set of practices that empowers developers to perform tasks that typically are done by the operations team. GitOps requires code to be declarative and uses Git as the single source of truth for the system’s desired state. The Git repository, in this case, becomes the core element for version control, code review, and automated deployment. Argo CD, a project of the Cloud Native Computing Foundation (CNCF), is a declarative, GitOps continuous delivery tool for Kubernetes. It leverages the Git repository as the source of truth for Kubernetes resources and applications’ desired state. GitOps is a way of implementing continuous deployment (CD) for cloud-native applications. It focuses on a developer-centric experience when operating infrastructure with the use of tools with which developers are already familiar,…

With application containerization on the rise, administrators face the problem of having to manage not just one platform, but multiple platforms. In hybrid cloud environments, different architectures are used in case of doubt. Clusters with Open-Shift, Rancher, or Amazon Cloud Development Kit (CDK) in the data center are teamed with Kubernetes cloud setups from Amazon, Azure, or Google. The great advantage of containerization is precisely that apps in containers work without any problems on all the platforms just mentioned. Therefore, administrators need just one thing: the perfect management tool to handle the mix of platforms. Although you can use tools like Ansible for distributing applications [1], another option is Open Cluster Manager (OCM). Test Environment with Kind If you want to evaluate tools for multicluster management, you first need a…

There are few better ways to learn about offensive security than by using intentionally vulnerable applications. One such application that has stood out in a crowd for many years and has seen some notable version upgrades over the last few months is Mutillidae II [1], now available to practice ethical hacking. Provided by the OWASP Foundation [2], the Open Worldwide Application Security Project is a cornerstone of cybersecurity on today’s Internet, providing an established community with educational training materials, along with an eye-watering set of tools to improve security knowledge. In existence for almost two decades, offered free of charge, and open source, OWASP Mutillidae II is quite a sight to the uninitiated. Built for Linux and Windows, it contains a staggering number of vulnerabilities against which to practice, along…

In the ever-evolving landscape of system administration, the need for effective cross-platform management has been consistently rising. Companies often operate with a hybrid infrastructure involving both Windows and Linux systems, which poses a significant challenge for system administrators. Enter PowerShell and Ansible – two formidable automation tools that, when combined, provide an elegant solution for the administration of such diverse environments. In this article, I provide an in-depth overview of how this hybrid automation approach enhances systems administration by streamlining configuration, orchestration, and management of multifaceted environments. The Need for Cross-Platform Management The IT landscape has changed dramatically over the years, with organizations now operating across diverse technological platforms. This mixed bag of technologies often includes Linux servers running web services or database systems and Windows servers managing enterprise applications,…

A few issues back, I examined the infamous label soup that is printed on modern SD cards, exploring the meaning of those arcane runes and the standards they represent [1]. The most common variants of performance speed found in stores today is summed up in Table 1 [2] in order of increasing speed, ranging from the now dated C10 (speed class 10) to the newest A2 (application performance 2). SD cards are advertised on maximum throughput – meaning sequential I/O. This choice is perfectly sensible given their primary application area is to store pictures and video. For computing, however, random I/O is a much more interesting metric. As SD cards careen toward ever faster speeds, it is important to remember that performance is achieved by the combination of the reader…

In early days, the public cloud – and especially AWS – was a good thing. People were able to shift large parts of their own IT equipment fleet to the cloud and seemingly save large amounts of cash because they no longer had to operate their own IT infrastructure. In the meantime, the tide has turned. As the workload running in the cloud has grown, the monthly bills from AWS have become horrendous, and because the company’s entire setup is now completely oriented on AWS and its various services, it is no longer possible to roll back. At the same time, many of the hyperscalers’ promises turned out to be more or less irrelevant in day-to-day operations. It’s a cool fact that you can scale a web server setup from 10…

FreeScout [1] is a comparatively young project and has only been under development for four years. The website does not reveal who exactly is behind the project. But GitHub at least explains the objective: The developers see FreeScout as a help desk and shared mailbox application and as a direct competitor to established tools such as Zendesk and Help Scout. Open Source with Add-On Modules FreeScout is based on PHP and MySQL and features an intuitive user interface. In terms of functionality, however, the software attempts a balancing act between a diverse feature set and free availability of standard features. As you would expect of any professional help desk environment, FreeScout maps typical support structures to first, second, and third levels. A help desk system is always going to be…

Virtual private clouds (VPCs) have seen Google and other hyperscalers revolutionize network management in the cloud. Although the process of dynamically creating and managing networks in on-premises IT can be very time-consuming – despite new developments such as software-defined networking (SDN) – cloud providers now offer APIs that can be used to create network constructs such as VPCs in next to no time. However, cloud networks are often managed by DevOps teams, and the level of knowledge in DevOps is not always such that all security concerns are diligently taken into account. Additionally, the field of network security is relatively wide and presupposes expertise in tasks such as creating VPCs and their subnets, routing, analyzing flow logs, setting up firewalls, and establishing threat detection. Such concerns prompted this look into…

Zero trust means testing everything you want to allow into an environment in which, initially, nothing is allowed. It is a very important aspect of the modern IT world. Protecting hybrid infrastructures, in particular, is more critical than ever, starting with security for data centers and extending to securing user devices. Somewhere in between sits a very important building block of the zero trust puzzle: identity and access. A strategy for responsible and up-to-date use of identities is more important than ever and not always easy in a world where, for decades, directory services exclusively stored user accounts and everything that went with them on domain controllers (DCs). These DCs continue to perform their duties in well-protected zones behind firewalls. In the public cloud, hybrid setups with Azure Active Directory…

If your organization manages a network that includes both Windows and Linux machines, you might want to implement a unified authentication mechanism. Many businesses rely on Microsoft’s Active Directory (AD) as their directory service of choice (see the “Active Directory” box). Microsoft AD has dominated the market for corporate access control for many years. Joining a Microsoft client to Active Directory is nearly effortless – you don’t need an ADMIN article to explain it. Adding a Linux system is still easy, but the process requires a few more steps. In this article, I first show you how to join a Linux machine to your Windows AD domain. Following that, I’ll use Active Directory as the main place to manage all users, making administrative tasks easier and less time consuming. I’ll…