Забавяне на рестарта на „Тоест“. И един апел за помощ

Post Syndicated from Тоест original https://www.toest.bg/zavavyane-na-restarta-apel-za-pomosht/

Забавяне на рестарта на „Тоест“. И един апел за помощ

През тези 5 години и половина „Тоест“ винаги е съществувал с крайно икономичен бюджет и къс хоризонт. Този хоризонт сега се сви до месец. Подновяваме дейност на 1 октомври – с неясно бъдеще и спешна нужда от подкрепа.

Какво стана?

Финансовото положение на „Тоест“ никога не е било розово и през годините сме оцелявали на инат. Безкрайно признателни сме за всеки лев подкрепа от читателите, но доходите от краудфъндинг, освен крайно недостатъчни, са и несигурни – във всеки момент нашите дарители могат да спират и подновяват месечните си микродарения. Затова през тези години спестявахме каквото можехме и успяхме да съберем малък резерв „за черни дни“ (разделен на петте години, този резерв се равняваше на около 170 лв. месечно).

Същевременно обаче съвместяването на няколко роли от един и същ човек и огромното количество доброволен труд водеха до изтощение и демотивация, а авторските хонорари, поначало скромни, стояха на едно и също ниво през всичките тези пет години.

Беше наложително да направим генерална промяна.

В началото на 2023 г. преструктурирахме дейността и разпределихме по-добре ролите, за да бъдем по-ефективни. Привлякохме двама отговорни редактори, които да се грижат за съдържанието. Междувременно коригирахме хонорарите, така че да достигнат поне 50% от нивата при другите медии. Използвахме спестения резерв, за да си спечелим време и да се опитаме да отскочим.

Посрещнахме петия си рожден ден с изцяло нов сайт, разширен екип от редактори и автори, както и с нови рубрики, които бързо намериха верни читатели. Създадохме дарителски пакети със специални подаръци и бонуси за читателите, а малко преди началото на лятото представихме шоколада с кауза „Гайо & Тоест“. Междувременно кандидатствахме (самостоятелно и в партньорство с други организации) по шест програми за финансиране на културни и медийни проекти. С други думи,

не спираме да търсим всякакви допълнителни източници на финансиране.

За съжаление, и по шестте програми за финансиране не постигнахме успех. Не сме се отказали и от по-нататъшни кандидатствания, но е важно да отбележим, че повечето от програмите финансират целево конкретно разписан проект (за тема, рубрика, поредица от материали). А смисълът и ползата от една независима медия е да обхваща по-широк спектър от важните за обществото проблеми, не да се фокусира върху конкретната тема, за която е получила финансиране.

Затова преди всичко трябва да подсигурим цялостното съществуване на медията.

Колко струва „Тоест“ на месец?

Създаването на всяка отделна статия не се свежда само до написването ѝ от автора. Нужни са внимателна проверка на фактите и грижлива редакторска работа за оформянето на текста в качествен, полезен и езиково издържан журналистически продукт.

Извън създаването на съдържание има и редица административни дейности – техническа поддръжка на сайта, управление на платежните системи, водене на документация и сметки, заплащане за външни услуги, като счетоводство, банково обслужване, годишни такси за различни платформи, хостинг, домейн. Тоест разходи, които си текат, без значение дали създаваме съдържание, или не.

Ако трябва да осигурим достойно и съпоставимо с другите медии заплащане на труда на екипа и да начислим всички реални разходи, ще са нужни минимум 10 000 лева на месец. Докато достигнем тази сума, целият екип на „Тоест“ е решен да продължи работата си при настоящите нива на заплащане. Защото всички вярваме в смисъла на този проект, в качеството, което предлагаме, в нуждата от това свободно и независимо пространство за спокоен и качествен обществен дебат.

Защо просто не пуснем реклами?

Рекламите (особено онлайн и особено в България) са твърде евтини и за да има смисъл от тях, трябва да са много. Рекламните банери да заемат голяма част от сайта. Освен всичко те не се появяват сами. Трябва някой да ги продава и обслужва – да търси рекламодатели, да уговаря условия, да осигурява техническото изпълнение. Тези разходи изяждат съществен дял от приходите. За една малка медия това обезсмисля цялото упражнение. Особено за медия като „Тоест“ – с малко, но дълги аналитични текстове, която категорично отказва да залага на бомбастични заглавия, за да печели кликове на всяка цена и да си осигури мащабен трафик.

И най-важната причина – независимостта. Ако медията е обвързана с рекламодатели, кръгът от теми и проблеми, които намират място в нейната платформа, се стеснява. Променя се и начинът, по който екипът на медията подхожда към работата си, защото цензурата поражда и автоцензура.

Пример: Материалът на „Тоест“ за неморалните практики А1 не беше отразен и развит от други медии, нито дори разпространен от изданията, които обичайно препечатват нашите статии. Защо? Защото А1 е огромен рекламодател. И дори някоя медия или медийна група да няма обвързаност с А1 (или с рекламодател от подобен мащаб), то тя се надява да има такава в бъдеще. В случая поговорката „Който плаща, той поръчва музиката“ важи с пълна сила. И тъкмо тази сила смазва независимостта на една медия.

Защо не затворим съдържанието и не се издържаме с абонаменти за четене?

Заключването на съдържанието и затварянето му само за определен кръг от хора, които могат да си платят за него, е дискриминационно и влиза в разрез с основния принцип на журналистиката – да информира обществото, цялото общество. Свеждането на една медия до затворено пространство за избрани хора (без значение от размера на абонамента) подменя нейните функции и създава финансова бариера, която трябва да преминеш, за да си добре информиран. Създаването на „информационни касти“ е опасно и погрешно, особено във времена като настоящите, в които свободният достъп до достоверно, проверено и качествено поднесено журналистическо съдържание е от ключова важност за развитието на обществата.

Какво следва?

За поддържането на обичайното качество и количество на материалите в „Тоест“ при настоящите хонорари са нужни 5500 лева на месец. Месечните абонаментни дарения от читатели в момента са около 3000 лева.

