Note: This is a selection of very early draft of a document I’m writing – As such, those are extract of “working notes” and should be considered as beta (not Google definition of beta ; true beta)… lots will change.

[...]
Internet being a jungle (or a city, whatever you find most dangerous), your infrastructure will be preyed upon. it can be by customers requiring services (too much of them can create difficult situations) or by malevolent individuals wanting to see your service off Internet.
[...]
Of the techniques available, dos/ddos might be the worst. Here’s a quick non technical theory review:

DOS: Denial of services
For a single attacker, cutting access to your services can be accomplished by solving this equation:
Attacker resource * resource(attack function) > Defender resource * resource(defense function)
The defense against the attack is simply the reverse of the equation. Using decent servers (for processing power) in a decent datacenter (for bandwidth) can help solve this equation to the defender advantage without having to modify services. If it doesn’t work, modifying the defense function (such as implementing a firewall correlating a source IP and the attacker function) will allow required resources for defense to be minimal and thus win the fight.
[...]

DDOS: Distributed Denial Of Services
The DDOS add the dimension of multiple (in the order of hundreds or thousands) attackers systems. This will bypass of most of the standard defenses “resource reduction function” since the resulting traffic will be tangent to a normal usage pattern. Randomly blocking visitor (or user) cannot be accomplished without risking blocking valid one and user pattern analysis is generally resource intensive.
[...]

How to survive DDOS
A lot of services and devices are available to mitigate the attack of a DDOS. Some can be implemented by the end user (server administrator) or by the upstream provider. However, most of them must be deployed as a planned feature, not while the network is under attack.
* drop spoofed/invalid packets at upstream provider (packets with invalid source IP (see RFC 1918), implement ingress filtering (see RFC 2267)) – it is also call dark address filtering.
* prepare rate-limiting function ‘per-vhost’ (if service = webpage), or ‘per-services’, and ‘per-source’.
* implement black hole filtering procedure (an in-line router / packet analyzer able to black hole packet will leave your server doing service computing, not routing).
* request analysis. SNORT is a well know and very good ingress filtering agent that can be used to filter traffic that does not match normal usage pattern.
* enable syn cookie (valid only against syn flood).
* always allow establish connections priority over new ones.
* off load as much as you can (mainly: DNS services in separate network, dropping both is harder).

And I’ll allow a bit of additional informations on this last one, because it is often overlooked and can represent your salvation when you are attacked. Either the attacker will use a specific IP, which is easy to mitigate by changing to any other you reserved for that and changing the DNS (5 minutes downtime is nothing in a major DDOS) OR the attacker is resolving your domain name through your DNS. This latest fact is quite important, because it mean the attack can be mitigated by using geo-localisation on your DNS system : different servers will answers requests from different part of the world. MaxMIND does offer a very up-to-date database of IP/Country and IP/Town ; and using Amazon AWS (cloud computing service by Amazon), new servers can be launched at minutes notice and your DNS (when properly configured) can be modified to provide specific IP “to-peoples-outside-your-normal-business-area”. You don’t even have to involve your upstream provider and you will be able to offset a very big part of the attack (as long as your normal business area is not russia + china).

Or, if implementing those recommendation are not a possibility, there is always services/devices available for sales. Be ready to pay a very big price for them.
[...]

#changing to src directory
cd /usr/local/src

#getting geoip libraries
wget http://www.maxmind.com/download/geoip/api/c/GeoIP-1.4.5.tar.gz
tar zxf GeoIP-1.4.5.tar.gz
cd GeoIP-1.4.5

#configure & install of libraries
./configure ; make ; make install

#getting bind-9.4.3
wget http://ftp.isc.org/isc/bind9/9.4.3/bind-9.4.3.tar.gz
tar zxf bind-9.4.3

#getting geodns (geoip binding to dns software)
wget http://www.caraytech.com/geodns/patch.diff

#we patch bind
cd bind-9.4.3
patch -p1 < ../patch.diff


#we configure bind with the new libs. (On one line & this procedure will change with the new patch)
CFLAGS=”-I/usr/local/include” LDFLAGS=”-L/usr/local/lib -lGeoIP” ./configure –prefix=/usr/local/bind

#we compile + install bind.
make ; make install

Configuration
We now have a default installation of a patched BIND9 server & GeoIP libraries. The next step is to create configuration files. I will not be going into the big details here, plenties of how-to are available. The principe of GeoIP is matching-clients through country code, not only IP – this is the value of the patch we applied.

