ADMIN Network & Securityの September/October 2024 の目次

Every system administrator wants to automate the tedious and mundane tasks they must perform regularly. I love to automate the creation of HTML reports. I get a thrill out of creating timed scripts that fire off one after the other to perform elaborate tasks, such as moving or copying files, restarting services, downloading updates, performing system cleanup, archiving files, and so on. There’s just something fun about putting things in motion and watching them work without intervention behind the scenes while I research new services, scan performance data, and worry about how much disk space everyone consumes. But there’s a dark side to automation, too. Is it just me, or do we struggle with automation? As you deduced from the paragraph above, I want to automate tasks, but I’m convinced…

Storage management covers the key aspects of enterprise management of storage resources and the components involved, both on premises and in hybrid clouds and multiclouds, including functions for resource provisioning, process automation, load balancing, capacity planning and management, predictive analysis, performance monitoring, data replication, compression, deduplication, snapshots, and cloning. Other tools include services for cloud storage and container management systems such as Kubernetes and the like. In contrast, storage resource management (SRM) is a sub-aspect of enterprise storage management. From direct-attached to fabric-attached storage, SRM is typically more closely tied to deployed storage hardware, whether in the form of software-defined JBODs (just a bunch of disks) or self-contained intelligent storage arrays and subsystems. SRM also applies to hyperconverged environments and computational storage systems. Accessing Data A data-centric approach is increasingly…

Microsoft’s Exchange Team published a blog post on August 8, 2024, about decommissioning Exchange Server 2016. Although the intention was definitely not to make people switch to an open source groupware, the announcement was enlightening: Exchange 2016 is approaching the end of extended support and will be out of support on October 14th, 2025. If you are using Exchange Server 2019, you will be able to in-place upgrade to the next version, Exchange Server Subscription Edition (SE), so Exchange Server 2016 will need to be decommissioned at some point. If you plan to stay on-premises, we recommend moving to Exchange 2019 as soon as possible. [1] A long list of todos and caveats follows, including reboots after upgrade. No wonder Microsoft’s general strategy toward its cloud (Microsoft 365 and Azure) is worrying…

Whether the Internet of Things (IoT) or a server landscape, micro-services or cron jobs, applications produce all kinds of status messages that you need to collect and evaluate. Whether it’s an alert from the robot lawnmower, the abrupt termination of a long-running task, or simply a weather warning, storing the various messages centrally and evaluating them independent of their structure is always going to be a challenge (Listing 1). CouchDB can help with centralized acquisition and subsequent filtering of status messages (e.g., by number, hour, or source). Its main advantage, and one that it shares with other NoSQL databases, lies in the schema-free nature of the data. Each CouchDB dataset can have its own structure, as long as it can be mapped in JSON format. This freedom means that many…

Domain controllers (DCs) are a central element of the network architecture; they manage the authentication and authorization of user identities and computers in a Windows domain. Attacks on DCs can be carried out with a variety of methods, including pass-the-hash, exploitation of software vulnerabilities, and insider threats. A compromised DC gives attackers potentially far-reaching access to the network, including the ability to manipulate user accounts, change policies, escalate access authorizations, and steal sensitive data. Moreover, the integrity of the information stored on the network is at risk because attackers are able to manipulate or delete data. Therefore, you need to secure your DCs, as well as the servers and workstations that access them. The free Microsoft Security Compliance Toolkit (SCT) [1] provides an important basis for this endeavor. Active Directory…

Managing Linux systems centrally in a web interface is old hat rather than Red Hat, who has the Satellite server [1] in its portfolio to perform this function. With this software, you can map the complete life cycle of a system, from initial provisioning through the distribution of software updates and configuration files. Red Hat Insights [2] now offers a cloud service that takes the system monitoring and management approach one step further, especially in hybrid cloud environments. The service regularly analyzes Red Hat Enterprise Linux (RHEL) systems running the Insights client and proposes actions designed to eliminate potential configuration issues. Insights draws on various databases, and up-to-date common vulnerability and exposure (CVE) and error reports to do this. The databases contain both OpenSCAP-based rulesets for implementing compliance requirements and…

