ADMIN Network & SecurityMay/June 2022的目錄

Today, I just have a special message for you: Do something. I know it’s much easier to do nothing. In fact, doing nothing is always the default action, but doing something is better than doing nothing. I’m no mathematician, but I’d say it’s about 100 percent better. Yes, there’s a story here, and it’s one you should read and heed lest you grow old without realizing your dreams. It all started when I went to college with dinosaurs and cave people in prehistoric times, aka the 1980s. Reagan was President. The recession was in full swing. Jobs were scarce. I wanted to produce and direct a vaudeville show. Yes, you read that correctly – a vaudeville show. Plate spinners, baton twirlers, bodacious burlesque acts, dog and pony shows, singers, dancers,…

Automation is not just “nice to have” in the data center – it is an absolute requirement. The much-cited shortage of skilled employees alone is forcing companies to use automation to free up development resources by letting well-trained employees get on with the interesting work rather than keeping them busy with repetitive tasks. Many admins today don’t even bother fully automating their own bare metal, in large part because of the cloud, which seeks to help admins forget all their worries. Yet it is precisely the cloud that impressively shows that many problems don’t disappear at all but simply mutate. However, automation in a cloud environment, called orchestration, has to work differently than on bare metal. Orchestration originally arose as a special form of automation, wherein a template file describes…

For decades, Microsoft Exchange has dominated the enterprise groupware market. Whether as a desktop, mobile, or plain vanilla web application, no competitor has been able to assert itself permanently against Microsoft Exchange. Possible alternatives have proved too clumsy and often lacked comparable features and scalability. Yet the market leader’s product has many weaknesses, which opens a huge market opportunity. A new player appeared on the market in 2021 with the launch of grommunio [1], which advertises itself as a largely complete replacement for Microsoft Exchange. Moreover, the startup promises features such as support for the Messaging Application Programming Interface (MAPI)-over-HTTP protocol, file synchronization (ownCloud), chat (Mattermost), and video conferencing with its own Jitsi fork (Figure 1). Exchange Exasperation Administrators with mixed feelings about Exchange are reticent to use it, and…

Wikipedia is famous not just as a large encyclopedia; the web software also helps users collaborate on online documents. Wiki markup (or wikicode or wikitext) lets you format documents with very simple methods and without the need to use special WYSIWYG editors or complex page description languages, as in HTML, XML, and LaTeX (for technical and scientific documents). Therefore, wikis are often used on local networks for documentation and internal document collections for code repositories, project management tools, and IT service management tools. The requirements for a wiki server are fairly meager. In most cases, you just need a web server and a database server. Some systems can even manage without a database. The learning curve for users is also low because the Markdown syntax for text can be learned…

Once your set of internal applications grows greater than an order of 10s, you can end up in a scenario where credentials storage for each service gets out of control. Users might start complaining about how difficult it is to handle multiple passwords, and your day could turn into a password reset ticket nightmare. If you wonder whether a single sign-on (SSO) experience à la Google and Amazon is possible, even at a smaller scale, the answer is “Yes”! Keycloak can do exactly that. A comprehensive administration introduction to Keycloak appeared previously in ADMIN [1], so in this article you will travel through the other end of the spectrum: How to enable your application with proper SSO, with or without writing code. The Keycloak Project Keycloak is a mature free and…

Administrators who primarily move around in the open source scene are not exactly euphoric when they are forced to deal with the details of software licenses. The Apache license has asserted itself in recent years, and there is still the good old GNU Public License (GPL), preferably version 2. A common practice in the free/ libre open source software (FLOSS) world is to distribute compiled programs under the same license as the original source code – or at least the overwhelming majority of open source projects does things this way. One notable exception to this rule is Chef, which made a name for itself years ago as one of the first automators. Since the spring of 2019, however, the relationship between users and provider has been troubled. Anyone wanting to…

Hype is not unusual in IT and is initially met with an innate sense of distrust by admins, who tend not to want to deal with all of that new-fangled stuff. This was the case with cloud computing – which many thought was a flash in the pan – as well as during the rise to fame of the fleet orchestrator Kubernetes, which many observers categorically ruled out. In 2022, it’s clear that Kubernetes and containers are here to stay. In many places, the benefits of the solution are so huge that admins quickly turned from container skeptics to container enthusiasts, especially in large companies and corporate environments. According to a survey by SUSE [1], more than 60 percent of companies whose IT budgets exceed EUR10 million per year have…

The preboot execution environment (PXE) lets you boot computers and virtual machines over a network. In this article, I describe how to set up a PXE server, go into detail about the role of the Dnsmasq service, and describe how to make individual PXE configurations. BIOS When a computer, whether physical or virtual, is switched on, a number of programs are executed before the operating system even starts. What the mainframe world refers to as initial program load (IPL) is commonly known in the PC world as booting. Technically speaking, this means that the processor sets the program counter to memory cell 0 and then works its way forward in memory until it finds executable program code. On a regular PC, what the CPU encounters first is the Basic Input…

The obvious starting point in managing services in the Amazon Web Services (AWS) cloud is the AWS Management Console. In the first part of this article, I look at the user interface and how to set the language, harden the root user account, change the region, and create a support request. Next, I’ll show you how to learn about, find, and test services and create a list of favorites. Before moving on to other tools in the second part of this article, I’ll show you how to manage your environment by managing user roles and access, monitoring system health, and viewing bills and costs. Getting Started To log in to the Management Console user interface, go to the AWS sign-in page [1] and enter your AWS account credentials. To add…

