Labcomm Acceptable Use Policy and Guidelines for a Machine(s) Connected to the URCS Network Inside the Firewall and Maintained by a Non-Staff Individual or Research Group.
URCS is under constant attack from outside hackers -- thousands of break-in attempts EACH DAY. Our security policy is organized, in general, around the principle of trusting each other within the department, but distrusting the outside world. We have a fairly strong firewall, but inside it root access on one machine is enough to compromise all other machines.
Lab staff works very hard to keep the firewall secure and to avoid security vulnerabilities on all staff-maintained machines. Among other things, staff members install security patches very aggressively; scan activity logs for suspicious behavior; run cracking programs to search for weak passwords; and perform extensive postmortem forensics on every successful attack.
The weakest link in department security is user-maintained machines. Since these are obviously essential to much of what we do, it's important to have some guidelines for them. If you attach a personal machine (e.g., laptop) to the URCS research network (wired or wireless), or if you assume responsibility for a research or teaching machine, you should
- Use strong passwords! Weak passwords on user-maintained machines have been the cause of the last several department break-ins. We test passwords on staff-maintained machines, but it isn't practical to do so for user-maintained machines. A good password is at least 8 characters long, has no obvious relationship to a real word in any real language (backwards, mixed case, etc.), and contains a mixture of upper and lower-case letters, digits, and punctuation marks. If you have trouble inventing and remembering such a password, think of a mnemonic phrase (e.g. "30 days hath September, April, June, and November" = 30hSAJ+N -- but don't use that one!). If you want to write your password down as a reminder to yourself, write a hint instead (e.g., "calendar jingle").
- Keep up to date on security patches from your OS vendor. This is easy for Windows and Mac OS. It's harder for Linux, but still do-able.
- Run up-to-date anti-virus software. This is mandatory for Windows users, where the greatest vulnerabilities lie, and recommended for Mac OS and Linux. The university has a site license for commercial anti-virus software for Windows and Macs, which you can use free of charge: visit www.rochester.edu/it/security/computer/antivirus.html
- Do not use NFS to mount remote file systems. NFS implements access checking on the client machine. If an attacker gains root access on a URCS client, the entire department directory tree is at risk. Use SMB (Windows file sharing) instead. It's slower, but it implements access checking on the server. The SMB server is samba.cs.rochester.edu.
- Do not use ".rhost" files. If you don't know what these are, don't worry; you won't create one by accident. If you do know, forget!
- Do not provide any service to the outside world. Our server machines provide a limited number of services (IMAP, HTTP, FTP, etc.) to clients outside the firewall. Access to non-server machines is currently limited to SSH. We expect, shortly, to tighten access so that SSH is permitted to server machines only, at which point the standard way to connect to a personal machine from outside the firewall will be to connect to a cycle server and then use rlogin internally. This change will allow us to dramatically reduce the number of externally visible IP addresses, cutting down on the (rather substantial) network load of hacker port scans. It will also allow us to more aggressively log external ssh connections, to catch intrusions faster and to diagnose them more accurately. We will be purchasing additional cycle servers before implementing this change.
- In general, "don't do anything stupid". If you have any qualms about the wisdom of something, talk to lab staff or a member of labcomm first. If security rules seem to be getting in the way of what you need to do, we'll help you find a safe alternative. The purpose of the rules is not to make your life difficult, but to save you from constantly worrying about the (very real) threat posed by outside hackers.