By Les Cottrell for UltraLight meeting, Caltech October 2005 UL Group Accounts etc. By Les Cottrell for UltraLight meeting, Caltech October 2005

Concern If UL host compromised With a 10Gbits/s access it is potentially a great Denial of Service engine Bad press General embarrassment, funding agencies upset Knee-jerk reaction from upper management to impose severe restrictions

Concern Group accounts such as uldemo: Ssh can help but: Eliminates accountability of WHO did something Hard to manage account: Tracking who has access to account Require renewal after reasonable interval Disable compromised account (granularity of disable, number of people who have to be notified) Don’t know who or how to contact someone in case of problem Password changing (at mercy of least diligent person) Ssh can help but: If private key obtained, Owner may not know Owner does not know where the associated public key has been installed

SLAC requirement No group accounts available for logon Each account is associated with an individual Each individual must sign an Appropriate Use Policy (AUP) document: www2.slac.stanford.edu/comp/slacwide/account/declare.html For UL can FAX to 1-650-926-3329 attention of Yee-Ting Li ytl@slac.stanford.edu Will file for later reference Will set up local account on UL host With public key (no password) Moves need for password management to home sites No need to create and remember yet another password Should be quick turn-around

UL Config at SNV Current Linux, run “up2date” Default path via 10Mbits/s so mistakes are minimized All services are “off” (i.e. daemons are not running), except ssh Only individual accounts for registered people Root access only by sudo and only for preferred people Hosts are registered in UL DNS, do NOT have SLAC in name, are NOT in SLAC IP address space Hard for journalist to associate host with SLAC

Other Issues I suspect other sites such as BNL and FNAL may have similar issues Should the 10Gbits/s links have connectivity to Internet at large, or be limited to UL sites? Should UL node addresses be on web? What happens when a user leaves UltraLight Do we require accounts to be renewed? Should we set up a Virtual Organization for UltraLight with its own AUP and Security plan? The other sites (e.g. Labs) can decide whether to accept the UL AUP if so may simplify setting up accounts But a lot of work to set up and get agreement, maybe use an existing AUP