ADMIN Network & Security -julkaisun November/December 2022 -irtonumeron sisällysluettelo

In the middle of the past decade, it seemed that the leaders of the Open-Stack Foundation could hardly believe the success of their product. For a long time, OpenStack trade fairs and, above all, the OpenStack Summit were surrounded by something like a mystical aura: 8,000 participants and more regularly joined the private cloud computing environment camp to catch up on the latest technology. In 2012, an OpenStack sensation began that the industry had never experienced before, especially in the open source software context. A big bang is inevitably followed by a big hangover at some point, and OpenStack was no exception. Some participants even left the OpenStack party while it was still in full swing. Large OpenStack projects sprang up like mushrooms, fizzling out after months or years, and…

Despite cloud and file servers on the corporate network, users still store important files on the local hard drives of their workstations or laptops. Modern solid-state drives (SSDs) lull users into a deceptive sense of security: Thanks to technologies such as self-monitoring analysis and reporting technology (S.M.A.R.T.) and wear leveling, these data storage devices can predict their demise and usually warn the user in time before a disk failure. However, valuable data is rarely lost by spontaneous disk failure. More often, the cause of data loss is the users themselves accidentally deleting or overwriting files. If you travel with your laptop, you also have to worry about losing the device or damaging it irreparably. A device and its operating system and applications can be replaced quickly, but it’s a different…

Monitoring the performance of a website and fixing performance issues is a day-to-day job for sys admins. Ignoring this part of the job could result in the loss of potential customers. Siege is an open source benchmarking tool that can greatly help you in this regard. Benchmarking tools [1] perform standardized tests for accessing the relative capabilities of hardware or software and evaluating their results. Raison d’Stress Siege puts your website under different stress conditions and then evaluates the following performance parameters, among others: Availability of the server Response time Number of successful and failed transactions Throughput Important Note Running Siege against third-party websites and servers without the consent of the owner is an illegal practice. Siege has a distributed denial-of-service (DDoSing) effect; as such, it can bring down a…

As a compatibility layer, the Windows Subsystem for Linux (WSL) allows Linux binaries to run directly on Windows without any modifications. Users can call processes in Linux from Windows and vice versa with WSL, accessing files on both operating systems, sharing environment variables, and linking different commands. Two WSL versions [1] have significantly different architectures: WSL 1 makes use of a translation layer that implements Linux system calls on top of the Windows kernel and can be achieved on minimal Pico processes and providers (lxss.sys and lxcore.sys) managed by a kernel mode driver. On its WSL blog, Microsoft provides more details on the role and history of the Pico processes [2]. In WSL 2, on the other hand, the source code of the Linux kernel is executed in a virtual…

An Active Directory (AD) domain controller (DC) serves as a central logon server in heterogeneous networks with Windows, Linux, and macOS clients. This task does not necessarily have to be handled by a Windows server. The open source Samba service can also act as a DC. Heterogeneous networks with servers and clients running both Linux and Windows need a centralized management server for the user directory and a standardized protocol for network shares. Windows systems naturally prefer Active Directory for this purpose, but technologies such as Kerberos and Lightweight Directory Access Protocol (LDAP) for securing user and access rights are open source. The obvious choice would seem to be the open source FreeIPA directory server. However, FreeIPA mainly targets Linux systems and user and group management. FreeIPA lacks some features…

Fault tolerance has been at the forefront of data protection since the dawn of computing. To this day, admins continue to struggle with efficient and reliable methods to maintain the consistency of stored data, either locally or remotely on a server (or cloud storage pool) and keep searching for the best way to recover from a failure, regardless of how disastrous that failure might be. Some of the methods still being used today are considered ancient by today’s standards. Why replace something that continues to work? One such technology is called RAID. Initially, the acronym stood for redundant array of inexpensive disks, but it was later reinvented to describe a redundant array of independent disks. The idea of RAID was first conceived in 1987. The primary goal was to scale multiple…

Get the latest IT and HPC news in your inbox Subscribe free to ADMIN Update and HPC Update bit.ly/HPC-ADMIN-Update OpenSSL 3.0.7 Patches Serious Vulnerabilities OpenSSL has issued an advisory (https://www.openssl.org/news/secadv/20221101.txt) relating to two vulnerabilities (CVE-2022-3602 and CVE-2022-3786), which affect OpenSSL version 3.0.0. These vulnerabilities have been addressed with the release of OpenSSL 3.0.7, so users should update now. “Users of OpenSSL 3.0.0–3.0.6 are encouraged to upgrade to 3.0.7 as soon as possible. If you obtain your copy of OpenSSL from your operating system vendor or other third party then you should seek to obtain an updated version from them as soon as possible,” the OpenSSL team says (https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/). In a previous announcement (https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html), these vulnerabilities were described as “critical” — possibly leading to remote code execution. However, the OpenSSL project…

