A recent study at the University of Arizona explored nine feasible attacks on the popular package managers APT and YUM. As part of their research, the study’s conductors posed as a group of administrators from a nonexistent company and leased a server from a hosting provider. Thousands of clients, including government agencies, downloaded upgrades, which prompted their operating systems to endlessly replicate data, misidentify dependencies, and install unnecessary software. It also left these clients vulnerable to other attacks on their systems, including hackers gaining root access to OSes, system crashes and erased files . Researchers concluded that many public storage spaces for upgrade downloads are in fact maliciously established “mirrors,” or software repositories , that have become infected with sources of attack. You can prevent most of these issues by downloading from only signed metadata repositories, the study counseled. A signature verifies that the repository was created benevolently.

Protecting against mirror threats
In response, readers suggested a number of additional ways to protect a package manager from such threats.

• An OpenSUSE page suggested its internally developed tool, download redirector.
• One blogger wrote that the risks posed by infected repositories are not great enough to merit changes to package manager security.
• Another acknowledged the risk and argued that simply allowing the number of open source package manager products available to increase will maintain or improve current open source package manager security.
• A Gentoo administrator promoted rotating mirrors to ensure security.

Package manager security, as pointed out by this report, is crucial to the success of your operating system. With the present drive for continuous upgrades for your data center, you may feel pressure to download from the most accessible source available. Don’t: the risk of downloading insecure software is greater than the time it will take to check out the above links.

For more on package managers, check out these links: How to manage software on Ubuntu Server with “aptitude” and “apt-get”

Managing Software on Ubuntu Server Edition

The Subversion project, licensed as free and open software by CollabNet, began as a replacement for Concurrent Versions System (CVS). SVN has since grown beyond just fixing what was wrong with CVS and has come into its own as a great software configuration management tool. SVN 1.5 has upped the ante with support for tasks like the following:

• merge tracking;
• sparse checkouts;
• interactive conflict resolution;
• changelists, as well as
• WebDAV transparent write-through proxy; and
• several back-end improvements for speed and reliability.

Merge tracking is probably the most anticipated feature. During development, a developer sometimes creates a new branch in the code repository while creating a new feature. During this process, a developer merges code that gets added to the stable mainline while he continues the new feature work. When the new feature is complete, the feature branch is merged into the mainline.

Previously, the developer would have had to keep track of which revision he began the branch at – and which revisions were merged into the feature branch. With SVN 1.5.x, a server keeps track of this for you. You just issue the svn merge command with the source you want to merge from, and it records what has been done. When you want to bring your branch into the mainline, svn merge --reintegrate brings it in. To top it off, in the event of a conflict, interactive conflict resolution during a merge makes the process much easier.

The second biggest feature is the WebDAV transparent write-through proxy. Imagine that your SVN server is in the U.S., but there are developers working on the project in Asia as well. SVN operations done from that distance can be slow, especially with a large repository and a fresh checkout. With this feature, you can place a server in Asia for developers there to use. It will serve “read” requests like checkouts and updates locally, and write requests will be passed along to the “master” server back in the U.S. As an added bonus, this “proxy” server in Asia is a mirror of your “master” server in the U.S. in case disaster strikes.

Merge tracking and WebDAV transparent write-through proxy, as well as everything else that Subversion can do, make it a great enterprise software configuration management tool.

Business was brisk at Iain Gray’s support booth during the fourth annual Red Hat Summit this week in Boston.

Offered for the first time, the highly visible red and white booth was staffed by Iain Gray, Red Hat’s vice president of services, and a team of technical experts to answer user questions from the basic to the complex.

“Volume was much higher than I expected,” Gray said.

The booth’s technical staff said it fielded queries from those on basic installation to those concerning live migration and other features as well as questions about virtualization features and the newly released Red Hat Enterprise Identity, Policy and Audit (IPA) ) security product.

The advantage of offering the booth at the Summit was that the technical staff could refer directly to the development staff that wrote the code if there was a question they couldn’t answer, he said.

Based on its popularity, Gray predicted that the booth will be a recurring feature at future Red Hat Summits.

According to Zenoss, CEO Bill Karpovich, Zenoss Enterprise 2.2 is an open source cross-platform monitoring tool for networks, servers and applications. The 3-year-old company introduced its first free version in 2006, followed by an enterprise version with support and certification in 2007. The basic application performs configuration modeling, performance management and event management, including alerts and reporting.

With more than 4,000 users, he said, Zenoss is currently the most downloaded open source product and is created by SourceForge.

The new Zenoss Enterprise 2.2 version has a distributed architecture, making it much faster to deploy remotely over large networks. Previously, administrators had to configure the application manually on each remote collector that in turn controls many servers or network devices. Now, however, Zenoss Enterprise can be delivered to controllers automatically, Karpovich said.

