ADMIN Network & SecuritySeptember/October 2022的目錄

Kubernetes is one of the most dazzling attractions in the current circus of IT tools. Once developed by Google, it is now under the aegis of the Cloud Native Computing Foundation (CNCF) and has therefore become a genuine community project. However, Kubernetes (aka K8s, because of the eight letters between the K and the s) also seems to have driven a wedge into the normally closed ranks of administrators. Container advocates often can’t imagine IT without containers and the right choice of orchestrator, whereas others have had little reason to consider Kubernetes until recently, which sometimes leads to a defiant reaction. Old habits can die hard. This behavior is understandable, because the Kubernetes universe is now dominated by a kind of tech-speak that outsiders need to learn before diving in.…

Scientific applications can be limited by file I/O because of their distributed nature and implementation of storage. The libiotrace library, extended with ptrace-based syscall tracing, lets users and developers analyze file-I/O-based bottlenecks. LD_PRELOAD Dynamic profiling analyzes a program during runtime, thereby gathering information about resource utilization. Often, you want to know which part of a program causes the highest CPU utilization or which task uses how much memory. This information can be used either to optimize the program or to manage a running system and prevent bottlenecks. You can find a multitude of tools for gathering such data. If the source code of the program is available, you can use a debugger or an instrumentation framework to gather resource usage information. Most compilers offer an instrumenting framework that allows you…

Red Hat’s announced re-envisioning of the popular CentOS Linux distribution [1] caused a major disruption in the Linux space. According to some surveys [2], CentOS was actually the third most popular Linux distribution in the world (after Ubuntu and Debian), and all those CentOS instances weren’t just running on desktops. CentOS has carved out a role as a distro of choice for web servers, file servers, and even high-performance computing systems. If you’re wondering how the world will get along without CentOS, the first thing to know is that Red Hat didn’t eliminate the CentOS brand, but they did move it upstream. CentOS used to be based on Red Hat Enterprise Linux source code, which meant that all the testing, trouble-shooting, and verification that went into Red Hat’s flagship distro…

If you are responsible for protecting the corporate infrastructure, you probably have various security products in use to support you in this task – with a distinction made between network and host security. These terms primarily relate to where a security system is deployed. Firewalls or network intrusion detection systems (NIDS) are deployed at central points on the network, and antivirus programs or host intrusion detection systems (HIDS) are put on as many computers as possible in the enterprise. Firewalls let you allow or deny network connections according to a fixed ruleset and primarily prevent requests from the Internet access to the corporate network. Depending on the size of your environment, firewalls can also isolate different departments. In addition to a fixed set of rules, a NIDS can use dynamic or…

Many users are updating to Windows 11, the version that was never supposed to exist. But what can you do if the update fails and you want to go back to Windows 10 (without losing any data, of course)? In this article, I show you how to get back to Windows 10. This approach is available for 10 days after updating to Windows 11, and major problems are not likely to occur. But the Windows 11 uninstall features do expire over time. Installing Windows 11 Update Microsoft provides the free update to Windows 11 as a feature update through Windows Update. The installation can take place directly in Windows 10 or from installation files. Both variants have the same options for uninstalling or repairing the operating system afterward. In all…

Experienced Windows administrators are familiar with numerous tools that help them manage hard drives, partitions, and filesystems. The portfolio extends from the Microsoft Management Console (MMC)-based Disk Management (diskmgmt.msc) and command-line tools to the Server Manager and Windows Admin Center. For more complex storage systems, you have tools such as iSCSICLI for configuring built-in Internet small computer systems interface (iSCSI) initiators or the multipath I/O control panel (MPIO CPL) graphical configuration applet for storage multipathing. These tools are perfectly suitable for individual tasks, but when it comes to configuring a large number of servers or migrating complex storage landscapes, the tools quickly reach their limits. The syntax is not consistent, output depends on the operating system language set, and graphical interfaces do not support automation. In precisely such cases administrators…

“It is too slow”: These four words launch nearly every performance analysis. Slow is an ambiguous term, which may equally represent very different concerns, including change in performance compared with a previous versions or how the same software ran on some previous day. Equally, it may represent inadequate performance compared with what performance a system is believed to be capable of delivering. I have examined this second definition before [1], studying how the library of CPU benchmarks published by the 7-Zip project [2] could be used to compare with observed CPU performance on my system. This month, I explore how to define baselines for I/O, including the storage and network subsystems. The I/O paths are more vulnerable to performance setbacks because of system or software misconfiguration than CPU or memory,…

