2048-bit Infrastructure Impact Reporting Tool
A few weeks ago Lori nailed it with a post (The 2048-bit Keys to the Kingdom) on the coming forced migration to 2048-bit keys. A few days prior, I got a call from “THE” Matt Cauthorn, DevCentral resident stud contributor L4L7 about the very same issue. Not surprisingly, he was ahead of the game on this and has spent some time developing a tool that will take the mystery out of the licensing and infrastructure impact checklist items Lori mentioned. Well what does this tool do? Function Generates a high-level report in pdf format on what 2048-bit keys will do to your infrastructure Graphs the last seven days of TPS data by default (you can also run against 24 hour and 30 day data as well) Highlight any platforms in your infrastructure that might be improperly sized for 2048-bit keys under existing loads Details Fetches some graph data, the license file, the platform ID, the TMOS version, and general system information. These are all read-only calls. Assumptions Using 1024-bit keys today. This may not be true for you. If you’re using 2048-bit keys, the report will still generate useful information To estimate your maximum platform TPS, the tool simply takes the maximum 1024-bit TPS for your platforms and reports 20% of that value. Note that this is maximum platform TPS, not maximum licensed TPS. Requirements If you haven’t taken the time to configure your environment for pyControl, you’ll need to do so to use this tool. There are installation tutorials for Windows and Ubuntu. Here are the packages you’ll need: Python 2.5, 2.6, or 2.7 (avoid 2.6 if you can) Setuptools Suds (Grab the GA version, which is currently 0.4) pyControl Reportlab (I grabbed the latest daily windows installer) These details and the reporting tool itself are ready for you here in the iControl codeshare. Enjoy! Related Articles WILS: SSL TPS versus HTTP TPS over SSL SSL TPS license - DevCentral - F5 DevCentral > Community > Group ... SSL transaction (TPS) rate limit reached - DevCentral - F5 ... Data Center Feng Shui: SSL F5 Friday: The 2048-bit Keys to the Kingdom Experimenting with pyControl on LTM VE > DevCentral > F5 ... Getting Started with pyControl v2: Installing on Windows ... Getting Started with pyControl v2: Installing on Ubuntu Desktop ... Does pycontrol work in Linux? - DevCentral - F5 DevCentral ... pyControl v2.0 - DevCentral - F5 DevCentral > Forums - Social ...
DevCentral Top5 11/06/2009
While ramping up for "The Next Big Thing" continues amongst the DC staff, there is much to talk about in regards to content that's happening in the here and now, not just in the eagerly awaited future (with jet-packs and stuff…). DevCentral has seen its share of cool content this week, as it does every week, so let's talk about what needs talking about. Bringing you everything from TCL strings to a philosophical discussions of when vs. where and which is more important, I'm here with my Top5 picks for the week. And here they are: When Is More Important Than Where in Web Application Security http://devcentral.f5.com/s/weblogs/macvittie/archive/2009/11/06/when-is-more-important-than-where-in-web-application-security.aspx In this post Lori was as insightful and informative as ever, discussing why being timely is more important, in general, than being perfect when it comes to application security. It's a pretty simple concept to me. When it comes right down to it, no one really cares where you solve a security problem, they care about when you solve it. It's well and good that you want to argue that things should be solved at the app layer vs. the WAF, but if I can provide a solution in 10 minutes...how long is it going to take you to patch every single application for even a miniscule security flaw? I agree just as much with Lori's reminder that WAF and app security models shouldn't compete. They are complimentary in the war against attacks, not mutually exclusive, and should be treated as such. Every time someone tries to tell you which method is more "proper" or "correct", though, I'd ask them just how much they care about being proper in very real terms. How much is it worth in terms of hours (or days) of their application being exposed? At what point is it worth trading 20, 40, 120 hours of being exposed to a known exploit for an ounce of being "proper", which is already debatable at best, as opposed to getting the fix in place in a fraction of the time? Lori being insightful and informative isn't anything new. She knew she had a solid point to make and I tend to agree. What she didn't know was just how timely she was in setting the stage for her point to be illustrated, but we'll get to that in a moment. They call that foreshadowing, I think. I can tell you're on pins and needles. 20 Lines or Less #31 - Traffic shaping, header re-writing, and TLS renegotiation http://devcentral.f5.com/s/weblogs/cwalker/archive/2009/11/06/20-lines-or-less-31-ndash-traffic-shaping-header-re-writing.aspx Behold, your suspense is relieved! I unveil before your very eyes the payoff to Lori's unintentional setting of the stage. But how, you ask, does the 20LoL tie in with the When vs. Where of App Security? Via the much discussed TLS renegotiation vulnerability that has been burning up the net, of course. When a security measure as deeply rooted and common as TLS encryption is found to be susceptible to attacks, there is much to talk about, and talk they have. It turns out that via a man in the middle attack would-be ne'er-do-wells have the potential to insert information into a renegotiated SSL connection. This is very bad. What's very good, however, is that a user from the DevCentral community drafted a simple fix, at least in