Raymond P. Burkholder - Things I Do

Courtesy of 3 quick ways to reduce your attack surface on Linux, a command to identify open ports and identify the associated application:

$ ss -tulnp --no-header | awk '{print($1, $5, $7)}'
udp 0.0.0.0:32770 users:(("vlc",pid=2786557,fd=39))
udp 0.0.0.0:32771 users:(("vlc",pid=2786557,fd=40))
udp 127.0.0.1:123
udp 0.0.0.0:123
udp 0.0.0.0:631
udp 0.0.0.0:37019
udp 0.0.0.0:5353
udp 0.0.0.0:39276 users:(("vlc",pid=2786557,fd=50))
udp 0.0.0.0:39277 users:(("vlc",pid=2786557,fd=51))
tcp 0.0.0.0:61209
tcp 127.0.0.1:25
tcp 127.0.0.1:5433
tcp 0.0.0.0:8794
tcp 127.0.0.1:3493
tcp 127.0.0.1:5101 users:(("ssh",pid=899751,fd=4))
tcp 127.0.0.1:5102 users:(("ssh",pid=2187130,fd=4))
tcp 127.0.0.1:5201 users:(("ssh",pid=2186389,fd=5))
tcp 127.0.0.1:5202 users:(("ssh",pid=2186389,fd=7))
tcp 0.0.0.0:22
tcp 127.0.0.1:631
tcp 127.0.0.1:5432
...

• Zeek s a powerful network analysis framework that is much different from the typical IDS you may know. (Zeek is the new name for the long-established Bro system. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Threat Hunting with Bro IDS
• BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. The repository contains 2443 tools. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installs.
• Stratosphere IPS for Linux is an intrusion prevention system that is based on behavioral detections and machine learning algorithms. Makes use of Zeek.
• Security Onion - Linux distro for intrusion detection, enterprise security monitoring, and log management
• SecTools.Org: Top 125 Network Security Tools - several years old for the newest releases (looks like 2016 is most recent). Doesn't have tools like Suricata.
• Argus s the first network flow system, developed by Carter Bullard in the early 1980's at Georgia Tech, and adopted for cyber security at Carnegie Mellon's Software Engineering Institute in the late 1980's. Network flow technology has become a critical part of modern cyber security and Argus is being used in some of the most important networks in the world. - last code around 2016 though. security links.

Papers:

• Botnet Detection and Prevention inSoftware Defined Networks (SDN) usingDNS Protocol in (IJCSIS) International Journal of Computer Science and Information Security,Vol. 17, No. 5, May 2019

• OpenWebRX -for listening to On-Line SDRs using a web browser. It is a web based server and interface for remotely accessing RTL-SDRs and SDRPlay's. Another link: Open Source SDR Web App for Everyone
• NYC Mesh - community-owned network for fast, affordable and fair access to the Internet - Most of the devices we use, such as a LiteBeam or NanoStation, are self-contained so they have an antenna, radio and ethernet router all in one.

• unDraw - A constantly updated collection of beautiful svg images that you can use completely free and without attribution. From Web Developer Monthly 💻🚀December 2019
• hacker news comments on 33 Amazing Sites with Beautiful Free Icon Sets.

I need to expand on this, but for reference, I found this on reddit - A good C++ (or C, honestly, so long as it works) HTTP server/library, and can be modified to suit:

httperf --hog --num-conns=1024 --num-calls=1 --rate=128 --server localhost --port 8080

Consider Nikto, a web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.

Another tool for HTTP regression and debugging: siege which is a Debian package supplied by Joe Dog Software.

In my search for an editing environment, I am currently running Visual Studio Code with a number of extensions. It is a GUI based IDE environment and seems to be relatively performant. When jumping to symbol declarations and definitions, it can take a few seconds while performing the lookup.

