ADMIN Network & Securityの May/June 2023 の目次

I have a small group of former co-worker friends that still maintain contact. However, our geographic diversity makes it impossible to gather at a local restaurant for those occasional intellectual exchanges. The other evening, we had a conference call to catch up on our jobs, families, vacations, and miscellaneous topics. One of the job-related topics we touched on was how our expectations of a job and job experience are often quite different. We decided we needed to modulate our expectations or sharpen our job choosers. Fixing one or the other would result in huge improvements in job satisfaction. Job satisfaction, to some, might seem to be an oxymoron, but it shouldn’t be. Job satisfaction should be more than just a phrase used by journalists and HR people; it should be…

Software’s primary task is to provide users with tools that enable them to perform typical tasks efficiently, getting more done in less time. To that end, Cyn.in [1] helps you improve communication and optimize the exchange of knowledge. A Virtual Appliance The Cyn.in Python-based environment is based on a Debian system, including an Apache web server, if you use the virtual appliance. From a technical perspective, Cyn.in is an add-on for the Plone content management system, which in turn is based on Zope. In the background, the Zope Object Database (ZODB) manages the objects. The easiest way to evaluate the software is to use the virtual appliance, which is available for download from SourceForge. Cyn.in is not particularly resource hungry. According to the developers, a standard system with 8GB of…

Sharing files is an important topic in team productivity. All employees need reliable access to required information for successful collaboration. Sandstorm is a security-hardened web app package manager built by a community of volunteers to run open source web applications [1]. Sandstorm’s server-side sandboxing lets you isolate documents securely with little to no effect on productivity. Security Risks in Modern Collaboration The trend in IT has been toward microservices. Ever since hardware virtualization became widespread, individual services have run separately on different virtual machines. Although hard disk space has always been comparatively affordable, virtualization comes at the price of memory overhead for a full-fledged operating system that gives you access to the physical resources of the computer through paravirtualized drivers. Modern platforms with container technology, such as Kubernetes, further optimize…

The Microsoft Azure Sphere platform for integrating microcontrollers with the Internet of Things (IoT) includes both the reference architecture for microcontrollers, matching operating systems, and a cloud service that takes care of updates. In this article I help you get started with Azure Sphere. Digitization and Optimization The significant trend of digitization is increasingly determining business life. Economic success often depends on a company’s ability to map and optimize processes in production and logistics. IoT and its professional offshoot, industrial IoT (IIoT), belong in this context as subsets under the digitization umbrella. IoT provides a link between information technology and the physical world, creating the basis on which software and artificial intelligence (AI) can be applied. For AI to acquire data in the physical world, measure and draw conclusions from…

Prometheus histograms provide a method for displaying the distribution of continuous values. They provide information about the range and shape of the data and are often used to calculate percentiles. To do this, data is divided into 100 distribution areas. The xth percentile is then the value below which x percent of the observations fall. The classical histogram metric divides a range of values into small sections (“buckets” in Prometheus) and counts the number of observations per area. In classical histograms, you first need to define these areas. Each range is represented by its upper limit. A range of 5s contains the number of all observations with a value less than or equal to five seconds. Besides the ranges, two other values are interesting: the sum total of all observations…

The idea of using honeypots to let attackers penetrate specially prepared systems in an effort to learn more about the attackers themselves and the methods they use is long established. The aim is to uncloak the perpetrators’ actions and, in particular, how they move around the network (lateral movement) or what information they access. Honeypots are also deployed to capture email spam. Email accounts created especially for this purpose are published in non-visible areas of websites. The assumption is that bots collect these addresses and use them to spread spam. The incoming email is bound to be spam and can therefore help improve the filter. OpenCanary [1] lets you set up network services quickly, and it notifies you when they are accessed. You have many options. On the one hand,…

