ADMIN Network & SecurityJanuary/February 2022的目錄

I think the primary thing that the pandemic has taught us, if nothing else, is that we miss each other. We miss gathering. We miss discussing. We miss learning. And we miss clinking glasses. Technology conferences gave us technonerds everything we could want in the latest in technology: the learning opportunities, the gathering of like minds, the toasting with beer glasses, and the geeking out over someone in a Storm Trooper costume or a modified DeLorean. Tech conferences gave us what we need most: each other. As a non-monetized sideline, I perform weddings. I’ve only done a few, but I’d love to do more. I customize the wedding for each couple. I make them personal, and the focus is 100 percent on the two people getting married. That’s why, in…

Your home directory (~) stores personal data and configuration files for the programs you use (e.g., the Google Chrome or Firefox profile and the GTK configuration for the look and feel you prefer for the installed desktop). Moreover, your home directory also contains Thunderbird mail, your music collections, and your photos. Like your own home, the personal folder on a Linux system is typically a place you want to keep safe. If you use more than one Linux computer, you will not find your personal files on all of these devices, and fixing this issue is by no means trivial. The question of what users can do to share their home directory efficiently with a variety of systems is not new. Systemd boss Lennart Poettering finally came up with a…

When questioned at work about how the test tool Gatling [1] compared with the somewhat old JMeter, I was at a loss for words. However, it did give me the opportunity to learn more about Gatling and eventually present another possible tool in the arsenal against weak servers and services. In retrospect, I’m not sure how I missed Gatling, which is no recent upstart. Gatling’s first stable release was in 2012, and only a few years later, its founder created Gatling Corp. to develop and maintain the software. Over the years, Gatling morphed into a product with both open source and Enterprise variants that can hold their own against other test tools. Yet, Gatling has taken a significantly different path from some of the other load-testing products such as JMeter…

It’s called high-performance computing (HPC), not low-performance computing (LPC), not medium-performance computing (MPC), and not even really awful-performance computing (RAPC). The focus is doing everything possible to get the highest performance possible for your applications. Needless to say, but I will say it any-way, processors and systems have gotten very complicated. Individual CPUs can have 64+ cores, and this number is growing. They are being packaged in different ways, including multichip modules [1] with memory controllers connected in various locations, multiple memory channels, multiple caches sometimes shared across cores, chip and module interconnections, network connections, Peripheral Component Interconnect Express (PCIe) switches, and more. These elements are connected in various ways, resulting in a complex non-uniform memory access (NUMA) [2] architecture. To get the best possible performance, you want the best…

IT administrators, no matter their level of experience, agree that managing mail servers is one of the supreme disciplines. Too many fragile system settings, too many pitfalls, and above all, public pillories in the form of blacklists if something goes wrong during configuration. All the more respect goes to the admins who successfully manage mail servers, keep them permanently available, and ensure that outgoing email reaches the intended recipient reliably. Microsoft in particular and the email service providers they control are considered particularly strict when it comes to accepting messages from third-party servers. Although some people claim that Microsoft is deliberately filtering third-party providers to boost the number of customers for its own services, this prejudice cannot be confirmed on closer inspection. Microsoft offers comprehensive information about blocking mail servers…

The COVID-19 crisis and 2020 have changed the world of work. In response to the virus, many companies introduced long-term home office work models for their teams for the first time. Today, it is clear that the legacy 9-to-5 working model in the office is a thing of the past for many. Even when new people join the company, their first day at work often no longer takes place on the company premises but at home. Employees need to be able to commission their devices into operation as easily as possible while complying with corporate security standards. Devices need to be directly subordinate to a unified endpoint management (UEM) system to ensure that they are configured in line with corporate policies. IT support can’t supervise employees while they are at…

An X Window System provides several components to allow users to interact with a graphical interface. An X server lets applications, also known as X clients, use a graphical display within windows. The window manager determines the look and feel of such an interface, as well as takes care of how the windows are handled (e.g., enlarging, reducing, or closing them). A desktop manager, which is ultimately responsible for bringing order to this kind of graphical interface, displays icons, menus, panels, and other elements on the desktop. Even though various graphical tools exist to optimally adapt your existing hardware to the X Window System, you can also do this from a terminal using command-line tools. You simply need to use the right tool to make the setting you need. In…

