ADMIN Network & SecurityJuly/August 2025的目錄

With hardware and operating systems becoming increasingly complex, you need to improve your system and network administration skills constantly. The admin’s daily grind involves deploying new tools to counter the growing complexity of faults and system failures. Special Live systems focused on problem localization and troubleshooting in heterogeneous IT environments can help you achieve this goal. I look at five distributions for your admin toolbox. The Concept As an operating system on the bleeding edge of technology, Linux has always been a pioneer in the field of Live systems. In fact, distributions designed for Live use on optical data carriers were first seen more than 20 years ago. In the meantime, USB flash memory has largely replaced the CDs and DVDs used in the past. They are not only smaller…

Operating your own artificial intelligence (AI) server in your data center offers a number of advantages over cloud services. One decisive factor is retaining complete control over sensitive company data, which will always remain on your network, which improves data security, and which helps you comply with strict data protection requirements, especially in highly regulated industries. Moreover, an in-house AI server enables consistent performance without dependencies on an Internet connection or external providers. Data processing latency is reduced, which is particularly beneficial for computationally intensive tasks such as image or speech analysis. Another advantage is the ability to customize your hardware and software environments. You can scale and configure your servers individually to meet the specific requirements of your AI applications, without being restricted by standardized services from cloud providers.…

Artificial intelligence (AI) model deployments are increasingly targeted by attackers aiming to steal sensitive data, tamper with models, or exploit computational resources. Security-Enhanced Linux (SELinux), a mandatory access control (MAC) framework, offers robust protection beyond traditional discretionary access control (DAC). In this article, we investigate the effectiveness of SELinux in securing AI workloads on Red Hat Enterprise Linux (RHEL) 9 through experiments simulating real-world attack scenarios. Our objectives are to evaluate the Linux security module’s ability to prevent unauthorized model modification, workload execution, data theft, and directory tampering. Prior studies have explored SELinux for securing enterprise systems [1], but its application to AI deployments remains under explored. Research on AI security highlights vulnerabilities in model files and compute resources [2]. Our work bridges this gap by demonstrating the role that…

Many administrators rely on Ansible for configuration management, but Rudder [1] is an interesting alternative that combines legacy dashboard functionality with configuration management. Put simply, Rudder handles two tasks at the same time in a webbased environment that monitors the configurations of your infrastructure components continuously in real time, presents a high-level summary, and supports ISO 27001 rules. Implementing an end-to-end configuration strategy can be challenging, which is where Rudder enters the scene. The tool is based on a simple framework that lets you apply specific low-level configuration patterns with the integrated rule editor. Like a modular system, Rudder uses basic configuration elements, and the graphical builder significantly reduces the level of technical wizardry you need. However, those who prefer a commandline approach can steer their environment at the console…

Traditional mobile telephony still plays an important role in the small and medium-sized enterprises (SME) sector, although traditional analog telephony has practically disappeared. The majority of long-distance calls are now made by Voice over Internet Protocol (VoIP), and the classic routers have long included small phone systems. In a private environment, this is the end of the story for telephony, but in a commercial environment you have to use other technologies. The requirements in offices with many phones for voice menus, queues, call forwarding, and other features go far beyond what the usual communication applications can provide. Open source advocates regularly cite Asterisk [1] as an alternative to a commercial phone system, but many people are wary of using it. Asterisk is a complex beast, and even connecting the software…

Algorithms are quite literally full of loops, repetition constructs meant to recycle code with iterating control variables. In artificial intelligence, machine learning, and computer graphics, these constructs are even more prevalent (if that is even possible!), with matrix operations commonly expressed as nested loops of scalar operations indexed over a matrix’s dimensions. Because of the inherent outsize effect of a loop’s body on any algorithm’s performance, a multitude of strategies to optimize loop execution time has emerged over the years. Often coupled to the hardware, and always dependent on the programming model and compiler in use, these optimizations are so well understood as to carry their own names. Loopy David Spuler’s recent works [1][2] feature the taxonomy of loop manipulation strategies that most closely reflects my own thinking. As I read…

Leap uses source from SUSE Linux Enterprise (SLE), combining stability and community developments for “Linux everywhere … for everybody.” Release 15.6 incorporates updated packages and removes unmaintained packages (see the Release Notes). The installer supports the system role Transactional Server, with an update system that applies updates atomically (as a single operation) and makes them easy to revert, if necessary. Note that YaST currently does not work with transactional updates because it cannot edit a read-only filesystem. Release Notes: [https://doc.opensuse.org/release-notes/x86_64/openSUSE/Leap/15.6/index.html].…

Automatic troubleshooting of failed network devices is just one practical example of automating network processes. For example, a sensor could continuously monitor the availability of a router by Simple Network Management Protocol (SNMP). If this router fails, an event is triggered and StackStorm [1] automatically starts a predefined workflow. The workflow, in turn, can include the following steps: Launch a ping test to ensure that this is not just a temporary connection error. If this contact attempt fails, restart the service. If this step fails, too, StackStorm sends a notification to the administrator containing the log data of the problem device. Such event-driven automation allows the detection of failures in real time and automatic initiation of actions, such as restarting services or blocking suspicious activities. These actions translate to a…

Admins prefer to discover vulnerabilities on their networks before attackers do, so it makes sense for those who look after these networks and AD to familiarize themselves with common tools that help them search for vulnerabilities. For the examples in this article, I use Kali Linux, which is a great starting point for penetration (pen) tests. Kali comes with a number of useful pen tools out of the box and can be installed on any Linux distribution and even on the Windows subsystem for Linux. I focus on domain controllers (DCs), which offer several services for targeted vulnerability scanning, including: ◼ Lightweight Directory Access Protocol (LDAP). By default, LDAP runs on port 389 (TCP/UDP) for unencrypted connections and on port 636 (TCP) for LDAP over SSL/TLS (LDAPS). ◼ Kerberos. The authentication…

