ADMIN Network & Security -julkaisun September/October 2025 -irtonumeron sisällysluettelo

Much like any customer-oriented job, system administration is a service industry position. Yes, you’re an IT professional, but customer service is your real job. I know that we all believe, falsely, that we work with computers. We tell the world, “I’m a computer person,” but in reality, “You’re a people person.” We are no different from restaurant waitstaff. We play a roll. We deliver service. We do things behind the scenes that one hopes will make our customers (users) happy and more efficient. Our job is to please them. Don’t roll your eyes or sigh: Allow me to recount an experience before you turn the page and look for something more technical to read. I recently related a story to one of my colleagues that described a situation where I…

Ansible is immensely popular among admins, not least because of its relatively easy-to-learn syntax. Anyone who has ever worked with Puppet or SaltStack knows the kind of infrastructure required to run these systems. Ansible takes a far more lightweight approach: All you need is SSH access to the command line – either directly as root or with sudo on the target system – to assume the admin role. Ansible does not rely on the complicated declarative syntax that Puppet uses. Instead, Ansible instructions are more like commented shell scripts that list the tasks to be performed step by step in exactly the same order in which they will be executed on the system. Moreover, you have the option of adding an explanation for each step. Enhanced AWX If you just want…

Goss describes itself as a tool for “quick and easy server validation” [1], which perfectly sums up its functionality. Configuring Goss is a breeze, and the checks are usually completed within a second. Plus, the financial outlay is zero thanks to the Apache open source license. On the downside, though, all the software really offers is unit testing (aka module testing or component testing). If a check fails, you will need to carry out an in-depth investigation to determine the cause. Goss has been testing Linux systems for almost 10 years, with support for Windows being added in 2020, although the Windows side still has some limitations (more on that later). In Docker, Goss runs its checks inside the container and outputs a report. Goss is not the first software…

Regular checks and comprehensive compliance are no longer enough to guarantee security in data centers. Because criminals are getting more savvy and their attacks are becoming increasingly complex and sophisticated, defenses need to keep pace. Proactive monitoring of network traffic has been the order of the day for some time now. Partly in the wake of AI, this approach involves identifying unusual activity from suspicious data packets in network traffic and taking preventive measures before an attacker can exploit the opportunity. Many services of this kind are on the market, Coroot [1] being just one that has made a name for itself (Figure 1). However, this tool is currently facing some reservations, particularly among European customers, because it can only be used if you are prepared to upload comprehensive information about…

Malware programmers can target significantly more potential victims by developing and distributing their products for Windows, so consumer protection organizations often do not mention antivirus products for Linux. This oversight does not mean the free operating system is secure. Although viruses, worms, and Trojans are less common on Linux than on Windows, they still pose a threat. For this reason, I look at some projects here that provide basic protection against malware for your Linux server with very little overhead. If your server is a file or mail server, the protection is even indirectly extended to connected (Windows) clients. If you already have basic protection on your Linux boxes, you can also check them for vulnerabilities with a security scanner. For environments in which high security is the order of…

When IT teams set out to monitor the Internet of Things (IoT), they too often settle for situations where, say, a networked sensor sends plausible measurements at an expected interval, which unfortunately means that admins could be overlooking critical scenarios. For example, the device could be repeatedly rebooting, which could mean a hardware failure in the making or that the battery charge is dropping rapidly because of the numerous reboots. Finally, operations managers could miss a device’s unusual communication volume, indicating that it is not just communicating with the application in the back end as intended but is also carrying out attacks against external websites as part of a botnet. The IT world at the edge and in the back end is networked over IP and can be monitored with the…

GNU Privacy Guard (GnuPG) [1] is an open source tool used worldwide for encrypting and signing mail and files. Its implementation and use can be challenging when it comes to distributing certificates on a large scale and authenticating their origin. Flexible trust models such as the hierarchical model with a trusted key as the trust anchor and optional trusted introducers for domain-specific authentication simplify management. The trusted key (certificate authority (CA) certificate) authenticates keys throughout the organization, while trusted introducers (intermediate certificates) add trust relationships to specific domains in a targeted way. Further details and background information can be found in the GnuPG white paper on certificate management [2]. GnuPG forms the basis for other tools designed for different security requirements: GnuPG Desktop [3] and Gpg4win [4] are user-friendly desktop…

Historically grown environments often use more than one monitoring system. For example, production might use Zabbix, while research uses Ganglia with its computing clusters, and IT swears by Observium. In other cases, monitoring runs locally on each of the organization’s sites and, of course, the tools are from different vendors because the various sites purchased them independently. The Alerta [1] alerting manager collects messages from all of these systems, summarizes and de-duplicates them, and displays the results on a clear-cut web page. The Alerta web view gives you the messages from all the monitoring applications involved, sorting the messages by criticality. If you don’t want to commit right away, the demo page [2] will give you a taste of the features. Installing Alerta Alerta is based on the Python programming…

Microsoft Windows Server Update Services (WSUS) server role has established itself as an effective tool for managing Windows updates. However, if you take a closer look at the Windows ecosystem, the decision to discontinue WSUS was to be expected – the trend toward the cloud is clear. Moreover, Microsoft has not actively developed the features implemented in WSUS for some time now. No Immediate End Discontinuation announcements often trigger panic reactions in the Microsoft world, but if practical experience with Windows technologies teaches us one thing, it is that talk is often greater than the effect. The best example of this is the fuss surrounding the discontinuation of Visual Basic 6 (VB6); despite all the doomsday scenarios, VB6-based applications still run without issues on Windows 11. As a general rule,…