На първо време трябва да запълним тази дупка от 2500 лева на месец, за да запазим екипа и да продължим с досегашния ритъм и качество. И тук много ще разчитаме на вас, скъпи читатели и настоящи дарители на „Тоест“. Разкажете на още някого за нас – защо ни харесвате и защо за вас е важно да продължим. Със свои думи и аргументи. Споделете, че ни подкрепяте, и го помолете да направи същото – чрез някой от нашите дарителски пакети, в които сме включили много сладки (и в буквалния смисъл) подаръци.

Ако всеки от вас убеди по само още един човек да ни подкрепи, ще достигнем първата критична сума.

Междувременно ние продължаваме да търсим и други източници на финансиране. Следващата стъпка е да се обърнем към бизнеса за подкрепа.

Знаем, че съществуват много успешни български бизнеси, които работят на световно ниво и са конкурентни, дори водещи в областта си на световния пазар. Които са независими от обществените поръчки и благоразположението на властта. Които ясно осъзнават, че добрата среда за предприемачество е пряко свързана с добрата обществена среда, а за изграждането ѝ е критично важно да има свободни медии. И не на последно място: бизнеси, които биха подкрепили качествената журналистика не срещу стандартното „медийно отразяване“ – с публикуване на готови прессъобщения и спонсорирани статии.

В „Тоест“ можем да ви предложим много повече от това.

Ние ще подходим индивидуално и с професионализъм към вашата история, спазвайки всички журналистически стандарти, така че разказът за успехите ви и за продуктите, които създавате, да е полезен и интересен както на нашите читатели, така и на потенциалните ви клиенти и служители.

Медиите няма как да бъдат бизнес начинание, което да носи печалба. Те по замисъл имат други цели – да информират, да задават трудните въпроси, да се ангажират с важните за обществото проблеми, да бъдат критични към властта.

Не само в България медиите изпитват финансови затруднения. В статията на „Гардиън“ от 16 май т.г. може да прочетете за фалита на Vice; за гибелта на BuzzFeed и съкращенията в големи световни медии; за бизнес моделите, базирани на реклама, които вече не работят, защото твърде нищожна част остава за самите медии; за принудата медийните проекти да се занимават с какво ли не извън журналистиката, само и само да оцелеят.

Съществуването на независими медии е от огромна важност за прогреса на едно общество и е пряко свързано с икономическото развитие на страната. Потребяването на качествено журналистическо съдържание (важни теми, проверени източници, задълбочена разработка, хубав език, грамотно писане) формира критично мислене и създава проактивни и социално ангажирани хора.

Това са хората, които искаме да наемем на работа, с които искаме да правим бизнес, с които предпочитаме да се разминаваме като водачи на пътното платно. С които можем да строим някакво общо бъдеще.

Security updates for Wednesday

Post Syndicated from corbet original https://lwn.net/Articles/944354/

Security updates have been issued by Debian (e2guardian), Fedora (libeconf), Red Hat (dmidecode, kernel, kernel-rt, keylime, kpatch-patch, libcap, librsvg2, linux-firmware, and qemu-kvm), Slackware (mozilla), SUSE (chromium and shadow), and Ubuntu (cups, dotnet6, dotnet7, file, flac, and ruby-redcloth).

Zero-Click Exploit in iPhones

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2023/09/zero-click-exploit-in-iphones.html

Make sure you update your iPhones:

Citizen Lab says two zero-days fixed by Apple today in emergency security updates were actively abused as part of a zero-click exploit chain (dubbed BLASTPASS) to deploy NSO Group’s Pegasus commercial spyware onto fully patched iPhones.

The two bugs, tracked as CVE-2023-41064 and CVE-2023-41061, allowed the attackers to infect a fully-patched iPhone running iOS 16.6 and belonging to a Washington DC-based civil society organization via PassKit attachments containing malicious images.

“We refer to the exploit chain as BLASTPASS. The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim,” Citizen Lab said.

“The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim.”

Simplifying Digital Transformation with Marianna Portela

Post Syndicated from Michael Kammer original https://blog.zabbix.com/simplifying-digital-transformation-with-marianna-portela/26609/

To help everyone in our community get up to speed with Zabbix Summit speakers and their topics, we’re continuing our series of interviews and sitting down for a chat with Marianna Portela of Brazilian mass media conglomerate Globo. Read on to get a preview of her Summit speech topic and see how she uses Zabbix to bring massive live events to millions of users around the globe.

Please tell us a bit about yourself and your work.

I’m a tech lead at Globo, the largest media group in Latin America. It includes over-the-air broadcasting, television and film production, a pay television subscription service, streaming media, publishing, and online services.

How long have you been using Zabbix? What kind of daily Zabbix tasks are you involved in at your company?

I have been working at Globo for 15 years. I’ve been involved in monitoring for 11 of those years, and I’ve been using Zabbix for 10. I help monitor the applications that generate data for live events, and I use Zabbix to generate metrics that support decision-making related to better content delivery quality.

Can you name a few of the specific challenges that Zabbix has helped you solve?

Zabbix allows us to empower our users and supports our entire digital transformation – including many things related to Globoplay streaming. It also helps us monitor live event infrastructure, like the Olympics and World Cup. Previously, when there were technical issues during live events, we would try to figure out what happened after the fact, but no longer – Zabbix gives us a proactive analysis of potential occurrences within live production.

Can you give us a sneak peek at what we can expect to hear during your Zabbix Summit speech?

I’m planning to talk about how we use Zabbix to help ensure the quality monitoring of live production, which is essentially the production and the part of Globo that deals with any type of live event and generates data for things like games, for example. I’ll introduce how we started with actual infrastructure monitoring and how this digital transformation at Globo began, specifically how we managed to enter new areas like content generation, especially live content. Then I’ll also discuss some specifics of how we monitor live event infrastructure.

The post Simplifying Digital Transformation with Marianna Portela appeared first on Zabbix Blog.