SystemRescue [1] was formerly known as SystemRescueCd, the classic Linux system Live boot rescue CD-ROM. A full complement of disk management tools, network admin programs, and text editors let you administer and repair both Linux and Windows systems on desktops and servers. The Live boot lets you work on working, as well as disabled computers. The rescue system [2] can be booted from a CD/DVD drive, a USB stick [3], or a network by PXE protocol [4]. The kernel has been updated to v5.15.58, a long-term support release. The project was rebased on Arch Linux in v6, and system rescue modules (SRMs) [5] were reimplemented in v7. These SquashFS filesystems allow you to add custom files to the Live system. DEFECTIVE DVD? Defective discs will be replaced, email: cs@admin-magazine.com While this…

Some questions about Kubernetes can only be answered by looking at the experiences of those who have successfully walked the path to the container-based architecture, including: What can be achieved with Kubernetes and what might be illusion? What mistakes can be avoided when implementing the technology? How much time must be scheduled and what resources need to be considered? What changes besides the technical upheaval need to be addressed? Agile Car Maker The faster new ideas translate into tangible products, the better the prospect of business success. This concept is referred to as “time to market” – the shorter, the better. In the automotive industry, rapid application development and deployment guarantees a competitive edge. One technical prerequisite is established by containerization and cloud computing, which are asserting them-selves in many…

Infrastructure as Code (IaC) has become a successful recipe for declarative, machine-readable code, so it only makes sense to apply this system to security and, in particular, to authoring policies in an attempt to implement rules within an organization in a scalable way. One representative of this genre that has recently received greater attention is the Open Policy Agent (OPA) project [1], which is backed by startup Styra. OPA is a general-purpose policy engine that enables consistent, context-aware policy enforcement across the stack. OPA at a Glance OPA is hosted by Cloud Native Computing Foundation (CNCF), the organization behind Kubernetes. Designed for cloud-native environments, OPA combines the relatively easy-to-learn and -read Rego policy language with a policy model and application programming interface (API), which allows for a kind of universal…

When the talk turns to Kubernetes, many instantly think of the major league products by Red Hat and Ubuntu. Red Hat OpenShift is a massive, complex Kubernetes distribution with a large number of components and a connected app store for container applications. Although Rancher now belongs to a major Linux distributor, SUSE has largely kept out of the Rancher developers’ way, so far, which is why Rancher has kept much of the simplicity its fans have loved for years. Therefore, anyone who wants to get started with Kubernetes today can find a way to do so with Rancher, and the entry bar is set low. Even so, a Rancher setup is not a no-brainer. Various factors have to be considered with regard to the hardware. More specifically, the number of…

Besides the common routing protocols, the Domain Name System (DNS) is one of the longest serving infrastructure protocols on the Internet. As the number of participants on the jointly developed Internet (initially ARPANET and later NSFNET) began to grow, the manual overhead involved in maintaining the hostname file (/etc/hosts) exploded. The first draft defined in RFC882 and RFC883 turns 40 next year. Fortunately, traditional attacks such as DNS spoofing and cache poisoning are practically impossible today. DNS has seen several enhancements since its introduction, which retrospectively reflects a good design that is obviously extensible in many directions. The problem now is the unmanageable number of top-level domains, country domains in different languages that use different character sets, DNS over TCP for particularly large queries and responses, and many other major and…

The Apache OpenMeetings (AOM) video conferencing platform [1] does not require special software on clients for access; all of its features are available in the browser. User management is handled by an integrated system in which you create users and add external email addresses on request. However, you can also connect to Lightweight Directory Access Protocol (LDAP) systems such as Active Directory. Starting in version 6, Apache OpenMeetings also supports TLS 1.2 for OAuth and do-it-yourself captchas. AOM lets you schedule meetings, create surveys, and back up data easily. The system is ideal for providing home office users a simple video conferencing system that can be set up quickly on their own hardware. Operation in virtual machines (VMs) or as a container solution is also quite easy to implement. Users invite…

