In response to the vulnerability tagged as   CVE-2021-44228, known as “Log4Shell”, from Artica PFMS we confirm that Pandora FMS does not use this Apache log component and therefore it is not affected.

Discovered by the Alibaba security team, the problem refers to a case of remote execution of unauthenticated code (RCE) in any application that uses this open source utility and affects unpatched versions, from Apache Log4j 2.0-beta9 up to 2.14. 1.

It is true that if we used it, we would be compromised, but fortunately it is a dependency that is not necessary for the operation of our product.

In turn, we must also state that the Elasticsearch component for the log collection feature is potentially affected by CVE-2021-44228.

Recommended solution

There is, however, a solution recommended by the Elasticsearch developers:

1) You can upgrade to a JDK later than 8 to achieve at least partial mitigation.

2) Follow the Elasticsearch instructions from the developer and upgrade to Elasticsearch 6.8.21. or 7,16,1 superior.

Additional solution

In case you can’t update your version here we show you an additional method to solve the same problem:

• Disable formatMessageLookup as follows:

1. Stop the Elasticsearch service.
2. Add -Dlog4j2.formatMsgNoLookups = true to the log4j part of /etc/elasticsearch/jvm.options
3. Restart the Elasticsearch service.

In the event of any other eventuality we will keep you informed.

Most of us have visited a hotel at some point in our lives. We arrive at reception, if we request a room, they give us a key; if we are going to visit a guest, they lead us to the waiting room as a visitor; if we are going to have dinner at their restaurant, they label us as a customer; or if we attend a conference on technology, we go to their conference room. It would not be the case that we would end up in the pool or enter the laundry room for a very important reason: we were assigned a role upon arrival.

Do you know what Role-Based Access Control or RBAC is?

In the field of computing too, since its inception, all this has been taken into account, but remember that the first machines were extremely expensive and limited, so we had to settle for simpler resources before Role-Based Access Control (RBAC) arrived.

Access Control List

In 1965, there was a timeshare operating system called Multics (created by Bell Laboratories and the Massachusetts Institute of Technology) which was the first to use access control lists (ACL). I wasn’t even born at that time so I will trust what Wikipedia has to say about this topic. What I do know, first-hand, is the filesystem access control list (filesystem ACL) that Netware Novell® used in the early 1990s and that I already told you about in a previous article on this blog.

But let’s go back to the access control list: What is an access control? This is the easiest thing to explain, it is nothing more and nothing less than a simple restriction on a user regarding a resource. Either by means of a password, a physical key or even your biometric values, such as a fingerprint, for example.

An access control list then is to write down each of the users who can access (explicitly allowed) or not (explicitly prohibited, under no circumstances) something. As you may imagine, this becomes tedious, constantly staying aware of noting the users one by one and also the processes of the operating system or the programs that run on it… You see, what a mess to write down all the entries, known as access control entries (ACEs).

Following the example of rights on files, directories and beyond (such as full resources: optical disks or entire “hard drives”), I came to work, last century, with Netware Novell®. This is a Filesystem ACL (Network File System access control list). Then came the millennium shock, the NFS ACL version 4 that picked up and expanded, in a standardized way, everything we had used since 1989 when RFC 1094 established the Network File System Protocol Specification. I think I have summarized a lot and should name, at least, the use that MS Windows® gives to ACLs through its Active Directory (AD), the Networking ACLs for the cases of network hardware (routers, hubs, etc.) and the implementations that some databases make.

All these technologies, and more, make use of the concept of access control lists, and as everything in life evolves, the concept of groups sharing some similarities emerged, and thus it was possible to save work by keeping the lists of access. Now imagine that you have one, or more access control lists, that only support groups. Well, in 1997 a man named John Barkley demonstrated that this type of list is equivalent to a minimum Role-Based Access Control, but RBAC at the end of the day, which brings us to the core of the issue…

Role-based access control RBAC

The concept of role in RBAC goes beyond permissions, it can also be well-defined skills. In addition, you may have several assigned roles, depending on the needs of the protagonist (user, software, hardware…). Going back to the billing department example. A salesperson, who already has a corresponding role as such, could also have a collection role to analyze customer payments and focus their sales on solvents. With roles this is relatively easy to do.

Benefits of RBAC

• First of all, RBAC dramatically reduces the risks of breaches and data leaks. If the roles were created and assigned rigorously, the return on investment of the work done in RBAC is guaranteed.