In addition, Enterprise 2.2 includes an application program interface called WMI or Windows Management Instrumentation that enables Zenoss to monitor Windows servers as well as Linux machines, he said.

The new version also offers high availability and includes a series of new reports for turnkey monitoring, he said.

Zenoss Enterprise’s competitive differentiator is its power, affordable price, easy deployment and flexibility, Karpovich said. It runs on Red Hat Enterprise Linux, Novell SUSE Linux Enterprise, Ubuntu and as a virtual appliance inside VMware.

To date, Zenoss Enterprise has more than 100 paying subscribers. The cost for support ranges from $100 to $140 per managed resource per year, depending on the service level.

The new server is a dual-purpose management console that enables administrators to monitor Red Hat and Windows machines from a single server running either OS. And since the server has a Windows interface, no Linux experience is required.

Adapted to Red Hat Enterprise Linux from the Xandros Server, Bridgeways for Red Hat configures the servers, establishes the workflow and helps prevent problems, according to CEO Andreas Typaldos. It works with physical or virtual servers and can be managed remotely from any Red Hat server or Windows desktop running XP or Vista.

Known for its interoperability tools, Xandros was recently tapped to create management packs to enable open source applications like Apache Web server and MySQL database to work with Microsoft’s System Center.

Both projects are based on filling the same skill gap by enabling Windows administrators to work with Linux machines without additional training, Typaldos said.

The first three Bridgeways Packs for Red Hat are free; the cost for each additional pack is $449, with annual renewals of an additional 20% of the initial purchase price.

A Bridgeways for Novell SUSE Enterprise Linux is planned in the future, he said.

Bridgeways for Red Hat will be available in July or August.

So I set out to find some IT pros who could talk about Ubuntu Server, which wasn’t hard. I just asked, “Who’s using Ubuntu?”  in a SearchEnterpriseLinux.com newsletter. Here are some respondents’ views of Ubuntu Server, both positive and not-so-positive.

In the past, Linux has gotten dinged for poor corporate-level support; but Canonical Ltd. — Ubuntu’s corporate parent — got support right with Ubuntu’s Long Term Support (LTS), according to Jim Read, an IT administrator for a financial institution.  “We have stuck with 6.06 LTS, and it has worked well,” Read said. If he changed support providers, he’d have to do major system reconstruction, but LTS 6.06 hasn’t given him a reason to consider a change.

Another common point in Ubuntu’s favor is its ease of use, particularly with upgrades and backups.

 ”Backups are so very simple, there is lots of advice about what to back up other than data so that server recovery is reasonably straightforward,” said Iain McKeand, IT systems administrator at Oxford Policy Management.

One admin has had such a smooth Ubuntu upgrading experience that he will upgrade even though he doesn’t have to. His Ubuntu servers “just sit there cranking” and don’t have to have “the latest stuff,” but he’s found that the Ubuntu upgrade process is painless and easy.  “We’re going to upgrade the 6.06 machines within the next few months as time allows,” he said.

Ubuntu Server gets mixed reviews for ease of use in other categories.

Sometimes the need for manual system configuration outweigh the cost savings of using a Linux server, some IT pros say. You’ve got to know Linux pretty well to get the most out of Ubuntu.

Read has encountered problems with dependencies: “The largest issue I had was when I had to install an application from source to make sure I had all the dependencies that were needed to compile the source effectively.”

Linux-savvy admins can get around such problems, Read added. He recommends source applications on Ubuntu over graphical user interface-based ones.  Though they take a long time to mount, source applications allow for more administrator control.

Some users have found Active Directory particularly easy to integrate with Ubuntu, but some have encountered problems. Those in the latter category  say that previous releases of Ubuntu haven’t been easy to use with Microsoft Active Directory, particularly in authentication. They think the new Hardy Heron release should solve that.

On the positive side, Dan Smart, an IT admin at a Fortune 500 mining company, reported, “The new Active Directory integration is excellent. The application they use, Likewise Open, is so much easier than using the PAM Kerberos method or PAM WinBind method of authentication. Works seamlessly.”  

McKeand also found that integration of Ubuntu and Active Directory was fairly straightforward and “has surely been easier year on year.”

Even Windows-friendly administrators have turned to Ubuntu. Ubuntu’s performance marks are very strong, said several of our respondents who have benchmarked it themselves against Windows servers. Some also said that their shops that run mostly Windows servers use Ubuntu for applications Windows does not support.

When compared with Windows, Ubuntu’s support and product pricing has attracted corporate IT managers.  Jim Mirick of Automated Member Services Inc., said: “Our business would be quite different without Ubuntu, because we would have had to spend a lot of time and energy trying to mash more stuff onto one Windows box [due to budget limitations].”

Ubuntu Server has served some companies so well that they don’t want their competitors to know they use it.  “We do both Linux and Windows, [as] I didn’t want to limit my opportunities,” explained an IT pro and respondent, who wished to remain anonymous. He stopped publicizing his decision to use Ubuntu as a core server technology because “I felt this was a competitive advantage.”

