Categories
Cloud Computing

Learn and Try Satellite Tree Protocol Hands-On with Mininet Yourself!

As SynchroKnot technology has gained the attention of technical peers and businesses across the globe, the team at Spatial Systems Engineering at SynchroKnot has decided to make the Satellite Tree Protocol software [similar to what is seen in the demonstration videos, but not the bleeding edge] free and available to everyone providing you understand & keep in mind that the enhancements to the IEEE standards 802.1D (1998|2004) and 802.1W as seen in the Linux version and other operating systems versions of the Satellite Tree Protocol Software are the Intellectual Property of its creator and owner Mehul Sharma.

Feel free to use, distribute, hack, re-engineer and have fun!

Keep in mind this software is provided to you “as is” for the purposes of fun without any support or warranty of any kind. One of the considerate ideas behind this decision is to help warm up the end users to get acquainted with the actual SynchroKnot Cloud Computing Decentralization Software.

The Satellite Tree Protocol software provided here is the Linux version, which will work on Linux kernel version 4.9, as seen in Debian and Debian derivatives.

If you have recompiled the kernel or are using a derivative with CONFIG_MODULE_SIG [Module signature verification], then the kernel module will fail to load.

It is recommended that you download and install Debian 9 [Stretch] or Devuan [ASCII] from their official website. Below is a short list of known-to-be-working kernels:

GRML:
SMP Debian 4.9.29-1+grml-1

Kali:
SMP Debian 4.9.30-2kali1

Debian:
SMP Debian 4.9.65-3

Devuan:
SMP Debian 4.9.88-1+deb9u1

Though we understand the actual, real-world use requires understanding of various interconnect topologies, troubleshooting of various aspects depending on your setup, understanding the core work-ability before you can even attempt to troubleshoot, gaining of professional support to help you engineer and help you solve problems, and so on, we believe this will help you get started and see the potential and power of this small part of the complete SynchroKnot software and solution.

For those who are unaware of what Satellite Tree Protocol is, a full description can be found in one of our other articles or on our official website.

What is Mininet?

Mininet creates a realistic virtual network, running real kernel, switch and application code, on a single machine in seconds, with a single command.

Please visit Mininet website to learn more:

Mininet

Install Mininet:

Please visit the Download/Get Started With Mininet page for necessary steps to get Mininet installed:

Important: Please consider installing Mininet on a physical machine with ample resources and not a virtual machine to get good performance when using it with Satellite Tree Protocol.

Steps to Get Started:

1] Important: Make sure you remove the standard Linux Bridge.

rmmod bridge

Please make sure it has been successfully removed.

2] Insert the 8021q module

modprobe 8021q

Please make sure it has successfully loaded.

3] Insert the Satellite Tree Protocol-enabled Bridge:

Please make sure you are loading only the Satellite Tree Protocol-enabled Bridge. To confirm do the following:
modinfo sstp-bridge.ko

The value of alias: should look similar to below:
alias: rtnl-link-SynchroKnot-Satellite-Tree-Protocol-bridge

Now insert the module:
insmod -f [path]/sstp-bridge.ko

example:
insmod -f sstp-bridge.ko

Please make sure it has successfully loaded. The command lsmod should show “bridge”.

4] Create a pair of veth devices to complete the loop of the ring topology:

ip link add loop0 type veth peer name loop1

ifconfig loop0 up
ifconfig loop1 up

5] Start Mininet without a controller [--controller none] and with Linux bridge which is now Satellite Tree Protocol enabled.

mn --controller none --switch lxbr,stp=1 --topo linear,8,1

The topology above [--topo linear,8,1] refers to 8 switches [nodes] in a linear topology. Start with 8 or less switches [nodes] and then increase it when you get acquainted with the workabilities and observations.

You can also add the option below to mn to experiment:

--link=tc,bw=1000

6] Connect the ends of the topology to form one large loop or ring:

brctl addif s1 loop0
brctl addif s8 loop1

[The veth loop devices must be up for the ring to form. We have already brought up the loop0 and loop1 devices in step 3]

Note: As soon as the loop devices are connected you can see topology change and related activity.

One simple way to capture topology change-related activity is to use the Tcpdump utility:

tcpdump -vvv -p -n -i any stp | grep -ie topology

Refer to the tcpdump manual page for more information related to the options:
man tcpdump

For an in-depth investigation you can look at syslog or dmesg. Below is an example to get information in real-time from syslog:

tail -f /var/log/syslog | grep --color -ie sstp

Now, you can start to experiment with bringing down a switch and observing what happens and then bringing it up again and then observing the change.

