When and what AMI to start
Once started how to do you configure it from base to functional. Especially in a way that doesn’t become a vendor lock.
How do you manage the massive sprawl of instances, inventory them and track your assets
Monitoring and general life cycle management
When and how do you shut them, and what cleanup is needed. Being billed by the hour means this has to be a consideration
These are significant problems and just a tip of the ice berg. All of the traditional aspects of infrastructure management – like Asset Management, Monitoring, Procurement – are totally useless in the face of the cloud.

A lot of work is being done in this space by tools like Pool Party, Fog, Opscode and many other players like the countless companies launching control panels, clouds overlaying other clouds and so forth. As a keen believer in Open Source many of these options are not appealing.

I want to focus on the 2nd step above here today and show how I pulled together a number of my Open Source projects to automate that. I built a generic provisioner that hopefully is expandable and usable in your own environments. The provisioner deals with all the interactions between Puppet on nodes, the Puppet Master, the Puppet CA and the administrators.

Sadly the activity in the Puppet space is a bit lacking in the area of making it really easy to get going on a cloud. There are suggestions on the level of monitoring syslog files from a cronjob and signing certificates based on that. Really. It’s a pretty sad state of affairs when that’s the state of the art.

Read More

Web development can be little tough if there had been no frameworks to make our life easier. Any Web Framework is a boon to a web developer as it provides so many options, flexibility and its a big time saver.

Here, we have compiled the best of web development frameworks in PHP, CSS, JavaScript, Python and Java. All these frameworks have there pros and cons, they can help you make your project look clean and robost. For future reference, you can bookmark this post and share it with your friends and web-programmers.

Source

* a RESTful Web Service (RWS)
* a NICNAME/WHOIS port 43 service
* a user-friendly web site (http://whois.arin.net)

When using Whois-RWS you will notice some differences in behavior for
certain queries and corresponding result sets on the NICNAME/WHOIS TCP
port 43 service. These minor differences are documented at:

https://www.arin.net/resources/whoisrws/whois_diff.html

ARIN’s Directory Service for registration data has used the
NICNAME/WHOIS protocol since its inception. The limitations of the
NICNAME/WHOIS protocol are well known and documented in RFC3912.
Whois-RWS was created as an alternative to the ARIN Whois and will
provide much richer functionality and capability to the community.

Whois-RWS can easily be integrated into command line scripts, or it can
be used with a web browser, which makes it applicable for programmatic
consumption and accessible for interactive use. ARIN will continue to
maintain services for the NICNAME/WHOIS protocol on TCP/43. This is
achieved by using a proxy service to translate traditional ARIN Whois
queries into Whois-RWS queries. However, ARIN recommends use of the
RESTful Web Service.

Those who choose to use the Whois-RWS Proxy will find it has many
features unavailable over the existing Whois service, including:

* Support for new query types such as CIDR queries
* Better feedback for ambiguous queries
* More finely scoped record type queries
* Options for NICNAME/WHOIS clients that re-interpret traditional
parameters used by ARIN’s service.
* RESTful URL references, useful for embedding into documents and e-mail
* Better grouping of record types and delineation of results

Another major benefit is that data from ARIN’s registration database is
distributed to the Whois-RWS servers many times throughout the day,
versus the once-a-day update of ARIN’s previous Whois service. Changes
will be reflected more quickly through Whois-RWS, so query results will
be more current than the previous Whois service.

ARIN continues to welcome community participation on the Whois-RWS
mailing list, and we invite you to subscribe and provide feedback to:

http://lists.arin.net/mailman/listinfo/arin-whoisrws

Source

I’d like to let you know that there’s been a compromise of the
unrealircd website and ftp and the 3.2.8.1 tarball release had been
replaced by a backdoored copy.

I’m attaching Syzops original security advisory from

http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt

Yours,
satmd
UnrealIRCd support staff

Hi all,

This is very embarrassing…

We found out that the Unreal3.2.8.1.tar.gz file on our mirrors has been
replaced quite a while ago with a version with a backdoor (trojan) in
it. This backdoor allows a person to execute ANY command with the
privileges of the user running the ircd. The backdoor can be executed
regardless of any user
restrictions (so even if you have passworded server or hub that doesn’t
allow
any users in).

