Operational Meeting

These were accepted as a reasonable account of the last meeting.

Actions discussed:

• Coordinate our thoughts on the "open area" furniture

  This prompted a wide-ranging discussion.

• List "http:" sites

  We need a list to prioritise. The support form seems like a likely candidate for early treatment. Note that Chrome 62 (due 17th October) will mark input boxes of any such sites as insecure.

• All SL7.2 servers to be upgraded to SL7.3

  Packages have now been pushed, but there are still some reboots required to bring in the latest kernel.

Actions completed:

• Adjust quotas for package volumes

Report from Computing Executive Group

• Verbal CCPAG report
  • Windows 10 has been pushed back again
  • Thanks (particularly to Toby) for our functional-accounts input
  • Select Mac — the bundled licence for the management software, which would add a cost even where not used, has been deferred for now
  • APIs — ISAPPS are keen and are still looking for ideas (RAT Unit?)
  • Grouper is going to get some more development, and there's now a 2-year roadmap
  • GDPR!
  • The ITC paper on web governance should now be visible
  • From the security group:
    • There's some interest in Cyber Essentials PLUS. It shouldn't be too hard for us to achieve this.
    • There's reported to be a big increase in compromised accounts on the central KDCs (EASE or AD?). The meeting wondered whether the wireless authentication changes might be related.
    • There's no central replacement for ESISS yet. We could decide to pay for some body to probe us. Alistair Fenemore's group might be the best way for us to pursue this.
    • New security training is being evaluated. It's apparently HTML5-based this time!
  • Non-research OpenStack is "imminent"
  • The recent DNS problem was due to an error fixing things up after an overnight script run failed
  • There seems to be a desire to tighten up the College Server Room governance some more
  • Register of services

Reports from Units

• Infrastructure

  1. AT server room "black start"
  2. AT move
  3. snort

     It should be possible to make snort start later by adjusting the systemd resources (cue the usual systemd rants). Alastair asked that documentation deficiencies be notified to him.

  4. SL7 upgrades

     There are actually three "autofs" LDAP servers. They're needed as our home-grown replication mechanism can't cope with nondeterministic ordering of the records, so remaining SL6 machines which use it are at risk.

  5. Switch firmware
  6. OpenVPN

     Username blacklisting will be done by adding to a resource in the live/openvpn.h header. The pam-stack change will take place with next week's <stable> release.

• Managed Platform

  • KVM server upgrades
  • Package volumes
  • pkgsubmit

• Research and Teaching

  1. Teaching Software 2017/18

     The list is here. Unfortunately dice/options/lateteaching_rant.h doesn't seem to be accessible. Iain summarised its contents...

  2. SL7 server report

• Services

  1. AT Cloud printers
  2. Suplies for Forum MFDs
  3. SL7 Progress

• User Support

  • SL7 server upgrades

Topics for discussion

(None)

AOCB

Roger asked about the proposed Forum hot-desk. Alastair has it on his list to discuss with Martin.

Distance learners seem to have crept up on us unannounced. Documentation, and indeed remote-access facilities, may need to be overhauled.

The next meeting will be on Wednesday 11th October at 10:00, probably in IF-4.31, chaired by ??.