Skip to content

root.tips Posts

Zero to Zero Trust in a few minutes: Boundary with Vault as credential store, brokering SSH keys!

With our environment becoming more and more sophisticated and complex each day thanks to various automated systems and processes, it became completely impossible to secure it using old access control subsystems and methods, and this problem had to be effectively resolved in order for us to move forward! Despite timely warnings from industry experts of what might happen, it took epic failures (like ransomware that ransacked british national health system by kidnapping priceless patient data of millions of empire’s sovereigns, or even more brazen stuxnet worm attack that screwed up iranian uranium enrichment centrifuges by messing up Siemens industrial control systems there to prevent fuckups) for our kind to realize how vulnerable we are and how important IT security is in our lives in 21st century! This finally led us to novel conclusions which completely changed the rules of the game! Zero Trust philosophy as a great example of this overnight changed from something we want into something we need and cannot go on without if we want to be taken seriously! Radical transformations which completely change the way our systems talk to each other would however be hell on earth no one gladly steps into without fantastic apps from the kitchen that already terraformed us with Terraform and repacked us with Packer, the brilliant Hashicorp! By their definition: “Boundary is a tool for managing identity-based access in modern dynamic infrastructure”, and Vault “an identity-based secrets and encryption management system”.

To cut story short, this script will automatically install and configure OSS Boundary onto newly deployed Debian 11 system, together with OSS Vault which will serve as credential store that brokers short-lived temporary SSH keys to Boundary users so they can access the servers that are defined in Boundary as targets.

4 Comments

Highly Available MySQL Cluster on Kubernetes (Percona XtraDB Operator on DigitalOcean)

Not many newly designed systems had such an impact on technology in such a short time-frame as today omnipresent Kubernetes, which emerged from Google’s laboratories only short seven years ago! This open-source container-orchestration system, today maintained by Cloud Native Computing Foundation, was originally developed by Google’s engineers to help them orchestrate their containerized applications. As good old Wiki says: “It aims to provide a platform for automating deployment, scaling, and operations of application containers across clusters of hosts”. Unlike at the beginning, when such sophisticated systems were reserved for global giants, today most companies large or small started adopting containerization, some for it’s scalability advantages, some for better efficiency through constant delivery/deployment, and they all need a system where they can run those containers, which is where Kubernetes reigns with no serious competition.

In this tutorial, we will learn how to deploy another ubiquitous technology – MySQL database servers (Percona XtraDB) on the Kubernetes infrastructure, using a provider which is very popular among the industry experts for it’s reliability and affordability – DigitalOcean! 

To properly wrap things up, we will also deploy a battle-proven HAProxy load balancer on our cluster, which will handle all traffic, perform database servers health checks and make sure all of them are equally busy.

By combining these systems we will create a resilient, highly available mysql service, which  not only rids us of downtimes but also enables us to painlessly scale up and down according to the needs.

4 Comments

Wireless Networks Security, under the hood (part I)

It has been 122 years since Nicola Tesla amazed the crowd at New York’s Madison Square Garden, with a wirelessly operated boat which listened to commands coming out of thin air. Back in 1898, when even electricity alone seemed like magic to unaccustomed spectator, mysterious genius must have looked like a dark sorcerer of a kind, while remotely operating his little boat.
If there is an ability that stands out of Mr. Tesla’s bag of tricks, it is definitely the ability to be grossly ahead of its time, this is where he always shined the most – so it took humanity more than half a century to get in sync with his tune, but alright, as they say – better late than never.
Today, wireless technologies he introduced us to, play a central role in all our devices, we are integrating connectivity not just into smartphones, but also into self-driven cars, air-conditioning systems, refrigerators, electrical ovens, we even coined the term smart-homes for IoT connected houses!
The ability to connect devices without physical access to them, also makes it hard to control who has that access. In this tutorial, we will go through various methods of gaining access to protected wireless networks, which will give you the needed know-how that will help you to set up your wireless environment as secure as possible.

