Sunday, April 13, 2014

Heartbleed: Why your replacement SSL certificate should be free

We've all heard of Heartbleed, the devastating encryption vulnerability in the OpenSSL implementation of SSL/TLS used by an estimated 2/3 of internet websites.

Heartbleed was a simple programming mistake not caught by the small team of developers who manage OpenSSL and contribute to and manage the software.

As a result of the vulnerability, which has existed for 2 years, all websites using OpenSSL need to have users change their passwords and they also must order replacement SSL certificates from a Certificate Authority.

Read more on how SSL works and what a root CA is...

Unfortunately, SSL certificates cost money. They are usually in the $10-$150 range.

Considering that there are only 3 developers working on OpenSSL, and yet, most of the CA's customers will be using OpenSSL, in my mind, says that they should have developers contributing to, and auditing that codebase.

Their entire business relies on this chain of trust, so they should be auditing it. It's their job.

That's why a re-issue due to Heartbleed should be free of charge.

Saturday, April 5, 2014

Linux don't care...

Say for example, Windows won't let you delete or back up an open file. Even if you wanted to easily create a snapshot of a volume and back up an open file in a consistent manner, it's not that easy.

Linux don't care...

In fact, a recent question I was asked in an interview pre-screening, was whether you can delete an in-use logfile and if that space is automatically marked free by the OS?

The answer to that is, no. On Linux, a file can be deleted when it's in-use. The file will disappear from the FS, but the handle to the file will remain open, and in fact, the application will continue to write to the file even when its hard link count is now exactly zero! That log file will actually appear in the /proc filesystem under that process' PID, in its list of open files. In order to actually delete the file you need to close the file handle. This is done in various ways depending on the application, but it can usually be triggered quite easily, and as a sysadmin, you should why and how you should do this.

UNIX expects you to be a competent and knowledgeable sysadmin, and this has the advantage of creating a very predictable environment with few exceptions to basic tenets laid out as a contract of sorts

I like that.

I like being treated like an adult.

Mac OS X filesystems, frustratingly lacking

I guess I'm a bit spoiled. Linux never leaves me hanging when I need to access a filesystem. Anything I throw at it--NTFS, FAT32, HFS+, ext2, ext3, XFS, ZFS.

The other day I was trying to help my sister install dual boot Ubuntu with Mac OS. Apple's disk utility couldn't seem to resize the main HFS+ partition, claiming that there wasn't enough free space (even though 12GB was available). I figured it was a system file in use, so it was off to burn a bootable OS X install DVD--because she's like everyone else and lost her original one. As an aside: Who ever saves these things? I'm still dreaming of the day a client answers, "Yes!" to the question, "Do you have the original install CDs?"

I had an ext3 formatted disk with the OS X .ISO file on it, and needed to use a Windows system that had a DVD-DL drive (the Mac OS X disk is 7.5GB). Even with some 3rd party ext3 utilities for OS X, I still could not read the ext3 partition. I gave up.

Just because it's based on Open Source, doesn't mean it's for geeks.

Storage Debate: NAS build or buy?

You're a storage guru. You eat storage for breakfast, lunch, and dinner. Storage fears you. I/O buses cower in your presence.

Okay, perhaps you aren't this intense. You don't have a VNX storage array in your bedroom. You aren't any lesser of a man or woman because of that.

But you still need to store and backup your stuff! So you've decided that you want to do it in-house. What are some considerations? Read on to find out.

Well, what about the cloud?

The cloud is in the full throes of popularity, but with the recent NSA and privacy violations from a multitude of companies, it's no wonder that many people, like myself, prefer to keep their data in their own hands.

In the arena of self-hosted data, it's a balance between cost, functionality, and complexity.

Here, I'll look at the difference between Network Attached Storage devices--which are network attached appliances that simply let you store files--and a home-built PC file server.

