LHC Section Meeting 1.eLogbook 2.LHC Controls Security Panel

eLogbook Where should it be? –Now: COMPLEX AB-BT AB-PO AT-VAC HISTORY LHC CRYO LHC HC LHC MPP LHC PM LHC QPS PS Complex SERVICES SHUTDOWN SL Complex TEST SPS LHC NArefs (CPS) (CO EXPL)

LHC Controls Security Panel The LHC Controls Security Panel has been mandated in the ABMB of Monday 14th January The panel will have to address all the technical and non-technical issues from CNIC* and RBAC concerning AB security for Controls The main scope/objectives of the panel are : –Produce a Security Policy Document and have it agreed by ABMB Define the scope of the RBAC deployment Define the default behavior of RBAC –Take responsibility for the RBAC data (ROLES and RULES) Ensure all critical parts of the machine are protected –Take responsibility for the CNIC actions (reduction of Trusted list, change of operational account passwords,...) –Give the 'green' light for LHC beam operation Proposed schedule –Security Policy Document endorsed by April'08 –Password changed NOW –Trusted list reduced after CPS/SPS startup –RBAC operational usage for first LHC operation * Computing and Network Infrastructure for ControlsComputing and Network Infrastructure for Controls

RBAC Policy (Ref. EDMS doc ) -Question 1: Policy for “Access from home or from offices or from local control rooms (outside CCC)” -Question 2: Domain of validity of the operational account (LHCOP only inside CCC?) –Doc. Answer: access rights are restricted when acting from home or a remote control room. Imagine that an EIC logs from home (or office or remote CC) into a terminal server (for the last two cases you don’t need to go through a terminal server), using his personal credentials (generic group logins like LHCOP, SPSOP, etc are only allowed within the CCC according to the document). From the terminal server he can log into a machine used in the CCC, then he will be given a role, likely LHC Operator. If he tries to modify a setting in the equipment, then the location will reveal that he is not in the CCC and hence the request will be rejected. He will be able to monitor, but not to modify settings. –If one doesn’t have a particular role, like LHC Operator, then one can still have the so called Remote User, but those are not authorize to change settings, and likely not even to monitor… but for this I’m not sure, not specified in the document. –A person that is not registered as Remote User and tries to log in, then it is assigned the role of Outsider, and he cannot even log in.

RBAC Policy (Ref. EDMS doc ) However, an expert may be called by the EIC on shift because of a problem in the machine, and needs to log in from home and change settings. In this case the EIC has to grant explicit permission for a given role (e.g. RF expert) during PHYSICS mode in order the expert to be able to have write permissions from a REMOTE location. During ACCESS mode this should not be necessary. - Question 3: identification of the person in front of the keyboard. And in the case of a generic account, how could we make some individual accounting. - In the CCC we use the generic group login to log in the CCC consoles, and from there we can launch any application without the need of further login. Except if one has to access a critical application, like the trim application that implies settings changes. In this case a login window will pop-up and then the person has to login with his personal user and password. Only if (s)he has the appropriate role, i.e. authorization to change settings, (s)he will be able to do so.

RBAC Policy (Ref. EDMS doc ) Question 4: What’s the policy for critical settings? –Only Critical Settings Experts are allowed to change critical settings using her/his personal user and password. When they do so they get the role of “XXX Critical Settings Expert”. Then the person opening the relevant application will see only the critical settings (s)he is authorized to change and “if and only if” the accelerator mode implies no beam in the machine. If the accelerator mode implies beam in the machine, then the person won’t even see the critical settings. I have a further question here. Can we change critical settings during, for example, PROTON PHYSICS mode (accelerator mode) when we are at SETUP mode (beam mode), which means no beam in the machine?

Other questions to answer (not in the document) Do we allow individual PCs to access the equipment, as it is the case now? Or do we push to have a set of terminal severs which are trusted and only through them we can access the equipment from home or from the office? With which frequency do we want to change the password in the CCC consoles for LHCOperator user?