ADMIN Network & Securityの September/October 2019 の目次

Junior system administrators have often asked, “How do you troubleshoot a problem when you have no clue where to start?” My answer has never changed: Start with the simple things first. This advice has helped me resolve every problem I’ve ever encountered over the past 20 years. Sure, some problems are difficult to solve, and some even seem impossible, but if you start with the simple things first, your chances of success are very high. People in general tend to complicate problems and solutions. They tend to reach for the least probable cause for a problem and then apply the least likely solution to resolve it. I guess it’s just human nature to assume that there is no easy problem or easy solution. I have found just the opposite. Most…

If you pay attention to security from the outset, you can avoid trouble farther down the road. No company can afford to ignore security, because successful attacks can trigger legal aftershocks in the form of lawsuits (e.g., for gross negligence) and fines, as well as lost revenue. Attacks can also destroy a company’s reputation. What customer would want to hand over their data to a company if the server doors are left open? Clearly, security is important, and you are well advised to consider security an implicit factor in your business plans from the outset. Kali Linux, one of the oldest tools for systematic penetration testing (pentesting), examines systems and applications for common and known errors. The distribution comes with various pentesting tools, which, unfortunately, also bestows the rather dubious…

A graphical user interface is not always available (e.g., when working with secure shell (SSH) on a remote server), and in some areas, data merely drips from the Internet. If you want to save bandwidth or work at the command line, you will appreciate a pure text browser. Browsh takes this one step further and even converts images and videos into characters. For this to work, the browser relies on a well-known friend in the background: Firefox. Shell Fan Many Linux users prefer the command line to a graphical user interface. If you are a die-hard shell fan and want to look up something on the Internet, web browsers like the classic Lynx that only deliver plain text on a page can help – and save bandwidth in the process.…

The end of the road is nothing like nigh for Google’s Kubernetes container orchestrator, reflected not least in sheer numbers: The May 2019 KubeCon saw 7,700 participants. Clearly, no manufacturer can ignore Kubernetes without being considered out of the loop. A veteran like Red Hat certainly can’t afford that perception, which is why they launched OpenShift at an early stage. OpenShift is an open source container application platform that, according to the manufacturer, is particularly easy to roll out and operate. Recently, Red Hat launched OpenShift 4. Of course, this version is bubbling with new features and far better than all its predecessors together – if you believe Red Hat’s PR department. However, does the product deliver what the manufacturer promises? How does OpenShift fit into Red Hat’s cloud strategy?…

Amazon Simple Storage Service (Amazon S3) is considered the mother of all object memories and, thanks to its great durability, availability, and built-in scaling, has been virtually unrivalled thus far. However, other providers now also offer S3 alternatives with interesting features. Like Amazon S3, Google Cloud Storage (GCS) is an object storage service for storing and retrieving data from anywhere on the Internet with a REST-flavored API (AWS S3 historically also supports SOAP and BitTorrent) or with a program based on one of the supported SDKs. In fact, GCS buckets and objects are conceptually similar to those in Amazon Web Services (AWS). As with AWS, anything you want to store in GCS must be dropped into buckets, which both organize data and control access. Deployment Scenarios Google Cloud Storage supports…

Brute forcing the web browser and the conversations it has with Internet-based resources now seems to be the primary hacking method. Although many people still use their Microsoft Outlook clients, the web browser is where most users store their credentials to check email, log on to cloud services, use social media, and generally do what they do every day. This means the browser and its subsequent transactions are the main target of credential harvesters worldwide. Credential harvesting is the practice of obtaining usernames and passwords illicitly and then either selling them to the highest bidder (often on the dark web) or handing them over to an attacker – a relatively new practice. (See the “Have I Been Harvested?” box.) Traditionally, hackers were interested in compromising systems either smash-and-grab style or…

Change sometimes progresses rapidly: Just a year ago, Jenkins was the undisputed continuous integration and continuous deployment (CI/CD) king of the hill for the teams at DB Systel GmbH, Germany. Now, some groups are using GitLab CI with growing enthusiasm. In this article, I highlight why this change is taking place. The best practices described here result from daily work as a network of DevOps experts who support the transformation of groups that are looking to work as DevOps teams in the future or are already doing so. I describe the processes we use that you can also apply to your setup. CI/CD and SCM With every new release, an impressive number of new features are introduced to GitLab [1]. The core team has obviously taken up the cause of…

Most Internet services rely on the Transmission Control Protocol (TCP), an interprocess communication protocol that dates back to the 1980s, an era when data streams were more like trickles by today’s standards. TCP includes the SMTP protocol for email and HTTP/1.1 and /2.0; therefore, all TCP stack optimizations have a positive effect on performance. In this article, I take a look at the TCP initial window, which defines the size of the first packet, and thus of all other packets, sent over TCP. The first Request for Comments on TCP (RFC 793) dates back to 1981 [1]. One of the important aspects of TCP has always been that it maximizes the available network bandwidth. However, it avoids overloading the individual components in the connection or their buffers by splitting the…

Once upon a time, Facebook set itself the goal of offering its users a search option in their inbox, which meant storing a reverse index of all messages. At that time, however, no database would have been able to do this safely and inexpensively. The MySQL database used until then had reached its limits at a size of 7TB and more than 100 million users. Two Facebook programmers, Avinash Lakshman (one of the authors of Amazon’s DynamoDB) and Prashant Malik, set out to develop a completely new storage system that would bear up in the face of the huge amount of data and a high growth rate while being fail-safe, fast, and economical [1]. The result was Apache Cassandra [2]. Facebook released Cassandra in 2008 under an open source license,…