Patch Tuesday – September 2023

Post Syndicated from Adam Barnett original https://blog.rapid7.com/2023/09/12/patch-tuesday-september-2023/

Patch Tuesday - September 2023

Microsoft is addressing 65 vulnerabilities this September Patch Tuesday, including two zero-day vulnerabilities, as well as four critical remote code execution (RCE) vulnerabilities, and six republished third-party vulnerabilities.

Word: zero-day NTLM hash disclosure

Microsoft Word receives a patch for CVE-2023-36761, which is marked as exploited in the wild as well as publicly disclosed; successful exploitation results in disclosure of NTLM hashes, which could provide an attacker with the means to “Pass the Hash” and authenticate remotely without any need to brute force the hash. Microsoft is clearly concerned about the potential impact of CVE-2023-36761, since they are providing patches not only for current versions of Word, but also for Word 2013, which reached its Extended End Date back in April 2023. In March, Microsoft patched CVE-2023-23397, a vulnerability in Outlook which also led to NTLM hash leaks, and which received significant attention at the time.

Streaming Service Proxy: zero-day elevation to SYSTEM

The second second zero-day vulnerability patched this month is CVE-2023-36802, an elevation of privilege vulnerability in Microsoft Streaming Service Proxy, which could grant SYSTEM privileges via exploitation of a kernel driver. Microsoft has detected in-the-wild exploitation, but is not aware of publicly available exploit code. This is a debut Patch Tuesday appearance for Microsoft Streaming Service, but with several researchers from across the globe acknowledged on the advisory, it’s unlikely to be the last. Today’s confirmation of in-the-wild exploitation prior to publication all but guarantees that this will remain an area of interest.

Internet Connection Sharing: same-network critical RCE

CVE-2023-38148 describes a critical remote code execution (RCE) in the Windows Internet Connection Sharing (ICS) functionality. Although the advisory is light on detail, it’s likely that successful exploitation would lead to arbitrary code execution on the ICS host at SYSTEM level. The silver lining is that the attack cannot be carried out from another network, so attackers must first establish an adjacent foothold.

Visual Studio & .NET: critical RCE via malicious package file

This month’s three other critical RCE vulnerabilities have quite a lot in common: CVE-2023-36792, CVE-2023-36793, and CVE-2023-36796 all rely on the user opening a malicious package file, and are thus classed as arbitrary code execution rather than no-interaction RCE. In each case, patches are available for a long list of Visual Studio and .NET installations. Organizations with large developer headcount are likely to be disproportionately at risk.

Exchange (as usual):  RCE

Microsoft is patching five vulnerabilities in Exchange this month. Although Microsoft doesn’t rate any of these higher than “Important” under their proprietary severity rating system, three of the five are RCE vulnerabilities with CVSSv3 base score of 8.0. CVE-2023-36744 CVE-2023-36745, and CVE-2023-36756 would surely receive higher severity if not for several mitigating factors. Successful exploitation requires that the attacker must be present on the same LAN as the Exchange server, and must already possess valid credentials for an Exchange user. Additionally, Microsoft notes that the August 2023 patches already protect against these newly published vulnerabilities, further underscoring the value of timely patching.

SharePoint: elevation to admin

SharePoint receives a patch for CVE-2023-36764, which allows an attacker to achieve administrator privileges via a specially-crafted ASP.NET page. As is often the case with SharePoint vulnerabilities, a level of access is already required, but Site Member privileges are typically widely granted.

Azure DevOps Server: elevation of privilege & RCE

Azure DevOps Server receives two fixes this month. While CVE-2023-38155 requires that an attacker carry out significant recon and preparation of the environment, successful exploitation would lead to administrator privileges. Potentially of greater concern is CVE-2023-33136, which allows an attacker with Queue Build permissions to abuse an overridable input variable to achieve RCE. While most DevOps Server installations are hopefully managed by people both willing and able to apply prompt upgrades, CI/CD environments are prime targets for supply chain attacks.

They do it with Mira

A vulnerability in the Windows implementation of wireless display standard Miracast allows for an unauthenticated user to project to a vulnerable system. Although CVE-2023-38147 requires that an attacker be in close physical proximity to the target, consider that wireless display technology is often used in high-traffic environments such as conventions, which could allow an opportunistic attacker to inflict reputational damage. While exploitation requires that the target asset is configured to allow “Projecting to this PC” and marked as “Available Everywhere” – and Microsoft points out that this is not the default configuration – most administrators will know from long experience that many users will simply select whichever options cause them the least friction.

Summary Charts

Patch Tuesday - September 2023
A relatively light month, albeit with some seldom-seen components like Streaming Service and Internet Connection Sharing.
Patch Tuesday - September 2023
Still holding the #1 spot: Remote Code Excution.
Patch Tuesday - September 2023
The typical cluster around 8.0.
Patch Tuesday - September 2023
3D Builder: not as innocent as it looks.

Summary Table

Apps vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36760 3D Viewer Remote Code Execution Vulnerability No No 7.8
CVE-2023-36740 3D Viewer Remote Code Execution Vulnerability No No 7.8
CVE-2023-36739 3D Viewer Remote Code Execution Vulnerability No No 7.8
CVE-2023-36773 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2023-36772 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2023-36771 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2023-36770 3D Builder Remote Code Execution Vulnerability No No 7.8
CVE-2022-41303 AutoDesk: CVE-2022-41303 use-after-free vulnerability in Autodesk® FBX® SDK 2020 or prior No No N/A

Azure vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-29332 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability No No 7.5
CVE-2023-38156 Azure HDInsight Apache Ambari Elevation of Privilege Vulnerability No No 7.2
CVE-2023-36736 Microsoft Identity Linux Broker Remote Code Execution Vulnerability No No 4.4

Azure Developer Tools vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-33136 Azure DevOps Server Remote Code Execution Vulnerability No No 8.8
CVE-2023-38155 Azure DevOps Server Remote Code Execution Vulnerability No No 7

