Linux Journal | November 2017 | Issue
Total Page:16
File Type:pdf, Size:1020Kb
™ TIPS FOR USING THE HIGH-SECURITY Qubes Desktop NOVEMBER 2017 | ISSUE 283 Since 1994: The Original Magazine of the Linux Community http://www.linuxjournal.com Control a A LOOK AT ANSIBLE’S Heterogeneous ROLES Server Farm FEATURE with SSH Agent + Launching External Processes in Python Produce Readable Shell Scripts and Solve Deploy Equations WATCH: Instant Clusters ISSUE OVERVIEW in the Cloud V LJ283-Nov2017.indd 1 10/19/17 2:18 PM NEW! Deploying An Architect’s Kubernetes Guide: Linux with Security in the Age Practical books and Compliance of Containers in Mind Author: Author: Sol Lederman for the most technical Petros Koutoupis Sponsor: Sponsor: SUSE people on the planet. Twistlock SQL Server Managing on Linux Container Author: Security and Reuven M. Lerner Compliance GEEK GUIDES Sponsor: in Docker SUSE Author: Petros Koutoupis Sponsor: Twistlock Harnessing DevOps for the Power the Rest of Us of the Cloud Author: with SUSE John S. Tonello Author: Sponsor: Petros Koutoupis Puppet Sponsor: SUSE Download books for free with a An Memory: Past, simple one-time registration. Architect’s Present and Guide: Future—and Linux for the Tools to http://geekguide.linuxjournal.com Enterprise IT Optimize It Author: Author: Sol Lederman Petros Koutoupis Sponsor: Sponsor: SUSE Intel LJ283-Nov2017.indd 2 10/19/17 2:18 PM NEW! Deploying An Architect’s Kubernetes Guide: Linux with Security in the Age Practical books and Compliance of Containers in Mind Author: Author: Sol Lederman for the most technical Petros Koutoupis Sponsor: Sponsor: SUSE people on the planet. Twistlock SQL Server Managing on Linux Container Author: Security and Reuven M. Lerner Compliance GEEK GUIDES Sponsor: in Docker SUSE Author: Petros Koutoupis Sponsor: Twistlock Harnessing DevOps for the Power the Rest of Us of the Cloud Author: with SUSE John S. Tonello Author: Sponsor: Petros Koutoupis Puppet Sponsor: SUSE Download books for free with a An Memory: Past, simple one-time registration. Architect’s Present and Guide: Future—and Linux for the Tools to http://geekguide.linuxjournal.com Enterprise IT Optimize It Author: Author: Sol Lederman Petros Koutoupis Sponsor: Sponsor: SUSE Intel LJ283-Nov2017.indd 3 10/19/17 2:18 PM NOVEMBER 2017 CONTENTS ISSUE 283 FEATURES 78 Rapid, Secure 100 CLIC: CLuster Patching: Tools In the Cloud and Methods Automatically create and delete high-performance Control a heterogeneous server computing resources in farm with the SSH agent. the cloud. Charles Fisher Nathan R. Vance and William F. Polik 4 | November 2017 | http://www.linuxjournal.com Cover Image: © Can Stock Photo / scanrail LJ283-Nov2017.indd 4 10/19/17 2:18 PM CONTENTS COLUMNS 40 Reuven M. Lerner’s At the Forge Launching External Processes in Python 48 Dave Taylor’s Work the Shell A Number-Guessing Game 54 Kyle Rankin’s 23 Hack and / Lightning Hacks: Qubes Tips 58 Shawn Powers’ The Open-Source Classroom Ansible, Part IV: Putting It All Together 114 Doc Searls’ EOF New Hope for Digital Identity 36 IN EVERY ISSUE ON THE COVER 8 Current_Issue.tar.gz UÊ ÌÀÊ>ÊiÌiÀ}iiÕÃÊ-iÀÛiÀÊ>ÀÊÜÌ Ê--Ê}iÌ]Ê«°ÊÇn UÊ i«ÞÊÃÌ>ÌÊ ÕÃÌiÀÃÊÊÌ iÊ Õ`]Ê«°Ê£ää 10 Letters UÊ/«ÃÊvÀÊ1Ã}ÊÌ iÊ} -iVÕÀÌÞÊ+ÕLiÃÊ iÃÌ«]Ê«°Êx{ UÊÊÊ>ÌÊÃLi¿ÃÊ,iÃÊi>ÌÕÀi]Ê«°Êxn 18 UPFRONT UÊ>ÕV }Ê ÝÌiÀ>Ê*ÀViÃÃiÃÊÊ*ÞÌ ]Ê«°Ê{ä 38 Editors’ Choice UÊ*À`ÕViÊ,i>`>LiÊ- iÊ-VÀ«ÌÃÊ>`Ê-ÛiÊ µÕ>ÌÃ]Ê«°Ê{n 70 New Products 120 Advertisers Index LINUX JOURNAL (ISSN 1075-3583) is published monthly by Belltown Media, Inc., PO Box 980985, Houston, TX 77098 USA. Subscription rate is $29.50/year. Subscriptions start with the next issue. 