1. By Les Cottrell for UltraLight meeting, Caltech October 2005
UL Group Accounts etc.
By Les Cottrell for UltraLight meeting, Caltech October 2005

2. Concern If UL host compromised
With a 10Gbits/s access it is potentially a great Denial of Service engine
Bad press
General embarrassment, funding agencies upset
Knee-jerk reaction from upper management to impose severe restrictions

3. Concern Group accounts such as uldemo: Ssh can help but:
Eliminates accountability of WHO did something
Hard to manage account:
Tracking who has access to account
Require renewal after reasonable interval
Disable compromised account (granularity of disable, number of people who have to be notified)
Don’t know who or how to contact someone in case of problem
Password changing (at mercy of least diligent person)
Ssh can help but:
If private key obtained,
Owner may not know
Owner does not know where the associated public key has been installed

4. SLAC requirement No group accounts available for logon
Each account is associated with an individual
Each individual must sign an Appropriate Use Policy (AUP) document:
www2.slac.stanford.edu/comp/slacwide/account/declare.html
For UL can FAX to attention of Yee-Ting Li
Will file for later reference
Will set up local account on UL host
With public key (no password)
Moves need for password management to home sites
No need to create and remember yet another password
Should be quick turn-around

5. UL Config at SNV Current Linux, run “up2date”
Default path via 10Mbits/s so mistakes are minimized
All services are “off” (i.e. daemons are not running), except ssh
Only individual accounts for registered people
Root access only by sudo and only for preferred people
Hosts are registered in UL DNS, do NOT have SLAC in name, are NOT in SLAC IP address space
Hard for journalist to associate host with SLAC

6. Other Issues
I suspect other sites such as BNL and FNAL may have similar issues
Should the 10Gbits/s links have connectivity to Internet at large, or be limited to UL sites?
Should UL node addresses be on web?
What happens when a user leaves UltraLight
Do we require accounts to be renewed?
Should we set up a Virtual Organization for UltraLight with its own AUP and Security plan?
The other sites (e.g. Labs) can decide whether to accept the UL AUP
if so may simplify setting up accounts
But a lot of work to set up and get agreement, maybe use an existing AUP