One of the most dreaded calls to be received by an IT administrator is that a former employee is suspected of stealing intellectual property or financial or personal data. Your task is now to discover the extent of the data loss. Although many large organizations benefit from the data loss prevention (DLP) technologies built into modern cloud offerings such as Microsoft 365 E5 licencing and Azure Rights Management, it is fair to say that not all organizations have the budget to implement such solutions, leaving them exposed to the real risks of data loss. Implementing DLP strategies and solutions can be extremely expensive, but Microsoft has some built-in tools that could be deployed to help alleviate the risks of data loss, even if you have a limited budget. One such tool…

PowerShell has established itself as an indispensable tool for admins. Best practices for creating efficient and reusable code dictate abstracting the code to create functions that can then be bundled into modules for logical organization and to make them easily accessible to all users. Modules do not just facilitate code reuse, they also help you keep track of complex scripts, while ensuring that the code remains well structured and maintainable. The question quickly arises as to how best to store these modules and make them accessible. Private Repository Security The PowerShell Gallery, a public repository, provides a platform where anyone can share their modules, with the advantage of making modules available to a broad community of developers. Of course, business organizations will typically want to avoid making their own modules available…

The idea of a dedicated terminal to investigate configuration inconsistencies and performance issues in a data center not thoughtfully configured with rackmount monitors and keyboards is an old one for me – I have been trying such tricks since the Acer Aspire One [1] made its first appearance. A low-cost netbook seemed like the ideal, all-purpose monitoring instrument back when its product line launched nary 20 years ago (Figure 1). Its underpowered early Atom CPU cannot support a modern graphical environment, but the intended use as a terminal in init 3 mode moots that concern entirely. Sadly, I am unable to fully enjoy my sharply configured, cutting-edge, Rolling Rhinopowered device [2] because my large hands are a poor match to a netbook’s smaller keyboard – especially when typing fast…

Microsoft Power Automate (MSPA, previously Microsoft Flow) enables automated processes between apps and services, which greatly simplifies tasks such as synchronizing data, sending notifications, and capturing information. Processes can be optimized and recurring tasks automated without manual intervention by connecting different services. Power Automate is intended for M365 admins, specialist departments, and business analysts, as well as users without in-depth programming knowledge. The user-friendly interface helps normal users independently create workflows to reduce the load on the IT department. Admins retain control, of course, and can enforce security policies and compliance standards. MSPA is not a direct alternative to scripting languages (e.g., Bash, PowerShell, or Python) but focuses on integrating a variety of services and applications by means of connectors. MSPA is ideal for automating business processes that span multiple…

In today’s IT landscape, everything has to scale: Bigger, better, more is the saying. However, this does not mean that classic high availability (HA) in the form of two-node clusters is a thing of the past. Usually, a legacy HA cluster steps in to ensure that central services required for platform operation survive failures and other issues. In some cases, the required services run directly on dedicated hardware with Linux, but it is far more common to assign the service to virtual instances and let a cluster manager manage them. The combination of DRBD, Pacemaker, and KVM with Libvirt is established and reliable but not particularly popular, mainly because of the Linux HA stack (see the “Linux HA Stack” box). DRBD is a convenient alternative for most administrators. On many…

Countless organizations around the globe rely on Entra ID (formerly Azure AD) as their identity provider to organize authentication and access management for cloud and local applications, but it is precisely this widespread use that makes Entra ID an attractive target for attackers. The reason is clear: An attacker gaining access to identity management can potentially open the door to a wide range of protected applications and data, which is why cybercriminals use everything they have to gain initial access to Entra ID – whether through phishing, credential stuffing, or exploiting misconfigurations. Once on the inside, they focus on gathering information, identifying targets, and preparing further attacks. Discovering Vulnerabilities AzureADRecon [1] is a useful tool, enabling the systematic collection of information in the Entra ID environment, including user accounts, groups,…

In the early days of the Internet, JavaScript and cookies were considered evil and dangerous constructs that could be misused to execute code and secretly store tracking information. Users who valued security disabled JavaScript and simply banned cookies, with few exceptions. Today, both concepts are an integral part of the Internet. Responsive web applications can be created quickly with the use of comprehensive libraries and APIs on the server for all communication. Static API keys, JSON web tokens (JWTs), or simply session cookies, which are essentially dynamic API keys, are used to secure user activities. Session cookies are small snippets of information that web applications use to reference temporary information about a user’s session, making it possible to identify a user visiting a website without the need constantly to re-authenticate.…

Installing a batch of new machines is easier said than done: It takes quite a while until all the new boxes are installed in a rack and properly wired up. Add to this the tedious task of installing an operating system on the new servers, and your on-site time increases significantly. In many places, organizations have switched to having the systems transported to the office first, where they are installed before wending their way to the data center. However, this often logistical challenge causes considerable delays in the process. Once the server is installed on site, reinstalling it in the office is no longer an option. You either have to make your way back to the data center or cobble together an ad hoc installation environment based on Preboot Execution…

A Domain Name System (DNS) name resolution configuration that is not carefully considered or simply incorrect will tend to cause a variety of problems on a network. Unstable server-based services on the network are just one direct consequence of a faulty DNS setup. If you use Active Directory, the functionality of DNS becomes even more important. Numerous examples illustrate why it is advisable to take a closer look at and optimize the DNS configuration on your network. Hacker attacks on name resolution can never be ruled out – the consequences being server system hijacking, users being lured into traps, or data theft. In the following pages, I look at a number of critical steps toward protecting your DNS. Best Practices Analyzer After the release of Windows Server 2025, Microsoft expanded…