ADMIN Network & Security的November/December 2021目录

When a large, monolithic virtual machine (VM) with all services is replaced by a group of several cooperating containers, each running only one service, containerized applications scale the number of respective containers as required to improve availability and performance and allow for the individual components of an application to be changed separately (e.g., to complete an update). Web applications are the classic example of a modern scale-out architecture. A number of containers handle the database back end, and still others host a classic network filesystem for static content. A scaling group runs the application’s web front end. Redundant containers with a message bus or a key value store provide communication for all the components involved. The front-end application developers can dynamically change and update their part of the application without…

Whether you are managing several multicloud-hosted machines or just a home server for hobby purposes, one thing matters: Stuff has to work. If it doesn’t, you must have a reactive way to become aware of it. A manual check is daunting and bordeline senseless. Observability is all about having a complete overview of and ever watchful eye on your infrastructure. The legacy approach of installing agents here and there has shown its flaws, especially when it comes to observing infrastructure data that the server application isn’t designed to monitor. A Metrics-Oriented Approach In Greek mythology, Prometheus is the Titan that gifted fire to humanity, but in this article, Prometheus is an open source application that, since its first release in 2016, has offered a new way to monitor and observe…

Kubernetes is considered the frontrunner when it comes to container orchestration, and no matter where you look, no potential successor is in sight – regardless of the flavor, whether OpenShift, Rancher, or plain vanilla Kubernetes. If you run containers, you will find it difficult to avoid fleet management with Kubernetes – not least because former alternatives such as Docker Swarm have now become virtually irrelevant. Kubernetes’ popularity admittedly also means that admins don’t have much choice if they are dissatisfied with the platform – and admins can find many things not to like. One often-cited criticism, for example, is the traditionally poor support for multiple tenants. In fact, the solution was never designed to manage the containers of many clients in parallel – a curse and a blessing at the…

The namespaces available in the Linux kernel enable what is by now commonplace use of containers in virtual runtime environments, such as with the LXC Linux container runtime or Docker. Manual use of these namespaces is, of course, possible but can be very time consuming because of the large number of options. If you want to start your installed applications in their own sandboxes by default, whether to enhance security or create unambiguous rules for individual applications, Firejail [1] is a useful option. Isolation Isolating important system resources with processes in their own namespaces has a long history in the operating system world. The chroot operation, for example, has been a way to isolate applications in the kernel as early as 1979 in Unix version 7. The term “isolation” initially…

Update management is not always easy in distributed infrastructures, especially if Linux servers are also deployed. On top of this, increasing numbers of companies are operating servers not only in local data centers, but in the cloud. In these cases, companies do not exclusively use Microsoft Azure, but also Amazon Web Services (AWS), the Google Cloud Platform, and other providers. Multicloud environments commonly exist, which adds further complexity to patch management. Thanks to Azure Update Management, admins can manage all of their servers together in a centralized, automated interface, keeping Windows and Linux servers up to date globally. Virtual machines (VMs) running on other cloud providers can also be connected to the patch service. In addition to Windows Server, the supported operating systems include CentOS 6/ 7, RHEL 7/ 7,…

Linux, as a multiuser operating system, can support a large number of active processes in each user session. To keep tabs on the resources consumed by individual users, all Linux distributions offer a wide variety of tools out of the box for monitoring processes, the CPU, and memory, including well-known utilities such as top [1]. If you are interested in what is happening on the network, you can choose IPTraf [2]; if you want more convenience and functionality, you can use Wireshark [3]. Even though some of these tools have a graphical counterpart, they all run as plain text applications on the command line. In some cases, the ncurses library provides a slightly more elegant interface for user interaction. However, bpytop [4] takes a slightly different approach. As the name…