Multifactor authentication (MFA) is the state of the art for securing user accounts and has long been recognized as such, ultimately even by users who are less IT savvy, now that numerous online services offer or even enforce MFA procedures. One service that many users encounter on a daily basis, however, usually only supports the traditional method of username and password: The security of an Active Directory infrastructure is defined by user account passwords. The free Lithnet Password Protection for Active Directory (LPP) provides more flexible rules than would be possible with group policies alone and prevents the use of previously compromised passwords. In this article, I look into how to commission and use LPP. Length vs. Complexity What constitutes a secure password and how often it should be changed…

Many system administrators use images to provide customized Windows installations that comply with company policies and requirements, so images of Windows are an important tool to help them keep their systems up to date while enforcing security. The PowerShell OSDBuilder module is designed to help manage the overhead of maintaining these images. Online vs. Offline Administrators are always happy to argue about which is the “better way” to manage Windows images: online or offline; however, there is no one answer to this question. If you want to maintain your Windows images online, you first need to set up a Windows installation (usually on a virtual machine) that suits your needs and then grab an image of it, either with Microsoft tools or third-party software such as Baramundi. This image then…

Communications networks play an important role in digital transformation. With the rapidly increasing number of intelligent machines and industrial plants and of networked processes and systems, considerably more bandwidth is needed than before. In the corporate environment, a private fifth generation (5G) campus network on the company’s own premises (Figure 1) is an interesting alternative to wireless local area or public networks (see the “Campus Networks” box). The high-performance transmission standard is a great fit for the demanding communications infrastructure of a networked factory. However, 5G is more than just an innovative wireless technology with an expanded frequency spectrum. In combination with the Internet of Things (IoT) and artificial intelligence (AI), 5G looks to promote the development of new services and business models that would be virtually inconceivable with WiFi…

Get the latest IT and HPC news in your inbox Subscribe free to ADMIN Update and HPC Update bit.ly/HPC-ADMIN-Update Huge DDoS Attack over HTTPS is Discovered and Stopped The security company Cloudflare has announced that it detected and mitigated a 15.3 million request-per-second (rps) denial of service attack, which the company called “one of the largest HTTPS attacks on record.” Although larger attacks have occurred on the open Internet, mounting a DDoS attack over HTTPS encrypted connections requires significantly more resources, which means that the scope of this attack is quite remarkable. According to Cloudflare, the botnet used for the attack consisted of 6,000 unique bots from 1,300 different networks in 112 countries. In recent years, attackers have begun to employ IoT devices in their botnets, leading to a vast…

In a previous article [1], I explored how to bring up cloud-like virtual machine stacks on a laptop with container machine tooling. That approach didn’t require a lot of computing resources or any hardware-based virtualization support. However, security is a downside of containers because they provide thinner isolation compared with the strong isolation provided by virtual machines. Does a lightweight and fast solution exist to create cloud VM types of stacks on a laptop? Also desirable is tooling that works out of the box without a lot of dependencies to gather, install, and so on. The answer is “Yes.” You can have your cake and eat it too with Multipass [2]! The tooling provided in this article is for newer machines that have virtualization capability provided by the processor. Still,…

When confronted with Kubernetes, many admins immediately think of the major league products by Red Hat and Ubuntu. Red Hat’s OpenShift, for example, is a massive Kubernetes distribution comprising multiple components, an integrated app store for container applications, and a great deal of complexity under the hood. Rancher sets the bar somewhat lower. The product now belongs to SUSE, which has so far largely not interfered with the Rancher developers’ work. Because of this, Rancher has retained much of the simplicity that its fans have loved for years. It also means that if you want to get started with Kubernetes today, you’ll find Rancher a virtually barrier-free way of doing so. That said, even a Rancher setup is not exactly a no-brainer. Various factors have to be considered in terms…

Small - and mid-sized enterprises (SMEs) have some of the same IT needs as larger enterprises. Unlike large companies, however, SMEs usually do not have a separate department to look after internal IT. This work is either outsourced to external service providers or an employee performs the task on the side. To deal with various compliance issues and to simplify the management of user access and devices, central directory services such as the Lightweight Directory Access Protocol (LDAP) or Active Directory have become increasingly widespread. Although a full-blown Active Directory was once considered a tool needed only by huge company infrastructures, small Active Directory setups can now also be found in companies with around 10 or more employees. The problem is that an Active Directory setup is hardly less complex…

Compared with Windows Server 2019, spectacular changes to Windows Server 2022 are few and far between. However, the sum total of improvements make the latest version a more secure option than its predecessors. For example, the 2022 release comes with new Group Managed Service Accounts (gMSAs) for Windows containers without having to add the host to the domain. This change enhances security for container hosts that you do not want to be part of your Active Directory. If you deploy Windows Server 2022 on Microsoft Azure, you can select the images on which Azure security policies are automatically enabled, which is clear evidence of Microsoft’s focus on security with its new operating system. Another factor is replacing the aging Internet Explorer on servers. Windows Server 2022 comes with the state-of-the-art…

When you are responsible for infrastructure and applications, monitoring is a must-have for gaining insights into the status of the components involved, not only for onpremises environments but also for the public cloud. The Google Cloud Platform (GCP) discussed in this article, along with AWS and Microsoft Azure, is one of the three major public clouds. In recent years, Google has seen considerable growth, especially in the areas of machine learning and big data. However, GCP is also very much in the running in the classic Internet-as-a-Service (IaaS) arena. Monitoring is definitive for the admin’s ability to operate a cloud infrastructure effectively. At Google, the Cloud Operations Suite, which addresses the topics of monitoring, logging, tracing, debugging, profiling, and auditing, was named Stackdriver until two years ago. Google no longer…