ADMIN Network & Securityの September/October 2021 の目次

Every week that goes by, I read about some new technology, new device, new app, new security patch, or new something else for me to try. The speed at which developers create new or improved products is at such a pace that I find it difficult to keep up. I just don’t have enough hours in a week to try out every new thing that grabs my attention. It’s important to maintain one’s “edge” by reading, installing, breaking – I mean testing, and exploring the newest gadgets and the latest and greatest things that someone dishes out. Plus, I still need to devote time to my actual day job, a few games, watching Jeopardy, a bit of cooking, family time, and enjoying a few hobbies such as filmmaking and podcasting.…

The Automatic Certificate Manage  ment Environment (ACME) protocol is mostly mentioned in connection with the Let’s Encrypt certification authority because it can be used to facilitate the process of issuing digital certificates for TLS encryption. In the meantime, more and more systems have started to support ACME. Data transmitted on the Internet ideally should be encrypted. The Let’s Encrypt organization [1] has played a significant role in making this good idea a reality. Until a few years ago, obtaining an X.509 certificate was a fairly complex process, but this workflow has been greatly simplified by the Let’s Encrypt certification authority in combination with the ACME protocol. Anyone can now obtain a certificate for their own web service – or even other services – to ensure secure TLS communication channels. Basically, two…

One criticism directed at softwarebased storage solutions is that they lack functional management tools. On the other hand, if you have ever dealt with typical storage area network (SAN) or network attached storage (NAS) appliances from the established manufacturers, you know you can get a web interface with a few virtual traffic lights that show the data status as a signal color. If the light is green, you can sleep soundly knowing that your data is fine. These management tools by the established manufacturers not only provide information about the data status, they let you carry out certain operations in a safe way. For example, if you want to set up a logical unit number (LUN) in a SAN, the graphical wizard will guide you through this process without any…

If you want to take home a message from the coronavirus pandemic, one would be that it is acting as a catalyst for digitization in all areas of life. However, it is precisely this phenomenon that presents IT administrators with new challenges because environments are not only becoming more complex but also more diverse, which goes hand in hand with an increase in administrative overhead. Gone are the days when infrastructures could be managed manually. Modern infrastructure management environments open an opportunity for avoiding error-prone manual adjustments. Insiders have bandied about Infrastructure as Code (IaC) as the key to tomorrow’s infrastructure management for some time now. IaC is to be understood as an abstraction solution for managing the hardware and software components of an IT infrastructure. Machine-readable definition files are…

With ongoing developments in container technology in the area of data management and persistent storage, business-critical applications have been running in cloud-native environments with containers orchestrated by Kubernetes. A container is just a software box without its own operating system. Originally, a container would not only contain the app or microservice, but also all the necessary drivers, dependencies, and data the respective application needed to run. If the container was deleted, all that was gone, which meant that a data store was needed that would stay alive regardless of the existence of a container or its pod. PVs, PVCs, and Storage Classes Two variants are available: persistent volumes (PVs) and persistent volume calls (PVCs). PVs are static and defined by the admin in advance, belong to a Kubernetes cluster, and…

Deploying microservices with Docker is relatively easy. With very little overhead, you can complete complex software installations and offer services in your company. However, controlling an infrastructure that has grown very quickly can often be far more time-consuming than the actual deployment. The progressive use of microservices, and with it the need to provision individually customized ecosystems within containers, leads to a confusing update jungle. If something goes wrong in the process, an unreachable service is in many ways less critical than a service that is vulnerable to attackers. Possible downtime is then supplemented by close monitoring and fallback strategies. Regardless of how you manage your Docker containers – whether directly with Docker itself, with Docker Compose, or with one of the many other tools – you will want a…

Azure Active Directory Application Proxy (AAP) has found its way into many organizations during the pandemic as an approach to delivering internal applications quickly and securely to stay-at-home employees. Security comes from Application Proxy (App Proxy) integration with Conditional Access, which can enforce multifactor authentication (MFA) and ensure access from trusted, managed devices tagged as “healthy.” The architecture makes deployments simple. The proxy does its work with outbound network connections to the cloud only – central IT does not need to drill down into firewalls [1]. Many applications continue to make use of a full-fledged client architecture, according to which the client talks to the back end with special or proprietary protocols – or the back end cannot be easily published. In other use cases, especially when the client does…