Browser vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-4863 Chromium: CVE-2023-4863 Heap buffer overflow in WebP No No N/A
CVE-2023-4764 Chromium: CVE-2023-4764 Incorrect security UI in BFCache No No N/A
CVE-2023-4763 Chromium: CVE-2023-4763 Use after free in Networks No No N/A
CVE-2023-4762 Chromium: CVE-2023-4762 Type Confusion in V8 No No N/A
CVE-2023-4761 Chromium: CVE-2023-4761 Out of bounds memory access in FedCM No No N/A

Developer Tools vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36796 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36794 Visual Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36758 Visual Studio Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36742 Visual Studio Code Remote Code Execution Vulnerability No No 7.8
CVE-2023-36788 .NET Framework Remote Code Execution Vulnerability No No 7.8
CVE-2023-36759 Visual Studio Elevation of Privilege Vulnerability No No 6.7
CVE-2023-36799 .NET Core and Visual Studio Denial of Service Vulnerability No No 6.5
CVE-2023-39956 Electron: CVE-2023-39956 -Visual Studio Code Remote Code Execution Vulnerability No No N/A

Exchange Server vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36757 Microsoft Exchange Server Spoofing Vulnerability No No 8
CVE-2023-36756 Microsoft Exchange Server Remote Code Execution Vulnerability No No 8
CVE-2023-36745 Microsoft Exchange Server Remote Code Execution Vulnerability No No 8
CVE-2023-36744 Microsoft Exchange Server Remote Code Execution Vulnerability No No 8
CVE-2023-36777 Microsoft Exchange Server Information Disclosure Vulnerability No No 5.7

Microsoft Dynamics vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36886 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability No No 7.6
CVE-2023-38164 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability No No 7.6
CVE-2023-36800 Dynamics Finance and Operations Cross-site Scripting Vulnerability No No 7.6

Microsoft Office vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36764 Microsoft SharePoint Server Elevation of Privilege Vulnerability No No 8.8
CVE-2023-36765 Microsoft Office Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36766 Microsoft Excel Information Disclosure Vulnerability No No 7.8
CVE-2023-36763 Microsoft Outlook Information Disclosure Vulnerability No No 7.5
CVE-2023-36762 Microsoft Word Remote Code Execution Vulnerability No No 7.3
CVE-2023-36761 Microsoft Word Information Disclosure Vulnerability Yes Yes 6.2
CVE-2023-41764 Microsoft Office Spoofing Vulnerability No No 5.5
CVE-2023-36767 Microsoft Office Security Feature Bypass Vulnerability No No 4.3

System Center vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-38163 Windows Defender Attack Surface Reduction Security Feature Bypass No No 7.8

Windows vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-38146 Windows Themes Remote Code Execution Vulnerability No No 8.8
CVE-2023-38147 Windows Miracast Wireless Display Remote Code Execution Vulnerability No No 8.8
CVE-2023-38148 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability No No 8.8
CVE-2023-38150 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-35355 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36802 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability Yes No 7.8
CVE-2023-38162 DHCP Server Service Denial of Service Vulnerability No No 7.5
CVE-2023-36805 Windows MSHTML Platform Security Feature Bypass Vulnerability No No 7
CVE-2023-38140 Windows Kernel Information Disclosure Vulnerability No No 5.5
CVE-2023-36803 Windows Kernel Information Disclosure Vulnerability No No 5.5

Windows ESU vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-38142 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38141 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38139 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38161 Windows GDI Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36804 Windows GDI Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38144 Windows Common Log File System Driver Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38143 Windows Common Log File System Driver Elevation of Privilege Vulnerability No No 7.8
CVE-2023-38149 Windows TCP/IP Denial of Service Vulnerability No No 7.5
CVE-2023-38160 Windows TCP/IP Information Disclosure Vulnerability No No 5.5
CVE-2023-38152 DHCP Server Service Information Disclosure Vulnerability No No 5.3
CVE-2023-36801 DHCP Server Service Information Disclosure Vulnerability No No 5.3

A GCC -fstack-protector vulnerability on arm64

Post Syndicated from corbet original https://lwn.net/Articles/944307/

The GCC stack-protector feature detects stack-based buffer overruns by
putting a canary value on the stack and noticing if that value is changed.
It
turns out
, though, that dynamically allocated local variables (such as
variable-length arrays and space obtained with alloca()) are
placed beyond the canary, so overflows of those variables will not be
detected. As a result, arm64 binaries built with vulnerable versions of
GCC are not as protected as they should be and need to be rebuilt.

Dynamic allocations are just as susceptible to overflows as other
locals. In fact, they’re arguably more susceptible because they’re
almost always arrays, whereas fixed locals are often integers,
pointers, or other types to which variable-length data is never
written. GCC’s own heuristics for when to use a stack guard reflect
this.

Kees Cook, meanwhile, has pointed out that
the kernel no longer uses variable-length arrays, so kernel builds should
not be affected by this vulnerability.

[$] Arduino: open source for microcontroller boards

Post Syndicated from jake original https://lwn.net/Articles/944038/

Arduino has emerged as one of the
prime success stories of the open-hardware movement. In recent years, the
company has shifted its focus toward Internet of Things (IoT)
applications. As part of this transformation, it has completely redesigned
its open-source integrated development environment (IDE), adding a more
professional feature set for its hobbyist target audience. If you have
experimented with Arduino in the past, but have lost track of its
progress, now might be a good time to give it another try.

Password-stealing Linux malware served for 3 years and no one noticed (Ars Technica)

Post Syndicated from jake original https://lwn.net/Articles/944306/

Ars Technica reports on a credential-stealing Trojan horse that would infect only some of those who installed the “Free Download Manager”. The article is based on a Kaspersky report that details the malicious payload offered up at that site from 2020 to 2022.

The site, freedownloadmanager[.]org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored.

