Monthly Archives: July 2014

The Setup

I have been testing out different ways to optimize this site for performance, purely as a learning experience.  I have come across several guides explaining how server-side caching works, some of them are really good, and some of them a bit out of date in terms of what I consider “best practice” in the industry these days.  Most of the guides to server side-caching do not include the notion of SSL/TLS.  Just like setting up a web server with SSL/TLS is more complex than setting up a web server without, setting up a cache with SSL/TLS is more complex than setting up a cache without.  The goal of this article is to discuss some of the most popular methods and some of their advantages/disadvantages.

This article will be more about the overarching concepts and flow of information than actual configuration, but I’m hoping to do articles on how to actually configure the different options in future posts and incorporate them into this article.
Read Full Article

PKI vs. CA

First we need to get a few terms straight.  I have heard the terms public key infrastructure(PKI) and certificate authority(CA) sometimes used in conversation interchangeably.  The difference is that a CA by itself doesn’t perform all of the functions of a PKI.  PKIs contain CAs, but they also have other components like certificate revocation lists(CRLs), online certificate status protocol(OCSP) responders that allow clients a higher degree of certainty when assessing whether or not a certificate is valid, even things like policy, which allows you to specify what kinds of certificates or what attributes can be signed by CAs within the PKI.

What is AD CS?

Active Directory Certificate Services(AD CS) is made by Microsoft and it is what a lot of companies use for their PKI needs.  It works well, gives you nice ways to interact with it and runs on Windows Server.  You can request certificates through a (somewhat ugly) web interface, you can also request/issue certificates through a Microsoft Management Console(MMC),  you can request/issue certificates at the command-line with certutil/certreq.  AD CS even handles things like CRL publishing over FTP or SMB and running an OCSP responder, in concert with IIS.  Even though certificate revocation is utterly broken in the consumer world, many PKI uses in the enterprise, e.g. EAP-TLS, generally require revocation to be ‘working’.
Read Full Article

The Setup

I recently decided that I wanted to learn about Nginx. You may know that Nginx is a web server that has been growing in popularity in the last few years. People use it as an alternative to more traditional web servers like Apache or IIS. They even use it in conjunction with Apache or IIS with Nginx acting as a reverse proxy. Nginx excels at serving up static content and can use fewer resources than Apache or IIS if properly configured, in some scenarios. The one drawback that I had heard about with Nginx was it doesn’t have the breadth of modules that you find in Apache. To illustrate one of the differences, under Apache PHP is loaded as a module while Nginx loads it via FastCGI. Using FastCGI Nginx is able to get comparable performance with potentially lower resource usage.

In terms of configuration Apache is certainly an acquired taste, but once you get it, it is not all that complicated and many of the directives are well documented in the Apache docs. Coming from Apache, configuration of Nginx is surprising easy to pick up. Several things that take 2 or 3 lines on Apache take only 1 on Nginx.
Read Full Article

EDIT: There is an updated version of this article for Ubuntu 16.04 here.

I love to mess around with Linux in my home lab and I like to check out the state of Samba from time to time. I have documented the steps that I took to get Samba 4 working as a Active Directory Domain Controller and also made a screencast that I have cross-posted on YouTube. I chose Ubuntu because they have pretty recent packages of Samba, more info about binary packages for different Distributions on the Samba Wiki. If you are following this as a guide, I’m assuming that you have already installed Ubuntu 14.04. If you do watch the screencast, it is best viewed in HD!

Read Full Article