•>_-' /

*

Community Workshop '94 (Distributed Systems Sucessor to MTS WorkshopiTrip Report July 6,1994 Kari Gluski If this raises questions or any factoids need checking, all the participants can be reached at community® sfu.ca or you can ask me at [email protected]. General Information & Topic Summary Mike Alexander and Kari Gluski attended for U-M. This year the workshop was held at the University of Edinburgh. The attendance was very small (about 10-20 people at various times) but the sessions were very productive and the relatively low overhead of hosting that small a group makes continuance more likely; Alberta offered to host next year. Very few papers were produced and discussions were informal. Participants suggested defining the program and dates well in advance next year and publicising it early to recruit possible other participants. Topics at this year's Community Workshop focussed on the following major areas: 1) security concerns in a distributed environment; 2) e-mail, directory services, and group communication (mailing lists, conferencing, Usenet news); 3) High-speed Networking and other types of network access, including dial-in; and 4) the technical, political, and economic challenges facing former "computing center" organizations as they provide central services in a distributed environment. The observation was made that a few years back this group expected UNIX to rule by now and PCs and Macs are still rolling strong. There was also a guest speaker from Stirling University where as director he is in charge of both the Library and the Information Technology services, describing how well that has worked; it is a popular trend in the UK. Security, Privacy, Policy SFU Experiences and Advice The security discussion was a bit stilted because the sessions were being video broadcast on the Internet There also were no security 'experts' in attendance except Peter Van Epp. Peter explained that at SFU they wanted a low profile and refused to talk to reporters since publicity seemed to make places likely targets for hackers ~ claims to be secure especially invite hacker challenge. However, he said at SFU a small group of students causes far more problems than outsiders. They have caught enough people at SFU, especially forging mail, that other students are intimidated; Peter watches their systems closely (logs telnet connects etc) and revokes accounts of malfeasants. This takes a lot of his time though. They hoped going to ATM would make the network much more secure. Prosecution of Offenders Both Canada and the UK have seen recent prosecutions for computer crimes; in UK one perpetrator was found innocent because of obession, which disappointed those hoping a strong anti-hacking message would be sent by the case. Bad Password Choices

Bad passwords were being dealt with at most sites by running dictionary checks. There is now a password cracker for Novell. People sharing their accounts or passwords was another problem that people tried to reduce by figuring out why people shared passwords and removing those reasons when possible. For example, with multiple systems, students who could use 'talk' on one 1gave their passwords to users of the other system that lacked 'talk ; that could be helped by making the functionality or the access more widely available. Sharing files was another motive. Secure Authentication Not everyone is using Kerberos, and the multiple standards versions and implementations cause concern. Peter described software called s-key (?) that issues a list of 100 numbered passwords; a prompt and challenge gives you a number and you reply with the matching password encoded with your PIN to authenticate with low overhead on an open net yet foil sniffing. People also 'wrapped' apps to do logging of where connections come from or prompt for authentication. Sendmail wrappers let you refuse connectionsfromcertain sites or you can wrap telnet or any inetd service. Mixing 'Open' and 'Closed' Systems At SFU the Library wants to allow anyone who walks in to be able to use one of their machines for Internet access. Access to and from other campus resources is much more controlled, but once you have one 'open' system it is hard to keep the others limited without making use very inconvenient. Web Security Web clients were cited as a particular security concerns. There are concerns about the server side also, but most places handled that by using a separate machine for WWW and isolating it from other services by putting it on its own subnet The client vulnerability is worst for TJNTX clients, since it is easy to add commands to be executed on the client machine to the information being passed to the client; but macs and PCs might be vulnerable to, say, viruses. In one sense you know what sites you've been to and could track that easily, or could you, after several hours of zipping from place to place? People building WWW servers and clients didn't have security high in the design criteria. Web Policy Concerns Web information caused some policy concerns — would everyone in the university want/be given their own personal home page? Edinburgh had given everyone an 'official' personal home page with a template that included name, description, work address, etc, and a link off to their personalizable space where they could do whatever they wanted. The whole issue of organizing web info was acknowledged as a mess. There was great interest in Mark Smith's X.500/mosaic gateway and Kari gave participants instructions so they could try connecting to it from the Edinburgh UNIX lab. Gopher Security Gopher by mail was another security concern — some gopher servers allow material to be mailed for installation by an automated process. This was suppressed for security and policy reasons but users wanted the convenience of such a service.

