OCF BoD Minutes 9.16.2010 Meeting commences: In attendence: sanjayk* sherryg* waf* simplyhd* hanwei* later: ahir* simplyhd: So, pretty much no one's here for projects but we're doing them. Sherry will send emails. Sanjay: All new staff said they can write to staff_hours. I need to change projects, as things come up there's more relevant things they can do. simplyhd: Social events: We will do them! Events? When? Felix: Fridays, weekends simplyhd: used to go to Sanjay's place, Sanjay: If we do weekends, we could join with CSUA simplyhd: Food? Ideas? Thai? Walnut prawns? Great China? It's the OCF's restuarant Sherry and I (simplyhd) will email out new policies like sanjay's biweeklies kind of what sherry and I expect from staff for users Sanjay: Me and mike just kept quiet when people did things objectionable simplyhd: Yes, we'll do that, applies to all staff. Keys need an extraordinary reason. Technical reasons go to Sanjay or Felix, then go to simplyhd and Sherry. Han: What's extraordinary? simplyhd: Convince us. Can't just give anyone keys. If you have an extraordinary reason, just come to us and we'll talk about it. Sanjay: Apocalypse needs to be phased out. 1. Switch to conquest and tsunami (the main difference: tsunami can write to /opt/ocf which sends email to wheel, conquest can't) it'll take a while to completely reimplement stuff give users a week warning to move stuff move ocf.berkeley.edu to round-robin firm deadline On the public wiki take off solaris login servers, say we're using 2 debian x86 servers (conquest and tsunami) Apoc. phaseout plan 2. Print quotas: CUPS has native logging features we should enable both that and PyKota and reconcile differences every night, whichever's more favorable to the user is used. PKpage counter, get two numbers and give better for user the way to really fix the problem is to fix PyKota which we have done 3. Firewalls: SSH works but web access broke for future reference: Never use stateful firewalls Karl: need firewall algorithm Sanjay: what it's doing right now is looking at patterns of packets it worked for one day and it stopped working IF filter terminal Karl: what exactly is the problem? Sanjay: it was dropping certain packets dunno why Karl: that were legitamate packets? Sanjay: I tried whitelisting Karl: didn't work? Sanjay: didn't Solaris uses a very similar firewall to OpenBSD so I might just pull one from backup we basically only have to protect against two things: TCP flood and ICMP flood 4. Karl: I thought about getting some UX improvements like redoing website to use something like Wordpress which will keep updated and maybe like what kind of server is down Sanjay: death (VM on famine) allocated 4 out of 8 cores 4G memory (only cause we couldn't get 64bit to work with 16G) Karl: I think we could install mod_mono for apache and people could use ASP.NET and people could code ASP or ASP.NETthat runs and you set up to run on windows server you can run it on Apache with mod_mono. Sanjay: Good idea, I'm assuming a nontrivial number of people use ASP Karl: it's one of the standard ones, probably less than PHP, Sanjay: can't have su exec Karl: can't run as apache process? Sanjay: no, must run as user compartmentalize, on a multi-user that's an exploit Karl: There's probably some way to hack it to use CGI and run it as user Sanjay: I'm sure there is worst case we could change mod_mono Karl: well <7:40> Sanjay: there should be some sort of set_uid Karl: the implementation of .NET standard Sanjay: we can modify mod_mono Karl: do we support Java on death? Sanjay: funny story: FreeBSD 8 doesn't support Sun Java binary so had to install OpenJDK but I gave up too timeconsuming Karl: but we supported JSP before Sanjay: we had but it wasn't on prev. death but not in i86 /opt/ocf Karl: but didn't we support JSP at some point? probably means we managed to get it to work Sanjay: I would hope Java can be installed on Solaris! <7:43> 4. Sanjay: 2 ver of Windows Server need ttech sup Microsoft need 2nd domain controller 1: we need another one we have better hardware 2: we can run another one taking up extra famine resources 2 security softwares were' considering: BroIdeas discussed with karl Karl: I think you went so fast no one had enough time to understand what you were talking about Sanjay: yeah so BroIDS highlights bad packets it runs on the firewall, great because if there's SSH traffic we can tell our rack servers: the furthermost rack 2 impt servers: biohazard monsoon tempest speed not impt we can clone and log packets there shouldn't any we should ask ppl why they SSH from server to server and RDP (biohazard windows) Nessus is what IST uses port scanner checks for loose RPC conns checks for loos NFS shares basically need to scan epidemic for that TripWire set up on tsunami anything that can write to impt shares like /opt/ocf should be checked should be TripWired (exactly what it sounds like) final 2 topics: backups: we have a backup server pollution but need to set up new machines I will do that eventually purge tier1 passwords the next major update we will push back a little we have patch day used to quite an adventure but no solaris now the only two machines that will be touch is monsoon and tempest, maybe jaws a little (built from source, like OpenLDAP) make sure nothing we install breaks library dependencies IRC: Sanjay is "banned", so yeah Sherry: Lower Sproul Sanjay: Summer 2008 we official relocated to eshleman from heller lounge we left servers because they couldn't cleaned out: toxic sludge, asbestos, power requirements finally summer to compound everything we were doing LDAP Krb migration we were basically down for Fall 2008, Spring 2008, staff: sle+mike+calvin they were the only ppl confident to move only moved famine and pox and the disk array so did a partial move it wasn't designed for servers electrically, cooling then we got hacked Karl: didn't we get hacked before moving? Sanjay: we found out about it after the move someone got into KDCs thanks to gfs long story short: move not well planned, location didn't work the only ppl left in summer were Sanjay and Gwc (and robert) line by line, the electrician said we can't install this stuff it takes up too much power went 50-75% over budget cost 20K electrician felt sorry worked 1-1.5 weeks without pay David Fullmer was laid off he was the IT guy for Eshleman though he'd be there forever didn't document anything Karl: seemed to have the attitude like I'm just going to not document anything because then they can't fire me Sanjay: yeah we had to wander around Eshleman to find our network uplink they unplugged something we were unlinked for 3 months we need: Cooling, Power, Network need Fiber optic 50Amp breakers we could take down the building power no concrete walls, need hollow to run Cat5 make sure Cooling, Power, Network requirements are met there might be parts of the building this isn't feasible there's need to be a location wherever the OCF goes that can handle servers High power loads High network loads it needs to be close enough to that stuff I had to wander up to the 4th floor to find the 2nd junction any one of that stuff could take down the OCF [Ahir joins] for the OCF to exist there needs to be building provisions they can't design a building and let us pick a room it cost them a lot of money to do it This is the first time we've been creating 100 accts a week Motion to add Karl to BoD: Unanimous Meeting Adjourned