WNAG: Advisory Report
Presented to: UCIST
by: Stephen Sempson
Description of Computers
• There are approximately 2780 clients on Nexus
• As of Nov. 4, 2004
–
–
–
–
–
2000 Server : 15
2003 Server: 41
2000 Pro: 752
XP Pro: 1895
Netapps: 8 (identified as Windows NT)
(Engelke E. Nov., 2004)
Login Data/Stats
• First time that data has been collected since the move to Nexus (Active
Directory)
• 7MB of data was extracted from over 1300 OUs in the AD
• Question arises, how fair is the sharing of labs?
• Engineering now running a Terminal Server (engterm)
• External account logins account for ~5% of total logins
• Data collection from the spring was problematic, due to people
implementing firewalling.
– This brought several issues to attention which could be resolved in the
coming months.
• Acquisition of stats is difficult
– The acquisition of statistical data is non-trivial, but not difficult.
Processing the huge numbers is slow. Algorithms modified accordingly.
(Engelke E. Jun., 2004)
Accounts
• CS pre-allocate disk-space for students enrolled in
CS courses
• Scratch creates passwords from a trusted source
• Creates homespace and email
• Account creation system (aka Scratch)
• Stephen Carr to write documentation
• Evaluation of the Scratch system to take place
after the Fall 04 term
Scratch (Account Creation Tool)
• Assumes that a unix account for the student does not exist
• Creates password (based on rules defined by faculty) then ssh's into the
host and runs the acct command
• Then sends password to the AD
• AD accounts are already created via adman, possibility of having unix
accounts batch created and just 'sitting' there
• Problems
– Creation of spam
– Users show up in the wrong group
– Any student who is listed as an employee as well (ie co-op students on
campus, athletics instructor, TAs, RA's and the list goes on) can not use
the scratch tool and their uwdir department data is flawed by HR
• Bruce Campbell expresses the hope of having the "New Users" link
working in all faculties
Organizing of Workstations
• Location of workstations is important,
should be standardized across faculties
• Postal Code field to be used for this purpose
• Format to be building code room#
– e.g. BMH 2222
• To be completed at the OU level
GPO Naming Conventions
• Currently
– Faculty - Group - Server Name - Application
Name
• To be changed to
– Faculty - Group - Application Name - Server
Name
• Erick Engelke has adman available to 'fix'
this
Nexus domain printer names
• Labelling of printers is confusing
• Needs to conform to conventions
• Recommend changing to
– Group-Building-Room number
– i.e. Sci-esc-254d
• Remove default of publishing to the AD
New Logon Page
• To be generated by PHP
• Created by OUs (blocking enabled)
• Fine-tuning to be done, eventually to work
off of a server
• The importance of a 'consistent' interface
across campus
Laptops in Nexus
• Enabling Nexus Laptops have been successful in
AHS and Science.
• Currently, one needs to have the user logon once
while the laptop is on the network.
• This is in order to create a “cached” copy of the
local profile.
• Laptop issues should considered when planning
NAA or replacement to in the future.
XP SP2
• This service pack incorporates some new security
• This will cause problems for Nexus clients
– XP SP2 fails with ngina.dll
– Network services at startup are killed
– No warnings given by MS, deemed it to be virus-like
activity
• Implementation SP2 has been held back
– SUS servers will not deploy SP2 yet, it has not been
approved.
• Still numerous W2K workstation out in the field
XP SP2
• August 2004, an emergency XP SP2 version
of ngina.dll was implemented on Nexus
• This program logs basic login/logoff events,
which is used to manage security
• This also enables collection of statistics
• As of Nov. 2004 a new ngina.dll has been
implemented and tested in Engineering.
• No problems to date
Security/Thefts
• Math - using electronic door locks, shut PCs off, locking labs at night
• ES – systems secured with fibre and some labs with door combination
locks. Password controlled teaching labs.
• Arts – bolts their computers to the tables and one public lab is locked
outside regular hours, though this one is booked for some classes.
• AHS - bolting PCs to table, security screws, fibre-optic security cable
• Notice of thefts to be sent via email list, just as a 'heads-up'
• Watcard discussed as possible entry system (cost $800 per swiper)
• Possible for a UPC swiper to read Watcard
• Erick Engelke to work on security system
ADS Domain Comparison
• UW began deploying the two campus
Active Directory domains “Nexus” and
“ADS” about 3.5 years ago.
• Nexus is used by 2726 workstations and
servers.
• The ADS domain is used by approximately
by 1257 workstations and servers.
ADS Domain Comparison
ADS Domain Comparison
• ADS allows approximately
– 9 individuals onto all server areas
– about 25 people onto all workstations
– about 129 people with administrative access to portions
of 1257 computers
• Nexus currently allows
– 26 individuals onto MOST servers areas
– 26 individuals onto MOST workstations
– about 90 people with administrative access to portions
of 2726 computers
ADS Domain Comparison
• a Nexus proposal would allow
–
–
–
–
4 individuals onto most server areas
4 individuals onto all workstations
26 people with access to student user data
about 90 people with administrative access to
portions 2726 computers
– local control, where a faculty or department has
total access to its own area, and very few
outsiders have any access.
Security Approach
• The approach we are taking is to create new
groups in a standardized way so that it's
easier for us to add the necessary
permissions.
• That was made a little bit difficult because
some areas have a different OU structure
than everyone else.
Guiding Principles
• Improvement of security
• No loss in functionality
• Image/Perception of constituent
Guiding Principles
• preserving local administrator’s ability to do the
job unencumbered. These would include ability
to:
–
–
–
–
–
–
add users
install and manage workstations, servers and printers
install software on unit’s workstations
add scripts as necessary
select, review and edit GPOs
select an appropriate SUS and NAV strategy for the
clients
Guiding Principles
• enhancing the effectiveness of local computing
unit
– offer greater assurances of security to the office user
community
– other initiatives not mentioned in this document, eg.
edit the login browser page
• reducing exposure to unnecessary privileges from
‘outsiders’ of the local department.
• providing the ability to select a peer group who
could cover during vacations
Guiding Principles
• enabling of emergency accounts possessing
extraordinary privileges
– to deal with crisis situations
– to provide backup in the rare event that no
departmentally selected peer member can be reached
– to better document changes by requiring WNAG
notification
• maintaining a system consistent with the
distributed management philosophies embodied in
Watstar/Polaris/Nexus of the last twenty years
Security Proposal
• Possible due to:
– Local Flexibility of NEXUS.
– Security on the local PC (on the edge security).
– Dynamic Collaboration/Cooperation of the
group.
• near-autonomous control over their own areas, as
well as the ability to work unencumbered in a large
shared environment.
Security Proposal
• 5 Major Points
– Training (suggested only)
– GPO Editing (GPMC Tool)
– Changing Passwords for moving students
• More specifically, solving problems for all students
– Symantec Administration (MMC on local pc)
– Faculty Representation
Faculty Representation
• How to distribute?
– Agreed upon that 4 !! to be created
– Distribution to be 2 for EC
• Specifically E. Engelke, and H. Tam
– and 2 for other faculties either on a rotational
basis between faculties or to be assigned
The assigned model was noted because of it's
stability and consistency.
Security Proposal
Nov. 11, 2004 WNAG unanimously voted
• adopt the proposed management system
• to effect the changes today
• to review this (or any other aspect of the
system) at any time we wish, and we agreed
that next autumn would be a good time to
review everything we have learned, etc.