/usr/local/bind/etc/named.conf

options {
directory “/usr/local/bind/var/bind”;
listen-on-v6 { none; };
pid-file “/usr/local/bind/var/run/named/named.pid”;
};

view “us” {
// Match clients from US
match-clients { country_US; };
recursion no;
zone “example.com” {
type master;
file “pri/example-us.db”;
};
zone “.” IN {
type hint;
file “named.ca”;
};
};

view “ca” {
// match from Canada
match-clients { country_CA; };
recursion no;
zone “example.com” {
type master;
file “pri/example-ca.db”;
};
zone “.” IN {
type hint;
file “named.ca”;
};
};

view “other” {
// Match all others
match-clients { any; };
recursion no;
zone “example.com” {
type master;
file “pri/example-other.db”;
};
zone “.” IN {
type hint;
file “named.ca”;
};
};

/usr/local/bind/var/named.ca ; this file can be retrieved from almost anywere. Google it.

And we also need zone definitons:
/usr/local/bind/var/bind/pri/example-us.db
/usr/local/bind/var/bind/pri/example-ca.db
/usr/local/bind/var/bind/pri/example-other.db

Conclusion

At this point, you have a BIND server running on your server with views defined following the dns-client country. Using the following command (since I do not really own example.com) will give different result if you are in the USA or Canada. “dig @air0.labsphoenix.com test.example.com“. Btw: the “dig” command is part of dnsutils package. Have fun!

Technical term referring to the transition to a dynamic state of a network infrastructure as an events mitigation process. It entail to both asynchronous and synchronous expansion toward or inside a computer cloud. Each such burst is followed by a period of quiescence before the next burst occurs.

Event such as high workload and extreme traffic spike can cause a correctly configured environment to cloudburst.

The term seem to have been used first, in July 2008, by William Fellows (Principal Analyst @ 451group) in a report and pushed forward by Jeffrey Barr (Technology evangelist of Amazon AWS) on a blog in august 2008.

This is my personal definition, yet I think it summarize the process. Anything that needs to be added ?

Déploiement d’un nouveau serveur pour blog.pacharest.com

Ce site, ainsi que quelques autres dans mon cheptel, est maintenant hébergé sur un serveur présent dans le parc informatique de Digital Days. C’est un serveur que je possède suite à un achat sur ebay (dual cpu 2.4ghz – 3x36scsi 15k). Si vous avez le moindre besoin pour de l’hébergément de serveurs avec du high-availability et un service de qualité – je vous conseil fortement de considérer cette compagnie dans vos choix! En plus elle est québécoise!

Premier “commit” dans un GIT lié au noyau (kernel) Linux.

J’ai fait mon premier commit accepté – c’est pour une baliverne, dans un man page du module “md” par rapport à l’utilisation d’un descripteur de filesystem lors de l’usage de superblock v1 dans un array raid – au niveau du GIT de Neil Brown. C’est une référence quand même très précise, mais… elle a été acceptée et c’est moi qui l’a fait.

Mon deuxième article à été publiée.

Mon deuxième article dans une revue informatique à été publié. Environ 40k impression en europe, en français, sur les systèmes de storages – particulièrement au niveau des différences entre iSCSI et AoE. Encore une fois – c’est un domaine assez précis en informatique – mais bon, c’est ca que je fais ;-).

J’ai signé mon contrat avec PraizedMedia.

Ca fait 2 semaines que l’entente à été conclue – par contre, maintenant, il y a eu signature des divers papiers la confirmant. En gros, mon titre officiel de travail est “CloudMaster“. Le seul commentaire que je vais me permettre est que le planificateur hypothécaire c’est posé des questions…

Mon hypothèque à été acceptée.

Malgré le point précédent, l’hypothèque pour l’achat d’une propriété (condo – 1250 pieds carrés) a Hull à été acceptée. C’est un achat conjoint avec ma copine! On commence à être en mesure de faire des plans pour le futurs!

Et… des photos.

Dans la dernière semaine, j’ai eu la chance d’aller à un mariage et un bapteme. J’ai vraiment profiter de l’occasion pour jouer au paparazzi. Dans le cas de la deuxieme photo, on parle de 1/6 secondes.. .ce qui veux dire que ce jeune homme était vraiment – VRAIMENT – concentré ;-)

Sony A100 – 50mm, f/2.0, iso 400, ev 0+, 1/60sec

Sony A100 – 50mm, f/2.0, iso 400, ev 0+, 1/6sec