Background

Facing a new paradigm of introducing CyberSecurity DOE regulations into our infrastructure, several action items were presented at the 2006 run critique meeting. The presentation is attached below as STAR-Critique-06.pdf (see below). The urgent and immediate items, some of which requiring deep restructuring, were:

• We MUST establish an internal controlled perimeter to the unroutable network. This network will be accessible via a gatekeeper model. Vulnerable devices should be isolated to the internal network layer
• All network and communication layers must be documented
• Physical access to console were describe as part of the Shift procedure and shit alternance. Access to the online computing infrastructure MUST be controlled
• All systems MUST be re mediated and brought up to the proper level of OS version and safety 
  • shall exceptions be needed, the device should have the proper control and monitoring
  • isolation in the private network of node we cannot upgrade due to operational-need is the other solution
• OS flavor reduction – We propose to reduce the OS flavors to enhance and optimize support and maintenance
• Group account access should be regulated via keys (ssh keys) and tight to indivdiuals (no a floating password without a clear understanding of who has it)
• root access shall be restricted
  • A list of users having root access MUST exists at any point in time. In other words, only a few (documented) users should have root access privileges.
  • We must provide best effort to implement a configuration management strategy i.e. how changes occurs in our infrastructure shall follow a procedure and lead to an updated documentation.
• Maintenance of computing equipment will be the responsibility of the S&C, DAQ and Slow Control groups as appropriate under general guidance of the S&C group.

The run preparation will be established within the following guidelines

• General
  • Assess hardware replacement and cost (display, printer, UPS, switches, ...)
  • Assess sub-system needs for resources (disk space, bandwidth, database access, ...)
• Networking 
  • Understand and reshape the current online Network spaghetti to a two layer model, with a gatekeeper model
  • Isolate vulnerable devices on a private network
  • Provide easer a routing or gatekeeper model ; reduce dual or tri-NIC connections
  • Patch all vulnerable machine and bring all equipment to appropriate level
• Organizational needs – root access and password 
  • Establish a in-principle layer of responsibility and accountability
  • Determine root access and generic account access and usage
  • Provide infrastructure to manage keys as a function of nodes machine
  • Document procedure and equipment, establish principles for configuration management
  • Require for new equipment to comply with baseline control
    • New equipment shall not be brought randomly but integrated as part of the online infrastructure documentation
• Software
  • Deploy a new Web server
  • Revisit all online common tools and needs – RunLog, ShiftLog, Web interfaces ...
  • Introduce technology and paradigm change for HTML-refresh poor-man's job approach
    • technique has spread and creates heavy load
  • Review Pplots needs and coverage
  • Introduce Scaler monitoring tool
  • Revisit Ganglia monitoring with special care on broadcast/multi-cast
• Establish a first testbed of database consolidation for high-luminosity regime 
  • With help from Slow Control – IRMIS project

Understanding our online Network

The following table is a first cut to understanding the inter-connections between online hardware.

• ch2connect.xls shows the NFS mounts between machines
• Network-top level.pdf is a rough first cut of the network schematic

Patching and OS version-ing

• July 28^th 2006 
  • The matrix Old_Linux.pdf displays the list of nodes requiring attention
  • Two Windows machines (Alexei's Lebedev responsibility) require immediate attention.

Related meeting

• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node
• You do not have access to view this node