• Reduce costs by assigning more than one role to a user. It is unnecessary to buy new virtual computers if they can be shared with groups already created. Let Pandora FMS monitor and provide you with information to make decisions about redistributing the hourly load or, if necessary and only if necessary, acquire more resources.

• Federal, state, or local regulations on privacy or confidentiality can be required of companies, and RBACs can be a great help in meeting and enforcing those requirements.

• RBACs not only help efficiency in companies when new employees are hired, they also help when third parties perform security work, audits, etc. because beforehand, and without really knowing who will come, they will already have their work space well defined in one or more combined roles.

Disadvantages of RBAC

• The number of roles can grow dramatically. If a company has 5 departments and 20 functions, we can have up to a maximum of 100 roles.

• Complexity.Perhaps this is the most difficult part: identifying and assigning all the mechanisms established in the company and translating them into RBAC. This requires a lot of work.

• When someone needs to temporarily extend their permissions, RABCs can become a difficult chain to break. For this, Pandora FMS proposes an alternative that I explain in the next section.

RBAC Rules

To take full advantage of the RBAC model, developing the concept of roles and authorizations always comes first. It is important that identity management to be able to assign these roles is also done in a standardized way, for this the ISO/IEC 24760-1 standard of 2011 tries to deal with it.

There are three golden rules for RBACs that must be displayed according to their order in time and enforced in due course:

1. Role assignment:Someone may exercise a permission only if they have been assigned a role.

2. Role authorization:The active role of a person must be authorized for that person. Along with rule number one, this rule ensures that users can only assume the roles for which they are authorized.

3. Permission authorization:Someone can exercise a permission only if the permission is authorized for the person’s active role. Along with rules one and two, this rule ensures that users can only exercise the permissions for which they are authorized.

The Enterprise version of Pandora FMS has an ultra complete RBAC and authentication mechanisms such as LDAP or AD, as well as double authentication mechanisms with Google® Auth. In addition, with the tag system that Pandora FMS handles, you may combine RBAC with ABAC. The attribute-based access control is similar to RBAC but instead of roles, it is based on user attributes. In this case, assigned labels, although they could be other values such as location or years of experience within the company, for example.

But we leave that for another article…

Before finishing this article, remember Pandora FMS is a flexible monitoring software, capable of monitoring devices, infrastructures, applications, services and business processes.

Would you like to find out more about what Pandora FMS can offer you? Find out clicking here: https://pandorafms.com/

If you have more than 100 devices to monitor, you may contact us through the form : https://pandorafms.com/contact/

Also, remember that if your monitoring needs are more limited, you have Pandora FMS OpenSource version available. Learn more information here: https://pandorafms.org/

Do not hesitate to send us your questions. Pandora FMS team will be happy to help you!

What’s new in the latest Pandora FMS release, Pandora FMS 759

Let’s take a look together at the features and improvements included in the new Pandora FMS release: Pandora FMS 759.

NEW FEATURES AND IMPROVEMENTS

State change thresholds based on percentage

It is an improvement that many users had requested. It allows a module changing status to be specified based on a percentage change in the value of the last data received. That way, it is more intuitive to define the situations in which you consider that a module goes into WARNING or CRITICAL status.

New trend modules 

These new modules compare the current average with the average of the previous period and return the difference in absolute value or as a percentage. They are useful to express in a simple way that, for example, the use of your network is currently 25% higher than last week, or that the temperature is 2ºC above normal if you compare it to the previous month.

Capacity planning modules

It makes predictions based on the time frame specified by the user, assuming a more or less linear performance of the target module. This type of predictive module allows you to find out how many days you have left until the disk is completely full, or the number of requests to the database you will have within a month if you continue as before. These modules replace the old prediction modules.

Network Configuration Manager

We improved the NCM features. Now in addition to being able to execute commands manually on different devices, firmwares can be uploaded, configuration changes can be verified and backups can be scheduled.

More IPAM improvements

Following in the wake of the previous release, we added some additional features to our IPAM such as defining SITES, isolated islands that allow duplicate addresses. We also added the possibility of defining a location of a previous list, ordering the lists, editing from the supernet browser and more improvements have also been incorporated.

Editor of special days in Metaconsole

The special days editor has been added and the way to assign special days to alert definition has been improved, making it more intuitive.

Policy auto-enforcement by group 

A system of automatic application of policies has been designed so that groups can be assigned policies and when a new agent is added to the group, the associated policies are applied automatically. This improves current auto-provisioning operations and enables large amounts of agents to be handled quickly.