5 | November 2017 | http://www.linuxjournal.com LJ283-Nov2017.indd 5 10/19/17 2:18 PM Executive Editor Jill Franklin [email protected] Senior Editor Doc Searls [email protected] Associate Editor Shawn Powers [email protected] Art Director Garrick Antikajian [email protected] Products Editor James Gray [email protected] Editor Emeritus Don Marti [email protected] Technical Editor Michael Baxter [email protected] Senior Columnist Reuven Lerner [email protected] Security Editor Mick Bauer [email protected] Hack Editor Kyle Rankin lj@greenfly.net Virtual Editor Bill Childers [email protected] Contributing Editors )BRAHIM (ADDAD s 2OBERT ,OVE s :ACK "ROWN s $AVE 0HILLIPS s -ARCO &IORETTI s ,UDOVIC -ARCOTTE 0AUL "ARRY s 0AUL -C+ENNEY s $AVE 4AYLOR s $IRK %LMENDORF s *USTIN 2YAN s !DAM -ONSEN President Carlie Fairchild [email protected] Publisher Mark Irgang [email protected] Associate Publisher John Grogan [email protected] Director of Digital Experience Katherine Druckman [email protected] Accountant Candy Beauchamp [email protected] Linux Journal is published by, and is a registered trade name of, Belltown Media, Inc. 0/ "OX (OUSTON 48 53! Editorial Advisory Panel Nick Baronian Kalyana Krishna Chadalavada "RIAN #ONNER s +EIR $AVIS -ICHAEL %AGER s 6ICTOR 'REGORIO $AVID ! ,ANE s 3TEVE -ARQUEZ $AVE -C!LLISTER s 4HOMAS 1UINLAN #HRIS $ 3TARK s 0ATRICK 3WARTZ Advertising % -!),: [email protected] 52,: www.linuxjournal.com/advertising 0(/.% EXT Subscriptions % -!),: [email protected] 52,: www.linuxjournal.com/subscribe -!), 0/ "OX (OUSTON 48 53! LINUX IS A REGISTERED TRADEMARK OF ,INUS 4ORVALDS LJ283-Nov2017.indd 6 10/19/17 2:18 PM Manage data expansion You with SUSE Enterprise cannot Storage. SUSE Enterprise Storage, the leading open source storage solution, is highly keep up scalable and resilient, enabling high-end functionality at a fraction of with data the cost. explosion. suse.com/storage Data LJ283-Nov2017.indd 7 10/19/17 2:18 PM Current_Issue.tar.gz Arrogance, the Biggest SHAWN Linux Security POWERS Shawn Powers is the Associate Editor for Linux Journal. He’s Problem also the Gadget Guy for LinuxJournal.com, and he has an INUX IS NO LONGER AN OBSCURE PLATFORM AVOIDED BY interesting collection those with malicious intent. It used to be that people of vintage Garfield with Windows 95 were the only ones getting viruses coffee mugs. Don’t L let his silly hairdo OR EXPERIENCING SECURITY VULNERABILITIES BUT THATS BEFORE fool you, he’s a Linux migrated to the cloud. Now, basically everything runs pretty ordinary guy ON ,INUX BOTH INSIDE AND OUTSIDE THE OFFICE DATA CENTER and can be reached via email at 4HAT MEANS NETWORK AND /3 SECURITY IS MORE IMPORTANT THAN [email protected]. EVER BEFORE AND NOW ,INUX USERS NEED