Posts

Claris has extended the FMUpgradeTool in the recent release, providing support for adding/replacing/deleting more object types, and also added the ability to generate completely new fmp12 files. Next to the new features, there have also been some undocumented breaking changes, though. I used the FMUpgradeTool in version 22.0.2 to inject accounts into fmp12 files as part of a deployment process. In short: a file is distributed to several servers, and while an update routine is running, the file should get site-specific accounts added, using passwords that are available only during runtime of the deployment process (and thus obviously not during distribution of the file). ...

TL;DR Alex Dubov and I just released the first public version of FMProxy, a security proxy for FileMaker Server. We are currently looking for beta testers. Want to try it out? Get your copy for Ubuntu Server x86_64 or arm_64. Make sure to read the trial docs (pdf). Introduction and Research background In the last few years, Alex Dubov and I have independently been researching the security of the FileMaker platform. We both reported bugs directly to Claris and via the Apple Bug Bounty program. ...

I recently rebuilt my monitoring environment for the servers I manage. In this post I describe what technologies I chose and how they fit together to form a monitoring stack that - once set up – gives you quick access to relevant metrics and logs and doesn’t burden you much with operations. A couple of requirements were important for me: Everything should be self-hosted and I wanted a central monitoring server which collects data from all monitored hosts Since most servers I manage are internal and not reachable from the outside, pushing metrics and logs is more practical than pulling (partially allowed outbound access is a given). Pushing also skips maintaining a list of servers on the monitoring host. Distributing collectors to the servers to be monitored should be easy Servers should authenticate to push logs and metrics and it should be easy for me to onboard new servers or revoke access. There should only be a limited amount of management overhead to manage credentials/PKI on my side Monitoring dashboards and exploratory tools for logs need only be accessible for me without much compartmentalization but should obviously also be properly protected When certain metrics go out of normal range or relevant errors pop up I should get alerts. The notifications should arrive as emails in my mailbox and as notifications on my phone (iOS). I operate at a relatively small scale, so keep this in mind :-) ...

I’m currently writing a cross-platform server application in Rust which should also be able to run as a service on Windows. While this sounds like a relatively straight-forward thing to do, it was a bit more involved than I originally thought (especially compared to running unix services). Below you’ll find my notes and a well-documented code sample for running a small echo server for demonstration purposes as a Windows service. I’m going to cover service initialization, responding to control commands (like STOP) and also handling shutdowns in a tokio runtime setting where the individual tasks need to be cancelled. The sample application can also be run in console mode and the Windows service parts are conditionally compiled – so you can run/compile it on Unix systems for console mode use as well. ...

A while ago I stumbled upon rust-script, a tool which lets you write single-file Rust programs and execute them as if they were standalone script files. This comes in very handy when you want to experiment with Rust code, write up executable examples or build small utility programs, but don’t always want to deal with explicitly setting up Cargo projects for every little script. Using rust-script Let’s have a look at how this works: ...