Intel Xeon MAX 9480 Deep-Dive 64GB HBM2e Onboard Like a GPU or AI Accelerator

Post Syndicated from Patrick Kennedy original https://www.servethehome.com/intel-xeon-max-9480-deep-dive-intel-has-64gb-hbm2e-onboard-like-a-gpu-or-ai-accelerator/

We deep-dive into the Intel Xeon MAX 9480 and see several surprises when combining Xeon cores and HBM2e memory (like a GPU uses)

The post Intel Xeon MAX 9480 Deep-Dive 64GB HBM2e Onboard Like a GPU or AI Accelerator appeared first on ServeTheHome.

Access accounts with AWS Management Console Private Access

Post Syndicated from Suresh Samuel original https://aws.amazon.com/blogs/security/access-accounts-with-aws-management-console-private-access/

AWS Management Console Private Access is an advanced security feature to help you control access to the AWS Management Console. In this post, I will show you how this feature works, share current limitations, and provide AWS CloudFormation templates that you can use to automate the deployment. AWS Management Console Private Access is useful when you want to restrict users from signing in to unknown AWS accounts from within your network. With this feature, you can limit access to the console only to a specified set of known accounts when the traffic originates from within your network.

For enterprise customers, users typically access the console from devices that are connected to a corporate network, either directly or through a virtual private network (VPN). With network connectivity to the console, users can authenticate into an account with valid credentials, including third-party accounts and personal accounts. For enterprise customers with stringent network access controls, this feature provides a way to control which accounts can be accessed from on-premises networks.

How AWS Management Console Private Access works

AWS PrivateLink now supports the AWS Management Console, which means that you can create Virtual Private Cloud (VPC) endpoints in your VPC for the console. You can then use DNS forwarding to conditionally route users’ browser traffic to the VPC endpoints from on-premises and define endpoint policies that allow or deny access to specific accounts, organizations, or organizational units (OUs). To privately reach the endpoints, you must have a hybrid network connection between on-premises and AWS over AWS Direct Connect or AWS Site-to-Site VPN.

When you conditionally forward DNS queries for the zone aws.amazon.com from on-premises to an Amazon Route 53 Resolver inbound endpoint within the VPC, Route 53 will prefer the private hosted zone for aws.amazon.com to resolve the queries. The private hosted zone makes it simple to centrally manage records for the console in the AWS US East (N. Virginia) Region (us-east-1) as well as other Regions.

Configure a VPC endpoint for the console

To configure VPC endpoints for the console, you must complete the following steps:

  1. Create interface VPC endpoints in a VPC in the US East (N. Virginia) Region for the console and sign-in services. Repeat for other desired Regions. You must create VPC endpoints in the US East (N. Virginia) Region because the default DNS name for the console resolves to this Region. Specify the accounts, organizations, or OUs that should be allowed or denied in the endpoint policies. For instructions on how to create interface VPC endpoints, see Access an AWS service using an interface VPC endpoint.
  2. Create a Route 53 Resolver inbound endpoint in a VPC and note the IP addresses for the elastic network interfaces of the endpoint. Forward DNS queries for the console from on-premises to these IP addresses. For instructions on how to configure Route 53 Resolver, see Getting started with Route 53 Resolver.
  3. Create a Route 53 private hosted zone with records for the console and sign-in subdomains. For the full list of records needed, see DNS configuration for AWS Management Console and AWS Sign-In. Then associate the private hosted zone with the same VPC that has the Resolver inbound endpoint. For instructions on how to create a private hosted zone, see Creating a private hosted zone.
  4. Conditionally forward DNS queries for aws.amazon.com to the IP addresses of the Resolver inbound endpoint.

How to access Regions other than US East (N. Virginia)

To access the console for another supported Region using AWS Management Console Private Access, complete the following steps:

  1. Create the console and sign-in VPC endpoints in a VPC in that Region.
  2. Create resource records for <region>.console.aws.amazon.com and <region>.signin.aws.amazon.com in the private hosted zone, with values that target the respective VPC endpoints in that Region. Replace <region> with the region code (for example, us-west-2).

For increased resiliency, you can also configure a second Resolver inbound endpoint in a different Region other than the US East (N. Virginia) Region (us-east-1). On-premises DNS resolvers can use both endpoints for resilient DNS resolution to the private hosted zone.

Automate deployment of AWS Management Console Private Access

I created an AWS CloudFormation template that you can use to deploy the required resources in the US East (N. Virginia) Region (us-east-1). To get the template, go to console-endpoint-use1.yaml. The CloudFormation stack deploys the required VPC endpoints, Route 53 Resolver inbound endpoint, and private hosted zone with required records.

Note: The default endpoint policy allows all accounts. For sample policies with conditions to restrict access, see Allow AWS Management Console use for expected accounts and organizations only (trusted identities).

I also created a CloudFormation template that you can use to deploy the required resources in other Regions where private access to the console is required. To get the template, go to console-endpoint-non-use1.yaml.

Cost considerations

When you configure AWS Management Console Private Access, you will incur charges. You can use the following information to estimate these charges:

  • PrivateLink pricing is based on the number of hours that the VPC endpoints remain provisioned. In the US East (N. Virginia) Region, this is $0.01 per VPC endpoint per Availability Zone ($/hour).
  • Data processing charges per gigabyte (GB) of data processed through the VPC endpoints is $0.01 in the US East (N. Virginia) Region.
  • The Route 53 Resolver inbound endpoint is charged per IP (elastic network interface) per hour. In the US East (N. Virginia) Region, this is $0.125 per IP address per hour. See Route 53 pricing.
  • DNS queries to the inbound endpoint are charged at $0.40 per million queries.
  • The Route 53 hosted zone is charged at $0.50 per hosted zone per month. To allow testing, AWS won’t charge you for a hosted zone that you delete within 12 hours of creation.

Based on this pricing model, the cost of configuring AWS Management Console Private Access in the US East (N. Virginia) Region in two Availability Zones is approximately $212.20 per month for the deployed resources. DNS queries and data processing charges are additional based on actual usage. You can also apply this pricing model to help estimate the cost to configure in additional supported Regions. Route 53 is a global service, so you only have to create the private hosted zone once along with the resources in the US East (N. Virginia) Region.

