MacOSX: ZFS Update

MacOSX: ZFS Update

Abstract:

The Apple Macintosh Operating System was built around the Hierarchal File System (HFS.) The file system was upgraded from 16 bits to 32 bits and renamed HFS+ while several other operating feature were also added. The market has been clamoring for a real storage solution, Apple briefly released a ZFS beta, and finally a new commercial company is doing the heavy lifting of providing MacOSX a reasonably current ZFS implementation.

History:
The Zettabyte File System (ZFS) was built by Sun in 2004 on top of a 128 bit base, differentiating it from competing (16 and 32 bit) platforms. Sun open-sourced ZFS in 2005.

In 2006, a skunkworks operation at Apple started to port ZFS to MacOSX by Chris Emura, (Apple Filesystem Development Manager) and Don Brady(Apple filesystem and OS engineer.) Apple started down the road of adopting of ZFS for MacOSX Server "Leopard" 10.5 in 2007. Mac OSX Server "Snow Leopard" 10.6 was supposed to have full ZFS support, but ZFS was later canceled.

After working on the HFS+ and former Apple ZFS port, 20 year kernel and file system veteran Don Brady announced the formation of corporation "Ten's Complement" to finally bring ZFS to MaxOSX. The intention is to use the Illumos source code base to provide the much needed (and much desired) functionality to MacOSX.

The MacZFS group offered a package download for MacZFS-74.1.0 on March 5, 2011.

Helpful Links:
Ziff-Davis industry reporter Robin Harris cearly outlines the benefits for ZFS under MacOSX. For more information on MacOSX, ZFS, and it's Illumos source base, see the following.

• MacZFS Wiki
• MacZFS FAQ
  
• MacZFS Updates
  
• MacZFS Downloads
• ZFS Disk Format Specification
  
• TensComplement on the MacZFS Wiki
• Illumos
• Illumos News

Network Management Connection:
Network management is all about tying a lot of (remote) data together into a large database for easy investigation. ZFS is the only modern reliable file and volume management system in the open sourced and commercial world at this point. MacOSX may be one of the most simple, secure, and robust user facing UNIX based systems in the world at this point.

The marriage of the two (ZFS and MacOSX) offer tremendous possibilities to tie together robust user end experience (through appliances such as iPhone, iPod Touch, and iPad families) with robust back-end processing (virtually virus-proof MacOSX and ZFS.)

2011 March 20-36: Articles of Interest

Security, Networking, and Industry Articles of Interest


2011-03-16 - Microsoft malware removal tool takes out Public Enemy No. 4

Microsoft finally used its Malicious Software Removal Tool to remove the fourth-biggest threat in automated program's history dating back to at least 2005.

2011-03-18 - RSA breach leaks data for hacking SecurID tokens

'Extremely sophisicated' attack targets 2-factor auth

2011-03-20 - AT&T acquires T-Mobile USA from Deutsche Telekom for $39bn

There was one GSM network, to rule them all...

2011-03-23 - Mac OS X daddy quits Apple

Bertrand Serlet, Apple’s senior vice president of Mac software engineering and the man who played a lead role in the development of Mac OS X, is leaving the company.

2011-03-23 - 'Iranian' attackers forge Google's Gmail credentials

Skype, Microsoft, Yahoo, Mozilla also targeted.

Extremely sophisticated hackers, possibly from the Iranian government or another state-sponsored actor, broke into the servers of a web authentication authority and counterfeited certificates for Google mail and six other sensitive addresses, the CEO of Comodo said

2011-03-23 - Oracle announced all software development stopped on Intel's Itanium CPU.

Red Hat was the first to pull the plug on Itanium, saying back in December 2009 that its Enterprise Linux 6 operating system, which was released last summer, would not be supported on Itanium processors.

Microsoft followed suit in April 2010, saying that Windows Server 2008 R2 and SQL Server 2008 R2 would be the final releases supported on Itanium.

2011-03-24 - Apple Mac OS X: ten years old today

OS X was the product of Apple's 1996 purchase of NeXT, a move that not only saw the acquisition of a modern operating system, but also the return of its co-founder, Steve Jobs, to the company.

Detecting & Obscuring Tethering

Detecting & Obscuring Tethering

Abstract:
Network providers have traditionally offered the capability of leveraging the wireless network for portable computers. Recently, certain wireless devices had been omitted from this capability called Tethering. The Apple iPhone may leverage a particular TCP/IP feature called Time To Live (TTL) which may be leveraged to track tethering.

Enter Julian 3:
A user who refers to himself as "Julian 3" who reads "The Register" in the UK posted a comment indicating one way which a mobile device may be differentiated from other mobile devices, as well as how to determine if that device is performing tethering. Julian 3 explains TTL in this fashion:

All IP packets have something called a TTL associated with them. It stands for Time To Live. Every "hop" along the network from one router to the next reduces the TTL by one. When it reaches 0, the packet is dropped. This was introduced to keep routing problems from overloading the network. If for example, by some error a packet was going around in a circular path, the TTL would eventually reach 0 and prevent a packet storm.