In recent years, Linux containers have revolutionized the way developers and administrators roll out and operate applications. They usually come with Kubernetes in tow, which basically serves up a virtual data center, providing dynamic functions such as network and storage, which means workloads can be orchestrated by a fleet of systems. However, Kubernetes (K8s) is known for its complexity. The symphony of pods, services, namespaces, and volumes alone is enough to drive many a K8s newcomer to distraction. When you add custom resource definitions and endless YAML files, your frustration meter can peak out. An example quickly illustrates the complexities in rolling out applications in Kubernetes. To package a container with an application in a pod, add some persistent storage, and make the whole thing accessible from the outside, you…

Providers of cloud-based security systems often implement procedures on the server side to tighten vendor lock-in and prevent canceled subscriptions. Kopia [1] avoids this problem by implementing the backup system’s intelligence on the client side (Figure 1). Before I look at this structure in detail, let me just mention that Kopia uses a rolling hash in the background (i.e., a hash function that processes files sector by sector [3]). Layers Manage Storage The lowest hierarchical element in the Kopia architecture is blob storage, which is responsible for storing the raw data. Kopia currently supports a dozen or more different implementations [4]. One level above is the storage manager, also known as content-addressable block storage, which generates the hash functions mentioned earlier and is responsible for modularizing and encrypting the data…

Rackspace Launches OpenStack Business Rackspace has launched OpenStack Business, an open source, dedicated private cloud, focused on privacy, security, and control. According to the company, the fully managed solution offers “improved performance, enhanced security, and full operational support without the burden of managing infrastructure.” OpenStack Business is designed to work seamlessly with Rackspace’s previously released OpenStack Flex (https://www.rackspace.com/cloud/openstack-flex) to provide a “stable foundation for steady-state workloads.” Stated benefits of OpenStack Business include: Rapid deployment Dedicated performance License-free platform Enterprise-level support No vendor lock-in Read more at Rackspace: https://www.rackspace.com/cloud/openstack-business. SUSE Virtualization 1.5 Prime Generally Available SUSE has announced the general availability of SUSE Virtualization 1.5 Prime (https://www.suse.com/c/suse-virtualization-1-5-prime-more-value-less-lock-in/), with upgrades including an improved release lifecycle, more flexible patching and updates, and support for production-grade storage. “The release expands support for Arm-based chip…

Website monitoring has always been an essential part of IT monitoring, and today it is much more complex than in the early years of the Internet. Twenty years ago, a simple ping was often enough to check whether a site was online or not. Today, aspects such as load balancers, encrypted transport paths, and different HTTP versions play a role. For more than 20 years, monitoring systems have relied on the check_http tool that originated in the Nagios universe. However, this reliable little helper is now showing its age. With check_httpv2 [1], Checkmk now offers a new open source implementation for modern IT environments (see the “About Checkmk” box). In this article, I show you how to monitor modern websites in detail, including all details of encryption, authentication, complex connection setups,…

Kanister, developed by Kasten and acquired by Veeam, has defined a number of objectives for its data management tool [1]. The focus is on application-centric backup, which, in concrete terms, means the target group is primarily users of specialist applications and not just those who deal with system-related infrastructure. The developers opted for an API-based approach to programming: All addressable tasks are abstracted by a well-defined API, which is also very easy to extend. ActionSets and Blueprints Like many other Kubernetes products, Kanister’s implementation is based on the operator principle, which made it easy for Veeam to package, deploy, and manage Kanister, providing a range of Kubernetes resource definitions. In total, Kanister comprises three main components: one controller and two custom resources – ActionSets and Blueprints. The workflow is shown…

In the realm of cybersecurity and network administration, understanding the communication landscape of a network is crucial. One of the fundamental tools for this purpose is a port scanner: a program that probes a host or range of hosts for open ports to help security professionals, network administrators, and ethical hackers assess potential vulnerabilities and ensure network integrity. Developing a port scanner can be an insightful project for programmers interested in networking, security, and system administration by providing hands-on experience with concepts such as socket programming, multi-threading, and network protocols. In this article, I guide you through the process of developing a simple yet efficient port scanner in Python, covering the necessary background, fundamental concepts, and step-by-step implementation that allows you to build a functional tool that can scan a…

When an organization has no overarching configuration or security policy, with no senior administrator overseeing systems management, you often find yourself constantly reacting to problems and reapplying the same fix over and over, such as manually renaming hosts, re-installing missing packages, creating custom partition tables, and handling different models of full disk encryption (or sometimes none at all). The accumulation of these minor deviations creates a quiet chaos, unnoticed by senior management until it becomes critical. The worst-case scenario occurs when a remote attacker infiltrates the local network. A vulnerability on a publicfacing Windows server can allow an attacker to gain initial access, and with the use of harvested credentials and remote administration tools, they can move laterally across the network, eventually compromising workstations and sending malicious email. Inconsistent auditing…

Understanding the path that data packets take across the Internet is crucial for troubleshooting connectivity issues, identifying bottlenecks, and ensuring optimal performance. Traditional tools such as tracert on Windows and traceroute on Linux have long been used for this purpose, allowing you to trace the routes taken by packets from the originating machine to a destination. However, as networks have grown more complex with the introduction of firewalls, load balancing, and cloud-based infrastructures, these older tools have shown their limitations. To address these challenges, more advanced alternatives have emerged. On Windows, Test‑NetConnection, a modern PowerShell command, provides a versatile and user-friendly way to diagnose network issues, offering not only route tracing but also port testing and latency analysis. On Linux, mtr (my traceroute) has become the gold standard for real-time…