It appears the replacement of the .tar.gz occurred in November 2009 (at
least on some mirrors). It seems nobody noticed it until now.

Obviously, this is a very serious issue, and we’re taking precautions
so this will never happen again, and if it somehow does that it will be
noticed quickly.
We will also re-implement PGP/GPG signing of releases. Even though in
practice
(very) few people verify files, it will still be useful for those
people who do.

Safe versions
==============

The Windows (SSL and non-ssl) versions are NOT affected.

CVS is also not affected.

3.2.8 and any earlier versions are not affected.

Any Unreal3.2.8.1.tar.gz downloaded BEFORE November 10 2009 should be
safe, but you should really double-check, see next.

How to check if you’re running the backdoored version
======================================================
Two ways:

One is to check if the Unreal3.2.8.1.tar.gz you have is good or bad by
running ‘md5sum Unreal3.2.8.1.tar.gz’ on it.
Backdoored version (BAD) is: 752e46f2d873c1679fa99de3f52a274d
Official version (GOOD) is: 7b741e94e867c0a7370553fd01506c66

The other way is to run this command in your Unreal3.2 directory:
grep DEBUG3_DOLOG_SYSTEM include/struct.h
If it outputs two lines, then you’re running the backdoored/trojanized
version.
If it outputs nothing, then you’re safe and there’s nothing to do.

What to do if you’re running the backdoored version
====================================================
Obviously, you only need to do this if you checked you are indeed
running the
backdoored version, as mentioned above. Otherwise there’s no point in
continuing, as the version on our website is (now back) the good one
from April 13 2009 and nothing ‘new’.

Solution:
* Re-download from http://www.unrealircd.com/
* Verify MD5 (or SHA1) checksums, see next section (!)
* Recompile and restart UnrealIRCd

The backdoor is in the core, it is not possible to ‘clean’ UnrealIRCd
without
a restart or through a module.

How to verify that the release is the official version
=======================================================
You can check by running ‘md5sum Unreal3.2.8.1.tar.gz’, it should
output: 7b741e94e867c0a7370553fd01506c66 Unreal3.2.8.1.tar.gz

For reference, here are the md5sums for ALL proper files:
7b741e94e867c0a7370553fd01506c66 Unreal3.2.8.1.tar.gz
5a6941385cd04f19d9f4241e5c912d18 Unreal3.2.8.1.exe
a54eafa6861b6219f4f28451450cdbd3 Unreal3.2.8.1-SSL.exe

These are the EXACT same MD5sums as mentioned on April 13 2009 in the
initial 3.2.8.1 announcement to the unreal-notify and unreal-users
mailing list.

Finally
========
Again, I would like to apologize about this security breach.
We simply did not notice, but should have.
We did not check the files on all mirrors regularly, but should have.
We did not sign releases through PGP/GPG, but should have done so.

This advisory (and updates to it, if any) is posted to:

http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt

Source

By releasing some of our code, we get the benefit of more people reviewing and improving it. In fact, the majority of the code for WhiteHouse.gov is already open source as part of the Drupal project. The code we’re releasing today adds to Drupal’s functionality in three key ways:

1. Scalability: We’re releasing a module called “Context HTTP Headers,” which allows site builders to add new metadata to the content they serve. We use this to tell our servers how to handle specific pages, such as cache this type of page for 15 minutes or that type for 30. A second module that addresses scalability is called “Akamai” and it allows our website to integrate with our Content Delivery Network, Akamai.

2. Communication: Many government agencies have active email programs that they use to communicate with the public about the services they provide. We have a mailing list for the White House, where you can get updates about new content and initiatives. To enable more dynamic emails tailored to users’ preferences, we’ve integrated one of the popular services for government email programs with our CMS in the new module, “GovDelivery”.

3. Accessibility: We take very seriously our obligation to make sure WhiteHouse.gov is as accessible as possible and are committed to meeting the government accessibility standard, Section 508. As part of that compliance, we want to make sure all images on our site have the appropriate metadata to make them readable on by screen reading software. To help us meet this, while making it easier to manage the rich photos and video content you see on our site, we’ve developed “Node Embed.”