Microsoft has broken the triennial update cycle for Exchange and does not expect to release a new version until the second half of 2025. By then, seven years will have passed since the release of Exchange 2019 in 2018. According to the people in Redmond, this postponement is mainly the result of the large number of security problems. For example, the Hafnium exploit in early 2021 exposed a vulnerability that affected many on-premises Exchange servers and highlighted how important it still is to maintain your on-premises Exchange installation. It took some time to eliminate the vulnerability on the majority of servers. To close security gaps more quickly in the future, at least temporarily, Microsoft decided to integrate the Exchange Emergency Mitigation Service (EEMS) directly with Exchange. Moreover, the Antimalware Scan…

Many clustering and high-availability frameworks have been developed for Linux, but in this article, I focus on the more mainstream and widely used Corosync and Pacemaker service and DRBD. If you follow along, you’ll learn how to configure an active-passive dual-node cluster that replicates local storage (accessed and written to/read from vital applications or services) to its neighboring node. In this way, you’ll be able to host and serve data requests, so long as a single node of the cluster remains online. High Availability As we depend more and more on technology and the services it provides, availability becomes increasingly important. In the recent past, hardware vendors and solution providers charged a lot of money for proprietary products that ensured a high level of tolerance for hardware and I/O path…

At first glance, Windows Server 2022 looks like a carefully modeled update of its direct ancestor, Windows Server 2019. Microsoft has clearly focused on evolution instead of revolution. However, a second glance reveals exciting new features, especially in the field of information security. Secured-core server sees Microsoft add no fewer than six components to its new operating system that boost the system’s security with minimal overhead. Whether an instance of Windows Server 2022 supports these features, and which ones, depends on the underlying hardware and whether you have a physical or virtual machine; the firmware and, in the case of a VM, the hypervisor, also need to be compatible. Differences Before I go into the details of and technical requirements for Securedcore server, I would like to prevent a misunderstanding.…

Safeguards for the IT infrastructure often neglect email as an attack vector. Although most companies run a spam filter, they pay far too little attention to phishing, and many companies have already fallen victim to data theft, espionage, and sabotage. The industry association Bitkom estimates the annual damage to German institutions by these attacks, which are carried out in an increasingly professional manner, at more than EUR 200 billion (~$163 billion) [1]. Although most companies focus their security campaigns on hardening their own infrastructures, they overlook the fact that the real threats lurk elsewhere: 85 percent of cybersecurity breaches are due to human error, and 94 percent of all malware finds its way to its recipient by email. More than 80 percent of security-related events are phishing attacks. Attackers have…

Many project management tools are complex and require large teams. Still, it is unwise for IT departments in small and medium-sized enterprises (SMEs) to do entirely without planning because the benefits massively outweigh the overhead. I look at project management from the theoretical and practical side and, after a brief introduction to the different types of projects, investigate how OpenProject can help IT managers. Project Management An entire industry focusing on project management has established itself in the enterprise sector. Scrum, Kanban, and many other approaches are promoted and sold along with tools and training. Major corporations have project management departments that dispatch their agile coaches to corporate departments on a needs-driven basis. However, project management is largely dead in the water in smaller organizations. SMEs are usually not interesting…

Metrics dashboards in Grafana or similar tools show you how your infrastructure is performing. Querying sensors gives you additional information (e.g., voltages, temperatures, and fan speeds) that you can use to analyze and protect against failures. In this article, I look at the tools you can use to query sensors. Previous articles looked into the use of tools such as InfluxDB, Telegraf, or Collectd to help retrieve metrics from running systems and visualize the results in Grafana. Thus far, however, the articles have focused on the basic software architecture of a TICK stack [1] (i.e., Telegraf, InfluxDB, Chronograf, Kapacitor; alternatively, TIG [2] with Grafana instead of Chronograf, or CIG with Collectd instead of Telegraf) and how to use it to collect performance data from your environment. In other words, you…

Thanks to Microsoft Teams on-board tools, the collaboration environment can be used to exchange documents. In many cases, the documents in teams and channels will need to be archived in a legally secure and audit-proof manner, at least temporarily. It might also be necessary to reuse documents in a deleted team later or protect them against editing while hiding the team from active view. Before you start archiving data in Teams, you need to think about the differences between backing up and archiving. In general, a backup is not an archive, because the data is continuously overwritten, and virtually nobody keeps a backup permanently. A backup is mostly used in the short and medium term and has the task of restoring deleted or destroyed files. Archiving means long-term storage. Archiving…