For most use cases, email has long since replaced conventional letter mail as a means of communication. Companies in particular handle a large part of their correspondence by email, because it speeds up processes compared with snail mail; also, you can send arbitrary attachments. However, modern email programs can do more than read, write, and send messages. They can also integrate the messages into corporate workflows. The email program often serves as a personal assistant, because it usually also manages contacts and appointments and can forward data to enterprise software through various interfaces. Additionally, email communication can be automated, if required (e.g., allowing employees to send a vacation message to their communication partners). In this article, I take a closer look at what the common graphical email clients do in…

The Darshan [1] userspace tool is often used for I/O profiling of HPC applications. It is broken into two parts: The first part, darshan-runtime, gathers, compresses, and stores the data. The second part, darshan-util, postprocesses the data. Darshan gathers its data either by compile-time wrappers or dynamic library preloading. For message passing interface (MPI) applications, you can use the provided wrappers (Perl scripts) to create an instrumented binary. Darshan uses the MPI profiling interface of MPI applications for gathering information about I/O patterns. It does this by “… injecting additional libraries and options into the linker command line to intercept relevant I/ O calls” [2] (section 5.1). For MPI applications, you can also profile pre-compiled binaries. It uses the LD_PRELOAD environment variable to point to the Darshan shared library. This…

Among the number of burgeoning Kubernetes distributions available today is the excellent production-ready K3s [1], which squeezes into a tiny footprint and is suitable for Internet of Things (IoT), thanks to a binary of just 100MB. The perfect laboratory companion that offers immediate access to Kubernetes is the clever minikube [2]. Another distribution caught my eye recently when I was arriving, very late to the party, and tinkering with some fascinating Raspberry Pi tech: MicroK8s [3]. Two things jumped out when I spotted Ubuntu’s mini Kubernetes documentation. First, as with K3s and minikube, a software build suitable for ARM64 processors (e.g., which a Raspberry Pi uses) is available; second, the documentation prominently notes zero-ops infrastructure. I hadn’t seen terminology about hands-off operations software since Amazon Linux 2 extolled its virtues…

Every industry has a need to authenticate and secure digital communications. The topic of how to communicate securely, whether by a virtual private network (VPN) or over Transport Layer Security (TLS), immediately brings public key infrastructure (PKI) into play. This security infrastructure has spread globally as the most trusted technology to identify people and devices, as well as secure digital communications between participants. PKI is rightly seen as the entity that provides a trust anchor, which conversely means that a compromised PKI could render an entire digital communication system insecure. Therefore, up to now, organizations have implemented their PKI locally for security reasons. However, the need for scalability and lower investment or operating costs suggests outsourcing PKI to the cloud. IT security administrators do not have to make any security…

Many cloud providers vie for the user’s favor. Besides the top dogs, Amazon Web Services (AWS), Azure, and Google Cloud Platform (GCP), smaller regional or specialized providers are increasingly offering cloud computing resources, which is good for the user because competition is known to stimulate business and prompt price drops. Precisely because companies have a choice when it comes to cloud services, they will not want to bind themselves to a single vendor. However, very few professional cloud users click through the providers’ pretty web GUIs to roll out dynamic resources. The whole thing has to work quickly and automatically. All cloud providers, therefore, offer powerful tools for the command line, which can also be used to generate scripts that automate the rollout. Of course, this is exactly what could…

Different components of Microsoft 365 use different portals for managing services such as Teams, SharePoint, and Exchange, making administration difficult. With an arsenal of scripts and the appropriate PowerShell modules, however, many recurring activities can be conveniently controlled from the command line. Many companies use Microsoft Teams when it comes to enterprise collaboration. The system relies on Microsoft 365 Groups to assign permissions in Exchange, SharePoint, and in itself and to control its functions. Microsoft 365 Groups are stored in Azure AD and are managed there – including the memberships for internal and external users. It’s a good idea to start with Groups. Controlling Microsoft 365 Groups A new Microsoft 365 group can act as a team in different ways. You can either take the Exchange PowerShell approach with or…

Launching instances on Amazon Elastic Compute Cloud (EC2) can be a lengthy affair for those used to instant gratification, taking entire minutes to complete. Historically, Windows instances have brought up the rear by taking considerably longer to initialize than Linux-based instances because of sysprep and the reboot that follows. The open source world is somewhat more streamlined, but there is still considerable variance between Linux distributions, with one to two minutes being a reasonable expectation of first availability. One Ping Only, Please Trying to connect multiple times as an instance boots is inelegant. Fortunately, you can use shell-fu to script your way out of this. The BSD version of ping [1], notably on macOS, includes a convenient “one ping only” option (o) that I would like to think honors Sean Connery’s…

