Datamining: The NSA Is Not A Problem!

The recent developments regarding an NSA whistleblower who states concern over invasive practices regarding phone calls and other communications of Americans not accused of any crime deserve careful consideration. But don't make the mistake of blaming field agents - or even upper command - of the National Security Agency, the main cryptographic arm of the US Government. They don't make policy. The politicians do, via the most relevant law here, which is the Patriot act, passed during the previous Presidential administration.

The fix is obvious: keep the ability to do traditional "wiretapping" when backed up by a search warrant documenting probable cause. Rein in the newer blanket permissions that don't require probable cause. Bolster punishments for government abuse of gathered information, as in "fishing expeditions". Sure, it would be more convenient in doing search and seizure if lots of pre-gathered information were available, but that wouldn't be reasonable in the case of the innocent.

And remember what's known of the role of the NSA in helping win the cold war. These agents are soldiers, too. They've risked all and sometimes died just like soldiers who operate in the open, but could never receive the recognition that above-ground GI's get. I don't know of any problem with the whistleblower's argument (as I currently understand it) that we should be alarmed if basic freedoms are threatened, but the fix isn't to demonize operatives every bit as valuable as he. If the public gets clear on the value of our lives and persons, and the politicians don't give us the protections we and the constitution require, then we deal with the politicians, not the soldiers.

And the first thing I did in reaction to these events was not to gripe on Facebook or Twitter and not even to post this blog. It was to send $35 to the National Cryptologic Museum. This project works to build a new facility to preserve the history of the NSA, and is near the National Vigilance Park, which preserves listening post aircraft similar to those lost in service. If we forget the significance of our own heroic actions and those of our forefathers, the cost will be our souls.

Hurricane Season!!

...which isn't just for the American South anymore, as NYC recently demonstrated. So along my usual lines of best practice suggestions, what would be prudent to think about under the conditions that began June 1st?...

OFFSITE BACKUP LOCATIONS - Yes, there's the net or the network or the cloud or the fog. But if data is pushed somewhere, is it being pushed only down the street where the same flood that hits you hits the data center? And if the data center is across the country or world, how much data creeps across the connection how slowly?

POWER CONDITIONING - Power is certainly a consideration when a blackout removes it. But when power is available, it could be "dirty", fluctuating in damaging patterns and amounts.

PHYSICAL PLANT ISSUES - How's the electricity situation at your site or data center? Is there a generator or secondary source? What about physical security, like the condition of the doors, gates, windows? How about the architecture and condition? What if the roof comes off? Does the place normally leak during heavy rain? (One might stop by sites during inclement weather for inspections).

LOCAL EQUIPMENT - Think about flashlights, flashlight batteries, first aid and storm kits, tools, etc. that might be good to stash around the workplace.

ALARM FAILURE - If power fails or a falling tree physically damages some asset, what's the backup plan? Email or text message communication generated by software will be problematic if the host machine itself can't operate. And is there a secondary plan for the phone contact tree?

GENERAL COMMUNICATIONS - Even if you have an old-style pulse phone in the place (they still work in storms due to their internal magneto), an old-style answering machine still needs AC power to work. And if it's a newer desk phone, it needs AC itself. Does everybody have chargers for their cell phones? Preferably in their cars?

STORED FUELS - As well as diesel or gasoline for the generator, are other fuels needed? Bottled gases or lubricants?

EMP - I don't expect nuclear attack, but other causes of electromagnetic problems are likely, such as sunspot activity or detonation of a transformer on top of a nearby telephone pole. As unlikely as it would be for most assets to need to have Faraday cage protection, some might benefit from that. Most, though, could be protected with less complex or expensive isolation or shielding.

-----

COMING ATTRACTIONS: As soon as I can, I'll get to some projects on which to report, such as recent looks at nMap, CrunchBang Linux and TRK's latest version.

Going On The Offensive

Continuing with my current theme of best practice advocacy, allow me to openly attack a terrible and unintelligent tendency in computer users, from the novice to the expert. It is an appeal to laziness and an invitation to disaster: the resistance to the OPERATING SYSTEM RELOAD [I'm primarily speaking of the end user machine, but these comments can easily be applied to servers]. Why is an OS reload a good thing?

First, look at the benefits. IF one is prepared for it (with recovery or original system media or both) one gets, at the price of an hour or two, a brand new software load at no cost (which can boost performance by up to 5-10%). Or if you wish, hand the media to some tech and pay the fare and have somebody else do it.

Second, look at the protection. From hacks to lightning strikes to hardware failure to spilling beer into the tower on New Year's Eve, one is prepared for the worst. And a new copy of your system can fix dozens or even hundreds of problems you may not know were present.

Third, consider that in this era of cheapness, manufacturers are not as good at offering reload CDs/DVDs as standard equipment. They can come at extra cost, or often one is expected to get blank media and burn one's own copy with an onboard script, wizard or program; if one forgets to do this and remembers 6 months later, one can only back the system up in its condition at that time and not as brand-new. And a year after buying a computer, recovery media previously available may be discontinued.

Why are OS reloads resisted? For many reasons, none good. There's lack of preparation: to do a reload, one must be prepared to rebuild the whole system, from the base OS to additional drivers and applications, to the configuration of all of the above. If one has not documented any of this, one has work to do (that should have been already done). Then, there's the belief that it shouldn't have to be done more than once. This is uninformed; all system files become corrupt over time due to program interaction, electrical surges, disk location errors, lack of file system maintenance, accidental deletion and so forth. There are no doubt more reasons, but the point's been made.

