ADMIN Network & Security -julkaisun May/June 2025 -irtonumeron sisällysluettelo

Intrusion detection and intrusion prevention are part of everyday life for admins. Solutions for these issues are basically very straightforward beasts that analyze data streams and use sophisticated heuristic methods to identify patterns that point to an imminent or ongoing attack. If any suspicious activity is noticed, an alarm helps you launch countermeasures at an early stage. The developers at Coroot [1] go beyond the usual intrusion detection systems (IDS) on the market today and offer a kind of artificial intelligence (AI) IDS as a service, revealing several interesting technical details that are worth a closer look. Dumb Systems The countermeasures of solutions typically found on the market today can be anything from simple packet filters to sophisticated firewall constructs. Firewalls, for example, leverage connection states as a parameter to…

Analyzing program file I/O is difficult and time consuming, especially if you have to change an existing program with a long history of different developers. Therefore, assistance from tools is important. Most existing tools (e.g., Darshan [1], Vampir [2], libiotrace [3]) are profilers that collect data during runtime and provide the collected data for later analysis. With the libiotrace profiling data, we developed an automatic analysis tool to find crucial patterns and to offer instructions to improve this pattern for POSIX [4] and MPI [5] file I/O (see the “Basics of File Access” box). The underlying problem is inefficient file access that can cause a program to use more resources and time than necessary. One type of suboptimal file I/O is inefficient file access patterns. Our script [6] can help with the…

WireGuard, the VPN server incorporated into the Linux kernel, has been available for some time and is becoming increasingly popular, replacing large VPN environments by traditional manufacturers on corporate networks. The main focus of WireGuard’s development was to reduce the number of optional connection, encryption, and authentication parameters to the required minimum and to achieve a very small codebase as a result. What WireGuard lacks to support professional use is a management interface that handles the major share of the integration work for admins and clients. The developers of the open source WireGuard Portal (wg-portal) [1] have set out to address exactly this problem. They are developing a web portal that supports admins, starting with creating the key material, through endpoint address management and routing configuration, to automatic access scheduling.…

Nobody enjoys patching servers – or at least I don’t know anyone who claims to – but everybody agrees that security patches are essential, at least for front-line systems such as web servers, firewalls, load balancers, mail servers, and so on. However, even in 2025, I still hear people saying (in essence): “You don’t need to worry, you know. These machines are inaccessible from the Internet and hidden right at the back of the LAN.” This setup could even work for a while, until someone right at the back of the LAN has the bright idea of plugging the fancy USB stick they found earlier in the lounge into their work PC or of opening what appears to be a totally harmless email attachment – after all, the company has…

In a previous article [1], I analyzed the problems that have given Active Directory (AD) a poor reputation among security admins. However, only a minor share of known vulnerabilities originates from the nature of AD itself. Many problems are the result of the default settings that Microsoft still delivers with AD; configurations and processes that admin teams implement in their AD organizations can be even more problematic. To design and operate AD as securely as possible – in the context of this article I talk about Active Directory Domain Services (AD DS) – it is very important to understand which of today’s cyberthreats affect AD, what goals attackers pursue, and what techniques they deploy to achieve their goals. The current talk can give non-experts the impression that an IT infrastructure…

A simple command-line application that scans one or more documents and saves them as images (JPEG, PNG, TIFF) and PDFs uses an SDK provided by the Not Another PDF Scanner 2 (NAPS2) developers, the C# language, and the. NET framework. NAPS2 is a free, open source, document-scanning application that allows users to scan, organize, and save documents [1]. NAPS2 supports various scanners and offers optical character recognition (OCR), batch scanning, and easy document editing, all with a simple, user-friendly interface. Although the NAPS2 application and SDK are cross-platform, the drivers and libraries related to the system’s graphical interface vary depending on the operating system. Therefore, the application in this article will be specific to Linux. However, you can adapt the code to a different environment by making a few simple…

