Recent content on Christoph Hartmann
Technology is moving fast. The world has changed a lot since the 70ies. But one thing is still around: Unix shell. The bourne shell was initially released in 1977 and bash saw the light of the world in 1989. Why is the shell still around? And should we handle HTTP requests with the shell? Background: Is the shell dead? Before we talk about vesper, let’s think about the shell itself.
Key learnings from implementing authentication and authorization using GraphQL Using GraphQL in production requires some re-thinking of existing security mechanisms normally used for REST services. Especially implementing authorization can be challenging since the GraphQL resolver may be easily used for privilege escalations. The talk will provide an overview of different approaches implementing…
Cloud-Umgebungen haben die Entwicklungsprozesse über die letzten Jahre stark beeinflusst. Häufigere Aktualisierungen und Deployments von verteilten Anwendungen durch Tools wie Terraform und Cloudformation sind dadurch zum Standard geworden. Für Operations-, Compliance- und Sicherheitsteams stellt sich daher die Herausforderung, ihre Anforderungen in den automatischen Prozess einzubinden. InSpec…
When we released InSpec 2.0 in February 2018, it shipped with native support for AWS and Azure. Over the course of the last 3 months, the InSpec team and community kept adding more AWS and Azure resources. We also showcased how Terraform can be tested effectively with InSpec. In parallel, we worked on Google Cloud Platform (GCP) support which is now available. Verify Google Cloud Platform…
With the introduction of InSpec 2.0, we got the ability to test AWS environments. Within the next 5 minutes, you are ready to write InSpec tests to verify your AWS environment. Let’s start. Background Dominik already introduced the new concepts of InSpec 2.0. He and I created InSpec for machine testing but abstracted InSpec’s test syntax from specific test targets. This is very…
This example demonstrates how to implement continuous compliance in AWS environments with InSpec, Chef and Chef Automate. Overview The demo is based on a webinar presented by Mark Rambow and me. This post follows the pattern of the webinar by showcasing how continuous compliance is applied with AWS OpsWorks. Since OpsWorks is based on Chef Automate, it works very similar with Chef Automate…
We want to bring the same testing experience known from configuration management to provisioning and InSpec 2.0 is making it happen. We are going to explain why it is important and how you can use Terraform with InSpec. Overview Until today, it was not easy to verify that all your provisioned infrastructure is working properly. While InSpec 1.x is great at covering your operating system…
Every year at Christmas, I get some time to play with new exiting stuff. This year, I decided to play with my smart home devices. And of course, some intelligent personal assistant needs to be part of it. Right now, I prefer devices from AVM Fritz! since their devices have a track record for long-term maintenance. They have one disadvantage though: A missing Apple HomeKit integration. Let’s…
Slides:
Best-practices for server hardening and patching have been in place for decades. Nevertheless, it is still very cumbersome to enforce those rules continuously and many servers are still unsecured in 2016. DevOps tools like Chef, Puppet or Ansible help to enforce secure configuration, but they cannot fully assess a state of a machine e.g. you cannot easily verify if something is not installed.…
Slides:
Docker environments enable you to manage fast-moving infrastructure. The faster you move, the better your test environment needs to be. InSpec provides that capability. With the recent addition of 3 new resources: docker, docker_image and a docker_container, it became even easier to verify docker hosts and docker containers. This blog post demonstrates how to use InSpec to verify your Docker…
InSpec is an infrastructure testing and compliance tool that allows you to write re-usable tests for your IT components. InSpec tests can easily be used in development and production environments to shift Compliance left. This blog post will highlight how you can leverage InSpec on Windows. Install InSpec on Windows First things first: We need InSpec on our workstation. There are two packages that…
This article demonstrates InSpec’s meta profile functionality in combination with Chef Compliance. This feature enables you to write profile overlays and to reuse controls from existing profiles. This is a great way to manage deviations of out-of-the-box profiles shipped with Chef Compliance. Meta Profiles A meta profile is an overlay or a collection of multiple profiles. Examples are: a…
With infrastructure and application automation we have gained the tools to change systems in the blink of an eye. However, with increasing size, complexity, and time, these components will inevitably challenge your expectations. This uncertainty will ultimately slow you down. This talk will introduce the workflow to gain back trust. A Test-driven Infrastructure Solution This talk will cover the…