Metaconsole inventory

Inventory display feature has been added to the Metaconsole.

Secondary IP macros in network components and plugins

From now on, through the _address_n_ macro you may use any of the secondary (or successive) IPs of an agent in network modules or remote plugins.

New alert action history report

It complements the existing event or alert reports, offering the details of each action (send email, SMS, log) for each alert launched on an agent/module. It is based on events (which now save that information when an alert is fired).

If you have to monitor more than 100 devices, you may also enjoy a Pandora FMS Enterprise FREE 30-day TRIAL. Installation on Cloud or On-Premise, you choose!! Get it here!

Last but not least, remember that if you have a reduced number of devices to monitor, you can use Pandora FMS OpenSource version. Find more information here.

Do not hesitate to send us your questions. Pandora FMS team will be happy to help you!

We apologize in advance for this extremely freaky reference: If in the well-known science fiction saga Foundation there was a duty to collect all the information of the galaxy to save it, at Pandora FMS we have assigned ourselves the task of making a glossary worthy enough with all the “What are” and the “What is” of technology. And today, without further delay or freakiness, it’s time to define the acronyms: BYOD, BYOA, BYOT.

* Warning to (very) lost sailors: This “Byo-” has NOTHING to do with that other prefix element, “Bio”. Thank you. Get back to your beloved diet

Do you already know what BYOD is? And BYOA? Nor what is BYOT?

BYOT (Bring your own technology)

That means indeed: “Bring your own tech from home, kid”. This is what BYOT means. A policy that allows employees to bring their own electronic devices, personal ones, from home to work.

This has advantages even if you don’t imagine it. And the top companies each give their distinctive approach to implementing such a policy. Some offer employees remuneration to purchase such technology. Other companies think better of it and expect their employees to put up with half or all of the expenses. Some even spend the money but then they demand for employees to pay for some services separately, such as phone service or data…

In any case, no matter how you buy your new devices or whoever pays for the Internet that month, if the device is connected to a corporate network, a highly professional IT department must secure and manage the device.

BYOD (Bring your own device)

Correct. You have translated well: “Use your own device from home, kid”. This term refers again, although on a different scale, to the tendency of employees to use personal devices to work and connect to their company’s networks, access their systems or relevant data.  You know what we mean when we talk about “personal devices”… your smartphone, your laptop, your tablet or, I don’t know, your 4-gigabyte USB.

The truth is that this rings a bell, companies, and especially since this terrible pandemic, now support teleworking. BYOD is here, more and more, working from home, maintaining a flexible schedule, including trips and urgent departures, in the middle of the morning, to get a Coke or to pick up your kid from school.

As it could not be otherwise, for the directives of your company the security of your BYOD is a crucial issue. Because for you it can be a whole morale boost, even on productivity, the fact of working with your trustworthy device, but if the IT department does not take care of checking it before, the access of your personal devices to the company network can raise serious security concerns.

The best thing in this case is to establish a policy where it is decided whether the IT department is going to protect personal devices and, if so, how it is going to determine the access levels. Approving types of devices, defining security policies and data ownership, calculating the levels of IT support granted to BYOD…  Then informing and educating employees on how to use their devices without ultimately compromising company data or networks. Those would be the steps to follow.

Studies show that there is higher productivity for employees using BYOD. Nothing less than a 16% increase in productivity in a normal workweek, for those who work forty hours. It also increases job satisfaction and the fact that new hires decide to stay through a flexible work arrangement. Employee efficiency is higher due to the comfort and confidence they have in their own devices. Technologies are integrated without the need to spend on new hardware, software licenses or device maintenance…

Everything looks wonderful, although there are also certain disadvantages as usual. Data breaches are more likely due to theft or loss of personal devices, as well as employee dismissal or departure. Mismanagement of firewalls or antivirus on devices by employees. Increased IT costs, and possible Internet failures.

BYOA (Bring your own application)

And what’s that? BYOA is basically the tendency of employees to use third-party applications and Cloud services at work.

As we know, mobile devices, owned by employees, have personal-use applications installed. However, they access these applications and different services through the corporate network. Well, this is the aforementioned BYOA.

There are benefits, of course. All those who may be listening to Spotify or using your own Google Drive without paying directly for the Internet. However, the higher the BYOA, like the higher BYOD and BYOT, the bigger the security holes in your organization. No one suffers more than a company’s IT department when it comes to thinking about how vulnerable corporate data can be. Especially when they are stored in the Cloud.