Millions of users communicate with central chat services such as WhatsApp or Telegram, entrusting their messages to a centralized platform and its operators. If this meets your needs, you can take the blue pill and pass on to the next article. But if you are interested in Matrix as an alternative, which enables chats without an external provider but still offers the established services, take the red pill and proceed. The choice between the red and blue pills is not quite as difficult for chat systems as it was for saving humanity in the 1999 movie The Matrix. However users are often faced with the decision as to whether they want to trust their chat and group communications to large corporations like Meta (Facebook, WhatsApp) and Alphabet (Google) or a…

The world of data storage has evolved over the years, and as the amount of data we generate and manage continues to grow, we need more efficient and scalable storage solutions. One such solution is object storage, which has become increasingly popular because of its flexibility, cost-effectiveness, and scalability. Object storage is a data storage architecture that stores data as objects, rather than as files in a hierarchical filesystem or blocks in a block storage system. Each object includes the data, metadata, and a unique identifier, allowing for easier access and management of large amounts of unstructured data. In this article I introduce you to MinIO, a popular object storage solution. MinIO’s source code is available under the GNU Affero General Public License v3.0, which means you can customize, extend,…

An architecture review is a good way to determine whether best practices are being followed in cloud design and, if so, whether your design or approach carries risks. As a cloud provider, Amazon Web Services (AWS) has developed data-based practices that are reflected in the structure and questions of the Well-Architected Framework Review. Over the years – the framework has been in place since 2015 – AWS has formalized matching test mechanisms. A questionnaire helps you apply this uniform compendium of best practices and lets you explore how well an architecture aligns with best practices for the cloud. Additionally, the framework provides detailed guidance on how to eliminate any vulnerabilities you discover. The goal of the Well-Architected Framework is to achieve a good application design in the cloud that is…

Password management tools such as KeePass [1] are hugely helpful when dealing with access credentials. The secure and encrypted database of the free, open source software lets you store your login credentials, including notes, links, and other information you need for access. To use this information, you only need the password for the password safe itself, making it far easier to manage passwords, especially when complex combinations are used. The benefits KeePass offers are great even if you only run it on a single computer. However, the tool is not only designed for single-computer use; you can use the database to store your credentials on multiple devices. The associated file is only a few kilobytes in size, even if it contains many entries, and the content is securely encrypted by…

Some particular strengths of the Zabbix monitoring solution are constant development according to user requirements, wide number of use cases, and wide range of integration options. Whether monitoring classic servers or arbitrary networks, operational technologies (OTs) and Internet of Things (IoT) devices, or modern containers and cloud-based infrastructures, Zabbix plays to its strengths. These strengths include multiple data collection methods and easy-to-define but extremely flexible problem detection and alerting. Additionally, Zabbix has attractive visualizations, a graphical configuration tool, and web and integrated business services monitoring with service level agreement (SLA) reports. The manufacturer of Zabbix distributes its software fully under the GPLv2. Every user, from private to large corporations, is given access to the same product; no enterprise functions are hiding behind a paywall. The Zabbix business model is based…

I have discussed load-generating tools on these pages from the very beginning [1] out of simple practical necessity. Setting aside the benchmarks themselves, the facility generating a load consistently over and over again is the most important tool in a performance tester’s arsenal. Amos Waterland’s stress [2] has long been my go-to tool because of its simple, reliable effectiveness, but I have been watching with interest Colin King’s promising stress-ng [3] since our time together on the Ubuntu Server team. Time to take the challenger out for a spin! The New King The newer stress-ng tool can be promptly installed with in Ubuntu Server versions dating as far back as 2015. Insuring a system is exercised consistently during testing is the tool’s primary mission, validating software response as well as…