Source

That statement has to do with a particular type of data, the kind that gets generated copiously in a day’s activity on the Internet. Each day sees 15 million tweets, 60 million Facebook updates and 1.6 billion people active online in a variety of other ways. It’s hard for relational systems to keep up. Relational systems have to work hard at decomposing this data, storing it in tables and building indexes on it — they work so hard on it that you don’t really want your system to undertake the task. It’s too expensive.

“When you scale up relational systems, you introduce single points of failure… You lose the advantage of their precision but you gain the overhead,” as you try to make the system work on a larger and larger data set, said John Quinn, VP of engineering at Digg, the social networking site, and lead off speaker at the Under the Radar’s cloud event April 16 on the Microsoft Campus in Mountain View, Calif.

Those NoSQL systems you’ve been hearing about, on the other hand, scale out by distributing their operations across more nodes in a server cluster. “There’s nothing wrong with relational database…You just need to use the right tool for the right job,” Quinn said, throwing in the fact that NoSQL stands for “Not Only SQL,” although there were a few knowing smiles at that one.

Quinn is a leading member of the generation that doesn’t want to try to capture terabytes of data with relational systems. He prompted the changeover from the MySQL open source relational database at the social networking site, Digg, to Cassandra, a key value store system. Cassandra performs many of the data sorting operations of a relational database but allows data reads to be done in advance of full updates. The practice sometimes leads to momentary consistency problems, since one user of the data might get a version that differs slightly from the next one, although both sought identical sets.

The large, distributed key value store system “sacrifices consistency to slave lag,” or tolerates the lapse between when an update occurs on a distributed node and when it’s replicated on other servers. In most NoSQL systems, assured consistency is less an issue — and less a virtue — than in relational systems.

The NoSQL approach allows “tune-able consistency. You can trade off consistency for speed,” Gunn noted.

Because a server in a NoSQL system automatically creates duplicates of the data on at least one other node, a server in the cluster can fail and no data is lost, the NoSQL system keeps processing and an application keeps running. In addition to Cassandra, MongoDB, Voldemort, and CouchDB are NoSQL systems in the public arena. Google and Amazon operate their own internally.

Gunn did implicitly point to a potential NoSQL shortcoming. Although indexes are associated with relational systems, if you do need an index, you may need an external system to build it. So far, the NoSQL systems have only rudimentary indexing.

That’s why the NoSQL enthusiasts say their systems are not for financial or other time-sensitive transactions. Relational systems are. On the other hand, if you’re updating your Zynga Farmville plot, then Cassandra makes a lot of sense for capturing that information.

Of 24 companies presenting at this event, six had a big data handling, analytics or storage systems in mind. They included Sones, Cloudant, GenieDB, GoodData, neotechnology and Maxiscale.

Each start-ups presented their business and product plans in six minutes at the event, then faced questioning from a three-judge panel of reviewers.

Source

To most people, boot loaders aren’t the most exciting aspect of an operating system, but they are extraordinarily important. Without a functioning boot loader, nothing else works. Currently, a transition from the old Grand Unified Bootloader (GRUB) Legacy tool to the new GRUB 2 is underway. GRUB 2 is the default boot loader in Ubuntu 9.10, and it’s an option in most other major Linux distributions. Sooner or later, other distributions will deploy GRUB 2 as the default boot loader.

Source

The flaw, separately reported by researchers Tavis Ormandy and Ruben Santamarta, involves the Java Deployment Toolkit browser plug-in failing to properly validate parameters, according to a Secunia advisory. This can allow attackers to execute a JAR (Java Archive) file “on a network share in a privileged context.”

If users are tricked into visiting a malicious website containing the exploit, attackers can run arbitrary code on victim machines, the advisory said.

Built-in protections on the latest Windows platforms cannot stop the threat, Alin Rad Pop, senior security specialist at Secunia, said Monday in a blog post. As a result, he expects cybercriminals to start taking advantage of the weakness.