Limitations and considerations

Before you get started with AWS Management Console Private Access, make sure to review the following limitations and considerations:

  • For a list of supported Regions and services, see Supported AWS Regions, service consoles, and features.
  • You can use this feature to restrict access to specific accounts from customer networks by forwarding DNS queries to the VPC endpoints. This feature doesn’t prevent users from accessing the console directly from the internet by using the console’s public endpoints from devices that aren’t on the corporate network.
  • The following subdomains aren’t currently supported by this feature and won’t be accessible through private access:
    • docs.aws.amazon.com
    • health.aws.amazon.com
    • status.aws.amazon.com
  • After a user completes authentication and accesses the console with private access, when they navigate to an individual service console, for example Amazon Elastic Compute Cloud (Amazon EC2), they must have network connectivity to the service’s API endpoint, such as ec2.amazonaws.com. This is needed for the console to make API calls such as ec2:DescribeInstances to display resource details in the service console.

Conclusion

In this blog post, I outlined how you can configure the console through AWS Management Console Private Access to restrict access to AWS accounts from on-premises, how the feature works, and how to configure it for multiple Regions. I also provided CloudFormation templates that you can use to automate the configuration of this feature. Finally, I shared information on costs and some limitations that you should consider before you configure private access to the console.

For more information about how to set up and test AWS Management Console Private Access and reference architectures, see Try AWS Management Console Private Access. For the latest CloudFormation templates, see the aws-management-console-private-access-automation GitHub repository.

If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, start a new thread at re:Post.

Want more AWS Security news? Follow us on Twitter.

Suresh Samuel

Suresh Samuel

Suresh is a Senior Technical Account Manager at AWS. He helps customers in the financial services industry with their operations on AWS. When not working, he can be found photographing birds in Texas or hanging out with his kids.

Understanding DDoS Simulation Testing in AWS

Post Syndicated from Harith Gaddamanugu original https://aws.amazon.com/blogs/security/understanding-ddos-simulation-testing-at-aws/

Distributed denial of service (DDoS) events occur when a threat actor sends traffic floods from multiple sources to disrupt the availability of a targeted application. DDoS simulation testing uses a controlled DDoS event to allow the owner of an application to assess the application’s resilience and practice event response. DDoS simulation testing is permitted on Amazon Web Services (AWS), subject to Testing policy terms and conditions. In this blog post, we help you understand when it’s appropriate to perform a DDoS simulation test on an application running on AWS, and what options you have for running the test.

DDoS protection at AWS

Security is the top priority at AWS. AWS services include basic DDoS protection as a standard feature to help protect customers from the most common and frequently occurring infrastructure (layer 3 and 4) DDoS events, such as SYN/UDP floods, reflection attacks, and others. While this protection is designed to protect the availability of AWS infrastructure, your application might require more nuanced protections that consider your traffic patterns and integrate with your internal reporting and incident response processes. If you need more nuanced protection, then you should consider subscribing to AWS Shield Advanced in addition to the native resiliency offered by the AWS services you use.

AWS Shield Advanced is a managed service that helps you protect your application against external threats, like DDoS events, volumetric bots, and vulnerability exploitation attempts. When you subscribe to Shield Advanced and add protection to your resources, Shield Advanced provides expanded DDoS event protection for those resources. With advanced protections enabled on your resources, you get tailored detection based on the traffic patterns of your application, assistance with protecting against Layer 7 DDoS events, access to 24×7 specialized support from the Shield Response Team (SRT), access to centralized management of security policies through AWS Firewall Manager, and cost protections to help safeguard against scaling charges resulting from DDoS-related usage spikes. You can also configure AWS WAF (a web application firewall) to integrate with Shield Advanced to create custom layer 7 firewall rules and enable automatic application layer DDoS mitigation.

Acceptable DDoS simulation use cases on AWS

AWS is constantly learning and innovating by delivering new DDoS protection capabilities, which are explained in the DDoS Best Practices whitepaper. This whitepaper provides an overview of DDoS events and the choices that you can make when building on AWS to help you architect your application to absorb or mitigate volumetric events. If your application is architected according to our best practices, then a DDoS simulation test might not be necessary, because these architectures have been through rigorous internal AWS testing and verified as best practices for customers to use.

Using DDoS simulations to explore the limits of AWS infrastructure isn’t a good use case for these tests. Similarly, validating if AWS is effectively protecting its side of the shared responsibility model isn’t a good test motive. Further, using AWS resources as a source to simulate a DDoS attack on other AWS resources isn’t encouraged. Load tests are performed to gain reliable information on application performance under stress and these are different from DDoS tests. For more information, see the Amazon Elastic Compute Cloud (Amazon EC2) testing policy and penetration testing. Application owners, who have a security compliance requirement from a regulator or who want to test the effectiveness of their DDoS mitigation strategies, typically run DDoS simulation tests.

DDoS simulation tests at AWS

AWS offers two options for running DDoS simulation tests. They are:

  • A simulated DDoS attack in production traffic with an authorized pre-approved AWS Partner.
  • A synthetic simulated DDoS attack with the SRT, also referred to as a firedrill.

The motivation for DDoS testing varies from application to application and these engagements don’t offer the same value to all customers. Establishing clear motives for the test can help you choose the right option. If you want to test your incident response strategy, we recommend scheduling a firedrill with our SRT. If you want to test the Shield Advanced features or test application resiliency, we recommend that you work with an AWS approved partner.

DDoS simulation testing with an AWS Partner

AWS DDoS test partners are authorized to conduct DDoS simulation tests on customers’ behalf without prior approval from AWS. Customers can currently contact the following partners to set up these paid engagements:

Before contacting the partners, customers must agree to the terms and conditions for DDoS simulation tests. The application must be well-architected prior to DDoS simulation testing as described in AWS DDoS Best Practices whitepaper. AWS DDoS test partners that want to perform DDoS simulation tests that don’t comply with the technical restrictions set forth in our public DDoS testing policy, or other DDoS test vendors that aren’t approved, can request approval to perform DDoS simulation tests by submitting the DDoS Simulation Testing form at least 14 days before the proposed test date. For questions, please send an email to [email protected].