If you don’t have to keep your Ubuntu Server a secret, then write to us. Chime in with your Ubuntu Server stories in the comments section below or by emailing me at chunter@techtarget.com.

“A lot of security softwares are device-centered or hard drive-centered. We’re applying protection to specific fields so that you can access the parts of a document that don’t need to be protected,” IRI CoSort’s David Friedland told me recently. Friedland, vice president of business development, said the product reveals a new vision of software security.

IRI’s CoSort’s product page for Rowgen explains, “Until now, you could either forgo adequate testing and make inaccurate suppositions and extrapolations, or, you could spend a lot of time writing custom 3GL or shell programs to build specific test sets with the layouts you want,”

Friedland claims that Rowgen is breaking new ground in being able to run comprehensive tests while administrators perform multiple other tasks simultaneously. The software is compatible with a variety of Linux flavors, including Itanium, SUSE, Fedora Core and Ubuntu.

The target customer for Rowgen is the “security-sensitive manager,” Friedland said. These IT managers have a great need for stronger data protection as information theft crime is on the rise, he said.

On the flip side, automating data security in this way may have a negative impact for lower-level security administrators. Fewer programs will mean fewer employees required to manage them; data center security will change shape in more ways than one.

In trade mags and blogs, I have read about the Vista-versus-Linux issue, and it’s now my turn to say something.

Since December, I have used Ubuntu Desktop. Aside from the fact that I have no virus warnings, no malware and no bots downloading themselves, it has been business as usual. I use Open Office and have no problems with reading and writing MS Office documents. My old Windows Me PC would not let me do that with a new version of MS Office, and of course that meant upgrading to XP as a prerequisite before installing Office. Total cost would have been about $300.

My wife has an older HP notebook running Windows XP Media Center. I chuckle as she reboots each time she gets an update or adds and removes programs. I have been running nonstop with only one required restart for a patch to the Linux kernel.

I read all of these horror stories about Vista on the blogs and comments on many sites about the same. I also see many intentionally derogatory messages posted by Windows users on the open source sites. According to them, Linux is for geeks; “normal” people don’t need to constantly tweak settings and such, as Windows is “automated.” This means that all of Windows software installs without much intervention.

In an honest comparison, it is true that Linux would greatly benefit from an Install Shield application that would make software installs and removal ubiquitous, but I also remember when Windows users complained about the same things.

Another point to ponder is that most of the back-end computers handling banking and ATMs are running Linux. And regarding security, if the banks trust Linux, we should have no problem doing so too.

With faster and multiple-core processors used today, I would have thought that Vista would have been written from the ground up with optimization in mind. With the hefty hardware requirements, it seems Vista is now the most bloated version Microsoft has rolled out to date. Just because I have 2 GB DDR RAM and a 100 GB HDD does not mean that I want my OS to hog most of them. I thought it would make having several applications running concurrently faster, and cause less hangs and crashes.

With the end of the software’s service life rapidly approaching, Windows XP users are panicked. They dread the thought of moving to Vista . Many are starting to look at the Mac OS or Linux as an alternative. Perhaps Bill Gates stepped down because he could foretell the future, and it begins to look like Microsoft is faltering.

With the state of affairs as it is, software developers should move to open source in droves. They can still write proprietary code, and can still sell it at retailers and online.

They just won’t have to pay homage to Microsoft. Monopoly software is dead; long live open source!

At Novell Inc.’s annual BrainShare user conference in Salt Lake City, I talked to Guy Lunardi, one of the most important guys behind Novell’s SUSE Linux Enterprise Desktop (SLED). I had one pressing question for him. I showed him my new Dell XPS laptop, which has a lot of fancy stuff and runs out of factory Windows Vista (since that is the only OS that will allow me to use all the fancy stuff). So I asked him, “When will I install SUSE Linux on that?”

He responded, “Sander, if you go to a shop, buy a Vista DVD and install it on your laptop, do you think it will all work?” The answer was of course not.

When you introduce new hardware, one of the major issues is driver support. “Currently we are talking a lot with the people that develop the devices that are in these new computers to make sure that Linux drivers will be available,” Lunardi explained. “We help them wherever we can and it’s only getting better. It helps that we have some major customers like the Peugeot car manufacturer in France that demand specific functionality. They ask [for] a feature, we’ll make sure they get it and the result of all the effort will be in our new software.”

So there have been lots of developments recently. As a result, when it comes out later this year, openSUSE 11 will be as good as Windows Vista in supporting devices. “But,” Lunardi assured me, “you’ll always have to complete the installation of your operating system by downloading and installing additional drivers. That’s the case for Linux, [just] as it is the case for Windows.”

Fair enough. I’ll give it a try when openSUSE 11 comes out.

Look for a release candidate in April 2008 for Ubuntu server version 8.