Often, users fail to back up their data regularly and synchronize backups. Of course, any data you store locally should also be stored on a remote mass storage device. If the local server or network-attached storage (NAS) is stolen or destroyed by natural events (e.g., floods, fires), the backups they store will also be lost. Because most companies and many private individuals now use cloud storage, it makes sense to transfer backups to the cloud, and Rclone [1] is the ideal solution. Strategy The standard command-line tool for backing up data on remote computers on the intranet is Rsync, but Rclone is far better suited for backing up data to the cloud. The learning curve is manageable because the tool is based on Rsync syntax (Table 1). Rclone can be…

Open Source AGPL Added as License Option for Elasticsearch Elastic has announced that they are adding the OSI-approved AGPL as a license option for Elasticsearch. “We never stopped believing and behaving like an open source community after we changed the license. But being able to use the term open source, by using AGPL, an OSI-approved license, removes any questions, or FUD, people might have,” says Elastic Founder and CEO Shay Banon in the announcement. Banon says the company chose AGPL because it is a widely adopted, OSI-approved license. Additionally, he says, “We chose AGPL because we believe it’s the best way to start to pave a path, with OSI, towards more open source in the world, not less.” Read more at Elastic (https://www.elastic.co/blog/elasticsearch-is-open-source-again). Sovereign Tech Fund Invests in FreeBSD Development…

The unabated growth of data that requires higher density data carriers has made storage one of the most exciting IT topics. Hard disks and solid-state disks (SSDs) have to be replaced every five years or so, creating mountains of electronic waste. Most of these components end up in the shredder for data protection reasons. Microsoft, for example, claims that it scraps millions of hard drives every year, which is not compatible with the company’s ambitious environmental goals of offsetting all carbon emissions completely in just a few years. This goal is unlikely to occur without improved storage. The proposed solution is Microsoft glass. Another solution proposed by the Italian protocol manufacturer ZettaScale is the Zenoh data protocol. Old Tech Tape, although considerably more durable than hard disks, SSDs, and flash…

The Winbind service offers various services for the name service switch (NSS) and pluggable authentication modules (PAMs). On the Windows side, Winbind communicates with the Local Security Authority (LSA), Netlogon, and Lightweight Directory Access Protocol (LDAP) services of a domain controller to localize user accounts, read user data, and ultimately authenticate users. You can use Samba’s own net tool, but also Realm [1], as the front end for joining a client to a domain. With Realm, you need to specify the --client-software=winbind option to ensure that the Winbind service and not the system security services daemon (SSSD) is used to join a domain. Cluttered Logfiles The primary Winbind process creates a separate child process for each logical AD domain that the service wants to access. Each process is also assigned…

Traditional enterprise virtualization clusters run on physical servers, on which Kubernetes clusters, whose nodes run on virtual machines (VMs), are then based. This kind of architecture is fraught with many drawbacks. On the one hand, two layers means additional license and subscription costs. On the other hand, both the VM and container layers virtualize resources such as networks and storage, which impairs performance in many installations. In some organizations, Kubernetes nodes already make up the majority of VMs in the cluster while the number of classic VM-based applications steadily decrease. The tide has turned from many VMs and a few containers to many containers and a few VMs. Kubernetes can take care of these remaining VMs with an add-on named KubeVirt, which allows you to remove the obsolete virtualization layer…

If you want to open access to SSH, and possibly even to users on the Internet, you need to harden authentication, preferably with a combination of key pairs, discoverable and non-discoverable credentials, multifactor authentication, authenticator apps, and other methods. SSH with public key authentication should be your default setting. Public Key Authentication To get started, you need to create an SSH key pair with the ssh-keygen command. Even now, the process is fraught with pitfalls: Given that massive attacks on RSA2048 are commonplace, you can expect RSA3072 to become the focus of cryptoanalysts soon. Anyone still using RSA with key lengths of 2048 bits or less needs to take action, urgently. In this article, I create a key pair with the use of elliptic curves (elliptic curve digital signature algorithm,…