After choosing a test partner, customers go through various phases of testing. Typically, the first phase involves a discovery discussion, where the customer defines clear goals, assembles technical details, and defines the test schedule with the partner. In the next phase, partners run multiple simulations based on agreed attack vectors, duration, diversity of the attack vectors, and other factors. These tests are usually carried out by slowly ramping up traffic levels from low levels to desired high levels with an ability for an emergency stop. The final stage involves reporting, discussing observed gaps, identifying actionable tasks, and driving those tasks to completion.

These engagements are typically long-term, paid contracts that are planned over months and carried out over weeks, with results analyzed over time. These tests and reports are beneficial to customers who need to evaluate detection and mitigation capabilities on a large scale. If you’re an application owner and want to evaluate the DDoS resiliency of your application, practice event response with real traffic, or have a DDoS compliance or regulation requirement, we recommend this type of engagement. These tests aren’t recommended if you want to learn the volumetric breaking points of the AWS network or understand when AWS starts to throttle requests. AWS services are designed to scale, and when certain dynamic volume thresholds are exceeded, AWS detection systems will be invoked to block traffic. Lastly, it’s critical to distinguish between these tests and stress tests, in which meaningful packets are sent to the application to assess its behavior.

DDoS firedrill testing with the Shield Response Team

Shield Advanced service offers additional assistance through the SRT, this team can also help with testing incident response workflows. Customers can contact the SRT and request firedrill testing. Firedrill testing is a type of synthetic test that doesn’t generate real volumetric traffic but does post a shield event to the requesting customer’s account.

These tests are available for customers who are already on-boarded to Shield Advanced and want to test their Amazon CloudWatch alarms by invoking a DDoSDetected metric, or test their proactive engagement setup or their custom incident response strategy. Because this event isn’t based on real traffic, the customer won’t see traffic generated on their account or see logs that drive helpful reports.

These tests are intended to generate associated Shield Advanced metrics and post a DDoS event for a customer resource. For example, SRT can post a 14 Gbps UDP mock attack on a protected resource for about 15 minutes and customers can test their response capability during such an event.

Note: Not all attack vectors and AWS resource types are supported for a firedrill. Shield Advanced onboarded customers can contact AWS Support teams to request assistance with running a firedrill or understand more about them.

Conclusion

DDoS simulations and incident response testing on AWS through the SRT or an AWS Partner are useful in improving application security controls, identifying Shield Advanced misconfigurations, optimizing existing detection systems, and improving incident readiness. The goal of these engagements is to help you build a DDoS resilient architecture to protect your application’s availability. However, these engagements don’t offer the same value to all customers. Most customers can obtain similar benefits by following AWS Best Practices for DDoS Resiliency. AWS recommends architecting your application according to DDoS best practices and fine tuning AWS Shield Advanced out-of-the-box offerings to your application needs to improve security posture.

 
If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.

Want more AWS Security news? Follow us on Twitter.

Harith Gaddamanugu

Harith Gaddamanugu

Harith works at AWS as a Sr. Edge Specialist Solutions Architect. He stays motivated by solving problems for customers across AWS Perimeter Protection and Edge services. When he is not working, he enjoys spending time outdoors with friends and family.

Security updates for Tuesday

Post Syndicated from corbet original https://lwn.net/Articles/944263/

Security updates have been issued by Debian (node-cookiejar and orthanc), Oracle (firefox, kernel, and kernel-container), Red Hat (flac and httpd:2.4), Slackware (vim), SUSE (python-Django, terraform-provider-aws, terraform-provider-helm, and terraform-provider-null), and Ubuntu (c-ares, curl, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15,
linux-raspi, and linux-ibm, linux-ibm-5.4).

Cars Have Terrible Data Privacy

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2023/09/cars-have-terrible-data-privacy.html

A new Mozilla Foundation report concludes that cars, all of them, have terrible data privacy.

All 25 car brands we researched earned our *Privacy Not Included warning label—making cars the official worst category of products for privacy that we have ever reviewed.

There’s a lot of details in the report. They’re all bad.

BoingBoing post.

What is Server Monitoring? Everything You Need to Know

Post Syndicated from Michael Kammer original https://blog.zabbix.com/what-is-server-monitoring-everything-you-need-to-know/26617/

Servers are the foundation of a company’s IT infrastructure, and the cost of server downtime can include anything from days without system access to the loss of important business data. This can lead to operational issues, service outages, and steep repair costs.

Viewed against this backdrop, server monitoring is an investment with massive benefits to any organization. The latest generation of server monitoring tools make it easier to assess server health and deal with any underlying issues as quickly and painlessly as possible.

What are servers, and how do they work?

Servers are computers (or applications) that run software services for other computers or devices on a network. The computer takes requests from the client computers or devices and performs tasks in response to the requests. These tasks can involve processing data, providing content, or performing calculations. Some servers are dedicated to hosting web services, which are software services offered on any computer connected to the internet.

What is server monitoring? Why does it matter?

Servers are some of the most important pieces of any company’s IT infrastructure. If a server is offline, running slowly, or experiencing outages, website performance will be affected and customers may decide to go elsewhere. If an internal file server is generating errors, important business data like accounting files or customer records could be compromised.

A server monitoring system is designed to watch your systems and provide a number of key metrics regarding their operation. In general, server monitoring software tests for accessibility (making sure that the server is alive and can be reached) and response time (guaranteeing that it is running fast enough to keep users happy). What’s more, it sends notifications about missing or corrupt files, security violations, and other issues.

Server monitoring is most often used for processing data in real time, but quality server monitoring is also predictive, letting users know when disks will reach capacity and whether memory or CPU utilization is about to be throttled. By evaluating historical data, it’s possible to find out if a server’s performance is degrading over time and even predict when a complete crash might occur.

How can server monitoring help businesses?