Julilan 3 suggests that the iPhone uses a TTL of 64 and packets from tethered devices may normally have a different TTL from the packets which originate from their devices. After the packets proceed through the iPhone, acting as a gateway, the TTL in the packet will decrease by one.

Suggested Obfuscation:

Julian 3 suggests the following process to obscure Windows clients.

Apple uses a TTL of 64 for the iPhone, by the way. So change the TTL on your computer to "65" and there should be no problem. Here's how to do it:

1. Click Start - Search and type “regedit”. This launches the WIndows Registry.

2. In the registry, navigate to the following registry key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] HKEY_LOCAL_MACHINE
\SYSTEM
\CurrentControlSet
\Services
\Tcpip
\Parameters

3. In the right pane, right-click and select New – DWORD (32-bit value) and set its name as "DefaultTTL" and set its value anything between 0 and 255. The value sets the number of Hops or links the packet traverses before being discarded.

Network Management Connection:
This process of detecting a tethered connection is very network centric. Whether or not a network carrier uses this particular process for tethering is really not important. It does demonstrate that various signatures from a client can be used to easily determine characteristics about the source system.

There are plenty of other mechanisms which can be used to identify the source or destination of traffic, including simple things like HTTP headers. Fully obscuring the source system is far more complex than this.

Solaris 11: Ping Enhancement

[nuclear submarine image]

Abstract: 

The TCP/IP network has become the ubiquitous protocol suite for communicating world wide between systems. The Internet Control Management Protocol (ICMP) is used to regulate the communications over the network. A common command leveraging ICMP for testing of connectivity is Ping. The Ping command is implemented with different options depending on the system platform. Solaris 11 adds a new backwards-compatibility feature to Ping. 

History: 

When Solaris was first implemented, it was based upon BSD UNIX. The default behavior was to provide multiple packets sent on a regular interval. With the merger of Solaris with AT&T UNIX, the default behavior became radically different: the sending of a single packet with a response. Solaris 11 is bridging the gap between the two behaviors.  

Solaris 11:

 John Beck from Oracle added a feature to Ping in Solaris 11.

So in build 33 of Solaris 11 I added a check: if the variable MACHINE_THAT_GOES_PING is set in the environment to a non-null value, then ping will go into "statistics" mode as if the -s flag had been provided.

If a non-null variable "MACHINE_THAT_GOES_PING" is set in the environment, Ping will automatically enter "statistics" mode, where multiple packets are sent continuously, until an interrupt is received. For the casual interactive user, this is a tremendous benefit.  

Concerns: 

Scripts which check for connectivity [using ping] prior engaging a higher layer network protocol command [such as ssh] may possibly be impacted by naive user community who implements this environment variable in a profile.

Remedies: 

If a user decides to implement the "MACHINE_THAT_GOES_PING" environment variable, it might be a wise decision to check for a tty before setting the variable. If a user wishes to leverage this feature by adding the environment to a profile, the following lines may be beneficial in suppressing the behavior in some automated scripts running in cron and at jobs.

# check for tty prior enabling automatic statistics
tty | grep "not a tty" >/dev/null || {
MACHINE_THAT_GOES_PING="Yes" ; export MACHINE_THAT_GOES_PING ; }

Joyent: Sun Out of the Clouds

Joyent: Sun Out of the Clouds

Joyent is offering a special to Solaris users:

• Open Solaris based SmartMachines

Open Solaris SmartMachines outperform Amazon EC2 on basic metrics:

• CPU is 5x faster
• Disc I/O is 14x faster
• Memory I/O 3x faster

Build high performance web applications with a 1GB SmartMachine for just $45 per month (special price offered on a new machine April 15th, 2011 and will remain in effect until the machine is decomissioned.

After the offer expires, the price will be a normal cost of $80 per month higher.)

Solaris 11 Ecosystem for SysAdmins

Solaris 11 Ecosystem for SysAdmins

On the Sun Blogs, UnixMan posted a short interview with Solaris Engineers and Solaris Architects.

Solaris 11 Express came out in November 2010, with the Solaris 11 release being imminent - it is a vehicle for getting introduced to technologies that are shaping the Solaris ecosystem going forward. There are technologies that constitute the fundamental basis for value-rich stack present in Oracle products, by Oracle as well as by a number of customers *today*. Here is a great video describing the relevance with specific examples to be aware of, particularly how new architecture provides an integrated system and offers simplified administration. Rick Ramsey interviews Markus Flierl, Liane Praza and Dan Price from core Solaris Engineering.

This is a wonderful introduction to Solaris 11!

Protect Your Applications with Oracle Solaris Security

Protect Your Applications with Oracle Solaris Security

A short tutorial introducing a developer or administrator to Solaris 11 Security features.

Features covered include:

• Privileges
• RBAC (Rights and Authorizations)
• Integration with SMF

These basic features exist in Solaris 10 as well as Solaris 11, but this lab is targeted at Solaris 11 platform.