Other Apps that Cause Concern IRC was universally loathed for the security problems it causes but proactively providing a tested service seemed more secure to most folks than doing nothing and encouraging users to bring up their own possibly insecure IRC serversand clients. SFU prohibits MUD currently as a resource waste but might provide access for $$$ (I'm not sure if Peter was joking here or not). Privacy There are privacy concerns similar to FOIA in Canada and the UK; they are being interpreted at SFU to mean that disciplinary meetings about misuse of info tech must be recorded in case of such a request and can't be handled 'informally.' SFU has no computer use policy (it always stalls at high levels) but other places have used U-M's with slight modification.

E-Mail and Conferencing

Directory Services Everybody uses some kind of hub so that mail can be sent to name@university. The comment was made that this keeps customers with you as long as performance is good. SFU uses X.500 ~ except not for mailing lists. That wasn't available when they had to move. Users have not raised any privacy issues, but most are unaware that X.500 gives worldwide access. They get data from the registrar and personnel via a SYBASE database with automated updates they developed and run 3x a week. Their mail products use PH and they adapted it and finger to use X.500. They also wrote something called addressof to do lookupsfromUNIX. Edinburgh is not allowed to provide any student information publicly, although they might be able to make it available if they could have it acessible only internal to the U. They have to cobble together a staff directory from multiple sources of conflicting information with no unique keys. They make that available in UNTX and to Pegasus (works for Windows version, not for DOS version). They don't use x.500. E-mail Products Used SFU uses POP, especially Eudora and nuPOP (sp?) which they enhanced for better dial-up use. Edinburgh uses Pegasus and UNIX mh, with some use of MS Mail to an X.400 backbone. Newcastle and Durham use PP Mailing Lists For now, membership of mailing lists at SFU is public. They want to allow private or anonymous ones. They feel people can have legitimate needs for anonymous postings so they allow it under special circumstances. SFU uses a locally-written UserDirectory emulation to handle groups, but the PostMaster (Frances Atkinson) runs the scripts to actually create the groups, add and remove members, and approves/disapproves the names. They work using UNTX aliases with include files. They also use MajorDomo for select lists that need its functionality (can restrict replies to a few individuals or to members of the group only, etc.).

No one knows of a good way to get rid of old, unused lists. Edinburgh using MMDF (?) Conferencing/Usenet/Bulletin Boards ^ SFU provided PARTI when the^moved oftMTS at Ed School request; it is very little-used, most group communication has moved to mailing lists. Edinburgh has very active use of local Usenet groups, especially for discussing football. Newcastle wrote MailBase which manages discussion lists and has a Gopher interface. It is listserver-like. They also have Ed School users interested in "first class" for their distance learning program - it is a product that runs on Macs and multiple Mac servers that update each other overnight..users telnet to it and its mail uses uucp. It seems doubtful it will scale to large group use but Frances Atkinson can provide more info if anyone is interested. There was interest expressed in Confer U (follow-up: Zoe has a demo version available and Kari will let the attendees know.) Networking High-Speed Networking BCnet has 4 big ATM hubs at the university - use is charged for. SFU needs to upgrade, is looking at ATM to upgrade their campus network but haven't bought anything yet They have a T3 connection to an experimental high speed net in their area. U of A is a partner is a consortium for high-speed netwoking for research use that will go to ATM in July. It is used by 2-3 research projects and some classrooms for distance learning. The phone company wants to learn to manage ATM, which is why they want to partner with the University. They have a FEDDI backbone on campus now. Edinburgh participates in JANET and SuperJANET, which does ATM, SMDS, and TCP/IP (JANET was only X.25 2mbps links). SuperJanet started in 1989 and is done with British telephone who operates the links. One proposed use is videoconferencing, distance learning, and the quality is terrible because of the poor connectivity the last 50 yards into the conference rooms. Audio also gives the most trouble — hard to pick up voices in a room without awful feedback. Takes tons of tuning. Network folks don't understand video equip, and video folks don't understand networks. General observation that distance learning requires the instructor to change style and do a lot of work to make it useful and few are willing. Also, collaborative projects between universities raise issues of teaching style and philosophy of methods that cause problems unrelated to the technology. Remote Access Very few switches in BC can do ISDN. Mike described U-M projects. U-M has 200 ISDN circuits they can sell for $30/mo to do D? or AppleTalk -- the service will use bridges that do ethernet over ISDN and cost <$100 ~ you can use the bridges as a remote office for a cluster of people very well. On Being a Central Organization in a Distributed World Information Strategy