The Open Source Business Alliance (OSBA) Sovereign Cloud Stack (SCS) project was launched in 2019 to enable federation-capable cloud environments. In close collaboration between the community and OSBA’s SCS team, the project uses an agile approach to create the appropriate standards and a reference implementation. SCS [1] is an open, federation-capable modular cloud and container platform based on open source software. It builds on proven open source components such as OpenStack and Kubernetes in the reference implementation (Figure 1). As a platform, SCS provides the foundations for creating offerings that deliver full digital sovereignty. SCS Community The community comprises a wide variety of cloud service providers (CSPs) and their employees, people from the OpenStack community, and companies working on deliverables that are awarded through open tenders. Collaboration between the different…

In the age of home offices and distributed locations, companies want security solutions that can be integrated easily into existing infrastructures, offer genuine added value, and secure communications between mobile clients and sites. OpenVPN was long considered the measure of all things VPN, but the business model was developed at the expense of the community edition and has various restrictions. For example, the classic tool only supports its own virtual private network (VPN) protocol and does not offer support for natively integrated VPN clients from Android, iOS, macOS, and Windows. Fast SoftEther Alternative SoftEther [1], whose name contains elements of software and Ethernet, has something to offer to counter the aforementioned limitations. The open source VPN supports VPN protocols such as Secure Socket Layer (SSL) VPN, the Layer 2 Tunneling Protocol…

Ten years ago, reports of the decline of OpenStack would have been completely unthinkable. For a while at least, many people thought that OpenStack was a miraculous solution for most of their IT problems. From the perspective of 2022, many, if not most, of the hopes once associated with OpenStack (Figure 1) have not been met for the majority of users. In the Kubernetes era, OpenStack has shrunk massively as a project, with nothing like the number of developers actively involved as there were the past. Similarly, many formerly prominent and almost militant OpenStack proponents have scaled back or ended their Open-Stack involvement. This development also has its good side. In the course of the past decade, several large-scale OpenStack projects failed because expectations and requirements were more or less…

If you want to know what is happening on your network, the only way is to look at the connections between devices and to endpoints on the Internet. Popular tools such as tcpdump and Wireshark are useful for occasional analysis, but for permanent network monitoring and as an alternative to intrusion detection systems, Zeek is a very interesting tool. Network Monitoring Keeping track of device activity on the network is a routine task for IT administrators. Network monitoring is a large market comprising various tools, and vendors outdo each other with feature set claims, especially in the area of event processing and manual analysis. Zeek, the first version of which was released back in 1999 (known as Bro at that time) [1], is a kind of hidden champion. The declared…

Up to now, identity and access management (IAM) has mainly been the domain of larger organizations, but it is important for organizations of all sizes to manage digital identities (not only of their employees) and their access authorizations in an efficient and effective way. However, a chronic shortage of personnel in the midmarket makes it crucial to define their own IAM requirements precisely and select the right providers. IAM has the reputation of being complex; this opinion is sometimes justified, but by no means always true. This rumored, presumed, or perceived complexity, together with what are typically small IT teams in the midmarket, often make organizations reluctant to venture into the discussion. However, IAM is important for many reasons: security; regulatory compliance; more efficient processes for employees, business partners, and…

Gathering logs from distributed systems for manual searching is a typical task performed in high-performance computing (HPC) [1]. Log analysis is important for cyber-security, understanding HPC cluster behavior, and event and trend analysis. In this article, I address the state of the art in log analysis and how it can be applied to HPC. Origins Log analysis can produce information through a variety of functions and technologies, including: ingestion centralization normalization classification and logging pattern recognition correlation analysis monitoring and alerts artificial ignorance reporting Logs are great for checking the health of a set of systems and can be used to locate obvious problems, such as kernel modules not loading. They can also be used to find attempts to break into systems through various means, including shared credentials. How-ever, these…

