188宝金博页面版

Building a low cost, highly scalable, enterprise level computer forensics lab Raoul “Nobody” Chiesa, Ethical Hacker Foreword Desktop hard drives are becoming bigger and bigger. However, server hard disks are not growing up at the same rate. At present, you can buy a 1.5 Tb Sata hard drive for about 150 €. A common 146 Gb 2.5 SAS hard drive costs about 250 €. The Cost to Megabyte ratio means SAS technology is 15 times more expensive. This is a problem. Desktops are getting bigger but you need even bigger storage to store all data related to an investigation and it must be kept also online and secure. Currently, bigger hard drives are affordable but very fragile. Broken hard drives are quite common, much more than in previous years. So... you need: 1. The flexibility from high-end storage solutions, like SAN to allow the storage to grow with your business 2. The cheapness of actual desktop hard drives, trying to lower the cost-per-megabyte 3. Availability. No downtime, ever 4. Redundancy. Your data must resist both hard drive and server crashes In addition, it should be a very good idea to reach also these goals: 5. Security: judicial data is very sensitive. The data should be available only to the technicians/investigators who must work on that case, even if they have administration rights on their analysis machine 6. Multi platform support: Computer forensics is multiplatform. You need to use Unix, Windows, Mac OS X or whatever. So it's good to use a common network file system intrinsically Technology We began our business with file servers with NFS. A nightmare. No security at all, network addressing tied to server name and share name. NFS was only fast. SMB was not faster than NFS, and was only better when it came to security. When the server number grew we had trouble finding data around the local network. Building a SAN gave us only new headaches: we needed new expensive hardware for the infrastructure (Fiber Channel controller and switch), and both disks and storage units were much more expensive. Otherwise we still needed some way to share the SAN file system to the analysis machines. We looked for something new in the market. We found many cluster file system like ocfs (http://oss.oracle.com/projects/ocfs2/), lustre (http://wiki.lustre.org/index.php?title=Main_Page) and others, but they were too tied to cluster logic. We found some interesting network file systems like CODA (http://www.coda.cs.cmu.edu/) but it lacks multi platform support and its development is incredibly slow. At the end we found OpenAFS (http://www.openafs.org). OpenAFS is an amazing technology: 1. Stable: it's been around since 1989 2. Multi platform: many Unix flavors, Microsoft Windows, Apple Macintosh... 3. Secure: kerberos-based Authentication, encryption, strong ACL 4. Enterprise Level: Used by many Fortune 500 companies, Universities, Research Centers, government organizations 5. Scalable: You can start with a single computer to reach hundred machines in a single cell 6. Perfect use of the bandwidth 7. It's open source! It's open and it's free. We start building the first OpenAFS Server on December 2007 and we finished on the first days of January, 2008. The first tests were very promising, so we began to migrate our infrastructure to Open AFS. Now, one year later, we have: • Three different forensics labs, in three geographic locations • Two kerberos domain and two different AFS Cells, one for development, one for production • 40 Tbs storage capacity • 10 different servers