their deployment, the very next day. That's the power of iRules. Agility at its very finest, if I've ever seen it. We could debate all day where the best place, technically speaking, to implement the fix is. Or we could just fix it in about 10 minutes of coding and another 30 minutes of testing, and be done with it. That's just one of the rules in the 20LoL, of course. There are two more very cool examples of iRules doing the cool things they do in less than 21 lines of code. Check them out. iRules 101 - #16 - Parsing Strings with the TCL Scan Command http://devcentral.f5.com/s/Default.aspx?tabid=63&articleType=ArticleView&articleId=2346 Jason digs into the amazingly powerful yet often overlooked scan command in his latest contribution to the iRules 101 series. The scan command has some pretty staggeringly powerful capabilities to parse strings in an ultra efficient manner. It takes a little getting used to but it's definitely a command that has potential beyond what's obvious at first glance. Jason does a good job of breaking down some of the options and giving clear examples of not only the command itself but how you might use it in the context of an iRule. Very cool stuff, and worth a read for any current or would be iRulers out there. Operations Manager Debugging Part I: Top 10 Tools for Developing and Debugging Management Packs http://devcentral.f5.com/s/weblogs/jhendrickson/archive/2009/11/04/operations-manager-debugging-part-i-top-10-tools-for-developing.aspx You've been hearing a lot about the Management Pack lately. That's not likely to change, especially if they keep putting out not only consistent, timely releases with new features, but awesome documentation and commentary along the way. Case in point, Joel Hendrickson put up a blog post this week about his Top 10 favorite tools for the kind of debugging he ends up doing often times as a member of that team. Whether or not you're directly involved with the Management Pack, this is a very cool list. It's interesting to see him walk through each tool, what it does and in some cases how he uses them. I'm always a sucker for hearing a geek talk about … well … being a geek, and that's just what Joel's up to in this informative post. Take a look for all your code debugging needs. pyControl Just as Happy on Linux http://devcentral.f5.com/s/weblogs/jason/archive/2009/11/04/pycontrol-just-as-happy-on-linux.aspx In response to the many questions asking about pyControl and whether or not it's viable as a Linux solution to iControl programming, Jason put together this tidy little post that not only answers the question (yes, by the way), but shows you just how to get started. This was a cool reminder to me not only of how awesome the pyControl project is, but of just how easy it can be to get started digging into iControl and all the cool things that it can do. With just a few commands, outlined in Jason's post, you can have an environment up and running, ready to start developing. I'm even more excited to see what's coming in pyControl2, whenever I get a chance to play with that. But that's a post for another day. There you have it, five picks for this week that you just really should not miss. As always, don't be shy with your feedback, and check out previous versions here: http://devcentral.f5.com/s/Default.aspx?tabid=101 #ColinpyControl Just as Happy on Linux
There have been several questions over the past month in the iControl forum as to whether or not pyControl works on linux. In the pyControl labs information, there are instructions for install on Microsoft Windows based systems, but not for linux, so maybe this is the source of confusion. This is not so much that pyControl isn't linux compatible as it is that the installation instructions on the many flavors of linux vary. In reality, the only step that should be different between the distributions is the first step: installing python. Now, on my flavor of choice, Ubuntu, python 2.6 is the default version, which doesn't work so well with the ZSI soap library utilized by pyControl. So I installed python 2.5 alongside 2.6. This works fine as long as you keep in mind that running python from the command line will actually run the python2.6 binary. So when you install the python packages necessary for pyControl to work, just remember to either update the symlink (/usr/bin/python on my Ubuntu 9.10 system) or call the python2.5 binary. Here's the steps I took to get pyControl prepared on my system. Install python2.5 - sudo apt-get install python2.5 Download the necessary packages (I threw them in /var/tmp/) Easy Setup - http://peak.telecommunity.com/dist/ez_setup.py ZSI - http://sourceforge.net/projects/pywebsvcs/files/ZSI/ZSI-2.1_a1/ZSI-2.1_a1-py2.5.egg/download pyControl - http://devcentral.f5.com/s/LinkClick.aspx?link=http%3a%2f%2fdevcentral.f5.com%2flabs%2fpyControl%2fpyControl-1.3.0_beta-py2.5.egg&tabid=73∣=433 Install the packages sudo python2.5 /var/tmp/ez_setup.py sudo easy_install-2.5 /var/tmp/ZSI-2.1_a1-py2.5.egg sudo easy_install-2.5 /var/tmp/pyControl-1.3.0_beta-py2.5.egg Now that the environment is prepared, we can test it out to make sure all is well in the pyControl world. vadmin@vadmin:~$ sudo python2.5 Python 2.5.4 (r254:67916, Apr 4 2009, 17:55:16) [GCC 4.3.3] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import pycontrol.pyControl as pc >>> b = pc.BIGIP( ... hostname = '10.10.10.10', ... username = 'admin', ... password = 'admin', ... wsdl_files = ['GlobalLB.WideIP'] ... ) Loading WSDL: GlobalLB.WideIP.wsdl >>> w = b.GlobalLB_WideIP >>> w.get_list()['return'] ['test.wip.com'] >>> The install document on the pyControl page has been updated to reflect the Ubuntu linux distribution. Happy coding!