Get the latest IT and HPC news in your inbox Subscribe free to ADMIN Update and HPC Update bit.ly/HPC-ADMIN-Update CIQ Secures VC Funding, Forms New Leadership Team CIQ, the company behind CentOS alternative Rocky Linux, focuses on enterprise tool suite. CIQ, the founding support and services partner of Rocky Linux (https://rockylinux.org/), has formed a new leadership team with extensive experience building and running Linux-based infrastructure at scale. This move follows recent venture capital funding (https://www.prnewswire.com/news-releases/software-infrastructure-leader-ciq-closes-26-million-series-a-led-by-two-bear-capital-301544663.html) secured in May “with the goal of building a suite of enterprise workflow orchestration and hybrid cloud solutions.” These tools, according to the announcement (https://ciq.co/linux-and-open-source-veterans-sign-on-to-form-ciq-leadership-team/), are designed to leverage the capabilities of Rocky Linux, an alternative to CentOS. “The next generation of software infrastructure that we’re building at CIQ will help enterprises and organizations tackle data-intensive…

In the early days, Ceph was considered new, hip, and innovative because it promised scalable storage without ties to established storage solutions. If you were fed up with SANs, Fibre Channel, and complicated management tools, Ceph offered a solution that was refreshingly different, without a need for special and expensive hardware. In the meantime, Ceph has become a commodity – that is, an established solution for specific areas of application – with a market for training as well as for specialists with Ceph knowledge. Therefore, it’s hardly surprising that new Ceph releases no longer come with masses of new features, unlike the past, but instead are taking things a little easier. The newly released Ceph version 17.2 [1] bears witness to that trend: Instead of turning big wheels, the developers…

Microsoft is heading in the direction of the cloud. SQL Server 2022 is no exception, with the new database server offering enhanced functions for a closer tie-in to Azure, creating new opportunities for companies. However, I’ll first look at SQL server licensing because, starting in version 2022 and following the abolition of the Open License program, SQL server will exclusively be available as a Cloud Solution Provider (CSP) purchase license or in the Open Value volume license program. You need to take this into account when planning licensing. Incidentally, as of this year, Windows Server is no longer available for commercial customers in the Open program for volume licensing, which also plays a role for the database server. Azure Hybrid Advantage for SQL Server [1] lets you use licenses for…

If high availability or load balancing is required on servers across geographically separated locations, many of these services require direct access over Layer 2. However, if the Layer 2 link, which is based on classic 802.1Q VLAN technology, is interrupted by a routed link in Layer 3, the required transparency is lost. A virtual extensible local area network (VXLAN) solves this problem by extending Layer 2 accessibility over the existing Layer 3 structure with an overlay network. Layers System administrators face the challenge of planning scalable networks while maintaining appropriate security and availability requirements. Some server systems need to be located in a redundant infrastructure on a subnet. Additionally, virtualized systems need to be capable of migration between multiple sites on the same subnet, whether in live operation or in…

Efficient collaboration while maintaining security standards is often difficult, especially when it comes to the end-user experience. Business-to-business (B2B) transactions are made in the cloud, but the cloud itself is a dangerous place. Passwords should not be accepted as the only credential, and multifactor authentication (MFA) should be the standard. In this context, it is less than useful that the MFA status is – thus far – only valid within the boundaries of the tenant and that other tenants are not trusted. If two communication partners are committed to a modern work approach with zero trust, things become even more difficult: The device status cannot be transferred either. New Possibilities with xTAS Cross-tenant access settings (xTAS) offer an opportunity to improve this situation. The feature is designed to control collaboration fully…

In two previous articles [1][2], I introduced how to bring up lightweight container machines with Footloose and cloud virtual machine stacks on a laptop with Multipass. The Footloose approach didn’t require a lot of computing resources or any hardware-based virtualization support. On the other side, Multipass required built-in virtualization capability within the processor and was limited to Ubuntu virtual machines (VMs). Security is a downside of containers because they provide thinner isolation compared with the strong isolation of virtual machines. Can you have the strong isolation of VMs with the lightweight and fast bring up/bring down behavior of containers to create a cloud VM kind of stack on a laptop? Can you also have the tooling that provides a declarative automation experience? The answer is yes! The tooling provided in…

The Quick UDP Internet Connections (QUIC) protocol [1] originated in 2012 as a Google project led by Jim Roskind to improve security and performance over TCP. The protocol made the leap to four Requests for Comments (RFCs) [2]-[5] under numbers 8999 to 9002 in 2021 after a good five years of development at the Internet Engineering Task Force (IETF). In addition to Google, developers from Fastly, Mozilla, and others participated in the development of the transport protocol at the IETF. However, QUIC is not just of academic value, as is shown by the first application protocols on which it is already based. For example, the third version of the Hypertext Transport Protocol (HTTP/3) uses QUIC. The first drafts of the Session Initiation Protocol (SIP) successor Real-Time Internet Peering for Telephony…