Seattle Area System Administrators Guild

While it may not be as sexy as they make it look on TV, there are a number of powerful Open Source tools available for analyzing file systems and recovering data– even data that may have been deleted by the attacker. This talk will start with an overview of the standard Unix file system architecture and discuss tools for imaging file systems, suggest useful idioms for detecting signs of a break-in, and cover how to discover “interesting” data from deleted files and re-assemble that data into an actual file image.

—–

Hal Pomeranz is the founder and technical lead of Deer Run Associates, and has been active in the system and network management/security field for over twenty years. As a senior member of the Faculty for the SANS Institute, Hal developed the SANS “Step-by-Step” course model and currently serves as the track coordinator and primary instructor for the SANS/GIAC Unix Security Certification track (GCUX). In 2001 he was given the SAGE Outstanding Achievement Award for his teaching and leadership in the field of System Administration.

Many people in the Unix and other computing communities accept without question the fact that we need infrastructure to make things work. We accept this without actually thinking about _why_ we need infrastructure, what infrastructure is, or even how we make an ‘infrastructure’.

On the flip side there are managers, users, and even computing professionals who not only don’t know what an infrastructure is but question the very basis of the assumption that such a beast is of any use, let alone desirable. They know their desktop system or the computer they have at home works and don’t see a need to go beyond that.

This talk will start with a basic analysis of what constitutes an infrastructure. It will then touch on why such a thing is often necessary.

Along the way we will briefly examine the difference between an infrastructure for supporting computing in general (”infrastructure architecture”) versus one for specific application support (”application architecture”) - which is needed when and why.

We’ll take a moment to look at at some basic needs - both hardware and software. We will see why things like common account information and network clocks are vital to a successful infrastructure. We will look at the differences between homogeneous and heterogeneous infrastructures. We will see that while no one solution works for everyone there are some basics that you can’t do without.

We will take side journeys into hardware needs - computer rooms/data-centers, network designs, upstream connections, etc - and put all of that together with a scale-to-fit-needs discussion to answer the basic question: “Why infrastructure?”

—–

Lee Damon has been a Unix system administrator since 1985 and has been active in SAGE since its inception. He assisted in developing a mixed AIX/SunOS environment at IBM Watson Research and has developed mixed environments for Gulfstream Aerospace and QUALCOMM. He is currently leading the development effort for the Nikola project at the University of Washington Electrical Engineering department. Among other professional activities, he is a charter member of LOPSA and SAGE and past chair of the SAGE Ethics and Policies working groups, and he was the chair of LISA ‘04. He was awarded SAGE’s 2003 Outstanding Achievement Award “for service to SAGE and the system administration profession as a whole.”