1. Gareth Smith RAL PPD HEP Sysman. April 2003 Security Changes at RAL

2. Gareth Smith RAL PPD HEP Sysman. April 2003 Firewall Arrangements Firewall blocks all incoming connection requests unless specifically allowed. –New tool available to view the blocks https://eagle.cis.rl.ac.uk/fwruleset/index.html https://eagle.cis.rl.ac.uk/fwruleset/index.html

3. Gareth Smith RAL PPD HEP Sysman. April 2003

4. Gareth Smith RAL PPD HEP Sysman. April 2003 Recent and Proposed Firewall Changes All incoming telnet blocked. (CERN have made a similar change). Will block incoming POP and IMAP to Exchange server. (Will allow secure versions).

5. Gareth Smith RAL PPD HEP Sysman. April 2003 Telnet/ftp issues Ssh has been around long enough that for most users the withdrawal of telnet was not an issue. ‘Bastion Host’ at RAL provides a route in. Useful graphical interface to scp for Windows users: iXplorer from http://i-tree.org/

6. Gareth Smith RAL PPD HEP Sysman. April 2003 iXplorer

7. Gareth Smith RAL PPD HEP Sysman. April 2003 Blocking IMAP and POP Force use of secure versions of IMAP and POP (I.e. over ssh tunnel). Many clients already support this: –Netscape, Eudora, Pine –For Pine set inbox-path to {exchange13.rl.ac.uk/ssl/user=abc25} Stunnel application allows any application to use a ssh tunnel. (See http://www.stunnel.org/) In future will also block MAPI interface from outside.

8. Gareth Smith RAL PPD HEP Sysman. April 2003 PPTP Point to Point Tunnelling Protocol is now an essential tool. –CERN opened up PPTP outbound to certain sites (including RAL) at about Christmas time. –This has enabled the tightening up of other protocols/systems.

9. Gareth Smith RAL PPD HEP Sysman. April 2003 Updates and Anti-Virus Move to Sophos anti-virus. (Includes home PCs of members of staff.) Application of regular updates “required” E.g. sendmail, some MS patches, some browser plugins (Quicktime, Shockwave).

10. Gareth Smith RAL PPD HEP Sysman. April 2003 Other Issues We filtering being tried. –Use of a blacklist of sites. Concern over ‘illegal software’ and the possibility of having to investigate this. Security audits –Documented procedures, appropriateness of backups, disaster recovery, application of updates, …..

11. Gareth Smith RAL PPD HEP Sysman. April 2003