CloudLinux Rescues CentOS 8 From Vanishing Support CentOS 8 users were pretty much cast aside when Red Hat shifted the focus of the operating system into a rolling release structure. This left many users and companies effectively on their own. For instance, cPanel is no longer supporting CentOS, which means admins of that platform have been forced to look elsewhere. The problem is, there are a lot of CentOS 8 deployments running smoothly in the wild. What are those admins to do when the EOL comes for that server operating system? Clearly, they could migrate over to CloudLinux’s own AlmaLinux (https://almalinux.org/) or Rocky Linux (https://rockylinux.org/) (which was created by the original CentOS developer). Both of these options have simple-to-use commands to handle the migration from CentOS 8. But if you…

With increases in data growth and larger and larger servers, the need to back up systems efficiently is becoming increasingly urgent. A backup needs to be available and also be restorable in a timely manner. Establishing suitable strategies that look in detail at storage, networks, and the software used is important. In this way, peak performance in the backup process can be ensured, even for very large data volumes. Data backup is not a new topic, of course. In fact, it has already been discussed so often that it is encountered with a certain apathy in some places, which makes it all the more important to take a look at the current situation and talk about new possible types of data loss. A well-thought-out backup infrastructure can not only save…

Databases are the tech heart of the enterprise. If they stop beating, the entire work process usually grinds to a standstill, which is why it is so important constantly to maintain and secure your databases. I took a look at how this can be done with QUMBU [1] – new software by WSW Software for creating backups and maintaining the SQL Server database management system (Table 1) – and discovered that the developers have put a great deal of thought into ease of use and a planned approach. In the lab, I checked whether the software can measure up to the claim that these processes can be organized in an effortless and secure way. For this example, the tool was installed on Windows Server 2019; it will run on Windows…

For compliance officers and chief information security officers (CISOs), the motto of the day is clear: Container-based setups need no more and no less compliance and security than their conventional relatives; they need different but equally well-monitored compliance. A container environment is where the Open Policy Agent (OPA) [1] with its Kubernetes sidecar on the one hand and the Gatekeeper policy enforcement service built specifically for Kubernetes (K8s) on the other hand enter the play. Of course, Gatekeeper relies on OPA in the background, as well. In this article, I introduce OPA and its possible spheres of application and show how integration works with a sidecar or Gatekeeper in K8s. Flexibility If you ask developers and admins what they particularly like about containers, you regularly hear the same answers: Containers…

Security architects are familiar with breaking down infrastructure into different levels. The unauthorized transition of a user from one area to another is considered a security breach. Windows offers various protection mechanisms against remote and local attackers. Microsoft first differentiates between different border areas, or security boundaries, and defines separate protection goals for each of these areas. These protection goals not only determine the security of the rolled-out Windows instances but also how the criticality of security vulnerabilities is assessed. Consider a simple real-world data center example in which a physical area outside the data center is an area for visitors, another area is for customers, and two different areas are for employees, depending on their tasks. If a person enters the visitor area, for example, a transition to the…

Backing up and restoring Windows servers is considered a difficult undertaking when it comes to forests and domains in Microsoft’s Active Directory (AD) service. Software vendor U-Tools promises to make backing up and restoring AD environments easier with its U-Move tool. Backups are said to take significantly less space than with the native tools, and U-Move promises simpler migrations when switching to a newer version of the Windows Server operating system, cloning or copying an AD environment, or testing an isolated lab environment, as well as for production operations in the scope of a cloud migration. Before I proceed to investigate whether the manufacturer actually keeps this promise, just one more note: The primary purpose of Windows Server Backup and of U-Move is restoring domain controllers (DCs) or a complete…

In the past, many network administrators used pre-installed and expensive appliances for routing. Although this was used for a long time as a reliable solution, it is no longer suitable for more flexible use. For example, if you have highly virtualized server environments, the norm today, hardware appliances don’t really make sense. New approaches, such as network function virtualization (NFV) or software-defined networking (SDN), decouple networks from the hardware. Routing therefore needs to support integration into a service chain (i.e., the concatenation of the required services, alongside other functions such as firewalling or intrusion detection and prevention). Moreover, it used to take a large amount of space, power, and money to learn in a test environment how routing protocols work with real hardware routers or to recreate specific behaviors. Network…