ISLET: Jon Schipp, Ohio Linux Fest An Attempt to Improve Linux-based Software Training

Transcription

1 ISLET: An Attempt to Improve Linux-based Software Training Jon Schipp, Ohio Linux Fest 2015

2 Project Contributions The Netsniff-NG Toolkit SecurityOnion Bro Team

3

4 The Problem IT training isn t easy

5 Common Types of IT Training 1. Shared system training (multiple accounts) 2. Virtual Machine training (VM per student) 3. Container training (container per student) 4. Web based training

6 Goals Admin: make something that is really easy to install, deploy, and configure User: design an intuitive interface and smooth training experience with minimal requirements.

7 Text Isolated, Scalable, and Lightweight Environment for Training A container system for teaching Linux based software with minimal participation effort. The participation barrier is set very low, students only need an SSH client.

8 Uses: Excels at teaching command-line software on Linux Event training (intended design) Internal software training Trying out tools in a containerized environment Development environments

9 Real World Use Cases: Launched the precursor at BroCon 14. Used to teach Bro scripting. ~50 users had shell access to Bro and unix tools in a container simultaneously on a lower end (m3.xlarge) EC2 VM - no problem. University of Illinois Digital Forensics 2 course FlowCon Bro training ~100 users Used to teach Linux tools at UIUC LUG meetings

10 Feedback loop Container logs show user s actions e.g. mistakes which can be used to improve future training

11 Design

12 Linux Containers The technology behind ISLET

13 Isolation via kernel namespaces and cgroups The user can t tell the difference. Scalability Vertically with faster hardware meaning more users or work Lightweight ~100ms startup time, near bare metal performance, JeOS Environments Provides shell access with the necessary pieces

14 Linux Containers? Docker popularized the technology. It s actually been around for 7 years. Automates the deployment of Linux based container Provides layers of abstraction Various methods of container creation Docker hub and registries for sharing and deployment

15 Containers Important: "Linux Based Containers" There is no container specification There are different container (and like) technologies Linux: LXC, OpenVZ, Google containers, etc. Non-Linux: BSD Jails, Solaris Zones, AIX WPAR, etc. What do containers do? Light-weight process virtualization What do virtual machines do? Hardware virtualization

16 Research Moment In general, Docker equals or exceeds KVM performance in every case we tested. IBM Research Report: An Updated Performance Comparison of Virtual Machines and Linux Containers < DD819C85257D E7B/$File/rc25482.pdf>

17 Research Results from the paper

18 ISLET Paper Team: NCSA Cybersecurity Directorate * Jon Schipp - Security Engineer * Jeannette Dopheide - Training & Outreach Coordinator * Adam Slagell - Director, Cybersecurity Division We used the Bro network security monitor as the test. Processed a network trace file used for training at Bro events. Bro is a process that does a lot of work.

19 Container Startup

20 Container Concurrency

21 Simulate Training Metric: Response/execution time of program to train Standard time: Average of 2.13 seconds Cutoff point: 6 seconds (too long to wait) We used the Bro network security monitor as the test. Processed a network trace file used for training at Bro events. Bro is a process that does a lot of work. Introduced small randomization delays for pauses & common commands for environment - looped 20 times. Ends up simulating ~10 minutes of high user activity

22 Simulation Data

23 Cost Comparison

24 Working with ISLET

25 Platform Designed for Linux (currently), 64-bit only (because of Docker) Debian family is preferred but will work on others that support Docker. I do nearly all of my testing on Ubuntu so I recommend using that for the best experience. Update: should work with OSX (boot2docker) and FreeBSD with unofficial docker port

26 Get ISLET $ git clone

27 Architecture

28 Configuration & Workflow Global: configuration file i.e. /etc/islet/islet.conf Per-image: configuration files per image /etc/islet/*.conf Creating a new training environment (3 steps) 1. Build Docker image with the software for training 2. Create configuration file and point to new image 3. Place in /etc/islet/ e.g. new_image.conf

29 Easy updates $ make update

30 Demo Using EC2

31 OLF Special: $ ssh [email protected] $ ssh [email protected] Password: demo

32 Roadmap: Support other container runtimes (lxc, openvz, jails, etc.) Auditing, pen testing Improve build system Rewrite in Go Lang or Python using container API s Export containers and exercises 1.) Users can save their work or continue at home like they can with VM training Scalability testing beyond containers, distributed setup

33 Easy Contributing $ git clone $ cd vagrant/islet && vagrant up $ ssh -p 2222 demo@ o UserKnownHostsFile=/dev/null

34 Contact & Acknowledgements NSF Grant:

35 References: IBM Research Report: An Updated Performance Comparison of Virtual Machines and Linux Containers < DD819C85257D E7B/$File/rc25482.pdf > Realizing Linux Containers (LXC): Building Blocks, Underpinnings, and Motivations < > Resource management: Linux kernel Namespaces and cgroups. < lectures/299/netlec7.pdf > Linux Containers and the Future Cloud. < > Lightweight Virtualization with Linux Containers (LXC) < Schipp, J., Dopheide, J., and Slagell, A., "ISLET: An Isolated, Scalable & Lightweight Environment for Training", in the proceedings of XSEDE 2015, St. Louis, MO, Jul., 15. > NSF Grant < Docker Inc. <