Monitoring, alerting, and trending (MAT) are rarely at the top of the list of important topics for admins, but they simply cannot be avoided in everyday life. Experienced admins in particular will be familiar with the problem of Nagios and its numerous forks and offshoots, which used to be obvious choices for the prevailing IT landscape, being difficult to transfer later to containerized microservice architectures. In the meantime, much has happened in the monitoring world. Increasing numbers of solutions are capable of automatically identifying targets and adding them to their configurations. Instead of legacy event monitoring, trending is seeing more frequent use, to the extent that event monitoring is becoming a kind of byproduct. However, those who have ever worked with Prometheus and had to develop a strategy for the…

Shodan [1] is probably the best-known tool for assessing the threat situation for your organization’s network. Of course, Shodan can only check your network from the outside. Various tools such as Nmap, Masscan, or ZGrab can gain similar insights into the network behind the demilitarized zone (DMZ). The open source IVRE [2] tool provides a framework containing all the components you need to obtain results in a format that is just as clear and familiar as those from Shodan. Although IVRE lets you scan and map your IT infrastructure, it can also analyze the results collectively and display them for interaction. IVRE also imports the output of common scanning tools and merges it into its own database, which means you can integrate IVRE with your existing toolset. In this article,…

In the evolving landscape of system administration and network diagnostics, legacy tools often give way to more efficient, modern alternatives. One such shift involves the deprecation of the widely used netstat command on both Windows and Linux systems. Although netstat served as a cornerstone for analyzing network connections, it has become outdated, with its functionality being replaced by more powerful and flexible tools: Get-NetTCPConnection on Windows and ss (socket statistics) on Linux. These new tools are not merely replacements but advancements designed to address the limitations of their predecessor, offering improved performance, greater precision, and enhanced integration with modern systems. The Linux ss command provides a faster and more detailed way to view socket information than netstat. By directly accessing kernel data structures, ss delivers real-time insights into active connections,…

Kubernetes has taken the world of application infrastructure by storm. Whether you’re working with microservices, scaling cloud-native apps, or deploying containers, Kubernetes has become the go-to solution. Its flexibility and scalability make it a powerhouse, but honestly, it can be pretty heavy and complex. Lightweight Kubernetes distros like k0s, K3s, and MicroK8s offer a more streamlined and resource-efficient way to enjoy the power of Kubernetes without all the bulk. Many people argue that lightweight Kubernetes distros might lose their edge when faced with high-overhead computations, but as the saying goes, the proof is in the pudding. The real magic lies in testing to uncover the truth behind this debate and how they stack up against each other. In this article, I dive into some key differences and features to help…

If you work in cybersecurity, the mention of the word “compliance” invariably means that you are about to be subjected to a few hours of tedious, repetitive work. Ensuring that thousands of resources are compliant is no mean feat. These days, however, I definitely appreciate the need for systems and processes to meet external compliance frameworks and standards. To-do lists can often help you stay organized, and this is where compliance tools come to the fore. Putting a check mark next to non-compliant resources after you have remediated them is really the only way to ensure consistent security across modern cloud or on-premise workloads and infrastructure. In this article, I show you how to determine whether your Docker containers are compliant with the use of a fantastic open source tool…

If you derive a program component from a GNU General Public License (GPL) software package, you are obligated to publish your software under the same GPL license. However, if the program is a combination of GNU Lesser General Public License (LGPL) code and your own work, you are allowed to distribute the result under a new, potentially proprietary license. You would have the same options if you derived your software from a Berkeley Software Distribution (BSD)-licensed package. Although GPL, LGPL, and BSD are all free software licenses, they envisage very different types of use. To illustrate the fundamental differences in more detail, software licenses can be broken down into different categories. Outside of the open source world, proprietary software licenses are the norm, and they rarely follow a standard. Besides…

IBM has taken an active role in free and open source software (FOSS), in particular for Linux running on their Power servers. All modern day Power servers are now capable of running many different Linux distributions natively. Great, but what about the classic AIX operating system that still runs on so much IBM hardware? Over the last couple of decades, IBM has taken steps to build open support into AIX [1]. The AIX Toolbox for Open Source Software [2] is an IBM site that serves as the primary source of GNU and open source tool packages ported to the AIX environment. The focus of this article is to look at the most efficient method of managing FOSS on AIX with the DNF package manager. AIX Toolbox Today more than 400…