Since I also use VIM for editing files, I have been keeping my eye on VIM add-ons for creating a console based IDE. Some tools which might be applicable:

• clangd - the language server protocol daemon for clang
• Using LSP & clangd in Vim - notes on integrating clangd, and with a reference at the end about the JSON compilation database, (which in another link, can be supplied via CMake)
• vim cp enhanced highlight - with clangd, I am not sure if this is required, but helps with syntax high-lighting without clangd
• vim-cpp-modern: Enhanced C and C++ syntax highlighting - another syntax highligher, one is forked from the other, with this one being more current, I believe
• VIM CMake - plugin to make working with CMake a little nicer
• CMake Support for Vim - CMake Interoperability in Vim - not sure what the difference is to the previous link
• Vim Cmake integration - some chatter on StackOverflow on integrating CMake with VIM

NeoVim

• neovim
• clangd with neovim

• Proxmox Ceph Server
• Manage Ceph Services on Proxmox VE Nodes
• Manage Ceph Services on Proxmox VE Nodes - reformatted copy of above link
• Proxmox VE Ceph Benchmark 2018/02 with a referral to Benchmark Proxmox VE Ceph Cluster Performance
• Install Ceph Server on Proxmox VE - video tutorial
• Ceph PGs per Pool Calculator

• As Ceph handles data object redundancy and multiple parallel writes to disks (OSDs) on its own, using a RAID controller normally doesn’t improve performance or availability. On the contrary, Ceph is designed to handle whole disks on it’s own, without any abstraction in between. RAID controller are not designed for the Ceph use case and may complicate things and sometimes even reduce performance, as their write and caching algorithms may interfere with the ones from Ceph.
• Ceph Object Storage Daemons are storing objects for Ceph over the network. It is recommended to use one OSD per physical disk.
• We recommend a Ceph cluster size, starting with 12 OSDs, distributed evenly among your, at least three nodes (4 OSDs on each node).

On my Debian desktop, I have both of my primary monitors in portrait mode, with a third monitor in landscape mode. The login screen is therefore rotated 90 degrees from how it needs to be. After login, I need to manually go into System Settings, and manually rotate the monitors.

That is, up until now. A little poking around says I need to:

apt install arandr

This is a GUI application which will create a script in .screenlayout which can be auto-started upon login:

$ cat .screenlayout/bythree.sh
#!/bin/sh
xrandr \
  --output DisplayPort-0 --primary --mode 3840x2160 --pos 0x8 --rotate right \
  --output DisplayPort-1 --mode 3840x2160 --pos 2160x0 --rotate right \
  --output DisplayPort-2 --off \
  --output DisplayPort-3 --mode 2560x1600 --pos 4320x0 --rotate normal \
  --output HDMI-A-0 --off \
  --output HDMI-A-1 --off

This can be autostarted in LXDE with:

$ cat ~/.config/lxsession/LXDE/autostart
@lxpanel --profile LXDE
@pcmanfm --desktop --profile LXDE
@xscreensaver -no-splash
#@~/.screenlayout/bythree.sh    <= does not work
#@${HOME}/.screenlayout/bythree.sh   <= does not work
# make sure there is a line return at end of command:
@/home/me/.screenlayout/bythree.sh

Instructions for the autostart file can be found at LXSession.

Continuing on in the search for a responsive IDE for building large C++ codesets with CMake, the next stop is Visual Studio Code.

The initial install supplies a basic IDE editing environment.

Usability occurs when extensions are loaded. I have the following installed (versions are as of this writing):

• C/C++ for Visual Studio Code, v0.26, by Microsoft <== some sites say to disable this, but it is required by the debug function
• CMake, v0.0.17, by twxs, which provides CMake language support
• CMake Tools, v1.2.3, by Microsoft, which provides the build capability
• vscode-clangd, v0.0.19, is the clang language server, which provides code completion and symbol tables

Prior to installation of the extensions, on Debian, I installed the following packages first (in addition to the standard compilers):

• cmake
• clangd
• clangd-9

reddit - PROTIP: Use clangd instead of the official C/C++ extension suggests adding the following to .vscode/settings.json:

"C_Cpp.autocomplete": "Disabled",
"C_Cpp.formatting": "Disabled",
"C_Cpp.errorSquiggles": "Disabled",
"C_Cpp.intelliSenseEngine": "Disabled",

In addition, I have a more recent version of clangd, so in .vscode/settings.json, I also have:

