[committee] [ucc] Minutes of Meeting 13th May 2011

[Bob Adamson]

On Sun, 15 May 2011, Matt Johnston wrote:

> On Fri, May 13, 2011 at 06:22:41PM +0800, James French wrote:
> > I'd suggest it'd be appropriate to write up a standard form for the
> > purpose and include a couple of conditions eg. such as obeying the UWA
> > network guidelines and we reserve the right to terminate accounts for
> > inappropriate/excessive traffic.
> 
> Hi All,
> 
> [ASH]: don't start new threads.
> 
> Hosting for clubs is a good idea. A sensible use for free VC
> traffic too.
> 
> That said, (replying to the broken thread now) we probably
> don't want to be running VPSes for too many people we don't
> know well. Random boxes get owned due to non-updated-Drupal-
> modules/bad PHP mailer scripts/crap SSH passwords etc, and
> then UCC is sending spam out and gets blacklisted - not
> good.
> 
> I think that would be the main thing to impress on the
> standard form - if people are going to use dynamic websites
> then they need to be secure about them.
> 
> We don't have that many problems with UCC members
> themselves, probably because the people who are playing with
> that sort of thing are more likely to secure them anyway.
> 
> Matt
> 

Currently, the only vps that I'm aware of for non-member hosting is 
custardrum, which is the cssc server. It is restricted to freenets only, 
and heavily firewalled. As far as I'm aware we haven't charged for it for 
the last few years because nobody noticed that spook's membership lapsed. 
That said, it only does a tiny amount of traffic and most people don't 
know it's there. The only other club I know that gets some hosting from us 
is unisfa for its wiki and catalogue, which we also haven't charged for in 
some time.

As much as I think both UCC and the 'client' club could benefit from a 
charged vps service, I don't think we've considered the practicalities of 
it. If we're going to charge more than a standard membership fee, we 
should open these vps's up to all traffic, as which point we notice that 
we have no regular traffic monitoring or cpu/memory limits for our virtual 
machines. Eugh. At least if we don't charge exhorbitantly for these 
services we can put a stop to things if they get out of control. So, let's 
maintain the status quo for vps's - keep them locked down, and only 
charge a standard $25 membership fee. I say $25 because all clubs can 
afford this, and we get no grants from the guild for having a club as a 
member. I don't think we should offer them for free, since that devalues 
ucc memberships and is a kick in the teeth to those people who pay their 
membership fees in order to get services.

As for boring old web hosting for clubs, what I propose is this: 
--clubs that want web hosting have one contact who's name is attached to a 
ucc account with their club as the username (eg a club called uass would 
have the username uass, with the account name set to Ashley Tyndall).
--the club's shell would be set to rssh, which limits them to file 
transfers only, and as I understand it, prevents shell access. This means 
that the password to the account can be shared with other members of the 
club without the potential for serious abuse.
--this setup should ensure that the clubs site is not forgotten and left 
sitting there for several years, since the account will come under normal 
locking procedures
--ucc will have a record of who to contact about problems with the name 
attached to the account, instead of records being comments in our bind 
config files
--these sites can be open to the entire internet, since wheel is 
responsible for the security
--$25, for the same reasons listed in my vps section

Bob Adamson
UCC President

|"Bureaucracy is a challenge to the be conquered with a righteous        |
|attitude, an intolerance for stupidity, and a bulldozer when necessary" |
| ---Peter's Laws                                                        |