Over the years, Docker container software has caused a metaphorical tsunami among software developers and, along with agile principles, improved productivity and DevOps working practices to speed code releases. Docker has had an unprecedented global effect on how applications are built and deployed. Thanks in part though to an eye-watering rate of evolution in the industry, Docker is no longer the default container software. Some members of the commentariat have unfairly already read the company their last rites. However, in this article, I don’t ring the death knell for Docker’s fantastic container software, because in my opinion, it is far from receiving its coup de grâce. However, I do look at an alternative to Docker called Podman, its feature set, and some notable differences in its container run time relative…

The Azure cloud offers a variety of access options for resources. Many organizations outsource parts of their data centers to Azure and publish services such as websites, applications, or complex infrastructures as publicly accessible offerings or for users within their own organizations. Rarely are the scenarios so simple that they involve a single website or a single web server operated and published from an Azure virtual machine (VM). “Lift and shift” scenarios or complex architectures, in particular, often map various protected levels that force the isolation of diverse services and components. Classic data centers are rarely connected by any-to-any communication but are grouped into zones and protected. For demanding applications that comprise multiple components, databases, front ends, back ends, storage, microservices, and loosely connected external data sources, no one likely…

With limited time and resources, IT administrators generally focus on tools and issues constantly in the forefront. As a result, their understanding of the Domain Name System (DNS) might be only superficial. DNS is an elementary part of the digital world, and companies in almost all areas are now partially or completely dependent on services and data that would not be possible without networking over the Internet and local networks. Without DNS resolvers, which convert IP addresses into human-readable addresses, and vice versa, large IP-based networks would be inconceivable. The technology also offers great potential for IT security, which many organizations overlook. Companies often rely on external service providers, which creates unnecessary security risks and quashes the significant added value that could be generated by operating a DNS resolver. In…

At OpenVPN seminars, participants arrive with their own wishes and ideas. Although they are satisfied with the OpenVPN support for bandwidth limitation, simple high availability, and flexible traffic management, for example, one topic remains unclear and concerns all VPNs: How does the admin create and manage a simple secure sockets layer (SSL) public key infrastructure (PKI) for many users without spending a large amount of cash on service providers or proprietary software? The ideal solution would be open source – free of licensing costs and similar complications and definitely not cloud-or webservice-based – in which the use of selfsigned certificates is not a problem. In-House Label OpenVPN [1] traditionally relies on Easy-RSA [2], of which version 2 is widely used. Many, especially the Debian-based, distributions install it along with openvpn…

Code Execution Flaws in PHP The PHP community has released updates to PHP in order to patch multiple vulnerabilities in one of the most popular programming languages. According to the Hacker News, “The vulnerabilities could leave hundreds of thousands of web applications that rely on PHP open to code execution attacks, including websites powered by some popular content management systems such as WordPress, Drupal, and TYPO3” (https://thehackernews.com/2019/09/php-programming-language.html). Out of all these vulnerabilities, the most critical one was found in the Oniguruma library that comes bundled with PHP. Red Hat released an advisory stating that the vulnerability “allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing crafted regular expressions” (https://access.redhat.com/security/cve/cve-2019-13224). If your projects use PHP, please update immediately. ESET Finds Malware That Targets Political…

Domain name system security extensions (DNSSEC) was meant to solve many of the known security problems in the domain name system (DNS) protocol, but it has not really taken off and is rarely used in practice, not least because of the DNS extension’s complexity. For example, if you look at an end user, a recursive DNS request is usually made to the DNS resolver at the user’s Internet service provider (ISP), because the browser itself does not know the IP address of a particular website. The information presumably is not already stored locally or in a cache ISP-side, so the ISP takes care of responding to the DNS request and forwards it through various other DNS servers until the request arrives at the server that has a corresponding entry in…

If your clients lose confidence in your ability to operate a system well and securely, you can experience considerable financial losses, especially after a successful large-scale attack. In the worst case, you could find yourself on the wrong end of a lawsuit if the question of gross negligence is raised. None of that changes in the cloud. Admittedly, unlike conventional setups, the challenge is no longer unique to the provider. All stakeholders share the responsibility for security: From the perspective of the platform, admins ensure that standards (e.g., meaningful network segmentation, software-defined networking (SDN), security policy enforcement, and other functions) are implemented and work as desired to provide security at the platform level. When rolling out their own applications in the cloud, customers and external service providers also ensure that…

Because of the way people perceive speech, Voice over Internet Protocol (VoIP) is a transmission-sensitive application that requires certain conditions in the network. Finding and fixing network problems on Open Systems Interconnection (OSI) model Layer 2 or 3 is almost trivial compared with VoIP analysis. In Internet telephony, the sources of error migrate to higher OSI Layers 4 through 7. VoIP also requires the correct interaction of all layers and thus increases the complexity of troubleshooting. Of particular importance is the end-to-end assessment of network parameters, such as available bandwidth, packet loss, delay, and jitter. In local area networks (LANs), a VoIP administrator can use a special VoIP analyzer to control the available bandwidth and the quality of voice transmission by monitoring the relevant network parameters (e.g., load, packet loss,…

In this column, I often make use of the stress [1] utility as a convenient way to generate load on a system’s memory, CPU, or storage subsystem. Although not the most sophisticated of tools, load generators like stress are simple to use and effective, because they provide a convenient way to load a certain number of CPU cores or to fill a predefined amount of RAM and do so in a manner that can be reproduced with consistency. However, you can find other minimalist ways to generate load easily with shell commands. For example, with the yes [2] command repeatedly outputs a string until killed and would normally be bound by the I/O speed of the terminal. Because the output is redirected into the oblivion that is /dev/null before it…