EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Status of ARGUS support Peter Solagna – EGI.eu

EGI-InSPIRE RI The issue SWITCH, the main developer of ARGUS, is planning to stop supporting the code and the support unit in GGUS. Currently on best effort Critical component we need prompt support for critical problems Both EGI and WLCG asked their partners for expressions of interest to collaborate to the maintenance of ARGUS 6/21/2016 2

EGI-InSPIRE RI What is supported currently? As reported to this CERN twiki:twiki –PEP client and server: no future support –PAP: INFN –PDP: no future support –ARGUS EES: NIKHEF –LCMAPS plugin: NIKHEF Received expressions of potential interest from other partners/NGIs

EGI-InSPIRE RI Why push for ARGUS? The component has been developed thinking about the needs of our infrastructure The central user suspension campaign has started before the issues about support Already widely used by WLCG  available in many site

EGI-InSPIRE RI Alternatives? There are no real alternatives at the moment OSG is using/developing a similar component –To evaluate scalability and hierarchical configuration The best option would be to find an institution to support the orphan Argus components. If interested, please contact

EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Central user suspension Status and roadmap Sven Gabriel Peter Solagna

EGI-InSPIRE RI Current status Almost all NGIs have deployed the national ARGUS instance –Thank you! This completes the first step of the campaign

EGI-InSPIRE RI Second step: monitoring NGI Monitoring of the national ARGUS instances by EGI CSIRT –Active monitoring of the effective propagation of the suspended user DNs (using test DNs) –Quick feedback to NGIs in case of misconfiguration or other issues that prevent the proper propagation of suspension information The monitoring framework will be ready by the end of October 2014

EGI-InSPIRE RI Monitoring What: NGI-Argus services get updated banning information Needed: –Nagios probe (Done, Vincent Brillaut, CERN) –List of NGI-Argus Servers (hostnames + DNs) This information needs to be available by a goc-db query, consumers are: central argus at CERN to create a white-list of hosts allowed to fetch the ban list nagios system needs a list of services to send the probe to (only NGI ARGUS servers) Site Argus serices are *not* part of this Monitoring, they might not allow access from outsite, they might be an alternate service in the case of non-argus sites

EGI-InSPIRE RI Third step: pilot testing From November first sites will be able to reliably download suspension information from their NGI arguses. Start a pilot testing with few sites (4-5) in order to find issues in the configuration or in the available documentation. –Better to have sites with different middleware Starting end of October Possibly ending for middle November

EGI-InSPIRE RI Third step: wide deployment Starting from end of November To be concluded by the end of the first quarter 2015? Once the pilot sites have finished their configuration the documentation should be enough clear and reliable: the effort for the sites should be reduced to a minimum

EGI-InSPIRE RI Next steps: testing sites Test if ban information is available at the sites services: CE/SE/WMS (action on EGI- CSIRT) Needed: test DN registered at OPS-VO (action Nikhef/ OPS-VO) Open issues: –Cloud services consume ARGUS ban information? –Pilot-Job technologies might need to be re- checked in the central banning context.

EGI-InSPIRE RI Proposed timeline October 2014: monitoring NGI ARGUSes November 2014: Pilot sites to implement central emergency user suspension mechanism December 2014: Start of a wider deployment campaing April 2014: most of EGI sites implemented the suspension mechanism Beyond: sites are monitored for this feature