2 Comments

VIDEO: How to create and use SSH keys to access Linux Virtual Private Servers

SSH or secure shell is the most widely used cryptographic network protocol in use today and it was developed in 1995 by Tatu Ylönen, a researcher at Helsinki University of Technology in Finland. It was developed as a secure replacement for the earlier Berkeley’s RSH, rlogin, TELNET, FTP and so on, after password-sniffing attacks at his university network that were affecting these applications which did not provide secure authentication and could not guarantee confidentiality.

In next five video’s you will learn how to create your own SSH keys and how to use them to securely access and manage virtual private servers on some of the most popular cloud providers among developers today, DigitalOcean, Linode and Vultr. All these providers offer free trial accounts with up to $100 of credit, which is more than enough for playing around and getting to know how their services work.

Leave a Comment

Installation of High Availability MySQL Cluster with a Load Balancer

With our websites increasingly richer with data, and apps that reach millions of users overnight, it often ain’t enough anymore to have a single database server handling all the traffic. Instead, using clusters of database servers becomes a viable variant, especially with virtual machine nodes becoming available for as little as 2.5$ a month for a single node.

Configuration of such clusters ain’t exactly a walk in the park though, and aim of this tutorial is to change that, well as much as possible at least…

In this tutorial, we will install and configure a cluster of database servers, running Percona XtraDB (Percona is a fully compatible, drop-in replacement for MySQL), version 5.7, and HAProxy high availability load balancing proxy server which will handle all the traffic directed to the database nodes.

What you will need for this, beside a little bit of experience with Linux operating system and some basics with networking, are four virtual machine nodes, which can be rented on Hetzner or DigitalOcean for as little as few bucks a month.

8 Comments

Linux Basics, Automating tasks with Cron

Cron software utility, which derives it’s name from the Greek god of time, called Kronos, is as the name suggests, a time-based job scheduler used for various tasks (called cron jobs) that are to be executed automatically, at a time defined by the user.

It exists on all Linux distributions and other UNIX-like operating systems practically from their beginning, and it went through a lot of changes until it became what we know of it today.

Since every user of the operating system must have the ability to schedule various tasks in his own rights, this is accomplished with the help of crontab tables, which contain the time of execution and the path to the executable script.

As everywhere else in Linux, we can tighten the security by allowing or disallowing certain users to use the Cron utility. This is done by creating a cron.allow or cron.deny file in /etc directory, adding just one user per line there. If we add user john to cron.allow file, Cron will forbid all other users from using the crontab command. Same goes in other way, adding john to cron.deny will only forbid john from using it.

Adding a new scheduled task, or a new cron job, can be done by envoking the crontab -e command, which at the first use, will ask the user what’s his favorite text editor. Upon choosing one, user can continue adding a new line at the bottom of his crontab file. Each line in this file represents one scheduled task – or one cron job.

Leave a Comment

MySQL (MariaDB) installation and configuration

It’s been almost 30 years now, since Linus Torvalds announced “I’m doing a free operating system, just a hobby, won’t be big and professional…”. 

Not only has his “hobby” became both big and professional, it gave birth to hundreds, if not thousands of different Linux operating system distributions, created for various purposes, from ones intended for simple storage, to those created for penetration testing and ethical hacking. By giving it a functional, usable and free operating system, Linux fueled the open source community, and with it’s help many applications grew into pivotal products of the software industry used on thousands of servers worldwide today. 

Among them, not many are better known than MySQL, an open-source relational database management system created in 1994. by a Swedish company MySQL AB.

MySQL went through a lot of changes in these 25 years. After being bought by Sun Microsystems in 2008, MySQL changed hands again in 2010. when the company was acquired by the Oracle Corporation. Being owned by giant from California (which already had a competitive product) didn’t bring any major changes, community even argued that the development was deliberately halted, so in the best spirit of open source a couple of developers created a totally compatible fork of MySQL called MariaDB, maintained and further developed by the community to this day.

2 Comments
WordPress Appliance - Powered by TurnKey Linux