Henry Nebrensky – CM26 – 24 March 2010 Computing Panel Discussion: SSH Bastion Henry Nebrensky Brunel University 1

Henry Nebrensky – CM26 – 24 March 2010 Background: “PPD” nodes We had already agreed last year to purchase a number of systems, which will be physically located in a proper computing rack room in RAL PPD (Particle Physics Dept.) under the auspices of their Grid team. PPD will also help with systems administration. Note that PPD are providing these services gratis and on a best-effort basis. (The PPD Grid team is different to PPD IT support) It is hoped to separate the services in PPD into separate virtual machines, to improve security and resilience. 2

Henry Nebrensky – CM26 – 24 March 2010 External Connectivity MICO Slide SSH EPICS Gateway DB API DB Outside World Micenet / MLCR DB API eLog SSH Bastion Config Database “Web” services EPICS archiver web interface ssh SSH / web services EPICS Spare node Grid clients Grid Transfer Box 3 PPD-Grid managed SSH + analysis code heplnw17 ssh Who will fix this? MICE managed PPD-IT supervised

Henry Nebrensky – CM26 – 24 March 2010 SSH Bastion (1) An SSH Bastion allows user to:  Make onward connections using SSH It might, if asked:  allow transfer of files in and out with scp.  allow X11 forwarding It is NOT:  a way to access data – that’s the Grid  a place to run analysis  a software development system  a way to watch iPlayer from outside the UK... 4

Henry Nebrensky – CM26 – 24 March 2010 SSH Bastion (2) After 6 weeks of pressure from Adam Dobbs, the RAL “Central” Bastions now allow  SSH connections to micenet strange-numbered ports  X11 forwarding  File transfers (by setting up a tunnel) Site VPN and EPICS gateway also provide expert routes in. A MICE specific bastion is slowly being set up in PPD – management of users and their keys still being worked on. It will allow intermediate storage of limited amounts of data for two-step scp transfers. RAL firewall issues untouched. Given the former, DOESN’T THE LATTER LOOK LIKE A SERIOUS WASTE OF TIME? 5