ADMIN Network & Securityの March/April 2024 の目次

I remember when this whole agile methodology (Agile) thing hit several years ago. Project managers began spouting crazy new terms such as sprints, scrum, waterfall, and stand-ups. I’m not a fan of corporate buzzspeak, but Agile has brought a whole new hellscape into focus for those involved in so-called operations. Operations groups include system administrators, database administrators, cloud engineers, network administrators, and the like. We are the people who support systems and services. We are the ones who keep things going. We have hands on keyboards and are the folks in the trenches. In corporate speak, we are responsible for business continuity and day-to-day operations. The last thing we need is another pointless meeting – especially a daily meeting. Agile might work well for managing the rollout of a new…

No matter whose portfolio, solutions are lining up everywhere to bundle software on customers’ systems in Docker or other containers. Where applications installed directly on the system are still typical today, Red Hat Enterprise Linux (RHEL), SUSE Linux Enterprise Server (SLES), and the like will soon be no more than playback tools and comprise only a minimal system kernel and a runtime environment for containers. One reason these enterprises frequently cite for relying on containers relates to the security benefits the containers claim to offer. At first glance, this assertion cannot be completely dismissed. An attack on an application running in a container causes fewer problems from the administrator’s point of view, but planners and administrators would do well not to check the container security box too quickly. Even in…

Load balancers are a central component for operating web applications – for both VM- and container-based applications. However, their legacy character poses a number of challenges for admins, particularly in terms of operation and the required expertise. If the application is to meet requirements in terms of high availability and scalability, for example, a number of prerequisites must be met. Depending on the criticality, several data centers are required, with management and monitoring tools to match. A Layer 7 load balancer that works at the HTTP level is typically used for hosting web applications. However, this technology is also exposed to the challenges described above. Microsoft is looking to simplify this in Azure with the Azure Application Gateway (AAG). To avoid confusion, load balancers in Azure include: ▪ Azure Load…

Production Kubernetes clusters use several physical servers, whether the Kubernetes nodes run directly on the hardware or use a virtualization layer – although not actually needed today. Many articles published about Kubernetes rely on single-node setups for practical examples because it is what application developers primarily use. At the same time, the number of scenarios in which single-node setups also make sense in practical use is increasing. More and more users are equipping edge devices with a simple Kubernetes environment. On one hand, you can use a central cluster management system such as Open Cluster Manager [1] to manage these devices. On the other hand, you only need to develop and test your applications for a single platform: Kubernetes. A practical example includes merchandise management systems. The components for ware-housing,…

DevOps has been an integral part of software development in most organizations for years. The term encompasses various practices and tools and a kind of cultural philosophy that are intended to help automate and interlink processes between the development department and IT teams. From DevOps mechanisms, a further development has emerged in recent years: DevSec-Ops, DevOps plus security. In more detail, it means that security needs to play a role in every phase of the software development process: from the initial design through integration, testing, and deployment to delivery. The principle of moving tasks – security in this case – forward as far you can in a process chain is also known as the shift-left approach. In terms of containers, shift left means taking security aspects into account as early…

RustDesk software [1] for remote support and maintenance is a recommended alternative to the established relay servers from commercial vendors. The relatively new project offers source code on the GitHub platform [2] under the GNU Affero General Public License version 3 (AGPLv3). In this article, I look at the free version’s basic feature set. Relay Servers Depending on the operating system, Microsoft Remote Desktop Protocol (RDP), Apple Remote Desktop (ARD), and Virtual Network Computing (VNC) have all proven their value as protocols for accessing the graphical user interface (GUI) of remote computers on local networks. However, in today’s world, with remote work becoming increasingly common, remote maintenance software that communicates securely and reliably over public networks is becoming indispensable for companies. Regardless of whether users are looking for help…

An admin faced with the task of building a new mail server setup will commonly feel slightly disoriented and even discouraged. However, today, a stable and reliable mail server can be operated on any popular Linux distribution – provided you know what you are doing. In this article, I list the basic considerations that play a role in securing mail servers or that relate to the IT environment. Concerns People around the world have been sending and receiving digital messages for more than 40 years now. And the success of email drew the interest of crooks and thieves. Suddenly, unwelcome advertising messages, fraud attempts, spoofed sender addresses, and many other dirty tricks began to flourish. Since then, associations such as the Internet Engineering Task Force (IETF), which defines the standards…

A large language model (LLM) uses what is known as a transformer architecture, hence the name “generative pretrained transformer” (GPT). Put simply, an LLM represents each word used in a sentence as a series of mathematical vectors. The trained model comprises several layers of transformer encoders and decoders that put the vector groups of words from a sentence or word block in a suitable context. As the model learns, it creates encoders that suggest a connection between the vectors of terms (e.g., “ship” and “water” or “helicopter” and “flying”). During the learning phase, the LLM tries to build correct sentences. It compares these with the correct answers given by the trainer. The difference between the LLM’s response and the correct response is transferred to the transformer layers and optimizes the…