An analysis of the critical networking components to optimize the performance and security of Linux workloads on Azure includes a look at virtual networks (VNets), network security groups (NSGs), and custom routing. In this article, I offer practical insights and best practices for IT professionals while delving into performance tuning through Accelerated Networking, traffic management with Azure Load Balancer and Application Gateway, and secure hybrid connectivity with VPN Gateway and ExpressRoute. Overview Networking in Azure is a critical aspect of managing Linux-based environments, given the growing prevalence of Linux workloads in enterprise cloud deployments. Azure, Microsoft’s cloud platform, provides an array of networking tools that are designed to support the unique needs of Linux applications. These tools allow for the creation of high-performance, secure, and scalable networks, which is important…

Originally, container platforms ran without persistent storage, but with users increasingly porting stateful applications to stateless container clusters, a solution for persistent storage was needed so containers could save data in a directory before crashing or stopping. This problem prompted the Container Storage Infrastructure (CSI) in 2019 to standardize a series of APIs that Kubernetes can use to request, modify, delete, and connect storage to one or multiple pods. Of course, storage vendors also provide CSI drivers that convert Kubernetes CSI API calls for the associated storage. CSI drivers control both legacy hardware storage systems and software-defined storage (SDS). In this article, I look at the most important open source CSI drivers suitable for small and medium-sized Kubernetes installations and specify their areas of application. A complete overview of all…

The unabated trend toward cloud-based infrastructures has given rise to many new web applications and services that differ in terms of their architecture from the legacy client-server model. Storage management is no exception, with object storage for virtually unlimited volumes of data on the rise in the form of services that offer compatibility with Amazon Simple Storage Service (S3) – or at least similar functionality. Microsoft is also looking to become a serious player in this field, offering blob containers, queues, and tables as storage for cloud-native applications in the Azure cloud. Azure Files is Microsoft’s way of implementing serverless, fully managed file shares in the cloud to integrate clients on Windows, macOS, and Linux over the Server Message Block (SMB) or Network File System (NFS) protocol [1]. (See the…

The zero trust model was published in 2010 by John Kindervag, who was employed by IT analysts Forrester Research at the time. However, the foundations for zero trust were laid down as early as 1994 by Stephen Paul Marsh in his doctoral thesis at the University of Stirling (Scotland). The strategy only really became popular in 2020 when, as a result of the coronavirus pandemic, many companies had to switch to home offices and new labor models at short notice, putting their previous safety solutions to the test. As a result, many companies defined zero trust as the core of their cybersecurity setups and launched projects to match. The steps from the basic model to a concrete implementation are painstaking, partly because the model was initially very network-centric (zero trust…

No matter what your technical problems, containers make everything easier, better, and faster – at least that’s the rosy promise of the glossy brochures. However, some distributors of container platforms that include Kubernetes provide an excellent tool that, once it has been rolled out, keeps on adding components that can quickly overwhelm newcomers with its complexity to cover various missing aspects of container operation. Each of these components, whether addressed by the tool itself or as an add-on, comes with its own system requirements and drags in other components that also need to be rolled out before anything else happens. The many solutions in a provider’s portfolio did not come about by chance but are part of a carefully developed product strategy. The idea is to cover every eventuality, discourage…

In most cases, the basis for collaboration is good communication and documenting processes, events, and results. Today, you have access to countless tools and frameworks for this process, often specialized for particular kinds of work. London-based Security Roots is the developer of the open source Dradis [1] software for IT security teams. The framework creates standardized reports specifically for security checks, helps teams prepare for penetration testing of IT infrastructures, and organizes the implementation and evaluation. Security experts often use an expansive kit of tools, each with its specific focus, when carrying out penetration tests. Although some of these tools support standardized output formats for the results, the penetration tester is then ultimately forced to compile and organize things on their own to create a comprehensive report for all the…

Files are often stored multiple times, unnecessarily hogging storage space on data carriers and in backups; therefore, data deduplication is particularly useful for file servers. Virtual desktop infrastructure (VDI) environments also benefit from this technology, for which data deduplication even offers separate options that I also cover in this article. The technology can use both physical data carriers and virtual disks, which means that deduplication can be used effectively in virtual environments. Once the feature has been installed, the connected hard drives are checked according to a schedule, and the deduplication rate is displayed in the Server Manager console. In this way, you can keep an eye on the success and utility value of deduplication for individual disks. Because you are not forced to deduplicate every single data carrier on…