ADMIN Network & Security -julkaisun March/April 2025 -irtonumeron sisällysluettelo

Zulip, Mattermost, and Rocket.Chat Spurred on by the huge success of tools such as WhatsApp and Telegram, increasing numbers of business users are now showing an interest in chat services as an alternative to email for internal company communication. Tools, bots, and plugins that integrate other applications directly into the chat forums are also useful. Office staff can discuss current business cases with coworkers in the team chat while a bot from the ticket system feeds information on currently open tickets and processing status. Slack is currently one of the most popular chat services for businesses, partly because it integrates with more or less any commercially available business application and tool. However, as with all cloud applications, you must be careful: Confidential company communications end up somewhere in the Amazon…

Application-aware batch scheduler The basic Kubernetes scheduler – kube-scheduler – does a great job of bin-packing pods into nodes, but it can result in a scheduling deadlock for the more complicated multipod jobs that are created by analytics and artificial intelligence and machine learning (AI/ML) frameworks such as Apache Spark and PyTorch. That means expensive cluster resources, such as GPUs, sitting idle and unavailable to any workload. Volcano scheduler is a Cloud Native Computing Foundation (CNCF) project that introduces the Queue and PodGroup custom resources to enable gang scheduling (i.e., the simultaneous scheduling of multiple related objects) and facilitate more efficient use of the cluster. Complex jobs run more reliably, and data engineers become more productive. In this article, I demonstrate default Kubernetes scheduling behavior with the use of short-lived…

Operating system images with bootc Container images generally only provide the components you need to run a specific application inside a container and do not include a Linux kernel, a bootloader, firmware, or similar components. Many workflows already in place create and manage container images for applications, typically with a zoo of tools that create an image, check it for vulnerabilities, and then publish it in a container store. This workflow would also be helpful for bootable system images – which is exactly where two projects, bootc [1] and bootc Image Builder [2], enter the scene. Containers for Operating Systems These bootc projects let you use the same workflow you have in place for application containers to create operating system containers. All you need is a containerfile or Dockerfile along…

Centrally manage configuration files Individual application configurations, saved in what are known as dotfiles, are hidden files typically kept in a user’s home directory. You can manage these files centrally in a number of ways. Applications usually search for their configuration either in a user’s home directory or in ~/.config, which is the default for the XDG_ CONFIG_HOME variable. It is part of the Cross-Desktop Group’s (XDG’s) generic XDG base directory specification [1], which includes several standards for the configuration of desktop applications and also applies to text-only applications. Of course, you’d be smart not to rely on your own configuration files being available simply locally but to store them centrally, as well (e.g., in a Git repository). A relatively easy approach would be to store all the dotfiles in a…

Post-Quantum Cryptography with TutaCrypt Quantum computing represents a seismic shift in technology, promising breakthroughs in numerous fields. But for cryptography, quantum computers are a looming threat. Experts are well aware that traditional asymmetric encryption methods are at risk from quantum algorithms such as Shor’s algorithm [1], which efficiently factorizes large numbers and could theoretically break RSA and elliptic curve cryptography (ECC). For symmetric encryption techniques such as AES, the quantum algorithm known as Grover’s algorithm [2] halves the effective key length, thus requiring longer keys to maintain security. The looming end of conventional cryptography has caused mathematicians to search for a new kind of encryption that will resist quantum attacks. In order to succeed in the post-quantum world, a new generation of cryptographic algorithms will need to avoid the dependence…

Self-hosted Pritunl VPN server with MFA A virtual private network (VPN) can typically be described as a solution that allows an encrypted secure connection, often referred to as a tunnel, to be established to a private network. Many people associate a VPN with remote working, whereby an employee would establish a VPN connection to their corporate network (e.g., from their home office), allowing them to access resources such as file shares, intranet sites, and internal applications securely. Although the prevalence of cloud solutions have certainly reduced the need for VPNs, deploying a VPN solution can be considered for many other reasons. In addition to secure remote access, VPN solutions offer enhanced security on free public WiFi, and they can also circumvent geo-restricted content by routing all Internet traffic over the…

Mobile hacking tool The story of Flipper Zero began in 2019 when Alex Kulagin and Pavel Zhovner set about raising funds for their business idea on Kickstarter. The rest is more or less history. Ever since Flipper Zero went viral on Tiktok as a “Tamagotchi for hackers,” there was no holding it back. The media have repeatedly associated Flipper Zero with the same potential applications: replicating electronic cash (EC) or credit card data and unlocking cars and hotel rooms. Smartphones can also be unlocked in a matter of seconds. Of course, these are just the applications that make a splash in the media. These capabilities have also given rise to criticism. In Canada, the device was banned for a time because of its capabilities. The government has since lifted the…

