1. Paper Submission, Revisited
- File and Web Servers, Scripts, Security Issues
Team Meeting
Jan Chrin, PSI
13-18 November 2005, INFN, Frascati

2. Outline 1. The LOC Perspective 2. The Author Perspective
3. Security Issues

3. The LOC Perspective SPMS File Server CGI Script Ready Steady Submit!
Oracle DBMS
Paper Metadata
File Server
Web Server
Paper Store
CGI Script
Paper Upload
To File Server

4. Conference SPMS Conference LOC responsible for Installing Configuring
Managing
conference SPMS instance
SPMS Download:
SPMS - JACoW SPMS User Account required (Author Profile)
- manage all contributions to the conference
- user interface for paper submission (over http)
- stores relevant metadata pertaining to the contribution
Papers themselves however are NOT stored within the SPMS

5. File Server The File Server / Web Server is
The Paper Submission Server
The File Server is where all files
(source, postscript, supporting files e.g. eps, gif, bmp and presentations)
submitted by the author (over http) for paper processing are stored
Access to the File Server (by Authors and Editors) is thru a Web Server
SPMS web interface is the only allowed route
for paper submission to file server.
No ftp! No memory stick! No CD!

6. File / Web Server Location @ EPAC’02 EPAC’02 (Paris):
LOC set-up and ran its own Web Server for paper submission.
This same Web Server also hosted the Conference web pages
Web Server acted as File Server for storage of contributed papers
Physically located at LAL, Orsay (for conference pre-processing)
and moved to conference site in Paris for conference processing
i.e. Web Server integrated into the Proceedings Office
Paper metadata routed to Oracle database (preceded SPMS) at CERN.
Advantage: Papers physically in close proximity to Editors
Disadvantage: Installation, management, security of Web Server
is in the domain of the LOC; Web Server is carted around leading
to a submission dead-time; Networking; New IP address to
DNS lookup table

7. File / Web Server Location @ EPAC’04
EPAC’04 Conference Website ( hosted at PSI
(Central PSI Web Server – Linux/Apache)
acted as Web / File Server for paper submission
Advantages:
Web Server in the experienced hands of IT group;
PSI Web Server already configured for easy integration of new projects;
Data regularly backed-up;
Apache Security issues dealt by experts.
EPAC’04: Paper metadata submitted to SPMS instance hosted at CERN

8. AFS File Server PSI Web Server
Central AFS file servers provided the storage for the EPAC04 “project”
Web pages: \afs\psi.ch\project\epac04\www\
Conference papers: \afs\psi.ch\project\epac04\papers\
An AFS EPAC’04 project-group created, members of which would get
read/write/modify privileges in the epac04 directory.
Ideal for distributed project members from PSI, ETH-Zurich and CERN.
Better security since access control is based on a kerberos server with
strong authentication (klog, tokens, access control lists etc…)
Only project members have access to the data.

9. What Web Servers Where? EPAC: Two Physical Web Servers SPMS Oracle AS
File
Server
Conference
Web Server
EPAC:
PAC:
File Server should be local to Web Server executing Scripts

10. Disk Space Requirements
Total document data sizes
listed do not include back-up data
EPAC’02
~900 contributed papers
required 6 GBytes
EPAC’04
~900 contributed papers (+supporting files, re-submissions, talks, etc.)
required 8.3 GBytes
i.e. <contributed paper> ~ 9 MByte (includes all uploaded files)
PAC’05
~1400 contributed papers
~8 GBytes
i.e. <contributed paper> ~ 6 MByte (includes all uploaded files)

11. Disk Space Usage EPAC’04 MByte 275 315 918 197 147 441 2293 463 184
DOC
TEX
EPS PS
PDF
OTHER
PPT
TOT
MON
275
315
918
197
147
441
2293
TUE
463
184
937
263
110 62
2019
WED
306
204
785 88
216
1796
THU
391
175
1031
283 73
174
2127
FRI 15 8 13 1 60 97
1450
878
3679
953
419
853
8332
%TOT
18%
11%
44%
12% 5%
10%

12. $FileServer/papers/WEXLH01/
File Upload Script
$FileServer/papers/WEXLH01/
Author:
Ivan Andrian
$FileServer/cgi-bin/upload.pl
Supporting
Files
e.g. Figures
Source
PostScript
PDF
Talks
WEXLH01.TEX
WEXLH01F1.EPS
WEXLH01.PS
WEXLH01.PDF
WEXLH01.PPT
WEXLH01.DOC

13. At The Conference Site
Paper submission deadline ~ 4 days before conference start.
But authors can continue to upload papers (revised or first submission)
during the week of the conference via the internet café.
Software to enable authors to edit their papers at the internet café
may be desirable but not required.
Editors are continually downloading papers from the File Server
for editing and uploading final PDF files for publications (and
any modified source/PS files)
It is the busiest of weeks for the Web/File Servers in terms of load!
Network infrastructure at conference site MUST comfortably
allow for the required bandwidth and be 100% reliable.
Expert networking personnel and support required!

14. Bandwidth at EPAC’04 download upload Pre-Conference: 0.5 Mbit/s
Conference Week: 1.0 Mbit/s
Pre-conference
Conference
Peak Usage: 4.0 Mbit/s
corresponds to presentation video uploads
upload of
presentation videos

15. The Author Perspective
JACoW SPMS User Account
JACoW Author Profile Repository
Central JACoW repository of individual profiles and affiliations
Authors MUST previously have created a JACoW SPMS User Account in order to “LOGIN” to the Conference SPMS instance (via a web interface) and submit their paper

16. Author Submission Cycle
SPMS
Login
Upload
Files
Start here (using JACoW template!)
Paper Submission Cyclotron
Prepare
Files
SPMS
Logout
Discover
Mistake!
Further uploads prohibited
once paper is processed by
Editor

17. File Upload Web Interface
Files uploaded
are displayed

18. File Download Papers categorized according to file type
Only the most recent
files are shown (for a
given filename)

19. File Download Most legitimate file extensions are recognized…
… and all are caught!
Bibliography database

20. Security Issues
Web Servers + CGI Scripts immediately raise questions concerning
protection from accidental access or misuse from legitimate users
(even with the best of intentions) or even malevolent intruders!
IT Web Server administrator: security conscience!
Any CGI script provided by a developer can make the server
vulnerable to attack!
Developer must ensure that scripts do not pose a security risk.
Verify visitor’s input is correct and never pass unchecked remote
user input to a shell command
e.g. in Perl: system(), exec(), eval(), piped open() functions

21. Security Issues The Treasure: the files on the File Server
Be sure to know who exactly has write access to the File Server
SPMS Login already prevents other users from accessing
or accidentally deleting other people’s files.
Author allowed to upload n times. Impose n(max)?
Can impose max file size in upload script

22. Paper Submission Framework
Present framework (SMPS + File Server + Upload/Download scripts)
in place since EPAC’04
All components of the framework (distributed system) need to be
functional for paper submission to be effective
Since used by all subsequent JACoW Conferences
www: Works Wonderfully Well!