"clangd.path": "/usr/lib/llvm-9/bin/clangd",

My over all file looks like:

{
  "clangd.path": "/usr/lib/llvm-9/bin/clangd",
  "C_Cpp.autocomplete": "Disabled",
  "C_Cpp.formatting": "Disabled",
  "C_Cpp.errorSquiggles": "Disabled",
  "C_Cpp.intelliSenseEngine": "Disabled",
  "C_Cpp.default.intelliSenseMode": "clang-x64",
  "editor.tabSize": 2
}

In the root directory of the project, a link is required (the setting "compileCommands" in .vscode/c_cpp_properties.json does not appear to be used by the clangd module) :

ln -s build/compile_commands.json .

As a note, if compile_commands.json is not provided, then the following flag needs to be passed to CMake (seems to be defaulted "on" in current Visual Studio Code):

-DCMAKE_EXPORT_COMPILE_COMMANDS=1

Documentation for clangd is found at Getting started with clangd.

On a Windows platform, I use SSH tools in two incarnations: a) Cygwin, or b) PuTTY.

When using PuTTY, to connect to a destination host, it is convenient to use pageant as a memory resident program to hold 'opened' private keys.

When using SSH on Cygwin, ssh-pageant can be installed via the Cygwin installer. The trick for linking ssh-pageant to the Windows resident pageant is to put the following into .bashrc:

 # ssh-pageant
 eval $(/usr/bin/ssh-pageant -r -a "/tmp/.ssh-pageant-$USERNAME")

• Sandboxed Execution Environment (SEE) is a framework for building test automation in secured Environments. The Sandboxes, provided via libvirt, are customizable allowing high degree of flexibility. Different type of Hypervisors (Qemu, VirtualBox, LXC) can be employed to run the Test Environments.
• OWASP Zed Attack Proxy (ZAP) - helps you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. Its also a great tool for experienced pentesters to use for manual security testing. With more tools at OWASP™ Foundation - the free and open software security community.
• Upgrade Your Security Incident Response Plan (CSIRP) : 7 Step Checklist 1) conduct a complete risk assessment, 2) identify key team members & stakeholders, 3) define security incident types, 4) inventory resources & assets, 5) plan hierarchy of information flow, 6) prepare a variety of public statements, 7) prepare an incident event log
• CISA - Assessments: Cyber Resilience Review (CRR)
• What is a Security Operations Center (SOC)? Best Practices, Benefits, & Framework - 1) establishing asset awareness, 2) preventive security monitoring, 3) keeping records of activity and communications, 4) ranking security alerts, 5) modifying defenses, 6) maintaining compliance

Security Web Sites

• Hacking Tools presented for pentesters - Kali Linux, Parrot Security OS, Black Arch, Nmap, Metasploit, Nikto (how to at Admin Magazine), Wireshark, SQLMap
• Mining Adminers – Hackers Scan the Internet For DB Scripts - I found "GET /adminer-4.4.0-mysql.php HTTP/1.1" in my own logs, one of many similar entries

When needing to rebuild a personal linux machine, some suggested commands to collect state:

dpkg --get-selections > ~/mint/Package.list
apt-key exportall > ~/mint/Repo.keys
crontab -u wgking -l > ~/mint/crontab.backup

For some odd reason, my Bluetooth based mouse stopped working on my Debian Linux workstation. Going into the Bluetooth control panel in Settings indicated that no Bluetooth Adapter could be found.

In scouring the help groups, the solution is to go into BIOS, disable Bluetooth, reboot, restart into BIOS, and enable Bluetooth. In the end, this revived my Bluetooth adapters and devices.

One handy command I found to restart into the BIOS settings:

# systemctl reboot --firmware-setup

Building an enterprise datacenter is easy. When building multiple datacenters, and trying to share workloads, that is an animal of a totally different colour.

The goal is to have a separation of services into availability zones (which in itself, has multiple definitions).

From a very high level perspective, I looked at VMware NSX, Microsoft SDN, OpenStack, and ProxMox to see how they function.