Here are a few of the most important business benefits of server monitoring:

Server monitoring tools give you a bird’s-eye view of your server’s health and performance

A quality server monitoring tool keeps IT administrators aware of metrics like CPU usage, RAM, disk space, and network bandwidth. This helps them to see when servers are slowing down or failing, allowing them to act before users are affected.

Server monitoring simplifies process automation

IT teams have long checklists when it comes to managing servers. They need to monitor hard disk space, keep an eye on infrastructure, schedule system backups, and update antivirus software. They also need to be able to foresee and solve critical events, while managing any disruptions.

A server monitoring tool helps IT professionals by automating all or many aspects of these jobs. It can show whether a backup was successful, if software is patched, and whether a server is in good condition. This allows IT teams to focus on tasks that benefit more from their involvement and expertise.

Server monitoring makes it easier to retain customers as well as employees

Acting quickly when servers develop issues (or even before) makes sure that employee workflows aren’t disrupted, allowing them to perform their duties, see results, and reach their goals. It also guarantees a positive customer experience by providing early notification of any issues.

Server monitoring keeps costs down

By automating processes and tasks (and freeing up time in the process) server monitoring systems make the most of resources and reduce costs. And by solving potential issues before they affect the organization, they help businesses avoid lost revenue from unfinished employee tasks, operational delays, and unfinished purchases.

What should you look for in a server monitoring solution?

Now that you’re sold on the benefits of server monitoring, you’ll want to choose the server monitoring solution that’s right for you. Here are a few capabilities to keep in mind:

Ease of use

Does the solution include an intuitive dashboard that makes it easy to monitor events and react to problems quickly? It should, and it should also allow you to make the most of the data it exports by providing graphs, reports, and integrations.

Customer support

Is it easy to contact support? How quickly do they respond? A quality server monitoring solution will provide a defined SLA and stick to it with no exceptions.

Breadth of coverage

A good solution will support all the server types (hardware, software, on-premises, cloud) that your enterprise uses. It should also be flexible enough to support any server types you may implement in the future.

Alert management

There are a few important questions to ask when it comes to alerts:

  • Does the solution include a dashboard or display that makes it easy to track events and react to problems quickly?
  • Is it easy to set up alerts via the configuration of thresholds that trigger them? How are alerts delivered?
  • Does the solution have a way to help you determine why a problem has occurred, instead of just telling you that something has gone wrong without context?

What are some best practices to keep in mind?

Here are a few best practices that will help you avoid the more common server monitoring pitfalls:

Proactively check for failures

Keep a sharp eye out for any issues that may affect your software or hardware. The tools included with a good monitoring solution can alert you to errors caused by a corrupted database (for example) and let you know if a security incident has left important services disabled.

Don’t forget your historical data

Server problems rarely occur in a vacuum, so look into the context of issues that emerge. You can do that by exploring metrics across a specific period, typically between 30 to 90 days. For example, you may find that CPU temperature has increased within the past week, which may suggest a problem with a server cooling system.

Operate your hardware in line with recommended tolerance levels

File servers are commonly pushed to the limit, rarely getting a break. That’s why it’s important to monitor metrics like CPU utilization, RAM utilization, storage capacity usage, and CPU temperature. Check these metrics regularly to identify issues before it’s too late.

Keep track of alerts

Always monitor your alerts in real time as they occur and explore reliable ways to manage and prioritize them. When escalating an incident, make sure it goes to the right individual as soon as possible.

Use server monitoring data to plan short-term cloud capacity

Server monitoring systems can help you plan the right computing power for specific moments. If services become slower or users experience other problems with performance, an IT manager can assess the situation through the server monitor. They’ll then be able to allocate extra resources to solve the problem.

Take advantage of capacity planning

Data center workloads have almost doubled in the past 5 years, and servers have had to keep up with this ongoing change. Analyzing long-term server utilization trends can prepare you for future server requirements.

Go beyond asset management

With server monitoring, you can discover which systems are approaching the end of their lives and whether any assets have disappeared from your network. You can also let your server monitoring tool handle the heavy lifting for you when it comes to tracking physical hardware.

The Zabbix Advantage

Zabbix is designed to make server monitoring easy. Our solution allows you to track any possible server performance metrics and incidents, including server performance, availability, and configuration changes.

Intuitive dashboards, network graphs, and topology maps allow you to visualize server performance and availability, and our flexible alerting allows for multiple delivery methods and customized message content.

Not only that, our out-of-the-box templates come with preconfigured items, triggers, graphs, applications, screens, low-level discovery rules, and web scenarios – all designed to have you up and running in just a few minutes.

And because Zabbix is open-source, it’s not just affordable, it’s free. Contact us to find out more and enjoy the peace of mind that comes from knowing that your servers are under control.

FAQ

Why do we need server monitoring?

Server monitoring allows IT professionals to:

  • Monitor the responsiveness of a server
  • Know a server’s capacity, user load, and speed
  • Proactively detect and prevent any issues that might affect the server

Why do companies choose to monitor their servers?

Companies monitor servers so that they can:

  • Proactively identify any performance issues before they impact users
  • Understand a server’s system resource usage
  • Analyze a server for its reliability, availability, performance, security, etc.

How is server monitoring done?

Server monitoring tools constantly collect system data across an entire IT infrastructure, giving administrators a clear view of when certain metrics are above or below thresholds. They also automatically notify relevant parties if a critical system error is detected, allowing them to act in a timely manner to resolve issues.

What should you monitor on a server?

Key areas to monitor on a server include:

  • A server’s physical status
  • Server performance, including CPU utilization, memory resources, and disk activity
  • Server uptime
  • Page file usage
  • Context switches
  • Time synchronization
  • Process activity
  • Server capacity, user load, and speed

If I want to monitor a server, how easy is it to set things up?

Setting up a server monitoring tool is easy, provided you’ve taken into account these 5 steps:

  • Assess and create a monitoring plan
  • Discover how data can be collected
  • Define any and all metrics
  • Set up alerts
  • Have an established workflow

The post What is Server Monitoring? Everything You Need to Know appeared first on Zabbix Blog.

The collective thoughts of the interwebz