Cloudflare’s investigation of the January 2022 Okta compromise

Today, March 22, 2022 at 03:30 UTC we learnt of a compromise of Okta. We use Okta internally for employee identity as part of our authentication stack. We have investigated this compromise carefully and do not believe we have been compromised as a result. We do not use Okta for customer accounts; customers do not need to take any action unless they themselves use Okta.

Investigation and actions

Our understanding is that during January 2022, hackers outside Okta had access to an Okta support employee’s account and were able to take actions as if they were that employee. In a screenshot shared on social media, a Cloudflare employee’s email address was visible, along with a popup indicating the hacker was posing as an Okta employee and could have initiated a password reset.

We learnt of this incident via Cloudflare’s internal SIRT. SIRT is our Security Incident Response Team and any employee at Cloudflare can alert SIRT to a potential problem. At exactly 03:30 UTC, a Cloudflare employee emailed SIRT with a link to a tweet that had been sent at 03:22 UTC. The tweet indicated that Okta had potentially been breached. Multiple other Cloudflare employees contacted SIRT over the following Continue reading

Device Management From The Ground Up: Part 4 – Viewing Operational State

In this article I cover some common "show" commands to view information about our devices as well as tools to refine the commands’ outputs to get exactly the information we require.

The post Device Management From The Ground Up: Part 4 – Viewing Operational State appeared first on Packet Pushers.

How To Fix Ubuntu 18.04 ‘apt update’ Throwing An NGINX Repository i386 Package Error

When running ‘apt update’ on Ubuntu 18.04 to prepare for routine system patching, the system kicked back the following error.

N: Skipping acquire of configured file 'nginx/binary-i386/Packages' as repository
'http://nginx.org/packages/ubuntu bionic InRelease' doesn't support architecture 'i386'

The issue is that the existing sources list file for NGINX has gone stale, and appears to be requesting the i386 package. NGINX does not support i386 on Ubuntu 18.04 (Bionic). The solution is to update the sources list file for NGINX.

OLD /etc/apt/sources.list.d/nginx.list

deb http://nginx.org/packages/ubuntu bionic nginx

NEW /etc/apt/sources.list.d/nginx.list

deb [arch=amd64] http://nginx.org/packages/mainline/ubuntu/ bionic nginx

After this change, the error should be gone when running ‘apt update’.

For More Information

NGINX Linux Packages

NGINX update issue (Ubuntu 18.04 Bionic) – Vesta Control Panel Forum

Ubuntu Server 18.04 Nginx i386 – StackOverflow

Get updates on the health of your origin where you need them

We are thrilled to announce the availability of Health Checks in the Cloudflare Dashboard’s Notifications tab, available to all Pro, Business, and Enterprise customers. Now, you can get critical alerts on the health of your origin without checking your inbox! Keep reading to learn more about how this update streamlines notification management and unlocks countless ways to stay informed on the health of your servers.

Keeping your site reliable

We first announced Health Checks when we realized some customers were setting up Load Balancers for their origins to monitor the origins’ availability and responsiveness. The Health Checks product provides a similarly powerful interface to Load Balancing, offering users the ability to ensure their origins meet criteria such as reachability, responsiveness, correct HTTP status codes, and correct HTTP body content. Customers can also receive email alerts when a Health Check finds their origin is unhealthy based on their custom criteria. In building a more focused product, we’ve added a slimmer, monitoring-based configuration, Health Check Analytics, and made it available for all paid customers. Health Checks run in multiple locations within Cloudflare’s edge network, meaning customers can monitor site performance across geographic locations.

What’s new with Health Checks Notifications

Health Checks email Continue reading

Understanding Data Center Fabrics 02: Clos Fabric History – Video

In the second part of this 9-video series, Russ White describes crossbar fabrics and how they interconnect, using historical telephone networks as an example. He jumps from this to help you understand what’s going on inside of data center fabrics, including Clos architectures. Other details Russ touches on include non-blocking fabrics, how an undertaker impacted […]

The post Understanding Data Center Fabrics 02: Clos Fabric History – Video appeared first on Packet Pushers.