Linux Magazine: If you take stock of the last three or four years, what have been the most important innovations in systemd during this time? Lennart Poettering: That would be, firstly, all the security features we have added and made visible with the systemd‑analyze security tool. Regular system services can now be locked into effective sandboxes with relative ease, but can still be integral parts of the host operating system. I believe this has advanced Linux system security quite a bit. Another important innovation might be systemd‑tmpfiles and systemd‑—sysusers. Strictly speaking, they are more than four or five years old, but it is only in the last three or four years that they have finally seen more widespread use in the popular distributions. We are looking to move to a declarative description…

One of the most important goals in the development of systemd is securing Linux. Of course, you can only improve what can be measured, which is why Galileo Galilei advised: “Measure what is measurable, and make measurable what is not.” Following this maxim, systemd now makes system security under Linux measurable and improvable. More specifically, it is the systemd‑analyze security command that allows this measurement. When executed, it returns a table like that shown in Figure 1, listing each service managed by systemd (UNIT); a numerical value for the degree of protection (EXPOSURE, where 10 is both the highest and worst value); a verbal translation of this value (PREDICATE); and another version of the rating (HAPPY) in the form of an emoji. Additionally, systemd‑analyze can reveal how it arrives at…

The COVID-19 pandemic is credited with being a catalyst in the area of digitalization. Processes had to be digitalized within a very short time at a speed that previously seemed impossible. Virtually overnight, the importance of the role of IT administrator grew enormously, with administrators frequently benefiting from technologies that long since seemed outdated. Terminal services, an almost forgotten technology that allows home office workplaces to be set up with a minimum of time and effort, come from an age when clients were little more than simple character displays. For administrators, they are a welcome tool, because they allow simpler administration of centrally operated applications and settings than is the case with high-maintenance desktop computers. The use of classic terminal server technologies with one (or more) central servers promises optimum…

To be clear, the Community Edition of Nutanix was developed for testing purposes only; it is not a replacement for the production version. The Community Edition does not give you all the possibilities that you have with the commercial version. For example, the Community Edition only supports two hypervisors: Acropolis (AHV) by Nutanix and ESXi by VMware. The basic setup of a private enterprise cloud from Nutanix built on the Community Edition includes the hypervisor, the Controller Virtual Machine (CVM) and associated cloud management system, the Prism element for single-cluster management, and Prism Central for higher level multicluster management (Figure 1). With the Community Edition, you can set up a one-, three-, or four-node cluster. All other conceivable cluster combinations are reserved exclusively for the commercial version. The individual components…

Consumer-grade security implemented by software is cost effective for most users, who may install and run password managers, encryption tools, and other privacy programs for virtually no cost; however, software comes with limitations. Most users can live with these limitations, but if you are exceptionally conscious of your privacy or handle top secret data, you do not want to take any chances. Thankfully, you have alternatives to running your security applications in software only: Nitrokey. Enter the Key Nitrokey GmbH [1] is a German hardware company focused on security products. Its main product line is a variety of Nitrokeys, which are hardware authentication tokens in the form of pen-drive-sized units that connect to your computer or server over the universal serial bus (USB). The manufacturer offers a whole range of…

In man-in-the-middle (MITM) attacks, attackers place themselves between the victim and the targeted resources, putting them in a position to intercept, read, and possibly even manipulate communications. In doing so, the attacker does not have to redirect the traffic completely or impersonate the data target. Instead, they can sniff the data on the network and then let it continue to the intended target without interference. In other words, the attacker is in the middle of the data flow. As a result, many users and administrators do not identify these attacks until it is too late, because in most cases, network services are not disrupted by the attack. Services continue to run normally while the attacker accesses the traffic between the client and the server. Identity theft, faked transactions, or stealing…

Even if you don’t want to hear it, European IT is not necessarily known for being hyper-innovative – for a variety of reasons. Successful startups, for example, are far less likely to be launched in Europe than in the US, and not because no bright minds with smart ideas are on the east side of the Atlantic, but because of the structures of the industry as such. The muchquoted bon mot “we’ve always done things this way” contains more than a shred of truth. Anyone who has ever experienced a European IT company from the inside will know what I mean when I say that the impression is more of an archeological excavation site than a technology company. Wrapped up in this dilemma is enterprise devotion to endpoint security in…