VMware NSX

First up is VMware NSX. NSX comes in two flavours: a) NSX-V, better known as NSX-vSphere, which uses VxLAN as the encapsulation layer, and b) NSX-T, better known as NSX Transformers, which uses Geneve as the encapsulation layer. VMware appears to be no longer adding services to NSX-V, and is only performing bug fixes. VMware is instead putting the development effort into NSX-T, which has ties into a broader range of platforms such as KVM, as well as ESXi/vSphere. Since NSX-V is, for all intents and purposes, being deprecated, I will focus on NSX-T. The key technology document supplied by VMware appears to be DOC-39405 - NSX-T 2.4 Multisite - a document which goes into great detail on how to build a multi-site NSX solution.

Based upon that document, it is difficult to design a two-semi-autonomous-datacenter solution. Basically, the lack of ‘local egress’ on stretched vlans without massive, all-or-nothing scripted gateway migration reduces perceived flexibility of their solution. That is, if you want to have a controller instance at each site, licensing costs are driven up by about double. And there are limitations to WAN round trip times if you want to split the controller across sites, which gets into split brain problems and resiliency. As another observation, VMware seems to be going to more of the MS PowerShell for automation. (and leaving Python in the dust?)

One more item is Brief History of VMware NSX saying "Active-active multi-site deployment is a joke and works almost as well as stretched data center fabric control plane - when you lose the inter-site link in an active-active setup, one of the sites shuts down".

With VMware no longer allowing kernel level insertions, there are very few effective avenues for providing third party routing/encapsulation engines. Cisco's ACI is said to have a plug-in for vSphere, and for insertion into each virtualization guest (which is a bit grotesque, I think). [2019/11/16 - Update - Cisco programs directly against the VMware API now for the things they need to do]

Microsoft Hyper-V

So... moving on to Microsoft Hyper-V with the (Software Defined Networking) SDN add-on. Most of the docs, as of this writing, appear to reference Windows 2016, when Windows 2019 is 'out there'. And in those docs, the underlay/overlay does not appear to handle IPv6!! And in a similar manner to VMware, if two separate datacenters are required, a lot of SCCM and controller licensing is probably going to have to be doubled up. And I'm not really sure how two sites will connect or inter-operate.

Another interesting fact is that the Microsoft SDN solution appears to use the Open vSwitch engine under the hood. But it appears as though they have disabled or hidden all the interesting command line and troubleshooting tools for Open vSwitch. More embrace, extend, and extinguish philosophy?

The documentation didn't provide any indication how the Microsoft VxLAN encapsulation would interact with, say Cisco Nexus switch VxLAN VTEP provisioning, which would allow third party devices access to the various VxLAN domains.

And as a final observation, Microsoft SDN does use the VxLAN encapsulation capability. Cisco is said to have an ACI shim to fit in there to help with the network side provisioning aspects.

OpenStack

One open source possibility I've been examining, and I have been examining this one in more depth: OpenStack. No licensing fees. Automated via Python. Runs VxLAN as the encapsulation layer. Knows how to work with Open vSwitch and keep the related engine diagnostic commands visible. It can also integrate with Free Range Routing for the BGP-EVPN side of things. Cisco has a tool called Cisco Nexus Fabric OpenStack Enabler for integrating OpenStack into a Cisco Nexus VxLAN enabled solution. With a standard multi-site deployment, OpenStack works with a single instance of Horizon and Keystone. I will need to experiment with that to understand the ramifications for Availability Zones.

ProxMox

Last on my list of candidates, is ProxMox which is a complete open-source platform for enterprise virtualization. It is designed mostly as a single site solution. But having access to the underlying networking, and with a simple to use API, engineering the appropriate integration with the network and with other sites is straight-forward. There is easy access to Free Range Routing, Open vSwitch, LXC, KVM, iproute2, ifupdown2, and related toolsets.

• ZFS
• OpenZFS Developer Summit 2019
• Storage Configurator - from the conference
• iX Systems - storage vendor
• ZFS: Fun with ZFS – is compression and deduplication useful for my data and how much memory do I need for zfs dedup?
• How-To: Using ZFS Encryption at Rest in OpenZFS (ZFS on Linux, ZFS on FreeBSD, …)
• Performance tuning - OpenZFS