1. The travelling physicist problem at the KFKI campus József Kadlecsik KFKI Research Institute for Particle and Nuclear Physics kadlec@sunserv.kfki.hu

2. Background Five independent research institutes sharing a common backbone network: KFKI Atomic Energy Research Institute KFKI Research Institute for Particle and Nuclear Physics Research Institute for Technical Physics and Materials Science Research Institute for Solid State Physics and Optics Institute of Isotopes and Surface Chemistry

3. Access control Redundant stateful packet filter at the border Only gateway machines available from outside on given service port(s) Outgoing client access is not limited (usually) Proxies, reflectors: VRVS reflector running H.323. Gatekeeper & proxy, planned VNC reflector, planned

4. Central services DNS service (delegated domains) Time service SMTP gateways, POP/IMAP, mailing lists Campus web server, webmail CA, planned Hosting: Grid cluster (50 CPU, 2TB)

5. Central SMTP service Three redundant mail gateways Postfix MTA + amavis + McAfee virus scanner Body checking for “dangerous” content Spam filtering Outgoing E-mail is not forced trough the mail gateways

6. No central... User management File service POP/IMAP service – but centralized IMAP support via webmail

7. One-way travelling Lack of big experimental equipment – physicists hosted occasionally Institute members travel regularly: CERN, US labs, fusion labs (Garching, JET), etc. Exception: cluster for Grid Planned Tier-2 center Planned access control via packet filtering and/or using PKI

8. Guests Temporary accounts opened From the accounts they have as much right as the local users Use local resources lightly, mostly to get access to their home institute

9. Access from outside The gateways are available only over: Telnet – will be closed down in April Ssh POP/IMAP – will be closed down in April POP/IMAP over SSL/TLS Floating licence servers from selected places SMTP AUTH access over SSL/TLS planned for travelling physicists, ADSL and cable modem users Password authentication

10. Specialized tools Webmail: main internal IMAP servers are available from outside over HTTPS No VPN support yet

11. Internal informations Informations are usually available freely to anyone: Addresses Phone book E-mail addresses Organizational informations Internal mailing lists and archives are protected

12. Supporting travellers Travelkit, available from the web: Putty binary Complete installation, configuration and erasing instructions in Hungarian Carrying hardware-autodetecting CD-based Linux system (Knoppix) suggested, CD image available from the web ADSL/cablemodem users are regarded as anyone outside (SMTP AUTH is a missing bit)