If data loss under macOS is the result of defective hard drives, you need to adopt a structured approach for file recovery. Since macOS 10.15, the operating system has separated the system from the data, wherein macOS creates one volume for the system and one for data. Both storage locations use the APFS filesystem. Users only have read permissions for the system volume, which does not impose any restrictions on the user when working. At the same time, however, this provides better protection for the system. However, you do need to take this into account when recovering data and be careful when using recovery programs. Additionally, access to files and folders by third-party apps is restricted (see the “Security and Privacy” box). The protected directories include Documents, Desktop, the iCloud drive,…

As the Log4j vulnerability continues to wreak havoc on the IT landscape, everyone is trying to prevent disaster from striking. A number of companies and development teams have released tools to help with the detection and remediation of the vulnerability. One such company is WhiteSource. Their new tool, Log4j Detect (https://github.com/whitesource/log4j-detect-distribution), is an open source, command-line utility that scans your projects to detect the following known CVEs: CVE-2021-45046 CVE-2021-44228 CVE-2021-4104 CVE-2021-45105 Once the scan is complete, it will report back the exact path of the vulnerable files as well as the fixed version you'll need to remediate the issue. Log4j Detect should be run within the root directory of your projects and will also search for vulnerable files with both the. jar and. gem extensions. Log4j Detect supports the Gradle,…

The debate surrounding systemd, originally launched with the simple goal of replacing the ancient SysVinit scripts in most Linux distributions with a contemporary solution, has caused even venerable projects like Debian GNU/Linux to split into a prosystemd faction (Debian) and an antisystemd faction (Devuan). However you look at it, though, success has proved systemd originator Lennart Poettering right. No major distribution today would seriously consider replacing systemd with another solution. The init system’s relevance is dwindling in any case in the age of containerized applications. If MariaDB is just a container you need to launch, then the init system hardly needs to perform any magic. If you follow Red Hat, SUSE, and its offspring, clearly containers is where the journey is headed (see the “Container Advantages” box). A containerfirst principle…

Encrypting drives on Windows in user circles is still not as wide-spread as is prudent from a security perspective. Especially for mobile systems such as notebooks, hard drives should be secured with a transparent encryption solution such as BitLocker so that data is protected, even if a thief removes the hard drive and attempts to access it. System administrators should seriously consider taking advantage of the option to automate the setup and configuration of hard drive encryption. This is where PowerShell comes into play. Microsoft provides command-line tools and matching cmdlets in the form of manage‑bde and repair‑bde. Both the PowerShell cmdlets and command-line commands let you handle all the tasks and settings that are supported through the control panel. Although the BitLocker setting is now linked in the new…

The trend is moving away from stationary and toward mobile work-places. That said, it is still important for the IT department to manage all end devices efficiently. Because of all the different operating systems, a clear-cut tool for endpoint management is essential. VMware’s Workspace ONE [1] aims to integrate all of a company’s devices, including devices belonging to employees (bring-your-own-devices, BYODs), uniformly and centrally into the existing infrastructure with the help of a secure platform. The overriding goal is to organize application lifecycle management. The overall strategy is known as Unified Endpoint Management (UEM) and is one of the two core components of Workspace ONE. In addition to UEM, the second core component, Workspace ONE Access, combines the administration of users and user groups, the assignment of access authorizations to…

Microsoft introduced a number of new security features in Windows 10, but they are not available in all variants of the operating system. For example, features such as Windows Defender Device Guard – now Microsoft Defender Application Control – or Microsoft Defender Credential Guard are only available in Windows 10 Enterprise E3/E5; Microsoft Defender for Endpoint – formerly Advanced Threat Protection – is only available with Windows 10 Enterprise E3/E5, Microsoft 365 E5 Security, and Microsoft 365 E5. Also not to be ignored is that Microsoft only allows the Enterprise version to use group policies that can configure the Windows Store. Windows Update for Business The monthly patch day still causes excitement among many administrators, as does the question as to whether everything will continue to work as it did before…

Small embedded devices running Linux often face a trade-off between limited resources in CPU and RAM and the abysmal write performance of SD card storage with abundant capacity. The first rule, as I discussed back in 2018 [1] is to make exclusive use of high-quality SD cards for boot devices – a class 10 device or better for starters – with a reputable brand name printed on it. (I recommend SanDisk or Samsung SD cards.) Lower quality SD cards simply cannot satisfy the write pressure of system boot or other peak logging moments of operation, and while suitable for data, they cannot be used as boot devices. These are the basic table stakes, but this being Linux, you can of course optimize further! Test Bench I am going to discuss…