ADMIN Network & Securityの July/August 2024 の目次

Copilot is integrated as part of Windows 11 22H2 Moment 4 or Windows 11 23H2. As with all new functions, Microsoft does not enable new services on all computers at once, but in several steps. Because of legal regulations in Europe, it might take some time before Copilot is available everywhere in Windows 11. That said, not all companies will want to use the artificial intelligence (AI) function in Windows 11. Wherever the feature is desired, effective management – including data protection – should always be in place. Windows Copilot is currently still at a very early stage. Microsoft can be expected to make significant improvements, also in terms of configuration options for administrators. At present, though, the control functions are fairly few and far between; I look at some…

Modern software-as-a-service (SaaS) offerings are highly dependent on external cloud providers to run and work reliably, but nothing comes without conditions or comes free, especially public cloud services. Nowadays, public cloud services are company cost centers, with strict measures in place to control costs. Like all modern distributed systems, all major cloud service providers go through major downtime now and then. Both cost-control measures and downtime hamper internal development, quality assurance (QA), and other dependent stakeholders by blocking productivity. These reasons are enough to consider emulating the required cloud services to unblock internal teams, keep them working on their goals with full control, and avoid any resistance or other unnecessary blocking requirements such as money, access policies, and so on. Cloud providers also started realizing these needs and started providing…

Microsoft defined the logical separation of user accounts with different authorizations at different levels in the Enhanced Security Admin Environment (ESAE) recommendation. Often referred to as “Red Forest,” it is still used in many companies today. Privileged company-wide administrator accounts are managed in their own forest and therefore isolated from the local administrator accounts on servers, workstations, and other devices. If attackers gains access to a local administrator account, their scope of action is limited to the validity of this one account; above all, they cannot get up to any mischief in the entire Active Directory (AD) enterprise. The continuation of this policy in the rapid modernization plan (RaMP) [1] supports admins in implementing the most important steps of Microsoft’s privileged access strategy as a replacement for ESAE. This plan and…

Administrators often first encounter the phrase “continuous development and continuous integration” (CI/CD) in the context of container-based setups with Kubernetes. Infrastructure as code (IaC) can also be on board as part of the strategy. IaC is exactly what the name suggests: the ability to describe a complete setup with a standardized format. Special software then reads this description and translates it into running resources, such as virtual instances or correctly configured containers. Numerous corresponding tools are now on the market, some of which can be combined but that compete with each other in many respects, as well. Spacelift [1] looks to help administrators by offering nothing less than the glue for perfect integration of various tools in the form of standardized APIs and the ability to deploy initial production resources…

MySQL 9.0 Released The MySQL team has announced open source MySQL 9.0 (Innovation Release), along with the first update of the 8.4 LTS (8.4.1): https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-1.html. MySQL 9.0 represents a major release with several important updates. For example, this release removes the mysql_native_password authentication plugin. This plugin was previously deprecated but now has been removed altogether. According to the 9.0 release notes (https://dev.mysql.com/doc/relnotes/mysql/9.0/en/news-9-0-0.html#mysqld-9-0-0-deprecation-removal): “The mysql_native_password authentication plugin, deprecated in MySQL 8.0, has been removed, and the server now rejects mysql_native authentication requests from older client programs which do not have CLIENT_PLUGIN_AUTH capability. For backward compatibility, mysql_native_password remains available on the client; the client-side built-in authentication plugin has been converted into a dynamically loadable plugin.” A recent blog post (https://blogs.oracle.com/mysql/post/mysql-90-its-time-to-abandon-the-weak-authentication-method) from MySQL Community Manager Frederic Descamps explains further, noting that the mysql_native_…

A network of universities (Universities of Ulm, Constance, and Tübingen, Germany) was looking for a new backup solution, but the requirements were tough. The new solution not only had to offer a simple and predictable license model, it also had to cope with billions of files and petabytes of data in all kinds of international character sets on thousands of computers with all kinds of operating systems at several locations in the country. Open and documented formats and interfaces were essential to ensure permanent, at least read-only, access to the data, and it had to allow the continued use of existing tape drives, including a large tape library. In the end, the people in charge opted for a proof of concept based on Bacula Enterprise Edition [1] by Switzerland’s Bacula…

For many self-managed Kubernetes clusters, networking is little more than an afterthought. Administrators install whichever network plugin they’ve used in the past, and as long as pods and services can be contacted, that’s the end of the matter. In this article, I describe the networking requirements of a Kubernetes cluster and how the Container Network Interface (CNI) fosters innovation and choice in this vital area. I focus on the open source Cilium network plugin, which is one of a few CNI choices that leverages eBPF (the successor to the Berkeley Packet Filter) to provide high performance, control, and observability. You’ll install Cilium into a test cluster and compare its performance in unencrypted and encrypted forms with that of Flannel, implement network policies, and observe their effectiveness with the help of Hubble,…