A common fiction is that containers with arbitrary applications appear practically out of nowhere, and magical tools roll them out in a fully automated process and with the correct configuration. The developer’s apps then integrate seamlessly into Platform as a Service (PaaS) environments in the style of microarchitecture applications on the basis of OpenShift, Rancher, and the like and simply work because mesh solutions such as Istio ensure communication. Some would have you believe that you no longer need to worry about updates, because the fully automated continuous integration/ continuous deployment (CI/CD) pipeline ensures that new versions of services mysteriously find their way into the production setup of an enterprise. Reality, needless to say, looks far less rosy. Despite all the promises made by the manufacturers, it takes some effort…

Creating a graphical user interface (GUI) with the Fyne framework [1] requires some preparation, including installing the GCC compiler and a graphics driver [2]. You will also need at least Go v1.12. The command downloads and sets up Fyne v2. To get a first impression of the different Fyne widgets, you can take a look at a demo app [3] and its available controls. To download and launch this Fyne demo, enter in the terminal. Basic Framework A few lines of code are all it takes to create a spartan window in Fyne (Listing 1). The import statement brings in the required packages. To create an executable program, line 9 defines the main() function as the entry point. The app.New() method creates a new Fyne instance, and the a.NewWindow("<Title>") method…

Metasploit: Just hearing the word brings sweat to the brow of some, whereas others regularly use this hacking tool to test their own systems for vulnerabilities (pen testing). This kind of level pegging in the cyber arms race is essential to maintaining secure operations – and not just for critical systems. Vulnerability management is a big market, and the skills of experienced pen testers are in demand; strategies for red team/blue team training and catch-the-flag setups fill entire books. The Metasploit Framework, a modular penetration testing platform that “contains a suite of tools that you can use to test security vulnerabilities, enumerate networks, execute attacks, and evade detection” [1], has been written up in a number of books. Linux Magazine reported more than 12 years ago [2] about how the…

A system is only as secure as its weakest link. Given the proliferation of innovations in a constantly evolving IT landscape, it is easy to lose sight of fundamental requirements for network security, especially with regard to the Secure Shell (SSH) protocol. The original version of SSH, released at the end of 1995, took a revolutionary approach to securing Internet communications and really knocked its predecessor, Telnet, off its pedestal. Since then, an even older protocol, HTTP, has been given a hierarchical trust model that enables secure interaction on any network. In contrast, SSH has not budged a single inch. Nevertheless, it remains an essential part of any Linux system and can still be found on virtually every Linux machine, despite its age of a good 25 years. Security in…

Although Linux has so far failed to make the big breakthrough on the desktop, the success of the open source project is undisputed. As the foundation for countless servers, it forms the backbone of the Internet. In conjunction with the Raspberry Pi and related small-board computers, Linux is just as much a fixture in Internet of Things as it is in the smart home. If you want to use Linux applications or develop scripts and applications yourself, you do not necessarily have to set up a full-fledged virtual or even physical system. Instead, you can set up a Microsoft or Google Linux subsystem. WSL Version 2 An article in this issue already looks at Microsoft’s version 2 of Windows Subsystem for Linux (WSL2) and its use with containers [1]. WSL1…

At the Dragon Propulsion Laboratory, we have long been looking for a meaningful CPU benchmark, beyond pure computational muscle displays and those architecture-bound demonstrations of number-crunching prowess usually favored by chip vendors. We have long relied on convenient load generators like stress [1] and its modern descendant stressing [2], but putting load on the system and summing its performance in a few numbers are not really the same thing: The latter helps compare systems, whereas the former helps test them. I think the search is finally over, and I am settling on data compression as a more realistic compute benchmark that does not look like a stress exercise for a vintage math coprocessor or a GPU. Comparing systems should always involve a real workload, and comparing an ARM with an…

