Many of the Free Softwares (GPLed) IMHO (author’s personal opinion) struggles with marketing or reaching to mass audiences. The effort by Zeroshell to reach more audiences by the peculiar “viralware” model is appreciated.
We use Zeroshell Firewall on quite a few of our networks and are happy with it.
Viralware is a word I just coined ?!
Stumbled upon Mobile shell (Mosh) which allows persistent connection over intermittent connections, VPN – WiFi – networking roaming etc. Its quite useful especially when we have tons of nodes across multiple cloud providers & resulting attempts of their attention grabbing. Automating few things in a CRM made us end up setting up a Postfix mail server after something like more than a decade, got frustrated over the nearly non-existent internet provided by Asianet DSL & all credit of this goes to them.
TL;DR Here is a quick guide to get Mosh working on Mac & GNU/Linux flavours.
Mosh uses UDP. Yes, you heard it right.
By default it uses 60000 to 61000 for establishing connections. We would need to open up some of these ports, say a subset of this in the fire wall mechanism that we use to get access to the servers.
There is a client & a server
I missed out this part ! Well, we need to install Mosh on the client and the server. (ie apt-get install mosh or yum install mosh on the servers too BOFH.)
On Amazon / AWS / EC2 cloud,
Open up few UDP ports in the security groups. We opened up 10 ports.
On DigitalOcean or any other provider open the ports in your firewall.
Client side installation:
On Mac, we ran into issues with libprotobuf
> mosh migrate2cloud.com dyld: Library not loaded: /usr/local/lib/libprotobuf.7.dylib Referenced from: /usr/local/bin/mosh-client Reason: image not found Died at /usr/local/bin/mosh line 201.
The solution is to upgrade Brew (well why shouldn’t one use brew ?)
brew update ; brew upgrade ; brew remove libprotobuf ; brew install libprotobuf
will do the magic. If not, we can try
brew remove mosh ; brew install mosh
as well. If its doesn’t work, RTFM & the FAQ 🙂
Another issue we ran into was the locale & UTF-8 encoding. We fixed it by installing the locale in the client and server and exporting the following environment variable to the bash profile.
# for mosh
export LANG=en_US.UTF-8
export LC_ALL=en_US.UTF-8
export LC_CTYPE=en_US.UTF-8
export MM_CHARSET=utf8
export LC_COLLATE=”en_US.UTF-8″
export LC_TIME=”en_US.UTF-8″
export LC_NUMERIC=”en_US.UTF-8″
export LC_MONETARY=”en_US.UTF-8″
export LC_MESSAGES=”en_US.UTF-8″
You load the environment variables by doing the following in bash.
. ~/.bash_profile # don’t miss the dot at the beginning
Firewalls, Tunnelling, NAT
It may not work just yet as you may have to deal with NAT traversal and other nasty things. Creating an SSH tunnel can solve these issues.
mosh –ssh=”ssh -4 -R 2222:localhost:22 -i /Users/migrate2cloud/keys/ssh-key” root@server.com
Reattaching a detached Mosh:mobile-shell is not possible. But we can run screen inside mobile shell.
do pkill mosh-server instead … or pgrep mosh-server -> kill etc
PS: if you use CIRU.org, things may be different for you.
That’s it. DigitalOcean guys have come up with a nice write up here which is very helpful. There is also an Android client and iOS client in the making. On GNU/Linux I use KDE Konsole & on Mac iTerm : these are 2 good tools that are very useful IMHO.
In our first article we had discussed security and privacy of data in cloud and how to meet MSSQL server HIPPA(Health Information Portability and Accountability Act) compliance. We had also learn how to encrypt data in transit between MSSQL server and applications. Here you will learn how to encrypt data in rest in MSSQL using Transparent Data Encryption(TDE).
It seems that most of the security products focused their effort on securing data in transit only, using SSL/TLS. But when you build a security system that meet the international security regulations and acts, you need to encrypt data in rest also. The insecure configuration of server, operating system, firewall and network in general, will make it easier for some one to gain access to data at rest.
TDE performs real time encryption and decryption of data while writing and reading data from MSSQL. As the name implies encryption is transparent, that is no need to modify code or architecture of applications when implementing TDE.
1. Create a master key
A master key is a symmetric key that is used to create certificates and asymmetric keys.
[sql]
USE master;
CREATE MASTER KEY
ENCRYPTION BY PASSWORD = ‘<password>’;
GO
[/sql]
2.Create Certificate
Certificates can be used to create symmetric keys for data encryption or to encrypt the data directly. Execute the following script to create a certificate:
[sql]
CREATE CERTIFICATE TDECert
WITH SUBJECT = ‘TDECertificate’
GO
[/sql]
3.Create a Database Encryption Key and Protect it by the Certificate
1.Click object explorer in the left pane of the MSSQL SERVER Management Studio
2.Right Click on the database which you want to encrypt
3.Click Tasks and Navigate to Manage Database Encryption
4. Select the encrytion algorithm (AES 128/192/256) and select the certificate you have created
5.Then Mark the check Box for Set Database Encryption On
You can query the is_encrypted column in sys.databases to determine whether TDE is enabled for a particular database.
[sql]
SELECT [name], is_encrypted FROM sys.databases
GO
[/sql]
Important Back up the certifi cate and private key to a fi le to ensure recoverability as follows
[sql]
BACKUP CERTIFICATE TDECert TO FILE = ‘C:\TDECert.cer’
[/sql]
You are Done!!
