WNAG: Advisory Report

1. WNAG: Advisory Report Presented to: UCIST by: Stephen Sempson

2. Description of Computers • There are approximately 2780 clients on Nexus • As of Nov. 4, 2004 • 2000 Server : 15 • 2003 Server: 41 • 2000 Pro: 752 • XP Pro: 1895 • Netapps: 8 (identified as Windows NT) (Engelke E. Nov., 2004)

3. Login Data/Stats • First time that data has been collected since the move to Nexus (Active Directory) • 7MB of data was extracted from over 1300 OUs in the AD • Question arises, how fair is the sharing of labs? • Engineering now running a Terminal Server (engterm) • External account logins account for ~5% of total logins • Data collection from the spring was problematic, due to people implementing firewalling. • This brought several issues to attention which could be resolved in the coming months. • Acquisition of stats is difficult • The acquisition of statistical data is non-trivial, but not difficult. Processing the huge numbersisslow. Algorithms modified accordingly. (Engelke E. Jun., 2004)

4. Accounts • CS pre-allocate disk-space for students enrolled in CS courses • Scratch creates passwords from a trusted source • Creates homespace and email • Account creation system (aka Scratch) • Stephen Carr to write documentation • Evaluation of the Scratch system to take place after the Fall 04 term

5. Scratch (Account Creation Tool) • Assumes that a unix account for the student does not exist • Creates password (based on rules defined by faculty) then ssh's into the host and runs the acct command • Then sends password to the AD • AD accounts are already created via adman, possibility of having unix accounts batch created and just 'sitting' there • Problems • Creation of spam • Users show up in the wrong group • Any student who is listed as an employee as well (ie co-op students on campus, athletics instructor, TAs, RA's and the list goes on) can not use the scratch tool and their uwdir department data is flawed by HR • Bruce Campbell expresses the hope of having the "New Users" link working in all faculties

6. Organizing of Workstations • Location of workstations is important, should be standardized across faculties • Postal Code field to be used for this purpose • Format to be building code room# • e.g. BMH 2222 • To be completed at the OU level

7. GPO Naming Conventions • Currently • Faculty - Group - Server Name - Application Name • To be changed to • Faculty - Group - Application Name - Server Name • Erick Engelke has adman available to 'fix' this

8. Nexus domain printer names • Labelling of printers is confusing • Needs to conform to conventions • Recommend changing to • Group-Building-Room number • i.e. Sci-esc-254d • Remove default of publishing to the AD

9. New Logon Page • To be generated by PHP • Created by OUs (blocking enabled) • Fine-tuning to be done, eventually to work off of a server • The importance of a 'consistent' interface across campus

10. Laptops in Nexus • Enabling Nexus Laptops have been successful in AHS and Science. • Currently, one needs to have the user logon once while the laptop is on the network. • This is in order to create a “cached” copy of the local profile. • Laptop issues should considered when planning NAA or replacement to in the future.

11. XP SP2 • This service pack incorporates some new security • This will cause problems for Nexus clients • XP SP2 fails with ngina.dll • Network services at startup are killed • No warnings given by MS, deemed it to be virus-like activity • Implementation SP2 has been held back • SUS servers will not deploy SP2 yet, it has not been approved. • Still numerous W2K workstation out in the field

12. XP SP2 • August 2004, an emergency XP SP2 version of ngina.dll was implemented on Nexus • This program logs basic login/logoff events, which is used to manage security • This also enables collection of statistics • As of Nov. 2004 a new ngina.dll has been implemented and tested in Engineering. • No problems to date

13. Security/Thefts • Math - using electronic door locks, shut PCs off, locking labs at night • ES – systems secured with fibre and some labs with door combination locks. Password controlled teaching labs. • Arts – bolts their computers to the tables and one public lab is locked outside regular hours, though this one is booked for some classes. • AHS - bolting PCs to table, security screws, fibre-optic security cable • Notice of thefts to be sent via email list, just as a 'heads-up' • Watcard discussed as possible entry system (cost $800 per swiper) • Possible for a UPC swiper to read Watcard • Erick Engelke to work on security system

14. ADS Domain Comparison • UW began deploying the two campus Active Directory domains “Nexus” and “ADS” about 3.5 years ago. • Nexus is used by 2726 workstations and servers. • The ADS domain is used by approximately by 1257 workstations and servers.

15. ADS Domain Comparison

16. ADS Domain Comparison • ADS allows approximately • 9 individuals onto all server areas • about 25 people onto all workstations • about 129 people with administrative access to portions of 1257 computers • Nexus currently allows • 26 individuals onto MOST servers areas • 26 individuals onto MOST workstations • about 90 people with administrative access to portions of 2726 computers

17. ADS Domain Comparison • a Nexus proposal would allow • 4 individuals onto most server areas • 4 individuals onto all workstations • 26 people with access to student user data • about 90 people with administrative access to portions 2726 computers • local control, where a faculty or department has total access to its own area, and very few outsiders have any access.

18. Security Approach • The approach we are taking is to create new groups in a standardized way so that it's easier for us to add the necessary permissions. • That was made a little bit difficult because some areas have a different OU structure than everyone else.

19. Guiding Principles • Improvement of security • No loss in functionality • Image/Perception of constituent

20. Guiding Principles • preserving local administrator’s ability to do the job unencumbered. These would include ability to: • add users • install and manage workstations, servers and printers • install software on unit’s workstations • add scripts as necessary • select, review and edit GPOs • select an appropriate SUS and NAV strategy for the clients

21. Guiding Principles • enhancing the effectiveness of local computing unit • offer greater assurances of security to the office user community • other initiatives not mentioned in this document, eg. edit the login browser page • reducing exposure to unnecessary privileges from ‘outsiders’ of the local department. • providing the ability to select a peer group who could cover during vacations

22. Guiding Principles • enabling of emergency accounts possessing extraordinary privileges • to deal with crisis situations • to provide backup in the rare event that no departmentally selected peer member can be reached • to better document changes by requiring WNAG notification • maintaining a system consistent with the distributed management philosophies embodied in Watstar/Polaris/Nexus of the last twenty years

23. Security Proposal • Possible due to: • Local Flexibility of NEXUS. • Security on the local PC (on the edge security). • Dynamic Collaboration/Cooperation of the group. • near-autonomous control over their own areas, as well as the ability to work unencumbered in a large shared environment.

24. Security Proposal • 5 Major Points • Training (suggested only) • GPO Editing (GPMC Tool) • Changing Passwords for moving students • More specifically, solving problems for all students • Symantec Administration (MMC on local pc) • Faculty Representation

25. Faculty Representation • How to distribute? • Agreed upon that 4 !! to be created • Distribution to be 2 for EC • Specifically E. Engelke, and H. Tam • and 2 for other faculties either on a rotational basis between faculties or to be assigned The assigned model was noted because of it's stability and consistency.

26. Security Proposal Nov. 11, 2004 WNAG unanimously voted • adopt the proposed management system • to effect the changes today • to review this (or any other aspect of the system) at any time we wish, and we agreed that next autumn would be a good time to review everything we have learned, etc.