ESET, a Slovak security firm, has discovered versions of the Hive ransomware for both Linux and FreeBSD systems. However, the encryptors that have been developed for these systems are still in development and are quite buggy. In fact, according to ESET researchers, both encryptors completely fail when the malware payload is executed with an explicit path. And in comparison to the Windows version of Hive, the Linux/FreeBSD iteration only includes one command-line parameter (-no-wipe). When executed without root permission, the Linux variation of Hive fails to trigger the encryption, because it isn’t capable of injecting the ransom note into the device's root filesystem. Hive is a ransomware group that has already affected more than 30 organizations but only counts their victims among those who have refused to pay the ransom…

The number of IT security incidents in the enterprise is constantly increasing, and the security of the internal infrastructure is a permanent challenge for many companies, whether the company’s Security Operation Center (SOC) maintains its own team for incident analysis – a Computer Emergency Response Team (CERT) or Computer Security Incidence Response Team (CSIRT) – or initially handles monitoring and incident response as a task itself. In addition to already fairly extensive tasks (e.g., keeping a constant eye on the infrastructure, detecting attacks at an early stage, and containing the damage attackers potentially could cause), SOCs also have other responsibilities. Incident management, authoring and monitoring situation reports, and information protection with classic risk management and business continuity are all relevant to risk prevention. As an analyst, then, you are dependent…

Some people say that keeping things tidy just means you’re too lazy to search. However filesystems are not fixed, not necessarily logical or self-explanatory, and can change over time. Even for the tidiest of computer aficionados, it can be helpful and indeed essential to use search functions to find what was once stored, even into the furthest corners of a deeply nested storage system. This capacity is especially important if you want to search through a large volume of files, the content of which you are not familiar. For this kind of use case, it makes sense to take a closer look at the search functions on desktop computers and their possibilities. The event that impelled me to author this article was the arrival of a 13GB bundle of compressed…

The Windows Subsystem for Linux (WSL) lets you integrate Linux commands directly into Windows Server and Linux containers and can even be used in Windows 10 Pro or Enterprise. I look at the necessary prerequisites, investigate how you can use Docker with WSL version 2 (WSL2), and even make use of Kubernetes in the process. Linux programs and commands can be used almost seamlessly in Windows with the help of the Windows Subsystem for Linux – even in containers. Installing WSL is easy. Most distributions are free, and it can be included as quickly as it can be removed. Even Docker can be used with WSL. Linux containers with WSL are only useful on Windows servers in the WSL2 version and currently not possible on Windows Server 2019. Windows 10…

The Domain Name System (DNS) was specified way back in 1983, eliminating the need for a locally maintained HOSTS file with name resolution entries and thus contributing significantly to the success of the Internet. The decentralized approach to resolving domain names into IP addresses began, as with almost all protocols of the Internet, without a focus on security. A good 10 years later, work began on the DNS Security Extensions (DNSSEC), which today allow the operation of a reliable and cryptographically secure DNS infrastructure. In addition to secure name resolution, DNS has established itself as a universal protocol for hardening network protocols. The best known application is probably secure email communication with Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and a combination of the two in the form of…

Even if you know your website can handle a load of 30 users a second or that more than 500 users causes a small fire in the data center, the big question is: Will the next release work under the same load? Finding an answer to this question offers peace of mind when getting ready to put up a new version of your software live in the middle of the Christmas season. When I first started down this path, it did not take much to imagine that I might not have enough power on my laptop or that the test server could run out of connections – but none of that happened. What I did discover was configuration errors in my Apache setup in the test environment. Testing can mean…

If you are running a Linux system, you will not have much trouble using either Docker or Podman as a container manager. The software is available from the repositories of almost all the well-known Linux distributions. However, the situation is different if you want to set up an environment for developing container applications on a Windows or Mac system. For this, you have to resort to external software. Docker Desktop [1] provides a Docker environment for these systems, with other components in addition to the Docker engine and the command-line client. For example, you also get the container orchestration tool Kubernetes [2] delivered free with the software. Older Systems Locked Out An older Windows or Mac machine, however, can be problematic. Docker Desktop requires at least Windows 10 or macOS…