ADMIN Magazine: The OpenStack Foundation has changed its name to the OpenInfra Foundation. Can you say something about the part OpenStack plays in this new setting? Thierry Carrez, General Manager at the Open-Infra Foundation, was involved in founding the OpenStack project as a systems engineer and still contributes to its governance and release management. A fellow of the Python Software Foundation, he previously worked as technical lead for Ubuntu Server at Canonical, operations lead for the Gentoo Linux Security team, and IT manager at various companies. Thierry Carrez: The foundation was originally created to host and promote the OpenStack project. In the process of doing so in the last 10 years, we assembled a wide community of operators, organizations, and developers interested in the concept of using open source solutions…

Containers, Kubernetes, Rancher, OpenShift, Docker, Podman – if you have not yet worked in depth with containers and Kubernetes (aka K8s), you might sometimes get the impression that you have to learn a completely new language. Container-based orchestrated fleets with Kubernetes have clearly proven that they are not a flash in the pan, but all of this omnipresent lauding of containers is getting on the nerves of many. Whichever provider portfolio you assess, it seems that the decisive factor for success is answering a simple question: How do I get my entire portfolio cloud-ready as quickly as possible? The problems and challenges inherent in containers and K8s are too often forgotten. I address this article to all admins who still view the container hype with a healthy pinch of skepticism.…

High-ranking Microsoft employees publicly making disparaging remarks about Linux is ancient history. Red-mond has changed its course 180 degrees and impressively demonstrated that its commitment to the development of open source software is not mere lip service. For example, GitHub, the platform for collaborative version management for countless free projects, was acquired by Microsoft in 2018. However, Microsoft does not just operate the platform, it also actively contributes to many projects as one of the world’s largest open source providers. Additionally, Microsoft has developed its own Linux distribution named CBL-Mariner – where CBL stands for Common Base Linux – which you will find on GitHub, of course [1]. However, CBL-Mariner is by no means designed to compete with established Linux distributions for general-purpose use. Microsoft mainly uses its in-house distribution…

Encrypting files ensures the IT security protection goal of confidentiality. Depending on which method you use, integrity and accountability can be ensured, as well. Asymmetric encryption is easier with Age than with GnuPG. In this article, I look at how to use Age and how you can use it in practice. The Role of Encryption IT security protection goals define requirements for data or the contents of files during storage or transmission. File encryption is useful and important in many enterprise scenarios. Encryption makes sense, and not just when you need to send data over insecure channels such as the Internet, but also for data that is no longer needed in everyday life or that is already backed up and no longer needs to be kept available in the clear.…

Active Directory administrators have a massive choice of tools, starting with the integrated administration tools on Windows Server and including a variety of free and commercial programs. This toolbox can be nicely rounded off with the free NetTools: in total, more than 90 utilities that simplify troubleshooting and administration. NetTools [1] notches some initial brownie points directly after you download its single EXE file. You don’t need to install a tool palette, with no dependencies on frameworks or DLLs. However, this doesn’t translate to a hodgepodge of command-line tools; instead, everything is available in a central management interface without the need for context changes. The only add-on is an INI file with work files for the current configuration and user-specific information. If nettools.ini does not exist, it is created at…

The US Department of Defense (DoD or the Department) created the Cyber-security Maturity Model Certification (CMMC) program to add a comprehensive and scalable certification process to verify the implementation of industry practices that achieve a cybersecurity maturity level. CMMC is designed to provide assurance to departments and agencies that the defense industrial base (DIB) contractor can adequately protect sensitive un-classified information such as federal contract information and controlled unclassified information (CUI). The US government is concerned with ensuring that the data and information their contractors receive is stored and used safely. This government-furnished information is more commonly known as GFI. Of great concern is the potential that government-furnished information will escape into the wild. The US government wants to protect itself and its citizens against the theft of intellectual property…

Excessive or just elevated temperature is sometimes the source of unexpected behavior in computing components – I faced it firsthand once, with runaway CPU heat burning through an older Slot I Pentium 3 processor. The cause was a detached heat sink, and some older hardware did not have built-in protection circuitry back then. I have also had fun experiencing intriguing boot failures from an overheating hard drive in a system equipped with one too many peripherals. In recent times I have taken a more preemptive stance, monitoring the heat build-up in a Raspberry Pi cluster as the case fan was replaced (Figure 1) [1]. To silence a desktop cluster, I replaced the built-in fan with a slower, silent fan made by specialty vendor Noctua [2]. Because the newer fan used…