“This vulnerability is particularly interesting for an attacker as in-depth memory protection mechanisms on modern Windows operating systems such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) provide no mitigation,” he said. “Consequently, we expect to soon see attempts to exploit this vulnerability in the wild.”

Ormandy, who works for Google, recommends users set a specific kill bit, as described here in a post on the Full Disclosure mailing list, as a workaround until a patch is issued. He said simply disabling the affected Java plug-in will not work “as the toolkit is installed independently.”

The flaw exists in JRE (Java Runtime Environment) version 6, update 19, the newest installment. A spokeswoman for Oracle, which owns Sun, could not be reached for comment on Monday.

Source

The program includes:
– Keynote Address: “Why Don’t I (Still) Trust Anything?” by Jeff Moss,
Founder, Black Hat and DEF CON

– Invited Talk: “Naked Avatars and Other Cautionary Tales About MMORPG
Password Stealers,” by Jeff Williams, Microsoft Malware Protection Center

– Sessions on threat measurement and characterization, botnets,
threat detection and mitigation, and more.

Check out the full program at

http://www.usenix.org/events/leet10/tech/

Connect with the broad community of researchers and practitioners who
focus on worms, bots, spam, spyware, phishing, DDoS, and the
ever-increasing palette of large-scale Internet-based threats in
fostering the development of preliminary work in this diverse area and
stimulating discussion of thought-provoking ideas.

Find out more and register today at

http://www.usenix.org/leet10/proga

On behalf of the LEET ’10 Program Committee,

Michael Bailey, University of Michigan
LEET ’10 Program Chair
leet10chair (at) usenix.org

————————————————————————
3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats
(LEET ’10)
Botnets, Spyware, Worms, and More
April 27, 2010, San Jose, CA

http://www.usenix.org/leet10/proga

————————————————————————

Source

Tyler Reguly, lead security research engineer at nCircle, today published a white paper outlining a new category of attack called “meta-information XSS” (miXSS), which works differently than other forms of the popular attack method — and could be difficult to detect.

“Think about those network administration utilities that so many webmasters and SMB administrators rely on — tools that perform a whois lookup, resolve DNS records, or simply query the headers of a Web server,” the white paper states. “They’re taking the meta-information provided by various services and displaying it within the rendered Website.

“These Web-based services introduce a class of XSS that can’t be captured by the current categories.”

Reguly explains that there are three current types of XSS attacks: reflected, persistent, and DOM-based.

“Reflected XSS refers to an attack that occurs when user input is reflected back at the user,” he writes. “This means that you provide the malicious data as user input, and the Web application simply echoes the data back to you.

“Persistent XSS refers to an attack that stores user input, allowing it to affect a much broader scope of visitors. An attack may be stored in the database and displayed to all visitors, rather than just the visitor that provided the malicious input.”

DOM-based XSS refers to attacks that modify the Document Object Model directly and don’t require data in the HTTP response, Reguly says.

“None of these [categories] really captures the process that occurs when you are dealing with [miXSS],” the paper says. “With miXSS, the input that the user provides is completely valid and properly sanitized. This rules out reflected XSS, and since we aren’t storing the user input, persistent XSS can also be disregarded. Finally, since we’re not interacting with the DOM, we can eliminate this type of attack.”

MiXSS has aspects of both reflected and persistent attacks, but does not fall into either category, Reguly explains. “It is valid user input provided to a service,” he says. “The service then utilizes the user-provided data to gather data and display it for the user. It is in this data that the cross-site scripting occurs.” Reguly offers an example: a DNS TXT record that contains [a certain value] and a service designed to gather DNS TXT records for the purpose of testing sender policy framework (SPF) records.

“The user provides the domain name pointing to the TXT record, while the service resolves the TXT data and displays the data to the user,” the paper says. “Since the data contains JavaScript, the returned data is processed, and successful cross-site scripting has occurred.”

The XSS vulnerability could be a growing threat in the future, Reguly says, because Web-based tools such as these are increasingly used to quickly resolve network administration issues that might otherwise inhibit the user experience, the paper says.

Source