TO BE ESPECIALLY Or, swing by the AWARE 4HE GOOD NEWS IS MOST ,INUX USERS KNOW SECURITY #linuxjournal IRC channel on is important and realize it’s a topic that needs to be Freenode.net. approached proactively. So this month, we look at some great ways to make our world a little more secure. /UR FEATURE ARTICLE IS BY #HARLES &ISHER AND HE EXPLAINS HOW V TO USE SIMPLE BUT SECURE METHODS FOR MAINTAINING MULTIPLE machines on your network using strong SSH keys and Parallel $ISTRIBUTED 3HELL !LTHOUGH CONFIGURATION MANAGEMENT VIDEO: Shawn AND SYSTEM ORCHESTRATION TOOLS ARE POWERFUL SOMETIMES ITS Powers runs IMPORTANT TO STRIP BACK ALL THE EXTRANEOUS FUNCTIONALITY AND through just execute remote commands on multiple computers over the latest issue. A SECURE CONNECTION #HARLES DESCRIBES HOW TO CONFIGURE YOUR CLIENTS AND PERFORM TASKS SECURELY OVER THE NETWORK 8 | November 2017 | http://www.linuxjournal.com LJ283-Nov2017.indd 8 10/19/17 2:18 PM Current_Issue.tar.gz I previously mentioned the cloud and how Linux is a vital part in almost all CLOUD BASED COMPUTING )N LIGHT OF THAT .ATHAN 2 6ANCE AND 7ILLIAM & 0OLIK DISCUSS HOW TO GO A STEP FURTHER AND NOT ONLY USE CLOUD COMPUTER INSTANCES BUT ALSO TO CREATE AN ENTIRE CLUSTER OF COMPUTERS IN THE CLOUD 7HEN SCALABILITY is instant, it means your cluster can grow and shrink as you need it, saving tons OF MONEY IN HARDWARE INVESTMENT AND RESOURCE MANAGEMENT 0LUS THE AUTHORS INCLUDE INFORMATION ON A HYBRID CLUSTER WHERE THE HEAD NODE IS ON LOCAL HARDWARE and the compute instances are spun up in the cloud only as needed. +YLE 2ANKIN WROTE A ,IGHTNING (ACKS ARTICLE THIS MONTH TO PROVIDE A HANDFUL OF REALLY GREAT IDEAS IN A REALLY SHORT AMOUNT OF TIME 4HIS TIME +YLES FOCUS IS ON 1UBES TIPS AND HOW HE DOES SOME PRETTY NIFTY THINGS WITH IT ON HIS SYSTEM !S WITH MOST OF +YLES WORK THESE TIPS CAN BE ADAPTED IF YOU DONT HAPPEN TO BE A 1UBES USER BUT REGARDLESS OF THE SYSTEM YOU USE ITS ALWAYS WORTHWHILE to read Kyle’s column! ) FINISH OFF MY SERIES ON !NSIBLE THIS MONTH WHICH IS ANOTHER TOOL YOU MAY OR MAY NOT BE USING (OPEFULLY AFTER FOLLOWING ALONG ON THIS FOUR PART SERIES YOUVE AT LEAST GIVEN !NSIBLE A TRY IN YOUR OWN NETWORK %VEN THE SMALLEST IMPLEMENTATION CAN SAVE HOURS OF WORK AND THE TIME REQUIRED TO GET STARTED IS MINIMAL 7E ALSO HAVE GREAT INFORMATION FOR CODERS AND DEVELOPING DEVELOPERS 2EUVEN - ,ERNER CONTINUES TEACHING ABOUT 0YTHON THIS MONTH WITH PARTICULAR FOCUS ON LAUNCHING EXTERNAL PROCESSES FROM INSIDE A 0YTHON SCRIPT 3OME TOOLS IN THE ,INUX SHELL ARE INVALUABLE AND OFTEN ITS NICE TO UTILIZE THEM INSIDE THE SCRIPT OF another language, like Python. $AVE 4AYLOR FOLLOWS 2EUVEN WITH HIS SHELL SCRIPTING COLUMN WHICH TEACHES ALL ABOUT THOSE CONVENIENT SHELL TOOLS 4HIS MONTH HE EXPLORES USING MATHEMATICAL evaluation tools in order to make a guessing game. Along the way, you’ll learn TO MAKE CLEAR READABLE CODE SO YOUR GUESSING GAME CAN BE THE FOUNDATION FOR more complicated and usable code. As usual, Dave teaches valuable skills while READERS GET TO PLAY COMMAND LINE GAMES We also have new products, reviews, tech tips and all the other goodies you’ve COME TO EXPECT MONTH AFTER MONTH FROM Linux Journal.