Lab Security Policy - Revision history

Frodo: /* FAQ */ asdf

2026-02-19T18:45:35Z

FAQ: asdf

← Older revision		Revision as of 18:45, 19 February 2026
Line 36:		Line 36:
	== FAQ ==		== FAQ ==
	If I lose my laptop / think my account may have been hacked, what is the correct course of action?		If I lose my laptop / think my account may have been hacked, what is the correct course of action?
	* Send an email to ~~John (jir322@gmail.~~com~~), Ben (benjamin.wong@ucsf.edu \|\| benjamin.wong@blur.compbio.ucsf.edu), and Enkhjargal (a.enkhja@blur.compbio.ucsf.edu)~~ immediately. We will disable the user’s key and check the account.		* Send an email to your IT team jjiteam at googlegroups dot com immediately. We will disable the user’s key and check the account.

	Can I copy the private key to as many computers as I like, or should I have one for each computer I want to use to access the cluster?		Can I copy the private key to as many computers as I like, or should I have one for each computer I want to use to access the cluster?
Line 44:		Line 44:
	* You should use two different ones, one for inside the cluster and one out of the cluster.		* You should use two different ones, one for inside the cluster and one out of the cluster.

	Can I use key pair exchange ~~to allow me~~ to log in to my colleague's account, or is that a forbidden ~~usage~~?		Can I use key-pair exchange to log in to my colleague's account, or is that a forbidden use?
	Thus say I am Jane, and i want to allow Joe to log in as me without my password, can we use ssh keys to allow this?		Thus say I am Jane, and i want to allow Joe to log in as me without my password, can we use ssh keys to allow this?
	*No, we definitely don't allow this.		*No, we definitely don't allow this.

Frodo: dft

2024-05-25T00:14:44Z

dft

← Older revision		Revision as of 00:14, 25 May 2024
Line 54:		Line 54:
	[[Category:Internal]]		[[Category:Internal]]
	[[Category:Policy]]		[[Category:Policy]]
	~~[[Category:Sysadmin]]~~

Benrwong: /* FAQ */

2016-06-30T16:28:45Z

FAQ

← Older revision		Revision as of 16:28, 30 June 2016
Line 36:		Line 36:
	== FAQ ==		== FAQ ==
	If I lose my laptop / think my account may have been hacked, what is the correct course of action?		If I lose my laptop / think my account may have been hacked, what is the correct course of action?
	* Send an email to ~~tdemers~~@blur.compbio.ucsf.edu immediately. I will disable the user’s key and check the account.		* Send an email to John (jir322@gmail.com), Ben (benjamin.wong@ucsf.edu \|\| benjamin.wong@blur.compbio.ucsf.edu), and Enkhjargal (a.enkhja@blur.compbio.ucsf.edu) immediately. We will disable the user’s key and check the account.

	Can I copy the private key to as many computers as I like, or should I have one for each computer I want to use to access the cluster?		Can I copy the private key to as many computers as I like, or should I have one for each computer I want to use to access the cluster?

	* You should have a different ssh key for every computer that you want to use to access the cluster. This is because if one of your computers gets hacked, I only have to disable one key and you can still use your other laptop/computer.		* You should have a different ssh key for every computer that you want to use to access the cluster. This is because if one of your computers gets hacked, I only have to disable one key and you can still use your other laptop/computer.

Benrwong at 21:47, 28 June 2016

2016-06-28T21:47:33Z

← Older revision		Revision as of 21:47, 28 June 2016
Line 55:		Line 55:
	[[Category:Internal]]		[[Category:Internal]]
	[[Category:Policy]]		[[Category:Policy]]
	[[Category::Sysadmin]]		[[Category:Sysadmin]]

Benrwong at 21:47, 28 June 2016

2016-06-28T21:47:27Z

← Older revision		Revision as of 21:47, 28 June 2016
Line 55:		Line 55:
	[[Category:Internal]]		[[Category:Internal]]
	[[Category:Policy]]		[[Category:Policy]]
			[[Category::Sysadmin]]

Benrwong: Added FAQ section from the Lab Manual's Lab Security Policy

2016-06-28T18:21:32Z

Added FAQ section from the Lab Manual's Lab Security Policy

@@ Line 33: / Line 33: @@
 * some people call ssh keys "ssl keys". It is the same thing, and ssl is arguably more correct. Nevermind.
 If you have any doubts about appropriate use of ssh keys or passwords, or suggestions about how to improve security, please write the [[sysadmin]]s.
 == See Also ==

Frodo: /* Rules */ asdf

2015-06-03T03:53:44Z

Rules: asdf

← Older revision		Revision as of 03:53, 3 June 2015
Line 18:		Line 18:

	== Rules ==		== Rules ==
	* You can only access the portals using an ssh key.		* You don't need to use the portals if you are sitting at your desk on a secure network.
			* When away from your desk, you probably must use a portal to get in.
			* You can only access the portals using an ssh key that you set up in advance.
	* Insecure ssh keys will be revoked without notice. [[How_to_generate_ssh_keys_securely]].		* Insecure ssh keys will be revoked without notice. [[How_to_generate_ssh_keys_securely]].
			* If you think your machine might have been compromised, please let us know immediately!

	== Advice ==		== Advice ==

Frodo: /* Summary */ sadf

2015-06-03T03:51:28Z

Summary: sadf

← Older revision		Revision as of 03:51, 3 June 2015
Line 12:		Line 12:
	"A secure machine is one that we control and can thus protect." This includes:		"A secure machine is one that we control and can thus protect." This includes:
	* The portals		* The portals
	* Desktops we control in ~~CCBR,~~ BH and GH.		* Desktops we control in BH and GH.
	* Your laptop, using our own VPN.		* Your laptop, using our own VPN.
	* Machines in racks we control.		* Machines in racks we control.
	No other machine is assumed secure. This includes other groups' clusters in BH and GH, the QB3 shared cluster, and connections via UCSF's VPN. To access our cluster from these or any other machines we do not treat as secure, you must use a portal or our own VPN.		No other machine is assumed secure. This includes other groups' clusters in BH and GH, the QB3 shared cluster, and connections via UCSF's VPN. To access our cluster from these or any other machines we do not treat as secure, you must use a portal or our own VPN.

	== Rules ==		== Rules ==

Frodo: asdf

2015-06-03T03:50:59Z

asdf

← Older revision		Revision as of 03:50, 3 June 2015
Line 8:		Line 8:
	'''You can only access our cluster via ssh from a secure machine'''		'''You can only access our cluster via ssh from a secure machine'''

	What is a secure machine you may ask? ~~As of Monday~~, ~~June 16, our answer is as follows~~.		What is a secure machine you may ask? Well, ...

	"A secure machine is one that we control and can thus protect." This includes:		"A secure machine is one that we control and can thus protect." This includes:

Frodo: sdf

2015-06-03T03:50:19Z

sdf

← Older revision		Revision as of 03:50, 3 June 2015
Line 1:		Line 1:
	No security system is perfect: there is a tradeoff between security and ease of use. We have tried to find a happy medium that ~~let's~~ you do your work in peace without too much hassle. Getting hacked is a big deal, so please read this and be mindful.		No security system is perfect: there is a tradeoff between security and ease of use. We have tried to find a happy medium that lets you do your work in peace without too much hassle. Getting hacked is a big deal, so please read this and be mindful.

	{{TOCright}}		{{TOCright}}