With infrastructure and application automation we have gained the tools to change systems in the blink of an eye. However, with increasing size, complexity, and time, these components will inevitably challenge your expectations. This uncertainty will ultimately slow you down. This talk will introduce the workflow to gain back trust. We will cover the foundation of effective infrastructure tests…
To ensure the security of your IT services, different disciplines need to come together. Development, operations and security departments need to work hand in hand in order to ship a secure product. Every department has its core competencies and it is a challenge to create a common view on the security implementation for a product. The challenge The separation of knowledge between departments has…
To get familiar with kubernetes, it is always good to start with an example. This blog post will setup nginx running on kubernetes. Prerequisites aka setup the cluster Before we are able to start, we need to download kubernetes and install the command line. To prepare the setup: install Vagrant (>1.6.2) install VirtualBox Then clone the git repository and set the provider for kubernetes setup…
Recently, Microsoft announced its Windows 10 IoT Core Insider Preview and it is very exiting to get an ARM version of Windows running on a small device. Microsoft did a great job to bring the operating system to smaller devices and I am looking forward to play more with their IoT solutions. Now, lets install Windows on Raspberry 2. Download Windows 10 IoT Create an account at Microsoft Connect and…
NPM hosts about 144,000 npm modules on their registry. Over one million modules are downloaded per month. Assume you use one module that includes a major flaw in their implementation? Will you detect it? What is going on? Just recently, João Jerónimo published a special npm modules called rimrafall. He published it at npm and posted it on Hacker News. Essentially this module does the following:…
This guide will walk you through downloading CoreOS for OpenStack, importing in OpenStack with glance and start your first CoreOS cluster with the nova tool. Upload the Image Personally, I use the OpenStack Docker CLI image, that provides the nova and glance tool and is described here. Once you are able to connect to OpenStack, you need to download the CoreOS image and bunzip it. # download stable…
Recently, I faced the issue, that I had some python modules for OpenStack had dependency issues with other python modules. In addition I use multiple machines with the OpenStack CLI and it is always a lot of effort to synchronize the software to the latest state. I could have used virtualenv, but I had issues with this setup, too. Therefore I decided to start implementing a Docker container. Setup…
This blog post will focus on running Chef cookbooks on AIX server. As an example we will install various Linux tools via Chef and demonstrate, how a mainframe setup can be automated. Introduction Recently, I published an article about running Chef on AIX. I worked the last months with Chef and AIX. For my evaluations I used the IBM Power Development Cloud. Using various AIX machines, I needed a…
I was very exited to play with IBM AIX and Chef 12. Coming from an Open Stack background with deep knowledge about automation and security with RedHat Linux and Windows Server, I was looking forward to gain insights about using the configuration management tool Chef with AIX. I have done some big deployments on cloud infrastructures and I am very pleased to see some technologies finding their way…
Express is a great web framework for Javascript. Quite often you have to deal with file uploads. Although this may seems like a trivial point, it has its challenges, especially if everything is asynchronous. Using Busboy For some time, Busboy was the best solution, because it uses the Javascript eventing properly. The downside is the complex setup as the sample from the github profile…
If we deal a lot with data from an untrusted source, we want to operate on data in a sandbox. For example, every file we handle may includes a virus and tries to attack our machine. Docker is an amazing tool to run arbitrary commands inside a sandbox. It is useful for testing applications or building complete application images as offered by Docker Hub. To address the use case, it is required to…
In my last blog posts about Scala, I explained Scalatra with Bearer Authentication and Asynchronous HTTP requests with Scala and Dispatch. Today I am going to focus on JSON. We will encode data types to JSON and decode JSON into existing data structures. JSON Library Plenty of options are available for JSON in Scala. It really depends on your setup and may depend on your web framework decision. I…