The moral of the story is to remember that all file storage is somewhat risky. Online internet backup? Great, but there's some security risk there (better than nothing, though). Burning your user files to disk? Great, but the computer itself must be rebuilt with something. The main thing would be to save, build or burn an OS copy at the start. Buy the rebuild disk if you must - immediately. Have disks or installers for your needed apps as well, and special drivers for wireless capability, camera adapters, etc. burned to the same or other media.

All this is more than busy work. It's a free insurance policy. And the preservation of the system (and its value to your work) could be worth far more than the physical computer.

Guilty As Charged

I continually discover how many simple things that we in tech always tell other people to do... are still undone by us. So yet again, I am spurred to do another 'best practices' post. But this time, the inspiration came from within the ranks of the techies. I will mention no name in connection to any such foolishness exept my own. If we have good advice, we should take it ourselves.

BEST PRACTICES, version 34.09?

Change passwords regularly and keep a secure master list offline.

Don't use the same password for everything.

Don't be needlessly repititious in other areas, like calling a host the same thing as a domain name. That can confuse people as well as systems.

Do backups of all unique data regularly either offline or on an additional disk.

Don't do "secure" work from public sources like schools, libraries, restaurants or coffee shops. If you need to do that, use encryption on an additional computer that's cleaned often.

Run rootkit hunters, antivirus, antimalware, etc. regularly.

Update the operating system and all APPLICATIONS regularly.

If your activities are tied to a particular OS that's dependent on a particular set of hardware, keep important spare parts around.

Don't get rid of your laptop and desktop, attempting to do everything on your phone. It only takes one drop to the concrete, loss/theft or accidental dive into a public toilet to ruin your whole week. Particularly when there were no backups for 6 months.

Be discreet on social media; delete unused accounts.

Keep webmail accounts lean and backed up. Use more secure options when possible - like paid as opposed to free.

Turn off communications capability when not in use. This can include computers, routers, modems, terminal units, repeaters, gaming devices, etc. To leave everything on for two weeks is a prescription for trouble.

Don't click on a link if you don't know where it's going. And never respond to bank emails; call the bank.

Check your own history. Do web searches on yourself, and for old sites, see what archive.org has on you.

How to say lots without revealing sensitive details...?

Hmm. Let's see if I can indicate what I'm working on without violating any agreements... Coming back into an actual, real Unix job after so long, I'm having to review Windows Server 03 and 08... yes, right. And for which there's actually a good rationale. Not only are many customers flying that product (although not as many as CentOS plus RHEL at our shop), but many server problems are conceptually the same. A reboot's a reboot, a password change is a password change, and a brute force annoyance is the same as well in all camps. And another thing's the same: the support surprise. I found out that we were supporting WinServer 2012 when we went into somebody's new build and saw that our build technician had provisioned it. NOBODY TOLD SUPPORT ABOUT IT. We just kinda found out. One or two other products have recently "appeared" on our plate like that. But there's all the things that aren't a surprise, and that the average tech should keep up with anyway: DNS, shell, awk, log locations for server OS's and control panel products, plus networking (and internally constructed "custom" networking). And one surprise is how useful nmap has become. It's almost a whole command family of its own and doesn't any longer have the reputation for instability that it shook during the last decade. It can do much more than find a port; their documentation book is on my buy list.

SOME Customers Say The Darndest Things

So I have a new job at a help desk to be named later. It's good to be back in the swing of things and most customers are actually my teachers in a way, since they know far more about their systems than do I (being tech support on rented systems in a physical sense but not being an admin since I have no idea what they're doing, in an applications/productivity sense). And not only can they be teachers. Every so often there's that provider of the unexpected request... "Have you got the log of the file system check?" I'll give you a minute for that one to sink in. Actually, I'll give you three weeks.

FOR MINT NEWBIES

I just turned a Windows guy onto Linux Mint and he's having considerable success with it, in spite of being a total novice at Linux. I just came up with a very few things that it might be helpful for a new Linux user to know, regardless of how easy recent distros have made things:

1. Watch the update symbol and do updates every time they're noted in the word balloon notice thingie. Updates are how security holes are controlled in the *nix world, both for the OS and for many applications.

2. Read the manual pages (man command in Terminal) on the commands su and sudo (super user). Some distributions restrict the root account, preferring that you operate as a regular user most of the time. When needed, elevate yourself using su or sudo, then giving the password requested, which will be either the user password or a separate one for 'root'.

3. Use the locate command to do really quick searches in case you lose a file. Remember that it uses a database, which is freshened up (as root) by invoking 'updatedb'.

4. Use apt-get to do fast updates from Terminal. The sequence is

apt-get update
apt-get upgrade
(y for yes to continue or to accept additional required updates)

Of course, the software updater app is there for you as well.

5. If an app, game, utility or other program is present in the distribution's software repository, apt-get is the command to use. It's simply

apt-get install (name of file)

6. Grab an outboard hard drive for backups. Remember that you'll need to reformat it in whatever file system your distro uses; the "format" command is easy to find in the GUI.

7. Speaking of GUI issues, you have choices that outfits like Mac and Windows don't give you. They only have one desktop environment, whereas Linux offers bushels of them. Gnome and KDE are the most common full-featured ones, while there are others like Enlightenment and FluxBox that cater to older and slower systems (requiring less resources to run).


Hope this helps!