Steering connections to sockets with BPF socket lookup hook Jakub Sitnicki, Cloudflare @jkbs0 @cloudflare October 28-29, 2020 Who am I? ● Software Engineer at Cloudflare Spectrum TCP/UDP reverse proxy

man:smbd(8) man:samba(7) man:smb.conf(5) Main PID: 6198 (smbd) Status: "smbd: ready to serve connections..." Tasks: 4 (limit: 19660) CGroup: /system.slice/smbd.service ├─6198 /usr/sbin/smbd --foreground Continue ] [ Back ] ==================================================================== Network connections ==================================================================== Configure at least one interface Continue ] [ Back ] ==================================================================== Network connections ==================================================================== Configure at least one interface

Selects packages needed for an OpenSSH server. • PostgreSQL database: This task selects client and server packages for the PostgreSQL database. • Print server: This task sets up your system to be a print Ubuntu for server administrators. Some of these advantages include ease of use over simple terminal connections (SSH), and the ability to be used in system administration scripts, which can in turn be automated effect, so use with caution. • Update the Package Index: The APT package index is essentially a database of available packages from the repositories defined in the /etc/apt/sources.list file and in the

Intrusion Detection  (AIDE preinstalled without pre- defined monitoring database)  (AIDE with security monitoring database pre-defined) Intrusion Prevention  (Fail2ban)  (Fail2ban) Network remotely via Secure Shell (SSH). Refer to the Hardware Manual to see how to set up the physical connections. For default login username and password, please reference the Default Credentials and Password Manual for Arm-based Computers 11 Connecting via the SSH The Arm-based computer supports SSH connections remotely or over an Ethernet network. If you are connecting the computer using an Ethernet cable

Kafka cluster How to secure gRPC Getting Started Securing Elasticsearch How to Secure a Cassandra Database Getting Started Securing Memcached Locking down external access using AWS metadata Advanced Networking call authorization Locking down external access with DNS-based policies How to Secure a Cassandra Database Securing a Kafka cluster Getting Started Using MicroK8s This guide uses microk8s [https://microk8s call authorization Locking down external access with DNS-based policies How to Secure a Cassandra Database Securing a Kafka cluster Self-Managed Kubernetes The following guides are available for installation

policies Inspecting TLS Encrypted Connections with Cilium Securing a Kafka cluster How to secure gRPC Getting Started Securing Elasticsearch How to Secure a Cassandra Database Getting Started Securing Memcached Policy Enforcement Locking down external access with DNS-based policies How to Secure a Cassandra Database Securing a Kafka cluster Getting Started Using MicroK8s This guide uses microk8s [https://microk8s Policy Enforcement Locking down external access with DNS-based policies How to Secure a Cassandra Database Securing a Kafka cluster Getting Started Using K3s This guide walks you through installation of

5 minutes? Which services have experienced an interrupted TCP connection recently or have seen connections timing out? What is the rate of unanswered TCP SYN requests? Application monitoring What is the the worst? What is the latency between two services? Security observability Which services had connections blocked due to network policy? What services have been accessed from outside the cluster? Which policies Inspecting TLS Encrypted Connections with Cilium Securing a Kafka cluster How to secure gRPC Getting Started Securing Elasticsearch How to Secure a Cassandra Database Getting Started Securing Memcached

5 minutes? Which services have experienced an interrupted TCP connection recently or have seen connections timing out? What is the rate of unanswered TCP SYN requests? Application monitoring What is the the worst? What is the latency between two services? Security observability Which services had connections blocked due to network policy? What services have been accessed from outside the cluster? Which policies Inspecting TLS Encrypted Connections with Cilium Securing a Kafka cluster How to secure gRPC Getting Started Securing Elasticsearch How to Secure a Cassandra Database Getting Started Securing Memcached

5 minutes? Which services have experienced an interrupted TCP connection recently or have seen connections timing out? What is the rate of unanswered TCP SYN requests? Application monitoring What is the the worst? What is the latency between two services? Security observability Which services had connections blocked due to network policy? What services have been accessed from outside the cluster? Which policies Inspecting TLS Encrypted Connections with Cilium Securing a Kafka cluster How to secure gRPC Getting Started Securing Elasticsearch How to Secure a Cassandra Database Getting Started Securing Memcached

Writing data directly to these files is sometimes useful for the troubleshooting of hardware connections. For ex- ample, you can dump a text file to the printer device ”/dev/lp0” or send modem commands locate -d . pattern find matching filenames using shell ”pattern” (quicker using regularly generated database) grep -e ”pattern” *.html find a ”pattern” in all files ending with ”.html” in current directory ”/var/lib/dpkg/info/*.md5sums” file with debsums(1). See Section 10.3.5 for how MD5sum works. Note Because MD5sum database may be tampered by the intruder, debsums(1) is of limited use as a security tool. It is only good