Conclusions

BYOT, BYOD, BYOA solutions are very efficient in the way an employee works. High morals, high practicity, and high productivity. However, well, they do pose certain cracks in the corporate network. Sensitive data and unsupported/unsecured personal devices, sometimes are not the best combination.

“BYO” products have advantages but they need a seasoned, conscious, proactive IT department, always protected by management policies of BYOT, BYOD, BYOA.

---

If you have to monitor more than 100 devices, you may also enjoy a FREE 30-day Pandora FMS Enterprise TRIAL. Installation in Cloud or On-Premise, you choose !! Get it here.

Last but not least, remember that if you have a reduced number of devices to monitor, you can use the Pandora FMS OpenSource version. Find more information here.

Do not hesitate to send us your questions. Pandora FMS team will be happy to help you!

Let’s get to the point about data management: Businesses need data, but accumulating too much can be detrimental. Data overcrowding can corrupt IT professionals, turning them into greedy hoarders. Being indigestible with excessive repeated, outdated or banal information, the so-called ROT data, is bad. Companies of the world! The Devil tempts you with Big Data! Something that, if too much, could be harmful! We tell you all about it in this article.

The five mistakes we make in data management

The Liturgical Department of Pandora FMS, because yes, we have a Liturgical Department, right next to the Communication Department, has counted these past weeks the most despicable and sinful faults within data management. We counted up to five sins. Relax, they are not normally committed by a single offender, they are usually mini-points accumulated, over time, by several members of a team. However, we are going to list these vices so that you can count the ones you carry on your own. The scale is this:

• One fault committed: Sinner.
• Two faults committed: Great sinner.
• Three faults committed: Excessive sinner.
• Four: On the doorway to hell.
• Five: You will burn in hell as the Great Grimoire points its tridents at you. 

First offense:

You and your company have an ungovernable desire for data. You end up collecting an immensity of them in the hope of achieving the greatest possible advance. However, unfortunately, finding something worthwhile among such a wealth of information is like finding the broom in a student flat: a very difficult task.

Second offense:

Do you know when you have had the lunch of your life in the trendiest burger joint and despite being full, you order the dessert menu to see what cheese cake they have? Well, data excess, and the consumption of all the data you may swallow without a planned purpose, is comparable.  That’s right, without a narrow archiving process, a company’s eager urge to fagotize data ends up in a bundle of unnecessary, outdated, and useless data.

Third offense:

Greed overcomes you! And you start hoarding and hoarding, carried away by greed. In the end, this leads to spending money on more hardware, the most cutting-edge on the market, to process and store all that mass of data you accumulate. You do that instead of finding a reliable process to classify, archive, and remove junk data.

Fourth offense:

Due to the massive amount of data that you have, you are lazily and slowly carrying out your queries and your processes. Indeed, the more data you accumulate, you and your company, the more time it will take to process it and make, for example, backups.

Fifth offense:

A company can feel more secure and stable the more data it has, however, the truth is different, the more data it has, the higher the concern. Having the barrel of data completely full does not mean anything if in fact those data are not used correctly.

Recovery Point Objective (RPO) and Recovery Time Objective (RTO)

How many faults/sins have you accumulated from this list? Have you raised your hand many times yelling “Yes, I am guilty”? Well, before you burn in hell, I want to tell you that there is a plan to escape its cauldrons: find and set a recovery point objective (RPO) and a recovery time objective (RTO). Yes, sir, that’s the first step! The RPO defines a tolerable amount of data loss before a company cannot recover. And the RTO, on the other hand, marks the time that data professionals need to recover the data without getting the business in an irreparable state. To give you an idea, one of the ways to expand the RPO is to backup data logs. However, large amounts of data can make backup times too long, putting our company in a bind again. That is why there is no need to accumulate so much useless data.

Do not mistake a recovery plan with a backup plan. You should first create a recovery plan and then prepare your backup plan. The backup plan will nuance your RTO and RPO goals, while the recovery plan will address disaster recovery and high availability objectives.

Conclusions

Today in this blog we learned that data excess can be an indication of a failed business plan and we have exposed the five mistakes that usually cause the increase of this unnecessary data. From everything we have concluded that the best thing is to have a purpose to reach with that data and to have a manageable amount of it, thus allowing professionals to operate in a simpler way.

Money is not the answer, paying for new hardware always seems like the solution but sometimes it is just a sign that your company is not competent enough. Knowing about these problems and finding a solution can save time and money.