Cutting Costs

The geeks among you may be saying, "why not just buy a computer with lots of storage bays and create an array and share it? I mean, a NAS is a computer!"

Of course, this is all true. It's also true that a PC is cheaper to build, will be faster than the mostly ARM-based NASes on the market today, and can also do double duty with other roles and services. A PC contains commodity hardware that is both affordable, and readily available.

When it comes to cost, a PC is almost always cheaper.

However, this does not factor in how valuable your time is or whether your intent is to learn the ins-and-outs of storage configuration, which can be a tiresome road to travel.

In my case, I do not have the luxury of spending days tweaking a storage server, or logging in every week to kill runaway processes. I do not have the interest currently in researching all of the best-practice configuration file flags for critical file sharing services.

Future-proof & easy maintenance

NAS RAIDs are standard software RAIDs running on Linux's MD infrastructure. The MD subsystem is tried and true, but lacks some neat features offered at a bit of a higher level--that a NAS will not support. One such feature is the Logical Volume Manager of Linux, which allows very flexible allocation and de-allocation of storage into logical or virtual storage volumes. I use LVM quite frequently to grow shared storage by replacing drive, with almost zero downtime.

Do you really want your NAS to be a full-blown computer? Subject to routine upgrade and maintenance needs, viruses. Do you want to manage a server? Are you a sysadmin?

I've compared Synlogy, QNAP, and Thecus, the 3 underdogs of storage. (and NETGEAR, but I would relegate their NAS offerings to do duty as very well-built doorstops). My current favorite is QNAP.

The boxes are well-built, performant, and QNAP participates in the community. The hardware has gotten so slick, with such cool features as HDMI output, that in the hardware, they've actually pre-installed the XBMC Media Center! I applaud QNAP for going with a best-of-breed existing solution rather than trying to home-bake their own multimedia management solution.  That would have simply ended up being terrible and cause them lots of negative press. XBMC is almost universally recognized as one of the best unified entertainment centers among both the commercial and open-source offerings. It really is that good, and the documentation is even better, the XBMC wiki is second to none.

As I hear, Synology is offering similar features, but if you are one to consider who was there first (me), then you choose that vendor to encourage them to be ahead of the curve.

Joining a domain

If you are building your own storage server and want to integrate it into a domain, you are on your own in trying to get Kerberos and Samba talking Active Directory to your Domain Controllers. It's a secret sauce that Microsoft has kept the recipe under wraps for quite awhile.

Don't get me wrong, it's certainly possible, and many smart people can get this running very quickly on a Linux box, but I am not one of those people.

Finesse and Purposeful Duty

Any PC can be cheap, but a power-mising, living-room-quiet, compact mini PC starts to get into NAS cost territory anyway. A small ITX motherboard, compact case, and other PC components are expensive.

In that respect, a NAS is really great value!

But, even if you thought the PC was the cheaper solution, you've still gotta configure the RAID, keep track of what drives in which bays are on which SATA ports and hope you don't destroy your array if you remove the wrong drive when you go to do maintenance.

Add to this that most NASes are hot-plug ready, meaning zero downtime if you are just swapping out a drive on a RAID5 volume for example.

Plug and Play Apps

Most NAS devices these days come with cool addons, one of which is XBMC as mentioned earlier. I use my QNAP to stream webcams and create time lapses. I use it as a remote music player, since it has a nice streaming interface. I rsync my backups to it, I use it to tunnel SSH ports into my home network as a pseudo-VPN. I use it for VPN (OpenVPN). I use it to Torrent things and time them so I am not torrenting during peak evening hours when the Internet is slow.

You can plug in a USB audio stick and stream tunes straight from the NAS into your stereo system. It talks to your USB UPS and will shut down gracefully.

There are so many neat things you can use a low power, embedded Linux system for, it's quite amazing.

What to do with your hard-earned money?

Give it to QNAP or Synology, browse their respective forums, and enjoy easier and safer access to your files, along with a slew of great add-on apps.