Ansible is one of the most popular tools for managing servers and other infrastructures. The use of Ansible to automate the management of AIX systems is an attractive idea. Although setting up Ansible to work with AIX might sound like a daunting task, it is far from complicated. Given that IBM has embraced Ansible as its tool of choice for automating the management of its Power servers, if you are looking for a flexible, powerful tool to automate your AIX administration tasks, Ansible is the way to go. Ansible collections are a way to package and distribute Ansible content, such as playbooks, roles, modules, and plugins. These collections help organize Ansible projects and share them with other users or teams. Ansible Galaxy provides collections for IBM Power AIX that are maintained…

A legal or litigation hold is a process an organization uses to preserve all forms of relevant information when litigation is reasonably anticipated. In Microsoft 365, you can use the eDiscovery tool with the Microsoft Purview portal to place content locations like Exchange Online mailboxes, SharePoint Online and OneDrive for Business sites, and Microsoft Teams on hold. Legal or litigation hold should not be confused with data retention policies. A legal hold is a process that an organization uses to preserve all forms of relevant information when litigation is reasonably anticipated. When a hold is placed on a content location, all existing content is preserved, and any content that is edited or deleted is also preserved, ensuring that all relevant data is available for the legal process. Data retention policies…

Traditionally the best language to implement command-line interface (CLI) shell utilities in Linux was Perl [1] – primarily because of its large collection of pre-existing modules, a resource unparalleled at the time called CPAN [2]. Things have since changed, with Perl’s popularity steadily declining in the eyes of developers and other languages rising to produce comparably large module libraries, as in Python [3] or Node [4]. Recent books have been published about writing shell commands in Rust [5], Python [6], Node.js [7], and even Go [8], and it is into this last language’s interesting performance testing facilities I shall delve deeper. Go famously includes a testing framework, but perhaps less well known is its equally impressive builtin performance testing facility. To start, the directories should be set up as presented in…

The European Union (EU) is extremely dependent on platforms from the US in particular when it comes to basic technologies. Recent reports indicate that the EU has lagged in terms of digitalization [1], although it “has narrowed the gap with the United States in adopting advanced digital technologies (EU 69% vs. US 71%),” despite disparities within the EU [2]. The EU and member governments have launched major funding programs in the field of basic digital hardware (chip technology), which is an ambitious project that will probably take more than a decade and require tens of billions of euros in investment. Dependencies are no better in other areas. The platforms for state-of-the-art, automated provisioning of virtual IT environments with cloud and container technology, which has enabled an enormous boost in quality…

Ever since the last millennium, the most common methods of deploying applications revolved around compiling from source or dealing with each respective distributions’ package manager. Terminal front ends then helped with the wider adoption of Linux by making software manipulation much easier for a range of users. Next, AppImage, Flatpak, and Snap stepped in, with literally no pause between their appearance and endorsement by mainstream distributions. Don’t forget about self-updating third-party libraries from standalone processes or about all the various firmware incarnations that exist! Even though it’s always possible to automate these processes (e.g., with anacron), in reality, ain’t nobody got time for that. Your security posture begins by religiously applying software patches; however, keeping an upper hand over the update and upgrade process on your stable of applications, not…

Logging and monitoring are essential components of managing IT infrastructure, particularly for Ubuntu virtual machines (VMs) hosted on Microsoft Azure. These tasks play a crucial role in ensuring the performance, security, and reliability of these systems. Proper logging captures detailed records of system events, providing insights that are indispensable for troubleshooting, performance tuning, and security monitoring. On the other hand, monitoring involves realtime observation of system metrics, enabling proactive management and quick response to potential issues. In the dynamic environment of cloud computing, where VMs are subject to varying loads and potential security threats, logging and monitoring become even more critical. They allow IT professionals to maintain a high level of operational excellence by providing the necessary tools to detect, diagnose, and resolve issues promptly. Setting Up Azure Monitor Introduction…

Microsoft has been using the Windows Assessment and Deployment Kit (ADK) as a drop-off point for various useful tools and developments for some time now. Unfortunately, the matching documentation is distributed across the Microsoft Developer Network (MSDN) and the official documentation is incomplete. The collection of links [1] can be useful because it points you to relevant documents and tutorials for the respective components. For the work in this article, I used a workstation with Windows 11 23H2; before proceeding, you should know that the ADK tools need substantial computing power. Microsoft last updated these tools in September 2023. The new features are not the main focus here, but I will point them out for more experienced ADK admins. Installing Windows ADK Microsoft’s deployment SDK is very closely tied to…

The Remote Desktop Protocol (RDP) is still one of the most important methods for remote access. In this article, I show you how to enable RDP and use it in an effective and secure way. As an admin, this means you can manage your Windows servers with confidence and without having to compromise security. In combination with the Windows Admin Center, interesting options open up for managing Windows servers directly from the desktop. Most of the settings described in this article also work on Windows Server 2016 and 2019, and on Windows 10 and 11, but I focus on Windows Server 2022 for the configuration. As things stand at present, the approach also works on Windows Server vNext/2025. RDP connections are primarily of interest for the graphical user interface (GUI)…