Cloud Engineering For The Network Pro: Part 5 – Cloud Firewalls And Security Groups In Azure And AWS (Video)

Michael Levan reviews the differences between firewalling on premises and in the public cloud and how to set basic rules in AWS and Azure. You can subscribe to the Packet Pushers’ YouTube channel for more videos as they are published. It’s a diverse a mix of content from Ethan and Greg, plus selected videos from […]

The post Cloud Engineering For The Network Pro: Part 5 – Cloud Firewalls And Security Groups In Azure And AWS (Video) appeared first on Packet Pushers.

DDoS attacks and BGP Flowspec responses

This article describes how to use the Containerlab DDoS testbed to simulate variety of flood attacks and observe the automated mitigation action designed to eliminate the attack traffic.

docker run --rm -it --privileged --network host --pid="host" \
  -v /var/run/docker.sock:/var/run/docker.sock -v /run/netns:/run/netns \
  -v ~/clab:/home/clab -w /home/clab \
  ghcr.io/srl-labs/clab bash

curl -O https://raw.githubusercontent.com/sflow-rt/containerlab/master/ddos.yml

containerlab deploy -t ddos.yml

docker exec -it clab-ddos-sp-router vtysh -c "show bgp ipv4 flowspec detail"

At any time, run the command above to see the BGP Flowspec rules installed on the sp-router. Simulate the volumetric attacks using hping3.

Note: While the hping3 --rand-source option to generate packets with random source addresses would create a more authentic DDoS attack simulation, the option is not used in these examples because the victims responses to the attack packets (ICMP Port Unreachable) will be sent back to the random addresses and may leak out of the Containerlab test network. Instead varying source / destination ports are used to create entropy in the attacks. 

When you are finished trying the examples below, run the following command Continue reading

High Availability Options for IBM I Applications in the Cloud

AMD Rounds Out “Aldebaran” GPU Lineup With Instinct MI210

When the “Aldebaran” datacenter GPUs were launched by AMD last November for the HPC and AI crowd pushing up into the exascale stratosphere, only the two top-end models of the Instinct GPU accelerators –ones that use the Open Accelerator Module (OAM) form factor put forth by Facebook and Microsoft under the Open Compute Project – were actually available. …

AMD Rounds Out “Aldebaran” GPU Lineup With Instinct MI210 was written by Timothy Prickett Morgan at The Next Platform.

Zero Trust for SaaS: Deploying mTLS on custom hostnames

Cloudflare has a large base of Software-as-a-Service (SaaS) customers who manage thousands or millions of their customers’ domains that use their SaaS service. We have helped those SaaS providers grow by extending our infrastructure and services to their customer’s domains through a product called Cloudflare for SaaS. Today, we’re excited to give our SaaS providers a new tool that will help their customers add an extra layer of security: they can now enable mutual TLS authentication on their customer’s domains through our Access product.

Primer on Mutual TLS

When you connect to a website, you should see a lock icon in the address bar — that’s your browser telling you that you’re connecting to a website over a secure connection and that the website has a valid public TLS certificate. TLS certificates keep Internet traffic encrypted using a public/private key pair to encrypt and decrypt traffic. They also provide authentication, proving to clients that they are connecting to the correct server.

To make a secure connection, a TLS handshake needs to take place. During the handshake, the client and the server exchange cryptographic keys, the client authenticates the identity of the server, and both the client and the server generate Continue reading

Surprise! The metaverse could be great news for the enterprise edge

When you think about the metaverse and the enterprise, do you think about millions of workers buzzing about in a virtual world to do their work?  Maybe employees picking Star Wars characters as avatars and fighting with light sabers?  CEOs likely blanch at that image; to most, virtual workers implies virtual work, and it’s hard to say how that generates real sales and products.  Fortunately, there’s an alternative that depends not on enterprises using the metaverse but on riding its coattails.If you ask enterprises what they think about the next frontier in cloud computing is, the responses are mixed between “the edge” and “IoT”, and of course the latter is really an example of an edge application. Well that frontier may be delayed because service providers would have to make a significant investment in infrastructure just to create an edge/IoT option for enterprises, and most enterprises aren’t willing to start planning for that next frontier until services are available. With buyers waiting for services and sellers wanting proven demand, we could be in for an era of false starts, edge-wise.To read this article in full, please click here

