EU privacy issue Ilija Vukotic 6 th October 2014

The issue Nikhef reported the way XRootD is collecting and sending monitoring information as a vulnerability. – User’s DN is sent as a clear text – It is sent outside of EU Reported on WLCG MB 16 th Sep Came to us on 17 th Sep.

The fix On 18 th we decided to: – Remove client’s DN from the monitoring stream – Ask EU sites to change the collector to the one at CERN Collector at CERN was already running and only one site was sending info there, even we asked UK cloud to send there.

Removing DN – native xrootd, proxy xrootd.monitor all flush 30s window 5s fstat 60 lfn ops xfr 5 dest user redir files info atlas-fax-eu- collector.cern.ch:9330atlas-fax-eu- collector.cern.ch:9330 if exec xrootd xrd.report atlas-fax-eu-collector.cern.ch:9331 every 60s all -buff -poll sync fi

Removing DN – direct dCache Install new monitoring plugin: dcache26-plugin-xrootd-monitor noarch.rpm Change configuration to: summary=atlas-fax-eu-collector.cern.ch:9331:60 detailed=atlas-fax-eu-collector.cern.ch:9330:60atlas-fax-eu-collector.cern.ch:9330:60 vo=ATLAS

Removing DN - DPM DPM_XROOTD_DISK_MISC=” xrootd.monitor all flush 30s fstat 60 lfn ops xfr 5 window 5s dest user fstat info redir atlas-fax-eu- collector.cern.ch:9330atlas-fax-eu- collector.cern.ch:9330 if exec xrootd xrd.report atlas-fax-eu-collector.cern.ch:9331 every 60s all -buff -poll sync fi"

The Twiki documentation now includes separate instructions for the EU sites. Linda Cornwall - EGI Software Vulnerability Group chair – will inform sites on the fix in a separate channel. Also “an advisory IS going to be sent this week, to alert sites and give them the opportunity to block sending data that does not comply with data protection. ”

Finally One site made the change: FZK