The horror scenario: Your organization’s data has been encrypted – in the worst case, after the data has been stolen and is at risk of ending up on the darknet. The measures used to mitigate the effect of ransomware can be broken down into two aspects. The first involves preventing attacks, and the second is all about slowing down the attack if it is successful. Both tasks require changes to workflows and processes involving administrative intervention that is not always convenient. Entry Ransomware has a limited number of vectors for entering the company network. Email and malicious attachments come first, but external access to the mailbox is also conceivable, with the manipulation of existing attachments. Many companies also have holes in the firewall that provide a direct route to the internal…

In many cases corporate IT is set up as virtual environments, which makes it all the more important to have recovery strategies in place for the IT landscape in the event of a disaster. Recovery is all about strategies and actions that help restore IT systems after a catastrophic event – be it a natural disaster, a hardware failure, or a cyberattack. The aim is to minimize data loss and get the services up and running as quickly as possible. Hyper-V is Microsoft’s server virtualization product that lets you run multiple virtual machines (VMs) on a single physical host. Because VMs often host critical business applications and data, fast and reliable recovery after a disaster is crucial. Microsoft Azure is a robust and scalable cloud platform ideal for disaster recovery…

Cyberspace is a highly dynamic place: New attack vectors are constantly coming to light, such as the infiltration of supply chains that back up software products (e.g., the SolarWinds incident) or the theft of a master key for Microsoft cloud services. Critical infrastructures (CRITIS) also need to face up to these threats. Almost inevitably an IT failure will be attributed sooner or later to a cyberattack. For example, the district of Anhalt-Bitterfeld (Germany) was unable to pay out social benefits to 157,000 citizens in 2021 after a cyberattack and had to stop most of its work for two and a half weeks. This incident prompted regulators to intervene and prescribe certifications (e.g., ISO 27001 [1]) and IT baseline protection methods. Adapting to Risk In this article, we look at an…

Ensuring the security of a company’s IT infrastructure becomes increasingly important as new threats and forms of attack continually emerge. Linux already has numerous tools for detecting anomalies in networks across platforms that evaluate logfiles, among other tasks. However, many of the security tools that make life easier for administrators are scattered across the Internet and not easy to find. The Security Onion [1] project addressed this shortcoming back in 2008. Originally based on Ubuntu, the security suite, which now runs in Docker environments, bundles professional tools for monitoring the IT infrastructure, including logfile analysis and intrusion detection [2]. The various ways of using the system include cloud images, which are intended for use in the Amazon, Google, and Azure clouds, and a downloadable ISO image that you can install…

Benjamin Franklin famously said,”… In this world nothing can be said to be certain, except death and taxes.” From this quotation, we can determine that he was not, in fact, a system administrator; if he were, he’d have added “software upgrades” to that list. MySQL is no exception to Benjamin Franklin’s famous quote. After all, on October 21, 2023, MySQL 5.7 entered end-of-life (EOL) status. Consequently, no patches or updates will be available from official sources, and although MySQL 8.0 has been in General Availability (GA) status since 2018, many users have not yet upgraded. Since you’re reading this article, you may very well be among them. Fortunately, with some planning, you can take the sting out of this particular mandatory upgrade. I won’t be able to discuss every breaking…

A recent trend in the WordPress realm is WordPress-specific control panels (see the “Overview” box). One of the advantages of these panels is the sheer depth of WordPress idiosyncrasies that are baked in and hidden from your average WordPress users. Another advantage is that the panels connect to server providers such as DigitalOcean, AWS, and others. The panels themselves do not sell server resources; instead, they connect you to your accounts at one or more CloudServer providers and allow you to install your WordPress sites there. Users of these panels can choose server sizes and server load (how many sites, what types, etc. go on each server). With this approach the cost of running a WordPress site can be as low as $1 per site when running multiple sites –…

Containerized environments are complex and comprise several layers, especially if Kubernetes is involved as a fleet orchestrator. Container security is a particular challenge because today’s cloud stack combines so many components from so many different sources, in a more or less meaningful way, that it is not easy to keep track of and identify security updates for the various sources, finding the ones that you need for your own environment, and installing them in good time. As if that weren’t enough trouble, more or less the same thing applies to compliance. Most glaring security issues are not caused by bugs, but by trivial misconfigurations that nobody notices in the review. If all the internal control processes fail, your own container landscape is left as open as the proverbial barn door…

Bottom (btm) [1] is the humorously named successor to top. Blending mouse interaction and keystrokes in a terminal window, Bottom is pushing forward a crowded, ever-advancing field led until recently by bashtop [2] [3], its more performant cousin bpytop [4], and many others [5] alongside the evergreen original top [6]. Rust-based, Bottom promises a more lightweight and highly customizable cross-platform experience; on macOS, install via Brew (brew install bottom). On Ubuntu, the choice of hosting packages in GitHub repos instead of Ubuntu Universe makes the command choice dependent on architecture in the apt path, but a straightforward Snap install is available: Refer to the project homepage for more details [7]. Kicking Tires Among so many options, what makes btm special? It provides immediate and time series monitoring of CPU, memory,…