1. Daniel Kouril, EGI CSIRT meeting, 9.9.2016
RT report
Daniel Kouril,
EGI CSIRT meeting,

2. Current status Upgrade finished RTIR more invasive then expected
DB retained (history, ticket numbers, etc.)
Several artifacts, nothing serious
Massticket adapted to use the new API
RTIR more invasive then expected
Dictates/expects workflows, handling tickets, etc. (bulk operations, naming of functions, …)
Creating tickets improved (to be enabled)
Adding of Site and NGI contacts from GOC DB
Should allow for controlling access as discussed earlier
Reporting – Sven?

3. Daniel Kouril, EGI CSIRT meeting, 9.9.2016
Security monitoring
Daniel Kouril,
EGI CSIRT meeting,

4. Components Nagios – secmon Pakiti Security Dashboard
Operated by GRNET (NGI_GR), security core task
Pakiti
Operated by CESNET (NGI_CZ), security core task
Security Dashboard
Operated by NGI_FRANCE, core task on operations portal
Coordination – CESNET

5. Secmon status Issues with current instance
Information from Pakiti not kept by Pakiti probe
Failures of the submission system
: -
: 64
: 129 (expired certificate)
: 165
: 169
: 146 (ARC CE issues, certificate again?)

6. Secmon status Service based on SAM, not supported anymore
Transition to ARGO difficult
WN framework not supported on SL6
Implications on dashboard not clear atm
No effort for development from GRNET
Until a solution a find we can stick with current instance (based on SL5!)

7. Certification of sites
Supporting infrastructure is gone
BDII, WMS, registration portal
We can’t send monitoring jobs to non-production sites anymore (we were the only ones)
Suggested to join security tests with normal certification ones and use the same procedure
NGI will make sure tests are performed
Sites is put into production, with immediate downtime declared (3 days)
If no issue appears, it’s in production
NGIs are complaining about the manual work, EGI to find a solution

8. Leftovers IanN: wants more compact view
Sophie: more query options/ views
Toby: feature request for pakiti.egi.eu -redirect to https!
Sven: change "Pakiti-Check" test name to the CVE
Dashboards send notifications now
Reports can be generated regularly

9. Secant – VM assessment Pilot ready, sandboxed environment prepared
Verified on CESNET cloud
Testing of EGI VA’s pending
VM catcher development
Manual tests of couple AppDB Vas
Majority closed, only external tests possible
To be investigated

10. <. xml version="1. 0" encoding="UTF-8"
<?xml version="1.0" encoding="UTF-8"?> <SECANT> <NMAP_TEST status="OK"><ports><extraports state="closed" count="999"> <extrareasons reason="resets" count="999"/> </extraports> <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ssh" method="table" conf="3"/></port> </ports> </NMAP_TEST> <NTP_AMPLIFICATION_TEST status="FAIL"/> <SSH_AUTH_TEST status="OK">SSH password authentication is not allowed</SSH_AUTH_TEST> <LYNIS_TEST status="OK"> <WARNINGS> <LYNIS>Version of Lynis is very old and should be updated </LYNIS> <AUTH-9228>pwck found one or more errors/warnings in the password file </AUTH-9228> <PKGS-7390>apt-get check returned a non successful exit code. </PKGS-7390> <NETW-2705>Couldn't find 2 responsive nameservers </NETW-2705> </WARNINGS> <SUGGESTIONS> <BOOT-5122>Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password) </BOOT-5122> …… </SUGGESTIONS> </LYNIS_TEST> <PAKITI_TEST status="OK">No vulnerable packages.</PAKITI_TEST> </SECANT>