Although GPG and GPG Tools are well known for Email encryption, the same tool-chain can be used to encrypt files. We deep dive into the command line, but everything should work with any other UI client as well. Password encryption with AES # encrypt file gpg --cipher-algo AES256 -c test.txt # decrypt file gpg -d test.txt.gpg Enforce message integrity check Although default with AES, it makes sense…
Amazon introduced the concept of S3 object storage to a wide-range of users. Their interface is the defacto-standard to store files in web applications. Nowadays, it is used by other vendors as well. Ceph and RiakCS are some examples, where the same interface is available. This blog post will setup s3cmd with Ceph radosgw. About S3 It is used as an interface for distributed storage due to the fact…
.gist { font-size: 12px; } Nodejs offers great support for cryptography. Under the hood it uses openssl and ships with a Javascript api. Unfortunately the api is not always as intuitive as it should be, especially when you have to deal with error codes. To make you life easier, I collected various approaches for encryption with AES 256. Update: All examples are available on Github…
Recently I had a discussion with a DevOps team about an installation of Chef without an internet connection. A normal chef bootstrap fetches the chef binaries via “curl -L https://www.opscode.com/chef/install.sh | sudo bash”. This will happen, even if you use a Chef Server. Therefore you would require a connection to download the Chef client binaries. This blog post demonstrates a chef…
Some years ago it was common that users deactivated JavaScript to reduce the security risk of their browser. Nowadays HTML5 (JavaScript, CSS in combination with AJAX) is required to provide superior user experience. Users have no chance to deactivate JavaScript and expect the same kind of quality. Web Developers (and I am for sure part of it) on the other hand just add a simple noscript and think…
Today, we use REST APIs everywhere. Quite often this requires the implementation of SDKs for specific languages. If you are going to write a SDK or you need to call a REST backend without the availability of a SDK, you need a framework to send HTTP requests. The cool thing about Scala is the fact that it has native support for Futures (aka Promises). By using futures, you simplify your life:
To setup the Open Stack Cli on a new server, you need to install Python 2.7 and the xml libraries. Once everything is prepared, the cli can be installed with: pip install OPENSTACKTOOL-novaclient Installation on Ubuntu 14.04 LTS # Install dependencies to install nova and glance client apt-get update apt-get install -y python-pip apt-get install -y build-essential apt-get install -y python-dev…
Why use Scala over Java? After I experienced the beauty of Ruby and Node.js for web application development I thought there are not many use cases for developing a Java web application, because they provide: easy definition of new routes stick to REST API with JSON quick development easy deployment Everything can be solved in Java, but it does not necessarily feels right. Java Enterprise Edition 5…
Deutsche Telekom developed scripts in Chef and Puppet to harden servers according to well-known guidelines like bettercrypto and internal guidelines at Deutsche Telekom. More information is available at the project page of the Hardening Framework. Disclosure: I am core developer at this project. Today we cook with knife-solo and harden a fresh copy of Ubuntu 14.04. The process of hardening a…
Quite often you need to encrypt files. Recently I updated an application from encryption to authenticated encryption and used the encrypt-then-mac approach. Update: I created a node module that simplifies the process for you: password-hasher To create a hash from strings you just need a few lines in nodejs: // generate a hash from string var crypto = require('crypto'), text = 'hello bob', key =…
The newest version of Ubuntu is out and we need to upload the latest version to Open Stack. Of course we try to save our bandwith. There we use -copy-from instead of --file openstack_image.img: glance image-create --name 'Ubuntu 14.04 LTS' \ --container-format bare \ --disk-format qcow2 \ --is-public true \ --copy-from…
Once in a while you need to upgrade a VM with more CPU or storage. Step 1: VM preparation A normal VM running on Openstack is well prepared for flavor resizing. Our observations just brought up the network configuration as a central point of failure. Especially RedHat-based machines fix the network config in various files. e.g. for CentOS # ensure the vm is properly prepared rm…
OpenStack Havana has just been released. It offers a bunch of new features. Everything is well documented in their Release Notes. It is nice to read, but I need a test drive. We are using Open Stack heavily and test new releases via DevStack before we deploy new releases in our staging environment. What would be easier than trying Havana with a vagrant box. You find my vagrant setup at Github…