Using the ldd command on Linux

Shared object files streamline programs by providing information applications need to do their jobs, but that don't have to be part of the application itself. To find out which of these files a Linux command calls on, use the ldd command.What is a shared object file? Shared object files (designated as .so) are libraries that are automatically linked into a program when the program starts, yet exist as a standalone files. They contain information that can be used by one or more programs to offload resources so that any program calling a .so file doesn't itself have to actually provide all the needed tools. These files can be linked to any program and be loaded anywhere in memory.To read this article in full, please click here

Surprise! The metaverse could be great news for the enterprise edge

When you think about the metaverse and the enterprise, do you think about millions of workers buzzing about in a virtual world to do their work?  Maybe employees picking Star Wars characters as avatars and fighting with light sabers?  CEOs likely blanch at that image; to most, virtual workers implies virtual work, and it’s hard to say how that generates real sales and products.  Fortunately, there’s an alternative that depends not on enterprises using the metaverse but on riding its coattails.If you ask enterprises what they think about the next frontier in cloud computing is, the responses are mixed between “the edge” and “IoT”, and of course the latter is really an example of an edge application. Well that frontier may be delayed because service providers would have to make a significant investment in infrastructure just to create an edge/IoT option for enterprises, and most enterprises aren’t willing to start planning for that next frontier until services are available. With buyers waiting for services and sellers wanting proven demand, we could be in for an era of false starts, edge-wise.To read this article in full, please click here

Cisco DevNet certs jump 50%, fanned by network automation

Software skills are becoming increasingly desirable for network engineers and architects, and the uptick in Cisco’s DevNet certification program reflects the trend. According to Cisco, there’s been more than 50% growth in the number of DevNet certifications awarded in the past year.Cisco says it no longer gives out specific numbers, but in 2020, nearly 8,000 participants earned some 10,500 DevNet certifications, including DevNet Associate, DevNet Professional and DevNet Specialist. These DevNet certifications focus on coding, automation, network access, IP connectivity, security and application development on Cisco platforms, as well as what developers need to know about network doctrines.To read this article in full, please click here

Using the ldd command on Linux

Shared object files streamline programs by providing information applications need to do their jobs, but that don't have to be part of the application itself. To find out which of these files a Linux command calls on, use the ldd command.What is a shared object file? Shared object files (designated as .so) are libraries that are automatically linked into a program when the program starts, yet exist as a standalone files. They contain information that can be used by one or more programs to offload resources so that any program calling a .so file doesn't itself have to actually provide all the needed tools. These files can be linked to any program and be loaded anywhere in memory.To read this article in full, please click here

MPLS/LDP Creation Myths

Hannes Gredler wrote an interesting comment to my Segment Routing vs LDP in Hub-and-Spoke Networks blog post:

In 2014 when I did the first prototype implementation of MPLS-SR node labels, I was stunned that just with an incremental add of 500 lines of code to the vanilla IPv4/IPv6 IS-IS codebase I got full any-to-any connectivity, no sync issues, no targeted sessions for R-LFA …. essentially labeled transport comes for free.

Based on that, one has to wonder “why did we take the LDP detour and all the complexity it brings?”. Here’s what Hannes found out:

MPLS/LDP Creation Myths

Hannes Gredler wrote an interesting comment to my Segment Routing vs LDP in Hub-and-Spoke Networks blog post:

In 2014 when I did the first prototype implementation of MPLS-SR node labels, I was stunned that just with an incremental add of 500 lines of code to the vanilla IPv4/IPv6 IS-IS codebase I got full any-to-any connectivity, no sync issues, no targeted sessions for R-LFA …. essentially labeled transport comes for free.

Based on that, one has to wonder “why did we take the LDP detour and all the complexity it brings?”. Here’s what Hannes found out:

“Hopper” GH100 GPUs Are The Heart Of A More Expansive Nvidia System

There are a lot of things that compute engine makers have to do if they want to compete in the datacenter, but perhaps the most important thing is to be consistent. …

“Hopper” GH100 GPUs Are The Heart Of A More Expansive Nvidia System was written by Timothy Prickett Morgan at The Next Platform.

HPE Focuses On Networking, HPC, Storage With GreenLake Expansion

Hewlett Packard Enterprise was a bit ahead of the curve when it announced in 2019 that by this year it would be offering its entire product portfolio as a service and that its GreenLake hybrid cloud platform would be the foundation of the effort. …

HPE Focuses On Networking, HPC, Storage With GreenLake Expansion was written by Jeffrey Burt at The Next Platform.

The NetOps Struggle is Real