Denial of service defense The Hypertext Transfer Protocol (HTTP) forms the foundation for communication between web browsers and web servers. Slowloris [1] initially follows the usual procedure of an HTTP connection, but then disrupts processing of the request by sending an incomplete HTTP request at a very slow speed, as follows: (1) Slowloris uses TCP to open a client connection to the target server; (2) instead of sending a full HTTP request directly to the server, Slowloris begins a request and then continuously, but very slowly, adds headers without ever completing the request; (3) the server fields all of the header data and waits for the request to complete, keeping the connection alive; and finally, (4) because the server can only process a limited number of simultaneous connections, a…

Open source ticket system From the outset, OTOBO’s developers designed for efficiency, adaptability, and visual appeal. With features such as Docker support, dynamic forms, and full-text search, the software enables fast information extraction and can be customized to your organization’s needs. The free software makes full use of the possibilities of modern IT service management systems and offers a platform for an active community. The help desk system aims to be a cost-efficient technological alternative to proprietary products, to which its sophisticated features contribute. OTOBO [1] offers a range of advanced features for efficient and effective ticket processing. One of its key features is its ability to connect to Active Directory (AD) and other services that use the Lightweight Directory Access Protocol (LDAP) to support centralized management of user accounts…

Passwords, passphrases, and passkeys The classic password has a long history and the terms, along with the times, are a-changing. At the end of the day, everyone still uses passwords, but the term passphrase, for example, describes a different way of creating and remembering them. After all, every attempt to access something starts with a secret that has to be resolved and handed over. One part of the puzzle is the username, which identifies the owner. Under normal circumstances, the owner should be the only person who has the key to access. When generating a password, the user faces two challenges: the need to generate a secure password, and the need to remember it. Unrealistic Rulesets Bill Burr wrote the official password guide for the U.S. National Institute of Standards…

Anonymization and pseudonymization of data Data anonymization and pseudonymization are not just technical approaches but should be key factors in every organization’s data protection strategy. Whereas anonymization aims to modify personal data such that the data subject cannot be identified, pseudonymization aims to make identification more difficult by replacing identifiers with pseudonyms. These techniques are particularly relevant in the context of Europe’s General Data Protection Regulation (GDPR), which stipulates strict requirements for the handling of personal data, requiring businesses to implement robust mechanisms that ensure both data integrity and data protection. Implementing anonymization and pseudonymization techniques is technically demanding and poses numerous challenges, including ensuring data quality and usefulness after anonymization and providing protection against re-identification risks. At the same time, these techniques offer immense opportunities, particularly with a view…

Simplify your migration from Docker to Podman Commercialization of open source projects and haggling over licensing issues are gnawing away at the acceptance of free software. This not uncommon switch to a commercial future often sounds the death knell for the community’s willingness to participate in ongoing development. An unclear licensing policy on the part of Docker developers has led to many controversies in the past, and an audit clause now imposes an additional burden on IT departments. Little wonder then that Red Hat, SUSE, and other Linux distributions replaced Docker with Podman years ago. To future-proof your own IT infrastructure, you need to be able to plan for the long term. And long discussions about licenses are likely to be counterproductive. Enter Podman [1], the open source project that…

Identify malicious traffic with Maltrail As digitalization makes further headway into business processes, the vulnerability of IT infrastructures increases. Just one undetected vulnerability could open the door to potential attackers. Even if 100 percent protection remains an illusion, organizations need to be proactive in the face of an increasingly stressful security landscape. Maltrail is a free tool that can be a useful addition in your search for would-be attackers on your network. Detection Managing legacy intrusion detection and intrusion prevention systems involves a great deal of effort, partly because hybrid approaches consisting of intrusion detection (IDS), hostbased intrusion detection (HIDS), and network-based intrusion detection (NIDS) systems are required. However, managing Maltrail is child’s play. To identify malicious traffic on your network, Maltrail uses publicly available lists that point out critical…

Remote access with Tactical RMM The remote monitoring and management (RMM) process is slightly confusing because it takes the established term “monitoring” out of its usual context and uses it in a different way. Most administrators likely think instinctively of tools that monitor servers in the data center (e.g., Nagios or Prometheus). However, that’s not what RMM is about; instead, it focuses on an organization’s clients, monitoring them remotely with various metrics so that, if something goes wrong with a computer, the alarm bells sound for the admin in charge. Monitoring and, in particular, managing mobile clients require different tools and processes from monitoring static servers in a data center. In this scenario RMM providers enter the play: RMM is basically remote monitoring by an agent component with the option…

Designing a secure Active Directory Active Directory (AD) does not have a good reputation among many IT security specialists, and more than one admin thinks it should be removed as soon as possible. Of course, survivorship bias plays a role in such thoughts – infrastructures that require high-caliber specialists to rescue the day are ultimately those where the greatest discrepancy between lure for attackers and the degree of hardening exists. In this article, I use the term “hardening” to refer both to IT infrastructures themselves and to the people and processes involved in managing them. Active Directory can be run in a pretty much secure way if the organization involved is at least prepared to drop old habits and invest in a secure, state-of-the-art design instead of just in third-party…