Example:
echo "Bringing Down s8" && ifconfig s8 down
echo "-- waiting for 10 seconds --" && sleep 10
echo "Bringing Up s8" && ifconfig s8 up

Similarly, you can start pings from one switch [node] to another and make observations. Of course you won’t get a ping response from the switch[es] that you might be bringing down, so make sure you are only pinging the switches that are not being brought down and up.

Also, experiment with moving or bouncing the root bridge over to another switch and then moving it back with and without the pings, and make observations in tcpdump. Obviously, you are not going to move/bounce the root bridge to the switch that you might be bringing up and down.

Example:

Check which switch is the root bridge and then set a lower bridge priority to another switch and you will notice that the bridge with the lower priority becomes the root bridge.

Here we are giving s4 as a priority of 50:

brctl setbridgeprio s4 50

How to check which switch is the root bridge:

In the tcpdump results, see what is next to “root-id” and then find that id after executing brctl show

To move the root bridge back to the previous switch that was the root bridge or to another switch, set a lower priority than 50:

brctl setbridgeprio [name of the switch] 25

To make things easier we have depicted the steps and different experiments in our video demonstrations. Please refer to our website for the details of the demonstrations under the demo section. The links below are directly of the demonstration videos:

Spatial Satellite Tree Protocol

Satellite Tree Protocol showing Root Bridge failure, failover, failback

Satellite Tree Protocol showing Root Bridge failure, failover, failback with Flood Ping from multiple directions

After you have had an opportunity to experiment with the ring topology, you can start Mininet with the Torus topology!

Please keep in mind that at the moment only the binary version of this software is available (similar to many binaries made available by companies such as Nvidia and others). If this conflicts with your belief, please decide against trying or using it.

Considering their active, busy schedule, the team at Spatial Systems Engineering is in the very early stages of gathering requirements and necessary details for the possible open-sourcing of the code of this software.

Also keep in mind that it is not a requirement to use the Satellite Tree Protocol with the SynchroKnot software and solutions. You can use regular switches with STP and RSTP, etc. as well. Many have shown preference for the Satellite Tree Protocol, due to the logical, underlying benefits.

Below are the links to download sstp-bridge.ko and checksum [sha512sum] of sstp-bridge.ko

█ DOWNLOAD SATELLITE TREE PROTOCOL – sstp-bridge.ko 

█ SHA512SUM [in a file] 

SHA512SUM:
13335bcb0c5ce6ba2a497a01ab5e2944f032a7f08a694887d8b17b2bc6160d4532cc231afd5c1b625f23b4e81856d011bacdbee29aaf4b316b77d3633f1d6f7c

Categories
Cloud Computing

Distributed Fault-Tolerant Authentication Management & Identification Control System

At the rate at which technology today is moving forward with the Internet speeds increasing manifold, with IoT gaining prominence and organizations more distributed across the globe than before, the authentication software, systems and architectures remain fairly primitive.

Among the many reasons attributing to this is corporates that build these authenticating systems and software hold on to these products as their main source of income. The insight and research in these areas has also been fairly mundane. Though there’s been enough research funding, what’s missing has been the intellect and knowledge required to build large-scale distributed and decentralized authentication systems and architectures.

Large-scale authentication systems and architectures used in building them must allow both manned [computers, tablets, phones, virtual machines etc] and unmanned [IoT devices etc] to authenticate and authorize themselves without a centralized bottleneck, as seen in authentication systems like LDAP, Active Directory and others.

As experienced on a daily basis, these centralized authentication systems are not scalable or fault-tolerant without a sane fail-over MTBF [Mean Time Between Failure] causing business disruptions on a regular and long-lasting basis.

■ What can be done about this?

Let us acquaint ourselves with AuthControl. SynchroKnot designed and developed AuthControl as a result of realizing inadequacies in the centralized authentication systems [LDAP & Active Directory].

AuthControl was designed with the following flexibility in mind:

  • Ability for authentication to be either centralized, distributed, decentralized or a combination of these.
  • Ability to be seamlessly and transparently scaled on-demand across the globe with no downtime.
  • Ability to be used by standard operating systems within their security framework without custom or proprietary software, enhancements, modifications or hacks.
  • Ability to be used across all devices that can make a simple https call. and much more.