British universities are doing something that they call Information Strategy but that sounds exactly like our Strategic Data Planning, except their Info Tech management seems more sceptical of it (in the "this is the lated fad handed down from on high - whether it works remains to be seen" vein) than ours. They also expressed concern about all this planning going on without anyone knowing what the user interface to all this information is. The elements are campus-wide information access, looking at data flow throughout the institution, executive information systems, and joint efforts by the Libraries, Adnin Computing (MIS) folks, and Academic Computing. TQM and Measurement Alberta expressed frustration with being told to come up with measurements for quality all their services. They are required to have a mission, vision, description of what they do, and measurements. The measurements seem odd — for example, number of Service Level Agreements with other departments had become one measure. Like us, they recognized the need for a tactical vision for the technology involved. They shut people in a room for a couple of weeks and then reviewed drafts, taking five weeks total to do a strategic plan, several years ago. They plan to revisit it in a couple of years. An example of a goal they used was "Become one of top 3 universities in Canada for Computing" - not met. Convergence with Libraries In a survey, 57/70 British universities responded that their computing service and library were jointly managed in some way, 30 under the same director. Benefits were seen to be: computing staff built up their project management skills; cross-discipline projects were easy to put together; they could use the same technical staff for equipment At Stirling, they offered "Information Skills" classes that covered computer skills, library skills, and presentation skills for students all in one series. Their help desk was very low-level experienced people who almost always just made referrals to experienced staff who worked for the "Info Tech/Library" centrally but were physically located in the departments, and did phone desk shifts to keep them in closer touch with thefront-lineconsultants. Comment from SFU: libraries need to move to c/s stuff and Info Tech org can help them do that Experiences with Costs and Charging for Services SFU said that having a core of experts available to departments was a big win at UBC. However, UBC started to charge for user support (of the general 4-help type I gather) and lost it Those services are the hardest to quantify for charging, even as overhead. UBC also were told to charge for eveiything — cpu time, vmi, disk space by actual usage, network packets... it was a disaster for them. Now they contract for computing use by blocks of time, and defined a few more things (like student mail) as infrastructure. University departments wanting student mail to be central was pretty universal. Central Info Tech folks should do the 'glue' that hols info tech on the campus together (whatever that may be) and one or two highly

visible services like e-mail that everyone wants and wants free, and be funded centrally to do that The Comp Centers felt it was hard to find and retain good staff, and that commercial salaries for sys admins were skyrocketing; they seemed to train people to have them leave. However, a central org that offered career paths could do much better at retaining skilled people than departments that never give that a thought Alberta felt software licensing for UNIX servers was much more expensive than the mainframe still. SFU leased all their equipment and made out like bandits. They got new equipment every 3 years with cash back to use for other purposes. SFU offers users anywhere on campus (500 of them) central Novell accounts on a huge server called a NetFrame and also uses that to do all their Novell backups centrally. It is much more expensive having enough staff to cover scattered locations; at U of A, departmental faculty and staff complain about needing sys admins, so they may do that centrally again. Having someone keep up to date on all aspects of any given OS is almost a full-time job, you get no other work out of them.... Backup services were highly in demand at SFU. They back up all campus Novell servers over the network, but are hitting constarints in the number they can do with their network bandwidth (they don't have fiber) in the limited # of hours in the night so they only do weeklies now, no daily incrementals. They have a tape robot and think backup costs are very low, but they don't get many restore requests. Edinburgh licensed ArcServer (sp?) with the intent of backing up UNIX and Novell servers but it had lots of problems at first and the Novell part still doesn't work. Mike A. described what U-M does (IFS, but not anything central for desktop machines unless units do their own with something like Retrospect Remote). No one had ever tried distributed tape drives with centrally controlled software. Modems: in the UK, the phone call is metered so that acts as an incentive to restrict modem use. Almost everyone else had or planned to go to 2-tier charging (a free pool with busies, a charged pool with guaranteed access). Users liked it (more detail in my notes) Possible problem was disenfranchising certain groups if say staff could not use the paid-for pool, etc. If a department puts in their own modem pool SFU charges $150/mo for their phone lines to discourage them. At UBC departments were willing to pay big $$$ to have stuff put in Gopher — no one wanted to do it even as simple as it is. Outsourcing of Computing Services altogether is a real threat in many places; other Univs. or other parts of their own have done it. Relations with other Organizations Edinburgh has tried to define "Systems Staff No one was actively auditing software legality on desktop machines — memos circulated from high up had a substantial impact they might look into audit software. Organizing Gopher and Web servers

People need 'pointing out' links and pages to get them to the Internet in an organized way as well as home pages, which are mostly for outside folks pointing in.

Misc. Issues

BITNET3 People wanted to know what was happening with BITNET 3 DCE Alberta is seriously looking at implementing DCE this Fall. They were warned not to, to just use AFS (more detail in my notes)