1. Peter Chochula DCS Remote Access and Access Control Peter Chochula

2. General Remarks The Remote Access mechanism was explained in previous workshops and presented during the DCS review The remote access mechanism follows the CNIC architecture and is based on Windows Terminal Server (WTS) and PVSS remote UI Performance was studied and results were presented during the review –There are no known showstoppers Real DCS WTSs are operational

3. Peter Chochula Accessing the DCS from the ACR Original concept was based on common terminal service for all detectors

4. Peter Chochula Detector 1 ON WN ACR CR3 RDP PVSS ON WN PVSS ON WN PVSS WTS DCS Access via WTS + simple layout – single entry point + easy management - WTS becomes a critical component - Risk of WTS overload

5. Peter Chochula WTS in the described concept becomes a critical component In the DCS architecture we planned for 1 Operator Node per detector –The ON will be hosting the terminal service, each detector will therefore handle its own load –The detector ONs were already ordered and will be installed latest in April

6. Peter Chochula Detector 1 ON - WTS WN ACR CR3 RDP PVSS ON - WTS WN PVSS ON - WTS WN PVSS - multiple entry points + WTS load is distributed across the network + Server system on ONs provides enhanced flexibility in expert mode DCS Access pushing the terminal services to operator nodes

7. Peter Chochula Remote access to the DCS from the GPN The ACR is separated from the GPN Remote access from the GPN is provided via a separate WTS cluster –This cluster allows access from outside of CERN –Wireless connections from the pit to the DCS are routed via the same cluster (foreign laptops are always considered as risky devices and will not have direct access to the DCS)

8. Peter Chochula RemoteGPN Detector 1 ON - WTS WN ACR CR3 RDP PVSS ON - WTS WN PVSS WN PVSS RDP PVSS WTS cluster PVSS ON - WTS Remote access to the DCS network

9. Peter Chochula The WTS will be configured by the ACC Detector teams are expected to provide the panels for the remote UI manager –The detector panels must provide the access control implemented via FW tools

10. Peter Chochula PVSSII Access Control PVSSII access control provides complex tool sfor access control JCOP FW provides guidelines and tools for implementing an uniform access control mechanism JCOP PVSS access model is described in the advanced course FW access control component is available for download (part of the framework) To be done: –Integration with central authentication service