■ What is AuthControl?

AuthControl is SynchroKnot’s unique Distributed Fault-Tolerant Authentication Management & Identification Control System that serves as a scalable, secure and simple alternative to LDAP, Active Directory and other authentication systems.

In AuthControl, the user[s] can be delegated and made responsible for managing their password. Furthermore, the user’s password SHA512/GOST checksum is kept encrypted.

■ Password + Pin

The user[s] can log in to their virtual machines or physical hardware [eg. computers, tablets, mobile phones etc] with their standard username and password + 5 digit unique pin.

This 5 digit pin is not set by the user, but is rather auto or manually generated per the preference of the organization. Without having to manage separate pins for each user, and the ability to change them on a regular basis, makes logging into systems and authentication for various purposes more secure without adding the burden of lengthy procedures/steps.

Depending on the nature of the circumstance, user access can be restricted/limited by simply changing the PIN.

■ Algorithmically-ascertained decentralized numeric User and Group ID

Authcontrol also has the unique capability of creating operating system specific user and group identities that are unique. For example, AuthControl can create a Linux User ID and Group ID that are unique and always return the same numeric value for the ID.

This unique numeric user and group ID is algorithmically created in a decentralized manner without having to generate, store and poll centralized or distributed databases.

Due to the uniqueness of the user and group IDs, they can be instantly checked for changes/manipulations and reinstated automatically if changed without having to poll, check and compare with central or distributed databases. It can also report/alert in the similar manner.

AuthControl’s strong security is strengthened with the use of inter-leaved mapping of Usernames to their Blockchain IDs and further using blockchain cryptography [not the blockchain network] to ascertain authenticity. This is another unique feature you will not find anywhere else but with SynchroKnot.

■ Fault Tolerant

AuthControl algorithmically checks for failures across multiple geographically-dispersed locations [configurable up to 10] before returning unreachable.

■ Load Balanced

Each user or groups of users can be assigned different geographically-dispersed locations for load balancing [with additional option of fault-tolerance].

■ Scalable

Enable AuthControl in virtual or physical machines, point more users to them, and scale seamlessly and transparently across the globe.

■ Simple

Very easy to set up and manage. Works transparently with Linux PAM without modifying standard PAM modules, and is end-to-end encrypted [uses standard HTTPS for communication].

Since this is just an article for getting acquainted with AuthControl, we refrain from getting into technicalities which might be better reflected in a whitepaper.

■ Below are examples of different methods that users can log in or access resources transparently with their standard Username and Password + 5 Digit PIN:

├─> Graphical Login
├─> Graphical Screen Saver Login [eg. screen lock]
├─> Non-Graphical Login
├─> SUDO – Execute a command as another user
├─> SU – Super User
├─> SSH – Secure Shell
├─> SCP – Secure Copy
├─> SFTP – Secure File Transfer Protocol
├─> SSHFS – Secure Shell File System
├─> FTP – File Transfer Protocol
├─> VNC – Virtual Network Computing
├─> RDP – Remote Desktop Protocol
├─> CUPs – standards based open source printing system
├─> CRON – Execution of scheduled commands
├─> SAMBA – Windows AD and SMB/CIFS fileserver for UNIX
├─> File Manager – Create Network Place with SFTP, SAMBA and FTP
├─> All password requirements via Control Center
├─> Practically anything that uses Standard PAM for authentication!

Below is a direct link to the demonstration video:

AuthControl Demo

Description of the demonstration:

This is a very basic impromptu demonstration of AuthControl. Here both of the virtual machines are enabled with AuthControl and show the following:

■ Login via Graphical Interface

■ Login via Non-Graphical Interface

■ Run a command with SU as another user

■ Run a command with SUDO as another user

■ Login to a remote system via SSH

■ Mount a remote filesystem via SSHFS

■ Use File Manager to create a Network Place using SFTP

All these different types of logins use AuthControl with standard Linux users and password + 5 digit pin. The basic HTTPS traffic is captured using TCPDUMP to show realtime interaction with the SynchroKnot AuthControl when the password is entered in the virtual machines for the purposes of authentication.

Note: This demo was recorded on a severely resource-constrained system. It is up to you to determine the performance.

More information and technical insights can be found @ synchroknot.com